In the Matter of: )
)
Deceptive Internet Sites )
Collecting Personally Identifiable Health Information )
Without Disclosing Its Intended Use )
__________________________________________)
Submitted to:
Donald Clark
Office of the Secretary
Federal Trade Commission
6th Street & Pennsylvania Ave. NW
WDC, 20580
In the Matter of: )
)
Deceptive Internet Sites )
Collecting Personally Identifiable Health Information )
Without Disclosing Its Intended Use )
__________________________________________)
I. Introduction
The Center for Democracy and Technology (CDT) files this Complaint
and Request for the Federal Trade Commission (FTC) to investigate
the practices of World Wide Web sites:
CDT believes that Heartinfo.org and Asthmacontrol.com are engaged
in the unfair and deceptive practice of collecting personal health
information from Web site visitors without providing adequate
information about the intended use of the information. CDT believes
that Heartinfo.org and Asthmacontrol.com are undertaking marketing,
product development, list compilation and other research using
personal information obtained from visitors to their sites. This
practice harms consumers by depriving them of information necessary
to make an informed decision about the use and disclosure of their
personal health information.
The ease with which information can be collected directly from
individuals and gathered surreptitiously through technologies
that track visitors digital footsteps across the Web presents
new challenges to protecting individual privacy. As news stories,
government forums, and on-line discussion groups focus on the
growing market for personal information, public concern with the
collection of personal information online continues to escalate.
During the Federal Trade Commission's November 1995 workshop,
"The FTC's Consumer Protection Role in the Emergining High-tech,
Global Marketplace," CDT stated that without the ability
to control the flow of personal information individuals would
be reluctant to participate in the growing online environment.
Our prediction that consumer privacy concerns would undermine
the potential of the Internet as a forum for communication, education,
and commerce has been confirmed. At the Commission's June 1997
Workshop, two surveys were released: both revealed that privacy
concerns are stifling Internet growth. Survey results showed
that individuals are particularly concerned with the collection
and use of their, or their children's, personal information without
their consent.
Protecting privacy has emerged as a critical component of developing
a trusted environment for communication and commerce online. The
failure of Web sites to provide full information about their data
practices and to provide individuals the ability to make informed
decisions about the use and disclosure of their personal information
undermines individual privacy and is detrimental to the growth
of the Internet.
CDT requests that the Commission order Heartinfo.org and Asthmacontrol.com
to cease and desist the practice of collecting information from
consumers without providing full and accurate notice and gaining
consent, and to provide the specific relief requested.
II. The Parties
A. The Center for Democracy and Technology
The Center for Democracy and Technology (CDT) is a non-profit,
public interest organization incorporated in the District of
Columbia and operating as a tax-exempt organization. CDT is dedicated
to preserving and enhancing democratic values and civil liberties
on the Internet and other interactive communications media. CDT
pursues its mission through public education, grass roots organizing,
litigation, and coalition building.
Central to CDT's mission is the principle that people must be able to maintain control over personal information in order to fully realize other core values, including autonomy, liberty, free expression and civic participation. The ease and pace with which information about people's activities and communications online can be collected, stored and reused present new challenges to privacy. However, CDT believes that the interactive and flexible nature of new communications media can enhance individual control over personal information. Through public policy, advocacy, and work with the technical and business communities, CDT seeks to ensure that policy and technology develop in ways that protect privacy and empower individuals to control their personal information.
B. Heartinfo.org
Heartinfo.org is run by the Center for Cardiovascular Education
Inc., based in New Providence, NJ. The site describes itself
as "an independent, educational Web site that provides a
wide range of information and services to heart patients and others
interested in learning about lowering risk factors for heart disease."
(Exhibit 1) The site states that it was founded by a "heart
patient" and a "physician, who is a world renowned expert
on heart disease." (Exhibit 2)
The Heartinfo.org Web site provides a range of information to
assist individuals suffering from heart disease including links
to a variety of resources on heart disease, a question and answer
section where registered users can query "experts,"
and information on "heart-healthy" products.
(Exhibit 3)
The Heartinfo.org site came to the attention of CDT staff when
the SmithKline Beecham site promoting Ecotrin disappeared from
the World Wide Web and all traffic was rerouted to Heartinfo.org.
(Exhibit 4) Heartinfo.org is sponsored by "pharmaceutical
and medical imaging companies, cardiac treatment centers, providers
of health care products and services, companies that provide low-fat
and heart healthy foods, exercise and cardiovascular fitness companies,
and other heart-related businesses." (Exhibit 5 & 6)
Although sponsors are listed, CDT believes that Heartinfo.org
does not fully disclose the nature of its relationships with sponsors
including the use and/or disclosure of personal information gathered
from visitors to aid sponsors in research, marketing, and product
development.
C. Asthmacontrol.com
Asthmacontrol.com is run by Glaxo Wellcome Inc., based in Research
Triangle Park, N.C., a subsidiary of London-based Glaxo Wellcome
plc. Glaxo Wellcome Inc. is a research-based pharmaceutical firm.
Glaxo Wellcome plc is an integrated, research-based group of companies
that discovers, develops, manufactures and markets pharmaceuticals,
and develops care and cost management programs (like pharmacy
benefit management programs). (Exhibit 7)
The Asthmacontrol.com Web site provides a range of information to assist individuals suffering from asthma, including downloadable documents to assist in predicting and managing the illness and a library of asthma-related resources. (Exhibit 8)
III. Statement of Facts
A. Heartinfo.org
Heartinfo.org encourages visitors to register. Only registered
members are entitled to participate in the question and answer
section where they can seek advice from medical experts. In addition,
registered members are able to participate in special awards programs
and receive coupons and discounts from site sponsors. While sections
of the site are available to unregistered visitors, the welcome
page's "Get started" icon leads to a page that immediately
"encourage[s] all of our readers to take a moment to become
a member of Heartinfo. Membership is free and it only takes a
minute to complete the registration form." (Exhibit 9)
1. Information Collected during Registration
The Heart Information Network Registration form (Exhibit 10) contains three fields identified as mandatory:
Following the mandatory fields are ten health-related questions which inquire about the individual's:
The questions about medication usage ask visitors to identify:
Following the questions about health, three optional questions are asked. Visitors are asked to "Please provide this (see below) information if you would like to receive coupons and special offers and discounts from our sponsors:"
2. Stated use of information
The member benefits section states that this information is collected:
The only additional disclosure about information use is located prior to the collection of a visitor's address, phone and fax numbers, where it states:
B. Asthmacontrol.com
Asthmacontrol.com encourages visitors to register. Registered
members receive a "free kit full of the latest information
to help you understand and manage your asthma..." (Exhibit
8) Although much of the content at Asthmacontrol.com is accessible
without registering, the welcome page entices visitors to register
by suggesting it will help them "prevent attacks before they
happen," (Exhibit 8) and limiting access to the Asthma Control
Program Handbook and Personal Tracker, and Asthma Network to registered
members.
1. Information Collected during Registration
The "Asthma Kit Electronic Registration Card" (Exhibit 11) asks visitors to provide the following information:
In addition, the registration form asks visitors if they are interested
in receiving information about asthma products and/or nasal allergy
products, or on another topic.
2. Stated use of information
The Asthmacontrol "Asthma Kit Electronic Registration Card"
tells visitors that the information will be used to place individuals
on their mailing list. In addition, the form states that "you
can make sure that you will continue to receive asthma-related
news and treatment options, important reports and other helpful
tools from Glaxo Wellcome on a regular basis." The form
states that Glaxo Wellcome will keep the information "confidential."
(Exhibit 11) No other uses of personal information are disclosed
to visitors.
IV. The Heartinfo.org site is deceptive and misleading in violation
of Section 5 of the FTC Act.
The Commission will find a violation of Section 5 of the FTC Act
if there is a representation, omission, or practice that is likely
to mislead the consumer acting reasonably under the circumstances,
to the consumer's detriment. According to the Federal Trade Commission
Policy Statement on Deception, the Commission considers three
core elements: first it must find a representation, omission
or practice that is likely to mislead the consumer; second, the
act or practice must be viewed from the perspective of a consumer
acting reasonably in the circumstances; and third, the representation,
omission, or practice must be "material", such that
it is likely to affect the consumer's conduct or decision with
regard to a product or service.
A. Heartinfo.org's failure to fully disclose the uses of consumers'
personal health information is misleading.
Heartinfo.org's failure to fully disclose the uses of consumers'
personal health information is misleading. CDT believes that
Heartinfo.org is using personal health information provided by
consumers for product and market research and possibly disclosing
information in non-identifiable, aggregate, and personally identifiable
form to its sponsors. If our belief is accurate, then Heartinfo's
failure to fully disclose its intended use of personal information
is misleading.
The site misleads consumers by obscuring the full purpose of the
consumer's interaction with Heartinfo.org. We believe that the
site is collecting personal information for a number of purposes,
including product and market research and the creation of marketing
lists, which are not revealed to visitors. By stating that information
will be used for the purposes of "mak(ing) Heartinfo a better
site" and providing registered members with "coupons
and special offers and discounts from our sponsors," Heartinfo.org
is implying that information will be used solely for the two identified
purposes. Consumers are likely to rely on the affirmative statement
of intended use in deciding whether to disclose sensitive health
information to Heartinfo.org. Because the statement is incomplete,
consumers will mistakenly believe that information will only be
used to send them coupons and improve the site. Heartinfo.org's
failure to inform consumers of the additional uses and disclosures
of personal information, which CDT believes are occurring, is
misleading.
1. Misleading representations
In earlier cases, the Commission has found a representation misleading
where a sales person misrepresented the purpose of the initial
contact with customers. For example, in the Matter of Encyclopedia
Britannica the Commission found that Britannica's sales representatives'
description of home visits as primarily for the purpose of conducting
surveys and brand analysis was misleading where the true purpose
for the visit was to sell merchandise.
The affirmative statements about the use of information made by
Heartinfo.org to visitors during the registration process can
be likened to the facts in the Britannica case. Similar
to the misleading representation in Britannica, CDT believes
that Heartinfo.org is misrepresenting its true intentions with
regard to the use of personal information gathered from visitors
and is encouraging consumers to engage in an interaction -- providing
personal information -- based on incomplete information. When
Heartinfo.org affirmatively states that it will use information
for specific purposes, a reasonable consumer is likely to infer
that no other uses will be made of this information.
When exploring deception claims, the Commission and courts examine
the representation within the context of the overall document,
taking into consideration the juxtaposition of various phrases,
the nature of the statement, and the type of transaction involved.
In this instance, the positioning of the statements of information
use at the point of collection bolsters the implication that information
gathered from visitors by Heartinfo.org is not being used for
other purposes or by other entities. Taken as a whole, the representation
made by Heartinfo.org is likely to mislead consumers.
2. Misleading omission
If Heartinfo.org is using information for marketing research,
product development and list compilation, its failure to disclose
these practices is an omission likely to mislead consumers. The
Commission has found that the omission of "material"
information can be misleading. In some circumstances, the Commission
presumes that an omission will lead consumers to draw false conclusions
about the product or service. In other instances, the Commission
has required evidence about consumers' expectations prior to finding
an omission to be misleading.
In Beneficial, the court upheld the Federal Trade Commission's order finding that the use of personal information gained through the preparation of tax returns for soliciting loans without disclosure to consumers was a false, misleading and deceptive practice injuring consumers. The Commission reasoned that the relationship of tax preparer and client would lead to the mistaken belief that the information would be used only for the purpose of tax preparation and maintained confidentially. Therefore, the Commission ruled that Beneficial's failure to disclose its intent to use personal information collected during the tax preparation process was misleading. In upholding the Commission's order, the court held that requiring Beneficial to disclose to consumers:
were rationally related to the FTC's attempt to alleviate unfair
practices. In upholding the FTC's ruling, the court noted that
the context within which the information was solicited would lead
"to the mistaken belief that the information would be used
only for that purpose and maintained confidentially" therefore
the omission of information was misleading.
Similarly, the public-positioning of the Heartinfo.org Web site
as an "independent, educational Web site" may encourage
consumers to perceive the site as a trusted entity operating solely
in the consumer's best interest and maintaining information confidentially.
Like Beneficial, Heartinfo has positioned itself as a
"trusted" party to whom consumers can reveal sensitive
information about their health. The lack of adequate disclosure
about Heartinfo.org's use and possible disclosure of personal
health information to assist its corporate sponsors is, taken
in context, likely to mislead consumers. Here too, the goal of
alleviating deceptive practices would be met by requiring full
disclosure of all intended uses of personal information.
If Heartinfo.org is using and disclosing sensitive health information
to assist corporate sponsors in their product and market research,
which CDT believes it is, then, absent a clear and conspicuous
notice, Heartinfo.org is misleading consumers.
B. Consumers acting reasonably in the circumstances are likely
to believe that Heartinfo.org is not using or disclosing their
personal information for additional purposes.
Heartinfo.org's statements regarding the use of personal information
is likely to mislead a reasonable consumer under the circumstances.
A reasonable consumer is likely to believe that Heartinfo.org
will only use personal information for the purposes stated at
the site. Unless consumers are provided with information about
other uses of their sensitive health data, they are unlikely to
foresee them.
Consumers are often unaware of the reuse and disclosure of personal
information they provide to others during daily transactions.
While the Internet and other interactive media are shedding new
light on the large market for personal information, consumers
are still shocked to learn that information about their activities
ranging from online browsing to grocery shopping is used for a
variety of purposes and made available to other companies without
their permission. When individuals become aware of the availability
of personal information, many take steps to protect it. Lexis
Nexis witnessed one such demand last August when thousands of
consumers called, emailed, and faxed in requests to be removed
from the P-Trak service. Services such as P- Trak, which provide
"credit header" information, have been available for
quite some time, however most consumers were unaware of their
existence. Similarly, AOL subscribers recently told the company
that providing their phone numbers to telemarketers was inappropriate
-- despite the fact that the practice of selling/renting subscriber
phone numbers is common in the marketing industry.
Unless consumers are informed that their information will be used
for other purposes and disclosed to others they likely to rely
upon the affirmative statements of information use made by the
site. The site's non-profit image and "org" domain
designation are likely to quell suspicions consumers may have
when interacting with commercial entities in the marketplace.
C. Given a full and fair disclosure of intended uses and disclosures
of information a portion of consumers acting reasonably in the
circumstances would not disclose sensitive health information;
therefore, Heartinfo.org's failure to disclose other uses
of the personal information they collect from visitors is "material."
Consumers acting reasonably in the circumstances would find Heartinfo.org's
use and disclosure of personal information for other purposes
relevant to their decision to provide information. Consumers
consider health and financial information to be their most sensitive
personal information. A bevy of surveys over the past five years
have documented a heightened concern with the privacy of medical
information, and an even deeper concern with the automation of
medical information.
Four findings of the 1993 Health Information Privacy Survey may be particularly useful in determining whether Heartinfo.org's failure to disclose its' use of individuals' health information for marketing and product research and development is "material." The 1993 Survey found that:
The survey data indicates that a reasonable consumer would object
to the use of her personal health information for research and
marketing purposes without her consent.
In its recent Advisory Letter regarding the collection of personally
identifiable information from children online, the Federal Trade
Commission staff took note of survey evidence introduced during
its June 1997 Privacy Workshop that supported the assertion that
an omission was "material." The Survey data indicated
that parents generally objected to the collection, use and disclosure
of information from children. This data lent support to the Commission's
finding that Spectracom's statement that personally identifiable
information was being collected from a child for a particular
purpose when the information was also being used for another purpose,
absent a clear and prominent disclosure to that effect, was deceptive.
The survey data indicated that given full information a reasonable
parent would object to the request for information, therefore
the omission was material.
In the case of health information, the survey data reveals that
people are opposed to its use without their consent. In light
of survey data indicating that well over half of the public believes
that personal health information should not be disclosed or used
for marketing or research without their consent, CDT believes
that a reasonable consumer given full and accurate information
about the intended uses of information would not disclose details
of their health information to Heartinfo.org. The survey data
also supports the proposition that individuals would want requests
for research uses of their health information to be limited in
scope -- to a specific entity, for a specific project, for a limited
duration, and with appropriate safeguards. Based on survey data,
CDT believes that Heartinfo.org's failure to disclose the intended
marketing and research uses of data gathered from consumers injures
consumers by depriving them of the ability to make meaningful
decisions about the use of sensitive health information.
Since information about additional uses and disclosures of health
information would influence some consumers' decision to provide
personal information, Heartinfo.org's omission is "material."
The Commission's Policy Statement on Deception states, "Where
the seller knew, or should have known, that an ordinary consumer
would need omitted information to evaluate the product or service.
. . materiality will be presumed because the manufacturer intended
the information or omission to have an effect. Heartinfo.org's
statements imply a limited use of personal health information.
Heartinfo.org is withholding information critical to consumers'
decision to disclose information. CDT believes that Heartinfo.org
knew, or should have known, that consumers would need full information
about its intended uses of personal information to evaluate Heartinfo's
request for personal information.
Without a complete, clear and conspicuous statement of Heartinfo.org's
information practices consumers are unable to make informed choices
about the appropriate use of their personal health information.
Consumers have indicated that personal health information should
only be used with their informed consent. Heartinfo.org's failure
to provide adequate notice to consumers is harmful in that it
deprives consumers of the information necessary to make a meaningful
decision and control the use of personal health information.
V. The Asthmacontrol.com site is deceptive and misleading in
violation of Section 5 of the FTC Act.
The Commission will find a violation of Section 5 of the FTC Act
if there is a representation, omission, or practice that is likely
to mislead the consumer acting reasonably under the circumstances,
to the consumer's detriment. In determining whether a given act
or practice is deceptive three criteria must be considered by
the Commission. The Commission must find a representation, omission
or practice that is likely to mislead the consumer. The act or
practice must be viewed from the perspective of a consumer acting
reasonably in the circumstances. And, the representation, omission,
or practice must be "material", such that it is likely
to affect the consumer's conduct or decision with regard to a
product or service.
A. Asthmacontrol.com's failure to fully disclose the uses
of personal health information provided by consumers is misleading.
CDT believes that Glaxo Wellcome is using information gathered
at Asthmacontrol.com for marketing and research purposes. If
CDT is correct, Asthmacontrol.com's failure to disclose its intended
use of personal information is misleading.
Consumers can be misled by direct misrepresentations, by implications
drawn from an accurate but incomplete statement, or by omissions.
If CDT's belief is correct, Glaxo Wellcome is misleading consumers
in two ways: 1) by affirmatively stating that information will
be used for a limited purpose, consumers are led to believe that
it won't be used for other purposes; and, 2) by failing to disclose
other uses of personal information Glaxo is withholding information
material to consumers decision to provide information.
1. Misleading representation
By stating that information will be used to "place individuals
on their mailing list" and to "make sure that you will
continue to receive asthma-related news and treatment options,
important reports and other helpful tools from Glaxo Wellcome
on a regular basis" Asthmacontrol.com is implying that information
will be used solely for the two identified purposes. Based on
this representation, a reasonable consumer may conclude that information
will not be used for other purposes.
In examining implied claims, the Commission and courts examine
the representation within the context of the overall document,
taking into consideration the juxtaposition of various phrases,
the nature of the statement, and the type of transaction involved.
Although the Asthma Kit Electronic Registration Card states that:
Additionally, you can make sure that you will continue to receive
asthma-related news and treatment opinions, important reports
and other helpful tools from Glaxo Wellcome on a regular basis.
All information will be kept confidential by Glaxo Wellcome
the name and URL of the site may confuse consumers. The name and
URL of the Web site obscure its relation to Glaxo Wellcome, a
large research-focused pharmaceutical company, and may bolster
the implication that information gathered from visitors is not
being used for other purposes. Written information about Glaxo
Wellcome is not provided at the site. A URL allows users to find
out information about Glaxo Wellcome from the parent company Web
site. If, as CDT believes, Glaxo Wellcome is using this information
for other purposes the affirmative, but incomplete, representations
made at the site are likely to mislead consumers by encouraging
a false belief that the site only uses information for the stated
purposes.
2. Misleading omission
If Glaxo is using information for marketing research, product
development and list compilation, its failure to disclose these
practices is an omission likely to mislead consumers. In some
cases the Commission has found that the omission of material information,
the disclosure of which is necessary to prevent the claim, practice,
or sale from being misleading is deceptive. In some circumstances,
the Commission presumes that an omission will lead consumers to
draw false conclusions about the product or service. In other
instances, the Commission has required evidence about consumers'
expectations prior to finding an omission to be misleading.
Asthmacontrol.com positions itself as an information resource
for asthma suffers. It does not advertise itself as a product
oriented Web site. Consumers who are unaware of Glaxo Wellcome's
business are unlikely to suspect that information they provide
at Asthmacontrol will be used for other purposes. The lack of
adequate disclosure about Glaxo Wellcome's interest in and use
of personal health information collected at Asthmacontrol.com
is, taken in context, an omission likely to deceive consumers.
If Glaxo Wellcome is using sensitive health information collected
at Asthmacontrol.com to conduct product and market research, which
CDT believes it is, absent a clear and conspicuous notice to consumers
it is misleading consumers.
B. Consumers acting reasonably in the circumstances are likely
to believe that Asthmacontrol.com is not using or disclosing their
personal information for additional purposes.
Asthmacontrol.com's statements regarding the use of personal
information is likely to mislead a reasonable consumer under the
circumstances. A reasonable consumer is likely to believe that
Asthmacontrol.com will only use personal information for the purposes
stated at the site. Unless consumers are provided with information
about other uses of their sensitive health data, they are unlikely
to foresee them. The sites URL which obscures its tie to Glaxo
Wellcome and format as a resource center are likely to foster
this misperception.
C. Given a full and fair disclosure of intended uses and disclosures
of information a portion of consumers acting reasonably in the
circumstances would not disclose sensitive health information;
therefore, Asthmacontrol.com's failure to disclose other uses
of the personal information they collect from visitors is "material."
Consumers acting reasonably in the circumstances would find Asthmacontrol.com's
use and disclosure of personal information for other purposes
relevant to their decision to provide information. Consumers
consider health and financial information to be their most sensitive
personal information. A bevy of surveys over the past five years
have documented a heightened concern with the privacy of medical
information, and an even deeper concern with the automation of
medical information.
Four findings of the 1993 Health Information Privacy Survey may be particularly useful in determining whether Asthmacontrol.com's failure to disclose its' use of individuals' health information for marketing and product research and development is "material." The 1993 Survey found that:
The survey data indicates that a reasonable consumer would object
to the use of her personal health information for research and
marketing purposes without her consent.
In its recent Advisory Letter regarding the collection of personally
identifiable information from children online, the Federal Trade
Commission staff took note of survey evidence introduced during
its June 1997 Privacy Workshop that supported the assertion that
an omission was "material." The Survey data indicated
that parents generally objected to the collection, use and disclosure
of information from children. This data lent support to the Commission's
finding that Spectracom's statement that personally identifiable
information was being collected from a child for a particular
purpose when the information was also being used for another purpose,
absent a clear and prominent disclosure to that effect, was deceptive.
The survey data indicated that given full information a reasonable
parent would object to the request for information, therefore
the omission was material.
In the case of health information, the survey data reveals that
people are opposed to its use without their consent. In light
of survey data indicating that well over half of the public believes
that personal health information should not be disclosed or used
for marketing or research without their consent, CDT believes
that a reasonable consumer given full and accurate information
about the intended uses of information would not disclose details
of their health information to Asthmacontrol.com. The survey data
also supports the proposition that individuals would want requests
for research uses of their health information to be limited in
scope -- to a specific entity, for a specific project, for a limited
duration, and with appropriate safeguards. Based on survey data,
CDT believes that Asthmacontrol.com's failure to disclose the
intended marketing and research uses of data gathered from consumers
injures consumers by depriving them of the ability to make meaningful
decisions about the use of sensitive health information.
Since information about additional uses and disclosures of health
information would influence some consumers' decision to provide
personal information, Asthmacontrol.com's omission is "material."
The Commission's Policy Statement on Deception states, "Where
the seller knew, or should have known, that an ordinary consumer
would need omitted information to evaluate the product or service.
. . materiality will be presumed because the manufacturer intended
the information or omission to have an effect. Asthmacontrol.com's
statements imply a limited use of personal health information.
Asthmacontrol.com is withholding information critical to consumers'
decision to disclose information. CDT believes that Asthmacontrol.com
knew, or should have known, that consumers would need full information
about its intended uses of personal information to evaluate Asthmacontrol.com's
request for personal information.
Without a complete, clear and conspicuous statement of Asthmacontrol.com's information practices -- including a description of Glaxo Wellcome and its access to and use of personal health information -- consumers are unable to make informed choices about the appropriate use of their personal health information. Consumers have indicated that personal health information should only be used with their informed consent. Glaxo Wellcome and Asthmacontrol.com's failure to provide adequate notice to consumers is harmful in that it deprives consumers of the information necessary to make a meaningful decision and control the use of personal health information.
VI. Conclusion and request for relief
If CDT's beliefs are correct, Heartinfo.org and Asthmacontrol.com
are engaged in deceptive practices. The failure of the sites
to clearly and conspicuously disclose the research and product
development uses (and perhaps disclosures) of the personal health
information collected from site visitors misleads consumers to
their detriment. The sensitive nature of the personal information
at issue, the well-documented consumer privacy concerns, and the
serious consequences the individual may suffer if health information
is misused require a full and comprehensive notice to consumers.
In light of relevant precedent and recent guidance, CDT respectfully
requests that the FTC order both sites to cease and desist from
collecting personal health information without:
In addition to the relief above, CDT respectfully requests that
the FTC order both sites to
A growing number of pharmaceutical companies are using the World
Wide Web to gather data from individuals. (Exhibit 12) CDT believes
that if the current practice of collecting personal health information
without full disclosure and informed consent continues, individuals'
privacy will be compromised and their sensitive health information
will be subject to growing misuse and abuse.
Respectfully submitted,
Deirdre K. Mulligan
Staff Counsel