Another Look at NAI’s High Standards for Health Data
A blog post by Anthony Matyjaszewski, NAI’s Counsel & Assistant Director of Compliance. |
At last month’s 2014 NAI Member Summit, FTC Commissioner Julie Brill praised the NAI for its self-regulatory initiatives in general, and in particular, for its provisions around the use of health information for Interest-Based Advertising (IBA). She went on to explain that companies’ collection of health information is going to be a “front and center” issue for her and the Commission. It is no surprise then, that in last month’s FTC report on Data Brokers, the Commission provided additional feedback on health conditions that it may deem to be “potentially sensitive.” Because this topic is so important to consumers, NAI members, and regulators, we would like to once again touch on the NAI’s approach to the collection and use of health-related data.
The 2013 NAI Code of Conduct (Code) definition of “Sensitive Data” in connection with health information includes “precise information about past, present, or potential future health or medical conditions or treatments, including genetic, genomic, and family medical history.” The collection and use of Sensitive Data for IBA requires Opt-In Consent from consumers.
The first point of analysis for members, therefore, is whether they are creating a health segment based on either precise information or actual knowledge, that consumers have a particular health condition. If the segment is based on actual knowledge about a health condition of a consumer, such as a medical record for example for example, that segment will be Sensitive Data regardless of which health or medical condition the segment refers to.
The commentary accompanying the Code further explains the NAI’s intent. It clarifies that “targeting users on the basis of any presumed interest in, not merely actual knowledge of, precise or sensitive health-related topics requires Opt-In Consent.” The NAI has not developed an exhaustive list of sensitive or precise segments in a field as dynamic as this one. Instead, we ask members to consider a variety of factors in determining whether a condition is sensitive, while also providing guidance on certain categories of health that NAI staff would consider to be sensitive. To determine whether a particular health condition is likely to be precise or sensitive, NAI members should consider the “seriousness of the condition, its prevalence, whether it is something that an average person would consider to be particularly private in nature, whether it is treated by over-the-counter or prescription medications, and whether it can be treated by modifications in lifestyle as opposed to medical intervention.” We go on to explain that “all types of cancer, mental health-related conditions, and sexually transmitted diseases” are examples of conditions that require Opt-In Consent. Under this analysis, other conditions such as acne, high blood pressure, heartburn, cold and flu, and cholesterol management are not considered to be precise or sensitive by NAI staff.
As with any subjective category, there may be certain conditions that do not clearly fall on either side of the line of sensitive or precise. For that reason, the NAI Code also requires members to publicly disclose any standard interest segments they use for IBA that are related to health conditions or treatments, even if those segments are not precise or sensitive. In turn, this allows consumers to view a member company’s standard health-related segments, and make their own determination whether they wish to opt-out of that company’s data collection for IBA. We feel that this two-pronged approach, requiring consumer Opt-In Consent for targeting on sensitive topics, while also requiring members to publicly disclose any standard health-related segments (sensitive or not) will help consumers by ensuring they are well-informed and empowered to exercise their choice when it comes to the use of health-related data for IBA.
It is also important to remember that the NAI Code prohibits members from using, or allowing the use of, IBA data other than for marketing purposes. Thus, members are prohibited from using, or allowing the use of, health-related interest segments – or any other interest segments – for purposes such determining eligibility for health insurance, life insurance, or employment.
It is also essential to note one key difference between the NAI Code and other regulations. When the NAI interprets the NAI Code in a specific context of a member’s activities, we apply our own judgment and experience. Interpretive matters related to the NAI Code are the sole province of the NAI. We nevertheless understand that the FTC or other regulators may have a different view as to what health segment data should be deemed “sensitive” when it comes to interest-based advertising. We encourage our members to contact NAI staff with any questions pertaining to the NAI Code of Conduct, and to contact their counsel regarding “sensitive” data outside the Code. With input from our members and other stakeholders, the NAI Code, along with related NAI guidance on sensitive health data and other topics, is expected to evolve and change from time-to-time.