In Re Pharmatrak, Inc. Privacy Litigation
329 F.3d 9, 29 Communications Reg. (P&F) 136, 2003 U.S. App. LEXIS 8758 (2003)
Rule of Law:
The Electronic Communications Privacy Act (ECPA) prohibits the intentional interception of electronic communications without actual consent, which cannot be casually inferred and requires clear knowledge and agreement to the specific scope of interception. Interception includes the contemporaneous acquisition of communication content, even if by an automatic routing program that duplicates data to a third party.
Facts:
- From approximately June 1998 to November 2000, Pharmatrak, Inc. provided its "NETcompare" service to pharmaceutical companies, including American Home Products, Pharmacia, SmithKline Beecham, Pfizer, and Novartis.
- Pharmatrak marketed NETcompare as a tool for intra-industry comparison of website traffic and usage, repeatedly assuring clients that it would not collect personally identifiable information from website users.
- Some pharmaceutical clients explicitly conditioned their contracts for NETcompare on Pharmatrak's guarantee that no personally identifiable information would be collected.
- Pharmatrak's service operated by clients embedding HTML code on their webpages, which caused users' computers to contact Pharmatrak's web server, retrieve a "clear GIF" (web bug), and place or access a "persistent cookie" containing a unique alphanumeric identifier.
- NETcompare was designed to record URLs visited and track users across client sites; however, it also collected full URLs, including query strings (using the "get" method), which sometimes contained sensitive personal information such as names, addresses, dates of birth, medical conditions, and email addresses.
- The collection of personal information was primarily due to one pharmaceutical client, Pharmacia, using the "get" method for a rebate form on its Detrol website, and also due to software errors.
- Pharmatrak's monthly reports to its clients did not contain any personally identifiable information, and clients were unaware that such data was being collected until litigation began, at which point they terminated the service.
- Plaintiffs' expert was able to develop individual profiles for 232 users from the approximately 18.7 million persistent cookies distributed by Pharmatrak, finding various types of personal information on Pharmatrak's servers.
Procedural Posture:
- Eight separate lawsuits were originally filed in the District of Massachusetts and the Southern District of New York.
- On April 18, 2001, the Judicial Panel on Multi-District Litigation ordered the transfer of the six New York cases to the District of Massachusetts.
- On June 28, 2001, plaintiffs filed an amended consolidated class action complaint in the District of Massachusetts against Pharmatrak, its parent company Glocal Communications, Ltd., and five pharmaceutical companies, alleging violations of Title I and II of the ECPA, the Computer Fraud and Abuse Act, state privacy laws, and common law claims.
- Pharmatrak, Glocal, and some pharmaceutical defendants moved for summary judgment in August 2001, while plaintiffs moved for summary judgment against Pharmatrak and Glocal on the Title I ECPA claim.
- The district court (Hon. Joseph L. Tauro, U.S. District Judge) denied plaintiffs' motion for summary judgment and granted in part defendants' summary judgment motions, holding that the claim against Pharmatrak under Title I of the ECPA was precluded by the statutory consent exception because the pharmaceutical defendants had consented to the placement of Pharmatrak's code on their websites.
- The district court granted summary judgment to all defendants on all federal law causes of action and declined to retain jurisdiction over the state law causes of action, dismissing them without prejudice.
- Plaintiffs (Appellants) appealed the district court's decision concerning the Title I ECPA claim against Pharmatrak (Appellees) to the United States Court of Appeals for the First Circuit.
Premium Content
Subscribe to Lexplug to view the complete brief
You're viewing a preview with Rule of Law, Facts, and Procedural Posture
Issue:
1. Did Pharmatrak "intercept" electronic communications under the Electronic Communications Privacy Act (ECPA)? 2. Did the pharmaceutical companies or the internet users provide actual consent to Pharmatrak's interception of personally identifiable information, thereby falling within an exception to the ECPA?
Opinions:
Majority - Lynch, Circuit Judge
Yes, Pharmatrak "intercepted" electronic communications under the ECPA, and no, neither the pharmaceutical companies nor the internet users provided valid consent for the interception of personally identifiable information. The district court erred by misinterpreting the ECPA's consent exception and by not finding that Pharmatrak's actions constituted an interception under the statute. Regarding consent, the court found that consent under the ECPA must be actual, whether explicit or implied, and should not be casually inferred. Implied consent requires convincing surrounding circumstances showing that the party knew about and consented to the specific interception. The pharmaceutical clients explicitly conditioned their use of NETcompare on the absence of personally identifiable information collection and ceased service when they learned otherwise. This scenario is the 'mirror image' of cases where clients purchased services for the purpose of creating user profiles. Furthermore, internet users could not have consented as Pharmatrak's involvement was invisible to them, and deficient notice defeats claims of implied consent. Regarding interception, the court determined that Pharmatrak's acquisition of communication contents was contemporaneous with the transmission from internet users to the pharmaceutical companies. Both the client's web server and Pharmatrak's web server communicated simultaneously with users. The court likened NETcompare to an 'automatic routing program' that duplicated part of the communication (URLs, sometimes containing personal information) and sent it to a third party. This process, where separate but simultaneous and identical communications occur, satisfies the ECPA's requirement for interception, even under a strict 'real-time' interpretation. The court remanded the case for further proceedings on the "intent" requirement of the ECPA, noting that 'intentional' means a 'conscious objective' and excludes inadvertent or mistaken acts, a point not fully addressed by the lower court.
Analysis:
This case significantly clarifies the application of the ECPA to modern internet tracking technologies, particularly regarding third-party data collection. It underscores that consent for interception under the ECPA requires actual knowledge and agreement to the scope of data collection, preventing companies from claiming implied consent based solely on the purchase of a service, especially when privacy assurances were given. The court's interpretation of 'interception' to include simultaneous acquisition via 'automatic routing programs' provides an important framework for assessing web bugs and cookies, ensuring privacy protections extend to complex digital communication flows. This ruling holds profound implications for web analytics firms and any entity involved in collecting user data, mandating greater transparency and adherence to stated privacy policies.
