American data privacy, post Roe

 As we plunge ahead into the post-Roe era, American laws about abortion are going to be very divided. Some states will seek to criminalize not only surgical abortions, but the use of pharmaceuticals as well (and, if Justice Thomas gets his wish, perhaps contraceptives of all sorts, as well as day-after pills).*

Some states may seek to prosecute their residents who seek treatment out of state, or who order mail order pharmaceuticals. Doing so will leave a data trail, in searches on the web, emails, and geo-location data.  How private will those data be?

This is going to be an issue for tech companies, prosecutors, and legislators at both state and federal levels.  E.g. can prosecutors access and use your geo-location data to determine if you visited a clinic?  Your web searches to see if you looked for one? Your emails or pharmacy data to see if you ordered drugs?  Your medical data of other sorts?

*Here is the Supreme Court Opinion, written by Justice Alito followed by the other opinions. Justice Thomas' concurring opinion begins on p. 117 of the pdf, after Appendix A to the majority opinion which ends on numbered page 108 (but the numbering restarts at 1 for Justice Thomas' opinion).  DOBBS, STATE HEALTH OFFICER OF THE MISSISSIPPI DEPARTMENT OF HEALTH, ET AL. v. JACKSON WOMEN’S HEALTH ORGANIZATION ET AL. 

Here are some thoughts on various aspects of the emerging situation.

From STAT:

HIPAA won’t protect you if prosecutors want your reproductive health records  by By Eric Boodman , Tara Bannow , Bob Herman  and Casey Ross

"With Roe v. Wade now overturned, patients are wondering whether federal laws will shield their reproductive health data from state law enforcement, or legal action more broadly. The answer, currently, is no.

"If there’s a warrant, court order, or subpoena for the release of those medical records, then a clinic is required to hand them over. 

...

"As far as health records go, the most salient law is HIPAA — the Health Insurance Portability and Accountability Act. It’s possible that federal officials could try to tweak it, so records of reproductive care or abortion receive extra protection, but legal experts say that’s unlikely to stand up in the courts in a time when many judges tend to be unfriendly to executive action.

...

"In states that ban abortion, simply the suspicion that a patient had an abortion would be enough to allow law enforcement to poke around in their medical records under the guise of identifying or locating a suspect, said Isabelle Bibet-Kalinyak, a member of Brach Eichler’s health care law practice. “They would still need to have probable cause,” she said."

***

Health tech companies are scrambling to close data privacy gaps after abortion ruling By Katie Palmer  and Casey Ross July 2

"STAT reached out to two dozen companies that interact with user data about menstrual cycles, fertility, pregnancy, and abortion, asking about their current data practices and plans to adapt. The picture that emerged is one of companies scrambling to transform — building out legal teams, racing to design new privacy-protecting products, and aiming to communicate more clearly about how they handle data and provide care in the face of swirling distrust of digital health tools.

"Period-tracking apps have been the target of some of the loudest calls for privacy protections, and the most visible corporate response. At least two period-tracking apps are now developing anonymous versions: Natural Cycles, whose product is cleared by the Food and Drug Administration as a form of birth control, said it’s had calls to trade insights with Flo, which is also building an anonymous version of its app."

********

From the Guardian:

Tech firms under pressure to safeguard user data as abortion prosecutions loom. Private information collected and retained by companies could be weaponized to prosecute abortion seekers and providers by Kari Paul

"Such data has already been used to prosecute people for miscarriages and pregnancy termination in states with strict abortion laws, including one case in which a woman’s online search for abortion pills was brought against her in court. 

...

"Smaller companies are also being targeted with questions over their data practices, as frantic calls to delete period tracking apps went viral following the supreme court decision. Some of those companies, unlike the tech giants, have taken public stands.

“At this fraught moment, we hear the anger and the anxiety coming from our US community,” period tracking app Clue said in a statement. “We remain committed to protecting your reproductive health data.”

"Digital rights advocacy group the Electronic Frontier Foundation (EFF) has advised companies in the tech world to pre-emptively prepare for a future in which they are served with subpoenas and warrants seeking user data to prosecute abortion seekers and providers.

"It recommends companies allow pseudonymous or anonymous access, stop behavioral tracking, and retain as little data as possible. It also advocated for end-to-end encryption by default and refrain from collecting any location information."

**********

From the NYT:

When Brazil Banned Abortion Pills, Women Turned to Drug Traffickers. With Roe v. Wade overturned, states banning abortion are looking to prevent the distribution of abortion medication. Brazil shows the possible consequences.  By Stephanie Nolen

"The trajectory of access to abortion pills in Brazil may offer insight into how medication abortion can become out of reach and what can happen when it does.

"While surgical abortion was the original target of Brazil’s abortion ban, the proscription expanded after medication abortion became more common, leading to the situation today where drug traffickers control most access to the pills. Women who procure them have no guarantee of the safety or authenticity of what they are taking, and if they have complications, they fear seeking help.

************

From the Guardian

Google will delete location history data for abortion clinic visits. The company said that sensitive places including fertility centers, clinics and addiction treatment facilities will be erased

"Alphabet will delete location data showing when users visit an abortion clinic, the online search company said on Friday, after concern that a digital trail could inform law enforcement if an individual terminates a pregnancy illegally.

...

"Effective in the coming weeks, for those who do use location history, entries showing sensitive places including fertility centers, abortion clinics and addiction treatment facilities will be deleted soon after a visit."

***********

And while we await further developments here, the Times has an article about growing surveillance in China:

‘An Invisible Cage’: How China Is Policing the Future By Paul Mozur, Muyi Xiao and John Liu, June 25, 2022

It begins "The more than 1.4 billion people living in China are constantly watched. They are recorded by police cameras that are everywhere, on street corners and subway ceilings, in hotel lobbies and apartment buildings. Their phones are tracked, their purchases are monitored, and their online chats are censored..."