{"id":492,"date":"2022-06-01T14:46:44","date_gmt":"2022-06-01T18:46:44","guid":{"rendered":"https:\/\/pbacyber.com\/?p=492"},"modified":"2022-06-01T14:46:44","modified_gmt":"2022-06-01T18:46:44","slug":"a-post-roe-future-presents-heightened-data-privacy-risks-with-femtech","status":"publish","type":"post","link":"https:\/\/pbacyber.com\/index.php\/2022\/06\/01\/a-post-roe-future-presents-heightened-data-privacy-risks-with-femtech\/","title":{"rendered":"A Post-Roe Future Presents Heightened Data Privacy Risks with FemTech"},"content":{"rendered":"

To call the forthcoming Supreme Court of the United States decision in <\/span><\/span>Dobbs v. Jackson Women\u2019s Health Organization<\/span><\/a> \u201cmuch anticipated\u201d would be a gross understatement. On May 2, 2022 the <\/span><\/span>draft opinion penned by Justice Alito that appeared in Politico<\/span><\/a> shocked the nation. If such an opinion is ultimately issued by the Roberts Court, it would mark a radical reversal on human rights and would intensify debates on several legal and bioethical issues (e.g., the argument that, under current technological and societal conditions, forced gestational labor by a pregnant person is a form of involuntary servitude and contrary to the 13th<\/sup> Amendment of the U.S. Constitution; the implications for assisted reproductive technologies and genomic medicine; limits of fetal medicine interventions; extraterritorial application of state laws; etc.). Among the countless concerns raised by the leaked Dobbs <\/i>opinion are the substantial informational or data privacy risks implicated by such an outcome to the case. Specifically, these include the data privacy risks for those who use FemTech apps and products, noted almost immediately by FemTech experts (such as <\/span><\/span>Bethany Corbin<\/span><\/a> and <\/span><\/span>others<\/span><\/a>) after the draft Dobbs<\/i> opinion surfaced, as well as the dangerous chilling factor that such a decision (along with the state laws such a decision would essentially \u201cbless\u201d) will impose on women\u2019s healthcare (such as those <\/span><\/span>detailed in this Twitter thread<\/span><\/a>) because of concerns about escalating attacks against the confidentiality of physician-patient communications. <\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n

A Quick Introduction to FemTech <\/span><\/i><\/b><\/span><\/p>\n

FemTech<\/span><\/a>, a term reportedly <\/span><\/span>coined<\/span><\/a> by Ida Tin in 2016, can be generally defined as technologies (such as mobile health apps, wearables, connected devices, software, products, and services) aimed at addressing women\u2019s health. While much of the FemTech industry remains narrowly focused, reducing the wide range of women\u2019s health issues to merely reproductive health, there is tremendous opportunity for FemTech to begin to address the myriad of women\u2019s health issues that have <\/span><\/span>long been ignored, dismissed, and otherwise understudied<\/span><\/a> in biomedical research. [As an aside, <\/span><\/span>extensive efforts<\/span><\/a> have been underway for more than two decades to improve scientific understanding of women\u2019s health and improve the representation of women in biomedical research. For more information, see, e.g., the <\/span><\/span>2001 Institute of Medicine Report<\/span><\/a> \u201cExploring the Biological Contributions to Human Health: Does Sex Matter?\u201d and the <\/span><\/span>2022 report by the National Academies of Science, Engineering, and Medicine<\/span><\/a> \u201cImproving Representation in Clinical Trials and Research\u201d]. <\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n

Placing FemTech Data Practices Under Scrutiny<\/span><\/i><\/b><\/span><\/p>\n

The FemTech industry has been <\/span><\/span>characterized<\/span><\/a> as \u201csurging,\u201d with <\/span><\/span>some projecting<\/span><\/a> the market worth will reach $1.1 trillion within five years. However, following the <\/span><\/span>FTC settlement against Flo Health, Inc. in 2021<\/span><\/a>, increasing attention is being given to the <\/span><\/span>potential misuse of data in FemTech<\/span><\/a> and <\/span><\/span>weaknesses in FemTech privacy policies<\/span><\/a>. Some FemTech vendors have already gotten in trouble for their data sharing practices, as illustrated by the previously mentioned <\/span><\/span>FTC settlement against Flo Health<\/span><\/a> in 2021. Such practices in FemTech\u2014sharing or selling data to third parties\u2014would become even more alarming in a post-Roe<\/i> society in which a woman\u2019s tracked reproductive data could be used to infer civil or criminal liability. As a recent <\/span><\/span>headline in Ms. Magazine<\/span><\/a> put it, \u201cWill My Period Tracking App Betray Me?\u201d Adding to the concern is the extent to which the government (i.e., law enforcement) might seek access to such data\u2014even in situations in which FemTech vendors have adopted protective privacy policies\u2014to aggressively enforce the <\/span><\/span>disturbing trend of criminalizing pregnancy<\/span><\/a> and even <\/span><\/span>punishing individuals for miscarriages<\/span><\/a>. The Third Party Doctrine (recognized in the digital, information age by the Roberts Court in 2018 in <\/span><\/span>Carpenter v. United States<\/span><\/i><\/a>) as applied to FemTech would likely mean that individuals who use FemTech apps and devices to voluntarily capture, enter, and track data related to their menstrual cycle and\/or fertility have reduced expectations of privacy (or perhaps even no legitimate expectation of privacy that the Court would be willing to recognize) in that information, thus making it even easier for the government to gain access to those records even without a warrant supported by probable cause. Some privacy scholars have explained the Third Party Doctrine is <\/span><\/span>\u201cdeeply flawed\u201d<\/span><\/a>, has no place in our digital, datafied culture, and is <\/span><\/span>incompatible with the Fourth Amendment<\/span><\/a> right to be free from unreasonable searches and seizures. That the holding in Carpenter v. United States<\/i> was so narrowly issued leaves considerable room for uncertainty and interpretation\u2014a dangerous context in which FemTech could exist without Roe<\/i> privacy protections. <\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n

Following the leaked Dobbs<\/i> opinion, several <\/span><\/span>U.S. Senators sent a letter<\/span><\/a> to the CEO of Google expressing concern about data vulnerabilities and urging the Google Play Store to block apps that might be used\u2014because of their data practices\u2014to \u201cvictimize individuals\u201d who seek reproductive healthcare services. They were joined by other U.S. Senators and Members of Congress in sending <\/span><\/span>a separate letter<\/span><\/a> to the CEO of Google calling for the company to reform its data practices to prevent its \u201cdigital infrastructure\u201d from \u201cbe[ing] weaponized against women.\u201d<\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n

FemTech Users in Pennsylvania Might Be Particularly Vulnerable to Data Privacy Risks<\/span><\/i><\/b><\/span><\/p>\n

Unlike <\/span><\/span>California<\/span><\/a>, <\/span><\/span>Virginia<\/span><\/a>, <\/span><\/span>Colorado<\/span><\/a>, and <\/span><\/span>Utah<\/span><\/a>, Pennsylvania does not have a comprehensive consumer data protection law. Furthermore, unlike <\/span><\/span>Vermont<\/span><\/a>, <\/span><\/span>California<\/span><\/a>, and <\/span><\/span>Nevada<\/span><\/a>, Pennsylvania does not have a data broker registration law. This can be disconcerting when one also recognizes that most FemTech vendors are not required to comply with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. FemTech vendors <\/span><\/span>are subject to the FTC\u2019s Health Breach Notification Rule<\/span><\/a> as well as general consumer protection requirements to avoid unfair and deceptive practices as set by Section 5 of the Federal Trade Commission Act. Thus, the limitations on FemTech data practices are mainly set by their own privacy policies and terms of use. While it is theoretically possible given its powerful catch-all provision of 73 P.S. \u00a7201-2(4)(xxi), it is currently unlikely that the Pennsylvania Unfair Trade Practices and Consumer Protection Law <\/span><\/span>(73 P.S. \u00a7\u00a7201-1 \u2013 201-9.2)<\/span><\/a> would be applied in such a way that holds FemTech accountable for data practices and privacy policies that in combination \u201ccreates a likelihood of confusion or of misunderstanding.\u201d <\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n

It is not without merit to view the current conditions in Pennsylvania\u2014given the lax data protections in effect\u2014as inviting FemTech startups to pilot their products and services with relatively few threats of liability for cybersecurity and data privacy features. While this might be helpful to promote innovation and competition in the FemTech industry, it is not comforting to prospective users who expect to be stripped of their human rights should the leaked Dobbs<\/i> opinion become issued by the Supreme Court. One could <\/span><\/span>anticipate<\/span><\/a> that individuals no longer able to lawfully access essential healthcare services in their home state might travel to Pennsylvania. If these individuals also are FemTech users, there could be some dire consequences assisted by the lax data privacy laws in the Commonwealth. These conditions offer FemTech users little recourse against vendors if reasonable data protection measures are not performed and also place FemTech users at heightened risk of prosecution for pregnancy-related offenses if the data are disclosed to or accessible by others. <\/span><\/span><\/p>\n

\u00a0<\/span><\/i><\/b><\/span><\/p>\n

The leaked Dobbs decision jeopardizes health information privacy generally<\/span><\/i><\/b><\/span><\/p>\n

Furthermore, the leaked Dobbs<\/i> decision also has serious implications for women\u2019s health aside from FemTech specifically. For example, it is plausible that electronic health records for services provided within Pennsylvania would become targets of subpoenas originating from any state. HIPAA\u2014specifically <\/span><\/span>45 CFR 164.512(e) and 45 CFR \u00a7164.512(f)<\/span><\/a>\u2014permits disclosures of protected health information when responding to subpoenas and to law enforcement under certain conditions. While <\/span><\/span>responses<\/span><\/a> to such attempts might vary across healthcare providers and systems, it seems all but certain that these provisions will be exploited by forced birth advocates in and beyond Pennsylvania. Another unsettling aspect is whether overturning Roe v. Wade<\/i> will disrupt efforts to improve representation of women in biomedical research, as choice of law for research activities remains unsettled (as <\/span><\/span>highlighted<\/span><\/a> by two recent publications in the <\/span><\/span>Journal of Law and the Biosciences<\/span><\/a>) and as <\/span><\/span>NIH Certificates of Confidentiality<\/span><\/a> for participation (which already had significant gaps identified by <\/span><\/span>law scholars<\/span><\/a>) could also prove themselves inadequate shields for information of interest in Mississippi, Texas, Oklahoma, and <\/span><\/span>elsewhere post-Roe<\/i><\/span><\/a>. <\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n

Quite simply, the emerging rise in FemTech and concurrent escalating attacks on women\u2019s rights highlight how integral data privacy is to the realization of human rights.<\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n

\n

Jennifer K. Wagner, J.D., Ph.D., is a solo practicing attorney and also is Assistant Professor of Law, Policy, and Engineering at the Pennsylvania State University. She has been a member of the PBA Cybersecurity & Data Privacy Committee since 2018, is a former contributing editor of the Genomics Law Report, and has published scholarly articles in prominent legal and scientific journals, including the Journal of Law & Biosciences; Journal of Law, Medicine, & Ethics; Albany Law Journal of Science & Technology; Virginia Sports and Entertainment Law Journal; North Carolina Journal of Law and Technology; Science; Nature Communications; Nature Medicine; American Journal of Human Genetics; Human Genetics and Genomics Advances; Genetics in Medicine; and PLOS Genetics. She served as a AAAS Congressional Fellow in a U.S. Senator\u2019s office in 2014-2015, and her work has been cited by the Supreme Court of the United States. You may follow her on Twitter as @DNAlawyer. Views expressed are her own.<\/span><\/span><\/p>\n

\u00a0<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

To call the forthcoming Supreme Court of the United States decision in Dobbs v. Jackson Women\u2019s Health Organization \u201cmuch anticipated\u201d would be a gross understatement. On May 2, 2022 the draft opinion penned by Justice Alito that appeared in Politico shocked the nation. If such an opinion is ultimately issued by the Roberts Court, it
Read More »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[6,4],"tags":[],"_links":{"self":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/492"}],"collection":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/comments?post=492"}],"version-history":[{"count":2,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/492\/revisions"}],"predecessor-version":[{"id":494,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/posts\/492\/revisions\/494"}],"wp:attachment":[{"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/media?parent=492"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/categories?post=492"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pbacyber.com\/index.php\/wp-json\/wp\/v2\/tags?post=492"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}