Written By: Ali Mousavi
The connection between a person’s browsing history and his or her own state of health is too tenuous to support plaintiffs’ contention that the disclosure requirements of HIPAA or California Civil Code section 1798.91 apply in the Smith case.[1]
Facebook has been capturing and selling the details of users who browse third-party health sites.[2] Plaintiffs, Winston Smith and two Jane Does, alleged that Facebook violated numerous federal and state laws by collecting and using their browsing data from various healthcare related websites.[3] The suit names Facebook and seven cancer institutions as defendants.[4]
The suit alleges that Facebook’s use of tracking cookies means that any site with a “like” button can potentially send browsing data to Facebook. That includes the site they have visited, any pages within that site, and anything they might enter into the search bar.[5] Plaintiff Smith alleges that Facebook captured the information about his “likes” and sold the information without his consent.[6]
In determining consent, courts determine “whether the circumstances, considered as a whole, demonstrate that a reasonable person understood that an action would be carried out so that their acquiescence demonstrates knowing authorization.”[7] The court cited an excerpt of Facebook’s disclosure that explains its collection and use of information of a person who visits or uses a third-party website that in turn uses Facebook’s services, for example, the “like” button.[8] The Ninth Circuit’s reading of the disclosure is that a reasonable person viewing the pertinent part of the disclosure would understand that Facebook maintains the practices of “(a) collecting its user’s data from third-party sites and (b) later using the data for advertising purposes.”[9] Consequently, the court held that knowing authorization of these practices constitutes the plaintiff’s consent.[10] Therefore, the Ninth Circuit held that the district court properly dismissed the action due to the fact that knowledge is a consent.
Plaintiff also argued that the collected data is subject to more stringent disclosure requirement under the Health Information Portability and Accountability Act of 1996 (“HIPAA”).[11] The court rejected this argument stating that the connection between a person’s browsing history and his or her own state of health is too “tenuous” to be protected under HIPPA.[12] The court reasoning was that the information available on publicly accessible websites “stands in stark contrast” to the personally identifiable patient record and medical histories protected by the statute.[13]
What is left as an option for Smith and other Facebook users is to be mindful of what they “like” on Facebook.
[1]Smith v. Facebook, Inc., 745 F. App’x 8 at 9 (9th Cir. 2018).
[2] Emma Woollacott, Man Called Winston Smith Files Lawsuit Against ‘Big Brother’ Facebook, Forbes, Mar. 19, 2016, https://www.forbes.com/sites/emmawoollacott/2016/03/19/man-called-winston-smith-files-lawsuit-against-big-brother-facebook/#1217059c7e28 (last visited Mar. 10, 2019).
[3] Smith, 745 F. App’x 8 at 8.
[4] Woollacott, supra note 2.
[5] Id.
[6] Id.
[7] Smith, 745 F. App’x 8 at 8.
[8] Id.
[9] Id. at 8-9.
[10]Id. at 9.
[11] Id.
[12] Id.
[13] Id.
very helpful article