Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Daniel Kaufman Comments on FTC Monitoring of Consumers’ “Right to Repair”

Adam Finerman Adds Explanation to Business Insider Article on Form 10-K

Melinda McLellan Serves as Panelist at Transportation Research Board Conference

Amy Mudge Speaks on Virtual Panel for ACI’s Food Law and Regulation Boot Camp

<figure class="wp-block-image alignright size-large is-resized"><img decoding="async" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2022/07/GettyImages-1165055245_1200x630-662x348.jpg" alt="Medical, medicine and Science" class="wp-image-7111" width="428"/></figure>



On July 8, 2022, following the Supreme Court’s decision in Dobbs, the president signed an <a href="https://www.whitehouse.gov/briefing-room/statements-releases/2022/07/08/fact-sheet-president-biden-to-sign-executive-order-protecting-access-to-reproductive-health-care-services/">executive order</a> that called on a number of federal agencies to take steps to protect reproductive rights. He specifically asked the Federal Trade Commission (FTC) to “consider taking steps to protect consumers’ privacy when seeking information about and provision of reproductive health care services.” The FTC responded swiftly with a <a href="https://www.ftc.gov/business-guidance/blog/2022/07/location-health-other-sensitive-information-ftc-committed-fully-enforcing-law-against-illegal-use">high-profile post authored by the acting director</a> of the FTC’s Division of Privacy and Identity Protection.



With one exception (discussed below), the FTC post mostly reiterates the agency’s long-held commitment to addressing misuse of health and geolocation data. Health issues have been an FTC privacy focus for decades. Indeed, one of the FTC’s first modern-era privacy cases was brought against a pharmaceutical company that <a href="https://www.ftc.gov/news-events/news/press-releases/2002/01/eli-lilly-settles-ftc-charges-concerning-security-breach">inadvertently sent an email</a> to consumers and put email addresses in the “To” line instead of the “Bcc” line,” thereby disclosing sensitive health information to all recipients of the email. Since then, there has been a steady stream of health-related cases, including a 2021 case against <a href="https://www.ftc.gov/news-events/news/press-releases/2021/01/developer-popular-womens-fertility-tracking-app-settles-ftc-allegations-it-misled-consumers-about">Flo Health</a>, the developer of a period-and-fertility-tracking app that shared health information with third-party analytics providers after promising that such information would be kept private. The FTC also enforces the <a href="https://www.ftc.gov/system/files/documents/rules/health-breach-notification-rule/statement_of_the_commission_on_breaches_by_health_apps_and_other_connected_devices.pdf">Health Breach Notification Rule</a> and recently issued a policy statement that broadened the interpretation of that rule, which governs breaches that occur with health apps not covered by the Health Insurance Portability and Accountability Act (HIPAA).



The FTC has also brought many cases challenging the use or sharing of location data. Recently, the <a href="https://www.ftc.gov/news-events/news/press-releases/2021/12/advertising-platform-openx-will-pay-2-million-collecting-personal-information-children-violation">FTC case against OpenX</a> alleged that although the adtech company represented that consumers could opt out of location data collection, it nonetheless accessed such data from Android users even after they opted out. Geolocations issues were also at the forefront of a 2013 FTC case involving a <a href="https://www.ftc.gov/news-events/news/press-releases/2013/12/android-flashlight-app-developer-settles-ftc-charges-it-deceived-consumers">flashlight app</a> that collected location data and allegedly deceived consumers about how their information would be shared with third parties.



FTC Calls Out Deceptive Claims of Data Anonymization and Aggregation



The July 11 post appears to be the first time the FTC has addressed false or deceptive claims related to data anonymization or aggregation as an avenue of enforcement. With the rising concern that health app data could be leveraged against individuals seeking reproductive care, a 2017 example of which can be found <a href="https://www.mass.gov/news/ag-reaches-settlement-with-advertising-company-prohibiting-geofencing-around-massachusetts-healthcare-facilities">here</a>, the FTC post indicates that companies may try to “placate” consumers by using statements about how data is anonymized or aggregated. The post cites to one study that, using just four location data points, was able to uniquely identify 95 percent of a 1.5 million-person dataset that was apparently anonymized. This demonstrates that app developers may not fully understand the extent to which they are (or are not) anonymizing data.



Whether intentional or not, the failure to accurately understand or represent their company’s anonymization may be due to the lack of specific, enforceable de-identification standards like those required by <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html#standard">HIPAA</a>. The <a href="https://www.ftc.gov/sites/default/files/documents/reports/federal-trade-commission-report-protecting-consumer-privacy-era-rapid-change-recommendations/120326privacyreport.pdf">FTC’s 2012 Privacy Report</a> discussed the issue of de-identification and noted that companies must “achieve a reasonable level of justified confidence that the data cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer.” The report also noted that relevant considerations as to what constitutes such “justified confidence” include the available methods and technologies as well as the nature of the data at issue and the purpose for which it will be used. The report further stated that “companies must take reasonable steps to ensure that data is de-identified.” Since 2012, data collection and monetization have exploded, sharing of significant health information outside their primary care relationships has become the norm, and now criminalization of abortion services will be permitted. It is likely that the FTC will be expecting something more than reasonable steps and perhaps will provide clearer standards for de-identification.



In the meantime, companies that collect consumer data should reexamine their de-identification processes and representations regarding data anonymization in their consumer-facing documents, as the FTC made clear in their July 11 post: “Companies that make false claims about anonymization can expect to hear from the FTC.”



<hr class="wp-block-separator has-css-opacity"/>



Please visit the <a href="https://www.bakerlaw.com/Post-Roe-Resource-Center">BakerHostetler Post-Roe Resource Center</a> or contact the <a href="https://www.bakerlaw.com/post-roe-resource-center#taskforce">BakerHostetler Dobbs Decision Task Force</a> for ongoing updates and information.

core/freeform

Data Counsel

Recent FTC Post Commits to Protecting Sensitive Health Data After White House Issues Related Executive Order

Featured Insights