NAI Leading the Way on High Standards for Health Data
The use of health data in advertising continues to be a hot topic and the Federal Trade Commission (FTC) has long taken the view that information about health and medical conditions may be sensitive. In a recent speech before the U.S. Chamber of Commerce, FTC Commissioner Julie Brill stated, “Here in the United States I believe we’ve reached a general consensus… that personal information about health is deeply sensitive.” She continued, “I believe that realizing all the potential benefits of health data analytics will require us – policymakers, companies, research institutions and other stakeholders – to work to ensure strong, effective protections for health information….”
The NAI Code of Conduct is the “gold standard” for self-regulation of third party advertising technology companies and related businesses. Nearly 100 NAI members, who are among the most responsible companies in the online advertising ecosystem, provide the foundation for a thriving and diverse market of ad-supported free content and services while also upholding and preserving consumer trust.
At NAI, we want members, brands and. most importantly. consumers to realize all the potential benefits of advertising health-related products and services. Like Commissioner Brill, we believe that we should have strong, effective protections for health information. Those protections should be developed by industry and enforced by industry. That’s exactly what we’ve done at NAI.
NAI members were the driving force for our organization to take a strong position that certain health conditions are sensitive and merit higher obligations for Interest-Based Advertising (IBA). The NAI Code of Conduct requires Opt-In Consent from consumers for the collection and use of Sensitive Health Data for IBA, and prohibits members from using, or allowing the use of, IBA data other than for marketing purposes. Thus, members are prohibited from using, or allowing the use of, health-related interest segments– or any other interest segments – for purposes such determining eligibility for health insurance, life insurance, or employment. “Interest segments” are groups of users and certain general interest categories that are inferred based on a variety of factors. An example of a health-related interest segment would be “migraine sufferer” or a person with “back pain.”
NAI asks members to consider a variety of factors in determining whether a condition is sensitive, while also providing additional guidance on certain categories of health information that NAI staff would consider to be sensitive. NAI staff guidance to members is that, to determine whether a particular health condition is likely to be precise or sensitive, NAI members should consider the “seriousness of the condition, its prevalence, whether it is something that an average person would consider to be particularly private in nature, whether it is treated by over-the-counter or prescription medications, and whether it can be treated by modifications in lifestyle as opposed to medical intervention.” We go on to explain that “all types of cancer, mental health-related conditions, and sexually transmitted diseases” are examples of conditions that require Opt-In Consent.
Under this analysis, other conditions such as acne, high blood pressure, heartburn, cold and flu, and cholesterol management are not considered to be sensitive by NAI staff. The Code does address the use of such interest segments for IBA as well, but does not require opt-in consent.
However, if, for example, a digital media company is going to create segments on sensitive health categories like AIDS and HIV, anorexia/bulimia, generalized anxiety disorder, sexual dysfunction, sexually transmitted diseases, pregnancy termination, or menopause, NAI believes Opt-In Consent from the consumer is necessary.
Whether or not the source of the data for a segment on AIDS is a person’s medical records is not the question here. The use of medical records for IBA – which we believe is not done – would clearly require express affirmative consent from a patient, regardless of the condition or specific subject matter.
We fully concede that in many cases what is sensitive can be subjective. For example, one consumer may consider baldness sensitive and another may not. As mentioned earlier, the NAI Code also requires members to publicly disclose any standard interest segments they use for IBA that are related to health conditions or treatments, even if those segments are not sensitive. In turn, this allows consumers to view a member company’s standard health-related segments, and make their own determination about whether they wish to opt-out of that company’s data collection for IBA.
To be clear, NAI believes that it is both valuable and essential that companies advertise health care products to consumers. There are many avenues for companies to do so effectively while complying with our high standards by advertising contextually on websites that address related topics, or in response to consumer searches about such topics, or in run of network campaigns, to list just a few examples.
However, if companies save a consumer’s past browsing behavior and use it to target an ad about a sensitive condition, NAI Code requires members to limit such advertising to consumers who have expressed Opt-In Consent.
We are very proud of our standards regarding the use of health information for IBA. Our standards on health information have been praised by the FTC and privacy advocates as examples of responsible industry best practices. Our Code is not perfect and we always welcome feedback from everyone – NAI members, others companies in the industry, privacy counsel, consumer advocates, and policy makers. If you have questions about NAI or our health policies, please contact us. And if you want to be part of the NAI and help develop our standards in the future, join now.
