Proprietary Algorithms

An initial concern about surveillance capitalism is that businesses using the internet have unfettered access to everyone’s personal information for an unlimited timeReference Post ¹⁴ and for good or nefarious purposes. But disparate data snippets, associations, and preferences are merely the raw materials for the black box algorithms of Google, Facebook, and other technology companies.Reference Pasquale ¹⁵ The technology companies do not merely compile data and sell personal information to commercial entities for targeted advertising and marketing. The value added and huge profits of surveillance capitalism are based on developing and using proprietary algorithms to continually update the digital profiles of billions of people — their characteristics, lifestyles, experiences, environments, interests, associations, wants, and beliefs. This allows the companies to predict individuals’ likely behaviors, such as their interest in various products and services and the most effective way for commercial entities to exploit consumer profiles for financial gain.

Influencing Behavior

Even more troubling, comprehensive data collection and analytics can influence behavior through the ostensibly innocuous algorithms that order online search results and select the content for personalized news feeds.Reference Kramer ¹⁶ Personal data about interests and attitudes also can be used to motivate actions, such as organizing and coordinating the activities of groups comprised of like-minded individuals regarding social, racial, political, religious, or other sensitive matters. Joining with others who share interests can be personally and socially beneficial, such as enabling individuals with certain health conditions to communicate with others with similar afflictions. Yet, manipulation of data and people raises increasingly troubling societal issues of privacy, autonomy, liberty, social cohesion, and democracy.

National Security, Politics, and Disinformation

There is an irony in invasive surveillance technology being used to undermine or even destabilize government. After the terrorist attacks of September 11, 2001, federal agencies responsible for intelligence gathering and national security solicited Google and other technology companies to accumulate vast troves of data on potentially violent individuals and groups. The connection between the technology companies and government security agencies was revealed by Edward Snowden in 2013,Reference Greenwald ¹⁷ but the simultaneous, ubiquitous, private surveillance by these companies makes the national security uses of surveillance capitalism less surprising and perhaps more inevitable than previously assumed.

Meanwhile, beginning with Barack Obama’s 2008 presidential campaign, data analytics became an integral part of mainstream American politics. Targeted fundraising and voter appeals gave the Obama campaign an edge, thereby initiating an “arms race” in cyber campaigning. By 2012, Obama’s reelection campaign, working with Eric Schmidt of Google, “knew every wavering voter in the country that it needed to persuade to vote for Obama, by name, address, race, sex, and income,” ¹⁸ to permit “micro-targeting” of campaign efforts. By 2016, these same techniques were utilized by both political parties at the federal and state levels, and by numerous political campaigns around the world, including the Brexit vote. ¹⁹ Also in 2016, Cambridge Analytica, a political data analytics firm, improperly obtained personal data from 87 million Facebook users to develop predictive voter profiles later used by the Trump campaign.Reference Gostin ²⁰

Since then, the largely unregulated universe of data acquisition, aggregation, analytics, and application has been exploited by malevolent domestic and foreign operatives to launch disinformation campaigns.Reference Benkler, Faris and Roberts ²¹ It also facilitated diverse and dispersed individuals to coordinate and carry out violent acts, as epitomized by the insurrection at the U.S. Capitol on January 6, 2021.Reference Mack, Mac and Bensinger ²² Additionally, misinformation about COVID-19 distributed on social media has led to significant resistance to vaccination, masking, social distancing, and other public health measures, resulting in many thousands of preventable deaths and the prolongation of the worst pandemic in a century.Reference Romer and Jamieson ²³

New Sources of Data

To maintain their competitive advantage and to continue generating vast profits the largest technology companies have updated their predictive capabilities by exploiting new sources of data. The best example is Google. Through aggressive deployment of internally developed surveillance methods (e.g., Street View, Google Maps) and corporate acquisitions (e.g., YouTube, Fitbit), Google extended its data sources beyond internet searches to e-mails, texts, photos, songs, videos, locations, interests, faces, emotions, social networks, consumer activity, smart home devices, wearables, and health information. ²⁴ The goal is ubiquitous data capture, intervention, action, and control of economic behavior.

Other technology giants followed Google’s financially successful strategy of diversifying and expanding their sources of unique, personal data. For example, Facebook acquired Instagram, developed the Novi digital wallet, and harvested data from its Like button to get a more robust view of individuals’ preferences and associations. Microsoft acquired LinkedIn to provide additional data that could be analyzed and marketed. ²⁵ Internet service providers, including Verizon, AT&T, and Comcast, also began monetizing data derived from subscribers’ internet activity. To launch these new ventures quickly, some companies with large customer bases acquired established technology companies, as exemplified by Verizon’s purchase of Yahoo! and AOL. ²⁶

Internet of Things

Novel methods of surveillance capitalism generate new sources of data and new privacy concerns. This is especially the case with the “Internet of Things,” which involves billions of networked sensors that record and transmit data over the internet,Reference Maple ²⁷ producing additional raw materials for artificial intelligence. These data sources include medical devices; environmental sensors; surveillance in public spaces, including facial recognition; “smart” televisions and other entertainment systems; “smart” cars, buildings, homes, and clothing; and digital assistants that record and relay users’ commands and other conversations. ²⁸ Many consumers infatuated with the latest “smart” technology do not realize that detailed data may be continuously recorded and transmitted for analysis.Reference Adams ²⁹

An example of these privacy issues involves smart toys, which can recognize the voices of individual children and interact in a personal way for appropriate educational and entertainment purposes. These toys usually have external Bluetooth and Wi-Fi connections, which can disclose a child’s location information and make the child vulnerable to harm. ³⁰ In theory, parents who give these toys to their child implicitly or explicitly consent to data collection and transmission about their child, but they cannot consent to disclosures made by their child’s playmates that may occur at the same time. ³¹ Lawsuits and regulatory actions dealing with smart toys include data breaches involving hundreds of thousands of passwords, user names, email addresses, and actual conversations children had with their dolls. ³²

The most notorious incident of a smart toy creating risks to young children and their families is Hello Barbie, which was introduced in 2015. The interactive Barbie doll was Wi-Fi enabled and could be hacked into a surveillance device for spying on children. It was also possible to hack the doll’s system information and gain access to a family’s Wi-Fi network, thereby enabling control of all internet-connected devices at the owner’s home. Mattel, manufacturer of Hello Barbie, pulled the doll from the market. ³³

Medical Records

In 2019, the disclosure of Google’s Project Nightingale, in partnership with Ascension, raised serious concerns about access to millions of medical records by Google. Ascension is a St. Louis-based, Catholic chain of 150 hospitals and 6,700 physicians, covering 50 million patients in 20 states and the District of Columbia. Without any notice to patients, consent, or even an opportunity to opt out, Ascension gave Google access to all of Ascension’s complete, individually identifiable, EHRs. ³⁴ The stated purpose was to use artificial intelligence to identify ways of improving patient outcomes.

After Project Nightingale was disclosed in the media, the first question many patients asked was whether this arrangement was legal under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, and the short answer is yes. As described below, covered entities under HIPAA, including health care providers, are permitted to use and disclose “protected health information” (individually identifiable information) without notice or consent for treatment, payment, or health care operations. ³⁵ Quality improvement, the avowed purpose of Project Nightingale, is included in the definition of health care operations. ³⁶ Since Ascension was permitted to do this analysis under HIPAA, Google, a “business associate” of Ascension, also could undertake the analysis on Ascension’s behalf because the parties executed a business associate agreement. ³⁷

Unsurprisingly, Project Nightingale is not a “one off” arrangement of Google and Ascension. Other large technology companies, including Amazon, Apple, and Microsoft, have actively pursued research arrangements with some of the largest and most respected medical institutions in the country. ³⁸ Even assuming there will be insights leading to improved health care, questions remain about whether health privacy and security will be maintained and whether it is acceptable to use millions of individually identifiable patient records for analysis and commercialization without notice to or consent from patients.

Using Surveillance Data to Predict and Control Risks

Predictive data are increasingly being used in common consumer activities. For example, most auto accidents are caused by careless acts, such as speeding, tailgating, running red lights, unsafe lane changing, and driving in bad weather. ³⁹ Drivers involved in these accidents are more likely to be distracted, intoxicated, or teenaged. ⁴⁰ Sensors installed in cars can measure how someone is driving, and some insurance companies believe that predictive information of driver behavior generated by sensors can reduce auto accidents and insurers’ liability. A few years ago, my insurance agent offered me a discount on my auto insurance if I would allow placement of a sensor on my car to monitor how I drive. ⁴¹ I declined the discount and said I would pay what amounts to a “privacy tax” not to be monitored. However, drivers might not have this option much longer, as auto insurance is highly competitive, and companies requiring the use of sensors might be able to offer less costly auto insurance. ⁴²

Closely related, rental car companies could begin using sensors to monitor how their cars are being driven and then prevent their cars from being started if the driver has been careless or reckless. ⁴³ Car rental companies could even base their driving predictions on sensor data of destinations, identity of occupants, and even the private conversations of passengers. Such surveillance measures probably would be legal under the weak version of consent in the United States in which consent is valid if individuals merely click “I agree” at the end of a multi-page document that virtually nobody reads.

Predictive analytics are also used to “encourage” individuals to make positive behavioral changes. For example, several years ago, my university-employer, like most large employers, began offering all employees a discount on their employee contributions for health insurance if we enrolled in an employer-sponsored and third-party administered wellness program involving self-reports on various health measures, such as weight, exercise, smoking, and alcohol consumption. I declined and chose to pay the “privacy tax.” Lower paid employees at my university, such as housekeeping and cafeteria workers, could not afford to forego an increase in their take home pay and therefore enrolled in the wellness program and have been monitored and urged to achieve certain health goals.

Few would object to encouraging individuals to adopt healthier lifestyles, but the evidence is mixed, at best, that employer-sponsored wellness programs are effective in improving employee health, reducing health costs, or producing a positive return on investment.Reference Abraham ⁴⁴ Moreover, it is questionable whether any modest gains in wellness are worth the price of permitting employers to control health care costs by contracting with third-party companies to surveil employees’ lifestyles and “encourage” health-promoting behavioral changes.

The examples of auto and health insurance only begin to scratch the surface of predictive analytics based on personal data harvesting. Other insurance products (e.g., life, disability, long-term care, and property and casualty) are among the next likely targets. Financial applications include consumer credit and home mortgages in which predictive analytics could consider consumers’ purchasing history, credit card usage, and credit scores. Employment, education, and government uses are other likely applications. In these and other areas the two main issues are whether the algorithmic predictions are accurate and, if so, whether the insights they provide are worth the privacy incursions and other social costs.

HIPAA Privacy Rule

Much of this misunderstanding is related to the erroneous assumption that the HIPAA Privacy Rule ⁵⁹ is comprehensive and stringent. It is neither. First, the Privacy Rule only applies to health care providers, health plans, health clearinghouses, and their business associates. ⁶⁰ It does not apply to, among other entities, insurance companies (other than health insurers), employers, schools, financial institutions, or technology companies. Second, the Privacy Rule is weakened by numerous, broadly worded exceptions. As mentioned earlier, a covered entity, such as a hospital, is free to use and disclose individually-identifiable health information without a patient’s knowledge or consent for treatment, payment, and health care operations. ⁶¹ In addition, there are twelve public purpose exceptions that permit covered entities to disclose individually-identifiable health information without notice or consent: (1) where required by law; (2) for public health activities; (3) about victims of abuse, neglect, or domestic violence; (4) for health oversight activities; (5) for judicial and administrative proceedings; (6) for law enforcement; (7) about decedents; (8) for cadaveric organ, eye, or tissue donations; (9) for some types of research; (10) when there is a serious threat to health or safety; (11) for special government functions, including national security; and (12) for workers’ compensation. ⁶²

In the context of precision medicine, the most important exception to the HIPAA Privacy Rule is consent (or authorization). Individuals have a right to access their own health records and to direct a covered entity to disclose some or all of the contents of their health records to any other person or entity. ⁶³ This gives rise to “compelled authorizations,” whereby individuals subject to economic leverage or legal compulsion can be required to provide their health records for a governmental or commercial purpose, such as applying for employment, insurance (life, disability, and long-term care), Social Security disability, workers’ compensation, veterans’ benefits, and professional licensure. The best estimate is that there are at least 25 million compelled authorizations each year in the United States.Reference Rothstein and Talbott ⁶⁴

In many cases, third parties can require the disclosure of complete health records, and even where the authorization is for more limited records, covered entities often find it easier to send complete records than engaging in the time-consuming and costly process of reviewing and redacting certain information. In the era of precision medicine, health records could contain sensitive information about matters ancillary to health status, such as relational, lifestyle, or financial data. Furthermore, once health records are received by an entity not subject to the HIPAA Privacy Rule (e.g., prospective employer), HIPAA does not limit redisclosure of the information to other individuals and entities.

Procedural and Substantive Privacy

Challenges to privacy can be divided into procedural and substantive issues. The United States, having failed to enact a broad privacy law in the 1970s when it was first considered,Reference Miller ⁶⁵ has adopted the default position that data access practices by public and private entities are lawful unless they violate a specific statute or regulation. ⁶⁶ In operation, notice and consent for access, use, and disclosure of private information, epitomized by online “click through” consent, is seriously deficient because the notice is rarely read or understood, and the consent is rarely informed or knowing. Even where notice is more informative and consent is more intentional, the process of compelled authorization, discussed above, is inherently coercive.

Compelled authorizations, permissible under the HIPAA Privacy Rule and other laws in the United States, are prohibited under the European Union’s General Data Protection Regulation (GDPR). ⁶⁷ Recital 32 defines consent in a much more stringent way than in the United States.

Legislation protecting privacy should address a range of procedural issues, such as transparency, limiting disclosures to the minimum necessary information, limiting identifiability to the minimum necessary, limiting time for use and disclosure of data, and prohibiting the reidentification of individuals and the redisclosure of information. Many of these limitations already are part of the GDPR. In the United States, these types of reforms are necessary but insufficient to protect informational privacy.

Substantive privacy protections require an analysis of the lawful uses of information. For example, under the Americans with Disabilities Act (ADA), ⁶⁹ after an employer extends a conditional offer of employment, the employer may condition employment on the satisfactory completion of a medical examination and a review of the individual’s health records. ⁷⁰ This is a reasonable requirement because many jobs involve strenuous physical exertion or exposure to hazardous environments. Nevertheless, neither the medical examination nor the health record review must be limited to matters directly related to the prospective employee’s job duties, even though an employer may not rescind a conditional offer for medical reasons that are not job-related. ⁷¹ The substantive issue is what information an employer may lawfully use in deciding employability, such as whether it is permissible to refuse to employ an individual who is at greater risk of a future health problem.Reference Rothstein ⁷² Other substantive health privacy issues include what personal health information insurers may consider in deciding insurabilityReference Rothstein ⁷³ and what health information government agencies may consider in ruling on eligibility for benefits.Reference Geiger ⁷⁴

Comprehensive Health Privacy Legislation

Unlike the great majority of industrialized democracies, the United States lacks comprehensive health privacy legislation.Reference Cortez ⁷⁵ The HIPAA Privacy Rule was only intended to protect privacy in the payment chain of health care. It does not apply broadly and does not prohibit the redisclosure of health information received by non-covered entities. The Privacy Rule also lacks effective remedies and does not include a private right of action for aggrieved individuals to redress harms caused by unlawful privacy breaches. ⁷⁶

A few states have recently enacted privacy legislation of a general nature, beginning with the California Consumer Privacy Act,Reference Rothstein and Tovino ⁷⁷ which has been followed, so far, by Virginia ⁷⁸ and Colorado. ⁷⁹ Illinois enacted the nation’s first biometric information privacy law, ⁸⁰ followed by Texas, ⁸¹ Washington, ⁸² and California. ⁸³ Although state legislatures have been termed the “laboratories of democracy,” ⁸⁴ it simply takes too long to enact legislation on emerging technologies in a substantial number of states, and some states are unlikely ever to enact such legislation. For the foreseeable future, the small number of idiosyncratic state laws are likely to remain inconsistent and often indecipherable.

In contrast to the limited protections of federal and state laws, the GDPR categorically treats health data as sensitive and strictly protected. Article 9, section 1 prohibits the processing of “data concerning health,” ⁸⁵ which could be construed as covering not only traditional clinical information, but the broad classes of data collected by precision medicine. ⁸⁶ Following the GDPR model would mean comprehensive, consistent privacy legislation rather than categorical legislation separately dealing with educational, financial, health, and other types of information.Reference Terry ⁸⁷

Stringent Consent Requirements

The viability of consent has been destroyed by technology companies. Many millions — if not billions — of people now regard consent as a “click through” burden that is a worthless, time consuming, formalistic requirement before they can download an app or software update. The actual consent language is often part of a long, legalistic document in small type, which further ensures that virtually nobody reads it.Reference Litman-Navarro ⁸⁸ Some consent documents even grant app developers and technology companies an extraordinary license to invade privacy.Reference Huckvale, Torous and Larsen ⁸⁹ In addition, compelled authorization is a form of coercion, but it is not prohibited by the HIPAA Privacy Rule or any state law in the United States.

Limiting the Use of Data

There are two main ways of protecting health privacy: limiting access to data and limiting use of data. Limiting access to data may be considered a procedural strategy to keep certain entities from obtaining data. For example, under the Genetic Information Nondiscrimination Act (GINA), ⁹⁰ it is unlawful for an employer to “request, require, or purchase genetic information with respect to an employee or a family member of an employee …” ⁹¹ In theory, if an employer or other entity does not have access to certain data, it cannot use the data to the detriment of the individual, and the individual’s privacy is also protected. In the case of GINA, this approach is undermined by compelled authorization practices, because even though employers may not request genetic information, healthcare providers and other entities in possession of genetic information often fail to take the extraordinary steps to delete or redact genetic information when complying with an authorization.

By contrast, limiting the use of data does not explicitly prohibit access to data, although GINA prohibits both access to and discrimination based on genetic information. ⁹² Where only use is prohibited, no reasonable individual or entity would want access to data that cannot legally be used because it might expose them to legal liability. ⁹³ Thus, even without explicit access restrictions, use limitations may be effective in protecting privacy indirectly. However, legislation prohibiting the use of data is more difficult to enact because it must address the substantive issues of how decisions about inclusion and exclusion (e.g., employability, insurability) are made by employers, insurers, and other data users. ⁹⁴