Informational privacy in 2011

By Associate Professor Aaron Caplan

Two cases on this year's U.S. Supreme Court docket examine informational privacy under the Constitution. Although definitions vary, informational privacy is ordinarily used to mean the ability of individuals to control the gathering, use, and distribution of information about them by others. The first case, NASA v. Nelson, has already been decided. It extends a long-standing stalemate on whether a person has a due process right to keep certain information private from the government. The second case, Sorrell v. IMS Health Inc., will be argued later this year. It asks whether data brokers and drug companies have a constitutional right to buy and sell information about doctors' drug prescription records for commercial purposes.

The prevailing wisdom has been that the Constitution provides little, if any, direct protection for informational privacy. As a result, privacy gets legal protection in the United States primarily through statutes. Among the most common statutes are those protecting information about medical care and prescription drug use. NASA leaves this general system basically intact, not expanding any direct constitutional source for privacy but not restricting the government's ability to enact privacy laws. Sorrell, however, has the potential to call many of our privacy-protecting statutes into question. [DISCLOSURE: I have provided some advice to the Vermont attorney general's office in Sorrell.]

BACKGROUND

Both of the 2011 cases can trace their roots to Whalen v. Roe, 429 U. S. 589 (1977), which marks the last time the Supreme Court gave extended consideration to what it called the "interest in avoiding disclosure of personal matters." The plaintiffs in Whalen were patients challenging a New York statute that created a computerized database of all persons who had filled prescriptions for certain drugs. A difficulty for the patients was that the Constitution does not in so many words set forth an individual right to keep information away from other private parties or from the government. (It does, however, provide explicit protection against certain types of information-gathering by the government. Most important are the Fourth Amendment limits on government searches of people's "persons, houses, papers and effects," and the Fifth Amendment right against testifying as a witness against oneself in criminal cases.)

In Whalen, the Supreme Court assumed for purposes of discussion that it might in theory be a deprivation of liberty without due process for the government to deny one's ability to keep personal information private. It ultimately concluded that the New York statute did not violate this hypothesized due process right to informational privacy because the state had a valid need for the information and because the statute contained "security provisions" to guard against unauthorized disclosure. The opinion concluded by noting that information-gathering statutes typically include a governmental duty to safeguard the collected personal information against further circulation, and this duty "arguably has its roots in the Constitution." The decision was unanimous, but Justice Stewart filed a concurring opinion in which he doubted the existence of any constitutional right to informational privacy.

NASA v. NELSON

The January 2011 decision in NASA v. Nelson duplicated the Whalen reasoning. The plaintiffs in NASA challenged newly implemented regulations requiring detailed background checks for employees of federal government contractors, including questions about drug use, mental health, and financial status. The Supreme Court once again assumed for purposes of discussion, that some types of governmental information-gathering might violate a right to informational privacy. It nonetheless concluded that the background checks would not violate the right, based on the importance of the government's interest in the information and the presence of security measures (here, the federal Privacy Act) that would keep the information private after it was collected.

Justice Scalia, joined by Justice Thomas, concurred on separate grounds, namely that "a federal constitutional right to 'informational privacy' does not exist." His opinion offered much fire-breathing rhetoric: among other insults, Justice Scalia accused the plaintiffs of advancing a theory that was "farcical" and the majority of using an approach that "harms our image, if not our self-respect." Despite this invective, a clear majority of the Court preferred to leave open the possibility that the due process clause might protect a constitutional right to informational privacy, a question to be explored in future cases.

SORRELL v. IMS HEALTH, INC.

There is often a linkage between privacy and free speech, because to effectively ensure informational privacy, people with information are forbidden to convey it. When privacy statutes restrict the ability of the press to report news of legitimate public concern, the Supreme Court generally finds that constitutional free speech rights trump the statutory interest in informational privacy. But such opinions typically include language agreeing that informational privacy protection is a suitable legislative goal. E.g., Bartnicki v. Vopper, 532 U.S. 514 (2001). The Court has also said that "to the extent sensitive information rests in private hands, the government may under some circumstances restrict its nonconsensual acquisition." Florida Star v. B.J.F., 491 U.S. 524 (1989). In the upcoming Sorrell case, the state of Vermont took these pro-privacy statements at their word by limiting commercial sale of prescription drug information.

Like most states, Vermont requires pharmacists to collect information about each prescription filled, which the State uses for various purposes, including supervision of doctors. A brisk business has arisen where pharmacists also sell this data to information brokerage companies, known as data miners, who package it for sale to drug companies. Although the commercialized data does not currently include the names of patients, the data brokers do in fact track patients over time, indicating which drugs they have taken, in which combination, on which doctor's prescriptions. The data includes the age and sex of the patient, where the prescription was filled, what combinations of drugs have been purchased by the customer at what times, and whether prescriptions are changed or refilled. The data brokers have compiled detailed dossiers on the medication patterns of more than 200 million patients nationwide. Doctors are identified by name in what is known as "prescriber-identifiable information." The files on the doctors show exactly which drugs doctors prescribe for which conditions to which types of patients, when they switch patients from one drug to another, and much more. Pharmaceutical companies use this data to prepare individually tailored sales pitches.

Doctors objected to the commercial resale of prescription information, complaining that it effectively intruded into doctor/patient relationships without consent. In response to these concerns, Vermont enacted a law forbidding the sale for commercial purposes of prescriber-identifiable information without the prescriber's consent. Data miners and drug companies filed suit, claiming that the law violated their right to speak freely on commercial topics. The Second Circuit invalidated the Vermont statute in a divided opinion, creating a split with two decisions of the First Circuit upholding similar laws from New Hampshire and Maine. The Supreme Court agreed to resolve the conflict.

Perhaps the most interesting question raised by the case is whether data miners are engaging in expression at all. When we think of speech protected by the First Amendment, we usually imagine speakers who go through some sort of thought process to create or select a message that is distributed to others in order to procure an effect that is somehow related to the content of the message (perhaps because the message affects the thinking or conduct of listeners, or because the act of self-expression gives emotional satisfaction to the speaker). The commercial sale of huge masses of personal data is different. The relationship of the data miner to the data resembles the relationship of a coal miner to a lump of coal, the logger to a tree, or fisherman to a fish. An object is found, processed, and distributed for profit, irrespective of the object's inherent expressive capacity. Unlike ordinary speakers, the data miner does not care about the content of the information sold or what impact its content has on the recipient, so long as it has market value. Viewed in this light, the activities of data miners are simply commercial conduct like coal mining, logging, and fishing, all of which may be subject to regulation without implicating the First Amendment.

The Court will likely be reluctant to declare that an activity based primarily on the exchange of words and numbers is not speech. That principle could cause problems if not carefully limited: for example, we would not want to say that the press does not speak, relying on a theory that journalists simply find facts, process them, and resell them for profit. I believe a principled difference exists between data miners--like credit reporting agencies who are fundamentally indifferent to the content of the data--and those who engage in expression for profit--such as book publishers or journalists who do care about the content. But courts should tread carefully given the risks of declaring that any large categories are beyond the reach of the First Amendment altogether. A likely strategy for the Court to avoid potential risks would be to follow the Whalen model once again: assume for purposes of discussion that the data miners are engaging in some sort of expression, and then ask whether Vermont's statute survives the customary Central Hudson test for regulations of commercial speech.

That commercial speech question should be fairly easily resolved in favor of the statute, because protecting the privacy of medical information is a strong governmental interest--perhaps of constitutional standing--that clearly outweighs the profit motive of the plaintiffs. The data miners will argue that the prescriber-identifiable data simply reveals the relationship between doctors and drugs, and does not reveal which patients take those drugs. In fact that may not be so--the data currently sold contains much patient-level information that could be linked to named persons without much detective work, especially in small Vermont towns. The argument also misconstrues the value of privacy in communications between patients and doctors. This relationship has long enjoyed legal protection for good reasons, but the relationship is compromised when the doctor's half of the communication is revealed without consent. Indeed, the logic of the plaintiffs' arguments could invalidate those statutes that protect patient-identifiable information. If there is a constitutional right to commercialize information about the doctor's end of a prescription transaction, why would it not include a right to commercialize information about the patient's end?

If the Supreme Court is serious about its past statements that at least some types of informational privacy statutes are constitutionally proper, it should uphold the statute in Sorrell. Since the government is initially responsible for the creation of this data through its drug laws, it is proper for the government to take reasonable steps to protect it against further unconsented distribution, as occurred in Whalen and NASA.