Springboarding off our earlier report on the Supreme Court's decision in Sorrell v. IMS Health, Hogan Lovells Privacy and Information Management practice co-leader Marcy Wilder and associate Eric Bukstein have published a more detailed look at the case. Read their BNA Privacy & Security Law Report for analysis of the decision.
The Supreme Court on June 27 granted certiorari in a geolocation tracking case that could have implications for companies that incorporate location-tracking features into their products or that monitor the locations of their employees or assets. Specifically, the Court asked the parties to brief whether the government violated the defendant's Fourth Amendment rights by installing a Global Positioning System (GPS) tracking device on his vehicle without his warrant and without his consent.
The appeal was from a decision of the D.C. Circuit that held that under the Fourth Amendment, law enforcement is required to obtain a warrant supported by probable cause before placing a Global Positioning System (GPS) device on the outside of a suspect's car to track his location (the D.C. Circuit decision is captioned United States v. Maynard -- the Supreme Court case will be United States v. Jones). In doing so, the appeals court distinguished a 1983 Supreme Court case, United States v. Knotts, that held that the use of a beeper placed in an object given to a suspect to track his location to his drug lab did not violate the Fourth Amendment. Distinguishing the "limited use which the government made of the signals from this particular beeper" in Knotts from the "twenty-four hour surveillance" enabled by the GPS device in Maynard, the D.C. Circuit stated:
Prolonged surveillance reveals types of information not revealed by short-term surveillance, such as what a person does repeatedly, what he does not do, and what he does ensemble. These types of information can each reveal more about a person than does any individual trip viewed in isolation. Repeated visits to a church, a gym, a bar, or a bookie tell a story not told by any single visit, as does one's not visiting any of these places over the course of a month. The sequence of a person's movements can reveal still more; a single trip to a gynecologist's office tells little about a woman, but that trip followed a few weeks later by a visit to a baby supply store tells a different story. A person who knows all of another's travels can deduce whether he is a weekly church goer, a heavy drinker, a regular at the gym, an unfaithful husband, an outpatient receiving medical treatment, an associate of particular individuals or political groups—and not just one such fact about a person, but all such facts.
Notably, the Seventh and Ninth Circuits previously considered the exact same issue and came to the opposite conclusion that no warrant is required to place a GPS device on the outside of a suspect's car. Other states and lower federal courts have also grappled with the issue, with varying conclusions, but the D.C. Circuit decision created a federal circuit split that likely prompted the Supreme Court to take up the issue.
Though the decision will only define the contours of acceptable location tracking by the government, it also could inform private lawsuits based on a theory that the tracking of a person's location without their knowledge has been an intrusion upon that person's seclusion. A main factor in such lawsuits is whether there has been a violation of a person's "reasonable expectation of privacy," the question that will be squarely at issue before the Supreme Court. If the Supreme Court agrees with the D.C. Circuit and holds that individuals do have a legally cognizable expectation of privacy against being tracked unknowingly by GPS devices, the theory could be used to support private lawsuits against companies that incorporate location tracking into their products. Though there have been some suits to date resting on such a theory, they would be on much more solid ground with a definitive ruling from the Supreme Court on the issue.
Regardless of whether the decision is overturned, as a best practice (and to stave off such lawsuits), businesses collecting geolocation information from their consumers should at minimum prominently disclose to consumers the nature of location data collection and give them the option to opt out of such tracking. Employers who monitor their employees for asset-tracking or business-productivity purposes should also disclose the nature of this tracking to any employees who may be tracked.
The U.S. Supreme Court struck down today a Vermont law prohibiting pharmaceutical companies from buying or using prescription data for marketing. The decision, Sorrell v. IMS Health, holds that the state law prohibiting the sale or disclosure for marketing purposes of prescription data that identifies prescribers (but not patients) is an unconstitutional infringement on the free speech rights of pharmaceutical and data mining companies. The case was decided primarily on First Amendment grounds with privacy addressed only as a secondary issue.
In a 6-3 decision written by Justice Kennedy and with Justices Breyer, Ginsburg and Kagan dissenting, the Court concluded that Vermont’s regulation of prescriber-identifiable data was a regulation of commercial speech that was content- and speaker-based such that it violated the First Amendment.
Vermont claimed that restricting the ability of pharmaceutical companies to “detail” prescribers would lower health care costs by encouraging doctors to prescribe generic drugs and improve health care outcomes by focusing pharmaceutical marketing efforts more on objective medical issues rather than on targeting specific doctors. The Court concluded, however, that Vermont imposed a policy that singled out pharmaceutical companies and allowed any speech related to the use prescriber-identifiable data except for one – the use of prescriber data for marketing purposes. This was deemed by the Court to be an unconstitutional restriction on commercial speech. The Court roundly rejected the state’s claim that the statute was needed to “protect medical privacy, including physician confidentiality, avoidance of harassment, and the integrity of the doctor-patient relationship,” noting that the statute allows for the sharing of prescriber-identifiable data for any reason except marketing. The Court focused on whether the privacy options available “reflect a State’s impermissible purpose to burden disfavored speech” and notes that merely flipping the regulatory regime from opt-in (which was how the Vermont law operated) to opt-out (meaning physicians could opt-out of having their prescriber-identifiable data shared) would not necessarily make this type of restrictive law constitutional. The Court does suggest that physician privacy is a valid state interest that could perhaps be protected with more narrowly drawn laws that permit the sale or disclosure of information in “a few narrow and well-justified circumstances.”
In its conclusion, the Court discussed the importance of privacy and how it should be factored into government regulation:
The capacity of technology to find and publish personal information, including records required by the government, presents serious and unresolved issues with respect to personal privacy and the dignity it seeks to secure. In considering how to protect those interests, however, the State cannot engage in content-based discrimination to advance its own side of a debate. . . . Privacy is a concept too integral to the person and a right too essential to freedom to allow its manipulation to support just those ideas the government prefers.
For more information on the background and arguments made in the Sorrell case, see our previous blog post: Is Access to Prescriber-Identifiable Data Protected as Free Speech?: The Supreme Court Hears Oral Arguments in Sorrell v. IMS Health.
On April 26, the Supreme Court heard oral arguments in Sorrell v. IMS Health – the first case heard by the Court that considers the limitations that a state may put on mining health data for commercial purposes. Specifically, this case raises the issue of how the government regulation of data mining practices impacts both the privacy rights of individuals and the speech rights of companies – both data mining companies and their customers.
When a consumer goes to a pharmacy to have a prescription filled, the pharmacy is required by law to collect certain information about the transaction, including the name and dosing details of the prescribed drug and the physician’s name. After the prescription is filled, the pharmacies sell the prescriber identifiable data to companies like IMS Health. Information identifying specific patients is removed. This data is then sold by data aggregators for a variety of purposes, such as research and, the purpose at issue in Sorrell, marketing by pharmaceutical companies. Armed with data about particular prescribers and their prescribing habits, a pharmaceutical sales representative can more effectively target physician marketing and education efforts through a process known as “detailing.”
In 2007, Vermont passed a law restricting the use by pharmaceutical companies of data gathered by pharmacies about physician prescribing habits for marketing purposes without the affirmative consent of the physician. The Vermont legislature made clear that the purpose of the statute was to both protect the privacy of doctors and to change the way the pharmaceutical companies market to physicians. Vermont hoped that changing the way that pharmaceutical companies could “detail” would lower health care costs and improve health care outcomes by encouraging doctors to prescribe generic drugs and making pharmaceutical marketing efforts more focused on objective medical issues rather than on targeting specific doctors.
Vermont is currently one of four states that have laws or regulations restricting the use of prescriber-identifiable data. New Hampshire’s law similarly restricts the use of prescriber data for any commercial purpose (without a mechanism for a prescriber to consent to allowing her information to be used for commercial purposes). After this law was passed, it was challenged by the same data mining companies currently litigating Sorrell. Eventually, the First Circuit held that the law regulated conduct, not speech, and did not violate the First Amendment. The Supreme Court declined to hear an appeal of the New Hampshire decision.
In Sorrell, the Second Circuit held that the Vermont statute was unconstitutional as failing to provide prescriber-identifiable data to pharmaceutical companies constituted commercial speech, and Vermont did not advance a substantial interest sufficient to survive intermediate scrutiny, which is given to regulation of commercial speech. This decision created a circuit split between the First and Second Circuits, and the Supreme Court granted a writ of certiorari to hear the case. The Supreme Court has agreed to hear the case to resolve the specific question of whether a law that restricts access to information in nonpublic prescription drug records and affords prescribers the right to consent before their identifying information in prescription drug records is sold or used in marketing runs afoul of the First Amendment.
The Justice Department joined Vermont assistant state attorney general, Bridget Asay, in arguing to uphold the law in front of the Supreme Court. Both Vermont and the Solicitor General argued that this case is about access to non-public information, and the First Amendment regulates speech and not access. In making this argument, Vermont points to the fact that the prescriber-identifiable data exists by virtue of government regulation (namely the regulation of prescription drugs), and that if this data were in the government’s hands the government could deny access to the data. During the oral arguments, this argument did not appear to be persuading the Justices as several Justices seemed to assume in their questioning that the Vermont law stood as a barrier to the commercial speech of pharmaceutical companies. Many of the Justices – including Chief Justice Roberts, Justice Alito, and Justice Scalia – also questioned whether the statute did anything to protect the privacy of physicians. The Justices kept asking how the statute protected privacy if the data could continue to be used for all other purposes except pharmaceutical detailing. Justice Scalia inferred that a physician could obtain a similar level of privacy protection by merely “shutting the door” on pharmaceutical representatives. Ms. Asay had trouble during her argument countering the aggressive questioning of the Justices regarding how the Vermont statute protected the privacy of physicians.
The other side of the case was argued by Tom Goldstein on behalf of IMS Health, several other data mining companies and the Pharmaceutical Manufacturers Association. IMS Health argued that the Vermont law prohibited only one use of the information – use by pharmaceutical companies for detailing purposed. They argued that this discrimination is intended to restrict truthful information presented by pharmaceutical companies to physicians. In the oral argument, IMS Health attempted to downplay the privacy issues involved with the case, by distinguishing the Vermont law from the recently introduced Kerry/McCain privacy legislation. Mr. Goldstein argued that privacy legislation could most certainly be constitutional, but that the Vermont statute was not typical privacy legislation. He made the following points about the differences between typical privacy legislation (e.g., the Kerry/McCain bill) and the Vermont statute:
Ultimately, this case may turn on whether the Court believes that Vermont’s law merely prohibits access to information regulated by the government or whether the law censors the speech of the pharmaceutical companies. It is doubtful that the Supreme Court will issue an opinion that speaks broadly to the constitutional status of data mining and whether all data collections or uses would qualify as speech (commercial or otherwise). However, this decision will certainly have an impact on the practices of pharmaceutical manufacturers and data minders dealing with prescriber-identifiable data. If the law is upheld, many states may attempt to pass similar laws regulating the use of prescriber-identifiable data. Further, states may try to regulate data mining more broadly, perhaps even outside of the commercial context. If the law if deemed unconstitutional, companies that access data for data mining purposes may have an additional arrow in their quiver when it comes to litigating against government regulation that inhibits their access to or use of certain data.
The Court is expected to issue a decision in this case by the end of June.
Thanks to Elizabeth Khalil in the Hogan & Hartson privacy group for providing this report.
On April 19, 2010, the U.S. Supreme Court heard oral arguments in the case of City of Ontario v. Quon, a Fourth Amendment privacy case on appeal from the Ninth Circuit.
The argument centered primarily on the first of three questions presented in the case: whether a police officer had a reasonable expectation of privacy in text messages transmitted on his official police department pager given the circumstances. Specifically, his employer, the city government, had articulated a general policy stating that employees should have no expectation of privacy in their e-mail and Internet usage on official systems. However, Quon understood the police department to have an informal policy that it would not read the personal text messages of officers who paid for additional text message volume on their pagers to allow for personal use. The officer in question, Jeff Quon, was a SWAT team member who paid for such personal use of his official pager, from which he sent personal messages to his wife, girlfriend and others. Department officials accessed Quon’s messages as part of an audit. In the course of reviewing the volume of the messages, obtained from the city's wireless provider, they came across the personal (and, at times, sexually explicit) content of the messages Quon sent.
At oral argument, Chief Justice John Roberts seemed somewhat sympathetic to the notion that the department had given Quon the impression that as long as he paid for personal use of his pager, “it would be reasonable for him to assume that private messages were his business.” Overall, however, the Court appeared skeptical of Quon’s claims.
There were two other questions presented in the case that were not the focus of oral argument: whether the Ninth Circuit contravened the Supreme Court’s Fourth Amendment precedents and created a circuit conflict by analyzing whether the police could have used less intrusive methods of reviewing the text messages, and whether individuals who send messages to a police officer’s pager have a reasonable expectation that their messages will not be reviewed by the recipient’s government employer.
The justices also touched upon what, if any, bearing statutes such as the Stored Communications Act (SCA) should have on the Fourth Amendment's concept of reasonable expectation of privacy, although the SCA was not an issue before the Court. It was, however, a subject of Quon’s suit at the district court and appeals court level, where he had named the wireless provider as a defendant. In Quon v. Arch Wireless, the Ninth Circuit held that Arch Wireless had violated the SCA when it provided the text transcripts to the police department. T he actions of Arch Wireless were not at issue in the Supreme Court appeal.
Add this blog to your feeds or put your e-mail in the box below and hit GO to subscribe by e-mail.
Enter keywords:
