Last week I was going to blog about the collateral damage that had been done to Amazon as a result of its AWS cloud computing unit being taken down, and rendering thousands of companies unable to access their mission-critical information. However, it was disclosed that Apple and Google were able to track people who use their Smartphones, and that raised certain privacy concerns for the users’ of those platforms. Lastly, came news that Sony’s PlayStation had been hacked, and the exposure of user information may be in the has of criminals all over the world.
To top of this definitive week in data security, the United States Supreme Court heard a case about the extent to which a company can go to share and sell mission-critical data that is mined by a third-party provider. The case Sorrell v. IMS Health, the State of Vermont passed a law in 2007 whereby doctor’s could decide whether pharmacies can, for marketing purposes, sell prescription records linking him or her by name to the kinds and amounts of drugs prescribed. Health information firms, along with the Vermont Medical Society, and a pharmaceutical company have challenged the law stating that it restricts commercial free speech.
A residual argument that has emerged in the wake of the past week events around data breaches is one related to informed consent and consumer protection. The case raises questions about who is collecting, managing, storing, sharing and selling all that data. Just as important, privacy advocates say, it raises questions about whether data brokers are adequately safeguarding it. Even though the patient and doctor’s names are removed, a look at the totality of the information, and it is very easily discernible to identify the individual, and thereby creating a risk of exposing private affairs.