The action is against those behind Pharmatrak, a now-defunct company that sold a service called NETcompare to drug companies, including Smithkline Beecham and Glaxo Wellcome, prior to their merger.
According to court documents, NETcompare “accessed information about the internet users and collected certain information” to allow “intra-industry comparisons of web site traffic and usage.”
The drug companies were emphatic that they did not want to access or use personal information about their web site users, and bought the service on this understanding. However, personal information was found on Pharmatrak’s computers. As a result, some individuals sued both Pharmatrak and the drug companies, arguing a breach of the Electronic Communications Privacy Act (ECPA).
Pharmatrak argued that its clients had consented to the accessing of information and therefore that it should not be party to the lawsuit. A district court agreed, but on Friday the Court of Appeals overturned its decision, reasoning that neither the drug companies nor the individual internet users had consented to the interception of personal information.
The Court of Appeals also disagreed with the lower court’s ruling as to the nature of the information accessed by NETcompare.
Pharmatrak had designed NETcompare so that no personal information would be accessed. It would only record such items as the pages viewed, length of time spent viewing, path through the site and IP address.
However, one drug company inadvertently altered its web site so that when a user searched the site, the information contained in the URL (Uniform Resource Locator) of the page generated, actually included all the words the user had typed. This information was recorded by Pharmatrak and on some occasions included personal details.
According to the court, the law provides a private right of action against one who “intentionally intercepts, endeavours to intercept, or procures any other person to intercept or endeavour to intercept, any wire, oral, or electronic communication.”
This covers the content of telephone conversations or e-mails, but the position is not so clear as regards information typed by a user when searching a web site. The Court of Appeal has now decided that the Act covers this too, a decision welcomed by the privacy advocates.
The case has now been sent back to the District Court for further action.