The action is against those behind Pharmatrak, a now-defunct
company that sold a service called NETcompare to drug companies,
including Smithkline Beecham and Glaxo Wellcome, prior to their
merger.
According to court documents, NETcompare “accessed information
about the internet users and collected certain information” to
allow “intra-industry comparisons of web site traffic and
usage.”
The drug companies were emphatic that they did not want to
access or use personal information about their web site users, and
bought the service on this understanding. However, personal
information was found on Pharmatrak’s computers. As a result, some
individuals sued both Pharmatrak and the drug companies, arguing a
breach of the Electronic Communications Privacy Act (ECPA).
Pharmatrak argued that its clients had consented to the
accessing of information and therefore that it should not be party
to the lawsuit. A district court agreed, but on Friday the Court of
Appeals overturned its decision, reasoning that neither the drug
companies nor the individual internet users had consented to the
interception of personal information.
The Court of Appeals also disagreed with the lower court’s
ruling as to the nature of the information accessed by
NETcompare.
Pharmatrak had designed NETcompare so that no personal
information would be accessed. It would only record such items as
the pages viewed, length of time spent viewing, path through the
site and IP address.
However, one drug company inadvertently altered its web site so
that when a user searched the site, the information contained in
the URL (Uniform Resource Locator) of the page generated, actually
included all the words the user had typed. This information was
recorded by Pharmatrak and on some occasions included personal
details.
According to the court, the law provides a private right of
action against one who “intentionally intercepts, endeavours to
intercept, or procures any other person to intercept or endeavour
to intercept, any wire, oral, or electronic communication.”
This covers the content of telephone conversations or e-mails,
but the position is not so clear as regards information typed by a
user when searching a web site. The Court of Appeal has now decided
that the Act covers this too, a decision welcomed by the privacy
advocates.
The case has now been sent back to the District Court for
further action.
