Previous month:
February 2019
Next month:
April 2019

12 posts from March 2019

The Worst Mobile Apps For Privacy

ExpressVPN compiled its list for 2019 of the four worst mobile apps for privacy. If you value your online privacy and want to protect yourself, the security firm advises consumers to, "Delete them now." The list of apps includes both predictable items and some surprises:

"1. Angry Birds: If you were an international spying organization, which app would you target to harvest smartphone user information? If you picked Angry Birds, congratulations! You’re thinking just like the NSA and GCHQ did... what it lacks in gameplay, it certainly makes up for in leaky data... A mobile ad platform placed a code snippet in Angry Birds that allowed the company to target advertisements to users based on previously collected information. Unfortunately, the ad’s library of data was visible, meaning it was leaking user information such as phone number, call logs, location, political affiliation, sexual orientation, and marital status..."

"2. The YouVersion Bible App: The YouVersion Bible App is on more than 300 million devices around the world. It claims to be the No. 1 Bible app and comes with over 1,400 Bibles in over 1,000 languages. It also harvests data... Notable permissions the app demands are full internet access, the ability to connect and disconnect to Wi-Fi, modify stored content on the phone, track the device’s location, and read all a user’s contacts..."

Read the full list of sketchy apps at the ExpressVPN site.


How To Do Online Banking Safely And Securely

Most people love the convenience of online banking via their smartphone or other mobile device. However, it is important to do it safely and securely. How? NordVPN listed four items:

"1. Don't lose your phone: The biggest security threat of your mobile phone is also its greatest asset – its size. Phones are small, handy, beautiful, and easy to lose..."

So, keep your phone in your hand. Never place it on a table out of sight. Of course, you should lock your phone with a strong password. NordVPN commented about other locking options:

"Facial recognition: convenient but not secure, since it can sometimes be bypassed with a photograph... Fingerprints: low false-acceptance rates, perfect if you don’t often wear gloves."

More advice:

"2. Use the official banking app, not the browser... If you aren’t careful, you could download a fake banking app created by scammers to break into your account. Make sure your bank created or approves of the app you are downloading. Get it from their website. Moreover, do not use mobile browsers to log in to your bank account – they are less secure than bank-sanctioned apps..."

Obviously, you should sign out of the mobile app when when finished with your online banking session. Otherwise, a thief with your stolen phone has direct access to your money and accounts. NordVPN advises consumers to do your homework first: read app ratings and reviews before downloading any mobile apps.

Readers of this blog are probably familiar with the next item:

"4. Don’t use mobile banking on public Wi-Fi: Anyone on a public Wi-Fi network is in danger of a security breach. Most of these networks lack basic security measures and have poor router configurations and weak passwords..."

Popular places with public Wi-Fi includes coffee shops, fast food restaurants, supermarkets, airports, libraries, and hotels. If you must do online banking in a public place, NordVPN advised:

"... use your cellular network instead. It’s not perfect, but it’s better than public Wi-Fi. Better yet, turn on a virtual private network (VPN) and then use public Wi-Fi..."

There you have it. Read the entire online banking article by NordVPN. Ignore this advice at your own peril.


Study: While Consumers Want Sites Like Facebook And Google To Collect Less Data, Few Want To Pay For Privacy

A recent study by the Center For Data Innovation explored consumers' attitudes about online privacy. One of the primary findings:

"... when potential tradeoffs were not part of the question approximately 80 percent of Americans agreed that they would like online services such as Facebook and Google to collect less of their data..."

So, most survey participants want more online privacy as defined by less data collected about them. That is good news, right? Maybe. The researchers dug deeper to understand survey participants' views about "tradeoffs" - various ways of paying for online privacy. It found that support for more privacy (e.g., less data collected):

"... eroded when respondents considered these tradeoffs... [support] dropped by 6 percentage points when respondents were asked whether they would like online services to collect less data even if it means seeing ads that are less useful. Support dropped by 27 percentage points when respondents considered whether they would like less data collection even if it means seeing more ads than before. And it dropped by 26 percentage points when respondents were asked whether they would like less data collection even if it means losing access to some features they use now."

So, support for more privacy fell if irrelevant ads, more ads, and/or fewer features were the consequences. There is more:

"The largest drop in support (53 percentage points) came when respondents were asked whether they would like online services to collect less of their data even if it means paying a monthly subscription fee."

This led to a second major finding:

"Only one in four Americans want online services such as Facebook and Google to collect less of their data if it means they would have to start paying a monthly subscription fee..."

So, most want privacy but few are willing to pay for it. This is probably reassuring news for executives in a variety of industries (e.g., social media, tech companies, device manufacturers, etc.) to keep doing what they are doing: massive data collection of consumers' data via sites, mobile apps, partnerships, and however else they can get it.

Next, the survey asked participants if they would accept more data collection if that provided more benefits:

"... approximately 74 percent of Americans opposed having online services such as Google and Facebook collect more of their data. But that opposition decreased by 11 percentage points... if it means seeing ads that are more useful. It dropped by 17 percentage points... if it means seeing fewer ads than before and... if it means getting access to new features they would use. The largest decrease in opposition (18 percentage points) came... if it means getting more free apps and services..."

So, while most consumers want online privacy, they can be easily persuaded to abandon their positions with promises of more benefits. The survey included a national online poll of 3,240 U.S. adult Internet users. It was conducted December 13 - 16, 2018.

What to make of these survey results? Americans are fickle and lazy. We say we want online privacy, but few are willing to pay for it. While nothing in life is free, few consumers seem to realize that this advice applies to online privacy, too. Plus, consumers seem to highly value convenience regardless of the consequences.

What do you think?


Behind the Scenes, Health Insurers Use Cash and Gifts to Sway Which Benefits Employers Choose

[Editor's note: today's guest post, by reporters at ProPublica, explores business practices within the health insurance industry. It is reprinted with permission.]

By Marshall Allen, ProPublica

The pitches to the health insurance brokers are tantalizing.

“Set sail for Bermuda,” says insurance giant Cigna, offering top-selling brokers five days at one of the island’s luxury resorts.

Health Net of California’s pitch is not subtle: A smiling woman in a business suit rides a giant $100 bill like it’s a surfboard. “Sell more, enroll more, get paid more!” In some cases, its ad says, a broker can “power up” the bonus to $150,000 per employer group.

Not to be outdone, New York’s EmblemHealth promises top-selling brokers “the chance of a lifetime”: going to bat against the retired legendary New York Yankees pitcher Mariano Rivera. In another offer, the company, which bills itself as the state’s largest nonprofit plan, focuses on cash: “The more subscribers you enroll … the bigger the payout.” Bonuses, it says, top out at $100,000 per group, and “there’s no limit to the number of bonuses you can earn.

Such incentives sound like typical business tactics, until you understand who ends up paying for them: the employers who sign up with the insurers — and, of course, their employees.

Human resource directors often rely on independent health insurance brokers to guide them through the thicket of costly and confusing benefit options offered by insurance companies. But what many don’t fully realize is how the health insurance industry steers the process through lucrative financial incentives and commissions. Those enticements, critics say, don’t reward brokers for finding their clients the most cost-effective options.

Here’s how it typically works: Insurers pay brokers a commission for the employers they sign up. That fee is usually a healthy 3 to 6 percent of the total premium. That could be about $50,000 a year on the premiums of a company with 100 people, payable for as long as the plan is in place. That’s $50,000 a year for a single client. And as the client pays more in premiums, the broker’s commission increases.

Commissions can be even higher, up to 40 or 50 percent of the premium, on supplemental plans that employers can buy to cover employees’ dental costs, cancer care or long-term hospitalization.

Those commissions come from the insurers. But the cost is built into the premiums the employer and employees pay for the benefit plan.

Now, layer on top of that the additional bonuses that brokers can earn from some insurers. The offers, some marked “confidential,” are easy to find on the websites of insurance companies and broker agencies. But many brokers say the bonuses are not disclosed to employers unless they ask. These bonuses, too, are indirectly included in the overall cost of health plans.

These industry payments can’t help but influence which plans brokers highlight for employers, said Eric Campbell, director of research at the University of Colorado Center for Bioethics and Humanities.

“It’s a classic conflict of interest,” Campbell said.

There’s “a large body of virtually irrefutable evidence,” Campbell said, that shows drug company payments to doctors influence the way they prescribe. “Denying this effect is like denying that gravity exists.” And there’s no reason, he said, to think brokers are any different.

Critics say the setup is akin to a single real estate agent representing both the buyer and seller in a home sale. A buyer would not expect the seller’s agent to negotiate the lowest price or highlight all the clauses and fine print that add unnecessary costs.

“If you want to draw a straight conclusion: It has been in the best interest of a broker, from a financial point of view, to keep that premium moving up,” said Jeffrey Hogan, a regional manager in Connecticut for a national insurance brokerage and one of a band of outliers in the industry pushing for changes in the way brokers are paid.

As the average cost of employer-sponsored health insurance premiums has tripled in the past two decades, to almost $20,000 for a family of four, a small, but growing, contingent of brokers are questioning their role in the rise in costs. They’ve started negotiating flat fees paid directly by the employers. The fee may be a similar amount to the commission they could have earned, but since it doesn’t come from the insurer, Hogan said, it “eliminates the conflict of interest” and frees brokers to consider unorthodox plans tailored to individual employers’ needs. Any bonuses could also be paid directly by the employer.

Brokers provide a variety of services to employers. They present them with benefits options, enroll them in plans and help them with claims and payment issues. Insurance industry payments to brokers are not illegal and have been accepted as a cost of doing business for generations. When brokers are paid directly by employers, the results can be mutually beneficial.

In 2017, David Contorno, the broker for Palmer Johnson Power Systems, a heavy-equipment distribution company in Madison, Wisconsin, saved the firm so much money while also improving coverage that Palmer Johnson took all 120 employees on an all-expenses paid trip to Vail, Colorado, where they rode four-wheelers and went whitewater rafting. In 2018, the company saved money again and rewarded each employee with a health care “dividend” of about $700.

Contorno is not being altruistic. He earned a flat fee, plus a bonus based on how much the plan saved, with the total equal to roughly what would have made otherwise.

Craig Parsons, who owns Palmer Johnson, said the new payment arrangement puts pressure on the broker to prevent overspending. His previous broker, he said, didn’t have any real incentive to help him reduce costs. “We didn’t have an advocate,” he said. “We didn’t have someone truly watching out for our best interests.” (The former broker acknowledged there were some issues, but said it had provided a valuable service.)

Working for Employers, Not Insurers

Contorno is part of a group called the Health Rosetta, which certifies brokers who agree to follow certain best practices related to health benefits, including eliminating any hidden agreements that raise the cost of employee benefits. To be certified, brokers (who refer to themselves as “benefits advisers”) must disclose all their direct and indirect sources of income — bonuses, commissions, consulting fees, for example — and who pays them to the employers they advise.

Dave Chase, a Washington businessman, created Rosetta in 2016 after working with tech health startups and launching Microsoft’s services to the health industry. He said he saw an opportunity to transform the health care industry by changing the way employers buy benefits. He said brokers have the most underestimated role in the health care system. “The good ones are worth their weight in gold,” Chase said. “But most of the benefit brokers are pitching themselves as buyer’s agents, but they are paid like a seller’s agent.”

There are only 110 Rosetta certified brokers in an industry of more than 100,000, although others who follow a similar philosophy consider themselves part of the movement.

From the employer’s point of view, one big advantage of working with brokers like those certified by Rosetta, is transparency. Currently, there’s no industry standard for how brokers must disclose their payments from insurance companies, so many employers may have no idea how much brokers are making from their business, said Marcy Buckner, vice president of government affairs for the National Association of Health Underwriters, the trade group for health benefits brokers. And thus, she said, employers have no clear sense of the conflicts of interest that may color their broker’s advice to them.

Buckner’s group encourages brokers to bill employers for their commissions directly to eliminate any conflict of interest, but, she said, it’s challenging to shift the culture. Nevertheless, Buckner said she doesn’t think payments from insurers undermine the work done by brokers, who must act in their clients’ best interests or risk losing them. “They want to have these clients for a really long term,” Buckner said.

Industrywide, transparency is not the standard. ProPublica sent a list of questions to 10 of the largest broker agencies, some worth $1 billion or more, including Marsh & McLennan, Aon and Willis Towers Watson, asking if they took bonuses and commissions from insurance companies, and whether they disclosed them to their clients. Four firms declined to answer; the others never responded despite repeated requests.

Insurers also don’t seem to have a problem with the payments. In 2017, Health Care Service Corporation, which oversees Blue Cross Blue Shield plans serving 15 million members in five states, disclosed in its corporate filings that it spent $816 million on broker bonuses and commissions, about 3 percent of its revenue that year. A company spokeswoman acknowledged in an email that employers are actually the ones who pay those fees; the money is just passed through the insurer. “We do not believe there is a conflict of interest,” she said.

In one email to a broker reviewed by ProPublica, Blue Cross Blue Shield of North Carolina called the bonuses it offered — up to $110,000 for bringing in a group of more than 1,000 — the “cherry on top.” The company told ProPublica that such bonuses are standard and that it always encourages brokers to “match their clients with the best product for them.”

Cathryn Donaldson, spokeswoman for the trade group America’s Health Insurance Plans, said in an email that brokers are incentivized “above all else” to serve their clients. “Guiding employees to a plan that offers quality, affordable care will help establish their business and reputation in the industry,” she said.

Some insurer’s pitches, however, clearly reward brokers’ devotion to them, not necessarily their clients. “To thank you for your loyalty to Humana, we want to extend our thanks with a bonus,” says one brochure pitched to brokers online. Horizon Blue Cross Blue Shield of New Jersey offered brokers a bonus as “a way to express our appreciation for your support.” Empire Blue Cross told brokers it would deliver new bonuses “for bringing in large group business ... and for keeping it with us.”

Delta Dental of California’s pitches appears to go one step further, rewarding brokers as “key members of our Small Business Program team.”

ProPublica reached out to all the insurers named in this story, and many didn’t respond. Cigna said in a statement that it offers affordable, high-quality benefit plans and doesn’t see a problem with providing incentives to brokers. Delta Dental emphasized in an email it follows applicable laws and regulations. And Horizon Blue Cross said its gives employers the option of how to pay brokers and discloses all compensation.

The effect of such financial incentives is troubling, said Michael Thompson, president of the National Alliance of Healthcare Purchaser Coalitions, which represents groups of employers who provide benefits. He said brokers don’t typically undermine their clients in a blatant way, but their own financial interests can create a “cozy relationship” that may make them wary of “stirring the pot.”

Employers should know how their brokers are paid, but health care is complex, so they are often not even aware of what they should ask, Thompson said. Employers rely on brokers to be a “trusted adviser,” he added. “Sometimes that trust is warranted and sometimes it’s not.”

Bad Faith Tactics

When officials in Morris County, New Jersey, sought a new broker to manage the county’s benefits, they specified that applicants could not take insurance company payouts related to their business. Instead, the county would pay the broker directly to ensure an unbiased search for the best benefits. The county hired Frenkel Benefits, a New York City broker, in February 2015.

Now, the county is suing the firm in Superior Court of New Jersey, accusing it of double-dipping. In addition to the fees from the county, the broker is accused of collecting a $235,000 commission in 2016 from the insurance giant Cigna. The broker got an additional $19,206 the next year, the lawsuit claims. To get the commission, one of the agency’s brokers allegedly certified, falsely, that the county would be told about the payment, the suit said. The county claims it was never notified and never approved the commission.

The suit also alleges the broker “purposefully concealed” the costs of switching the county’s health coverage to Cigna, which included administrative fees of $800,000.

In an interview, John Bowens, the county’s attorney, said the county had tried to guard against the broker being swayed by a large commission from an insurer. The brokers at Frenkel did not respond to requests for comment. The firm has not filed a response to the claims in the lawsuit. Steven Weisman, one of attorneys representing Frenkel, declined to comment.

Sometimes employers don’t find out their broker didn’t get them the best deal until they switch to another broker.

Josh Butler, a broker in Amarillo, Texas, who is also certified by Rosetta, recently took on a company of about 200 employees that had been signed up for a plan that had high out-of-pocket costs. The previous broker had enrolled the company in a supplemental plan that paid workers $1,000 if they were admitted to the hospital to help pay for uncovered costs. But Butler said the premiums for this coverage cost about $100,000 a year, and only nine employees had used it. That would make it much cheaper to pay for the benefit without insurance.

Butler suspects the previous broker encouraged the hospital benefits because they came with a sizable commission. He sells the same type of policies for the same insurer, so he knows the plan came with a 40 percent commission in the first year. That means about $40,000 of the employer’s premium went into the broker’s pocket.

Butler and other brokers said the insurance companies offer huge commissions to promote lucrative supplemental plans like dental, vision and disability. The total commissions on a supplemental cancer plan one insurer offered come to 57 percent, Butler said.

These massive year-one commissions lead some unscrupulous brokers to “churn” their supplemental benefits, Butler said, convincing employers to jump between insurers every year for the same type of benefits. The insurers don’t mind, Butler said, because the employers end up paying the tab. Brokers may also “product dump,” Butler said, which means pushing employers to sign employees up for multiple types of voluntary supplemental coverage, which brings them a hefty commission on each product.

Carl Schuessler, a broker in Atlanta who is certified by the Rosetta group, said he likes to help employers find out how much profit insurers are making on their premiums. Some states require insurers to provide the information, so when he took over the account for The Gasparilla Inn, an island resort on the Gulf Coast of Florida, he obtained the report for the company’s recent three years of coverage with UnitedHealthcare. He learned that the insurer had only paid out in claims about 65 percent of what the Inn had paid in premiums.

But in those same years the insurer had increased the Inn’s premiums, said Glenn Price, its chief financial officer. “It’s tough to swallow” increases to our premium when the insurer is making healthy profits, Price said. UnitedHealthcare declined to comment.

Schuessler, who is paid by the Inn, helped it transition to a self-funded plan, meaning the company bears the cost of the health care bills. Price said the Inn went from spending about $1 million a year to about $700,000, with lower costs and better benefits for employees, and no increases in three years.

A Need for Regulation

Despite the important function of brokers as middlemen, there’s been scant examination of their role in the marketplace.

Don Reiman, head of a Boise, Idaho, broker agency and a financial planner, said the federal government should require health benefit brokers to adhere to the same regulation he sees in the finance arena. The Employee Retirement Income Security Act, better known as ERISA, requires retirement plan advisers to disclose to employers all compensation that’s related to their plans, exposing potential conflicts.

The Department of Labor requires certain employers that provide health benefits to file documents every year about their plans, including payments to brokers. The department posts the information on its website.

But the data is notoriously messy. After a 2012 report found 23 percent of the forms contained errors, there was a proposal to revamp the data collection in 2016. It is unclear if that work was done, but ProPublica tried to analyze the data and found it incomplete or inaccurate. The data shortcomings mean employers have no real ability to compare payments to brokers.

About five years ago, Contorno, one of the leaders in the Rosetta movement, was blithely happy with the status quo: He had his favored insurers and could usually find traditional plans that appeared to fit his clients’ needs.

Today, he regrets his role in driving up employers’ health costs. One of his LinkedIn posts compares the industry’s acceptance of control by insurance companies to Stockholm Syndrome, the feelings of trust a hostage would have toward a captor.

Contorno began advising Palmer Johnson in 2016. When he took over, the company had a self-funded plan and its claims were reviewed by an administrator owned by its broker, Iowa-based Cottingham & Butler. Contorno brought in an independent claims administrator who closely scrutinized the claims and provided detailed cost information. The switch led to significant savings, said Parsons, the company owner. “It opened our eyes to what a good claims review process can mean to us,” he said.

Brad Plummer, senior vice president for employee benefits for Cottingham & Butler, acknowledged “things didn’t go swimmingly” with the claims company. But overall his company provided valuable service to Palmer Johnson, he said.

Contorno also provided resources to help Palmer Johnson employees find high-quality, low-cost providers, and the company waived any out-of-pocket expense as an incentive to get employees to see those medical providers. If a patient needed an out-of-network procedure, the price was negotiated up front to avoid massive surprise bills to the plan or the patient. The company also contracted with a vendor for drug coverage that does not use the secret rebates and hidden pricing schemes that are common in the industry. Palmer Johnson’s yearly health care costs per employee dropped by more than 25 percent, from about $11,252 in 2015 to $8,288 in 2018. That’s lower than they’d been in 2011, Contorno said.

“Now that my compensation is fully tied to meeting the clients’ goals, that is my sole objective,” he said. “Your broker works for whoever is cutting them the check.”

ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story newsletter to receive stories like this one in your inbox.


New Vermont Law Regulating Data Brokers Drives 120 Businesses From The Shadows

In May of 2018, Vermont was the first (and only) state in the nation to enact a law regulating data brokers. According to the Vermont Secretary of State, a data broker is defined as:

"... a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship."

The Vermont Secretary of State's website contains links to the new law and more. This new law is important for several reasons. First, many businesses operate as data brokers. Second, consumers historically haven't known who has information about them, nor how to review their profiles for accuracy. Third,  consumers haven't been able to opt out of the data collection. Fourth, if you don't know who the data brokers are, then you can't hold them accountable if they fail with data security. According to Vermont law:

"2447. Data broker duty to protect information; standards; technical requirements (a) Duty to protect personally identifiable information. (1) A data broker shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate... identification and assessment of reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of any electronic, paper, or other records containing personally identifiable information, and a process for evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks... taking reasonable steps to select and retain third-party service providers that are capable of maintaining appropriate security measures to protect personally identifiable information consistent with applicable law; and (B) requiring third-party service providers by contract to implement and maintain appropriate security measures for personally identifiable information..."

Before this law, there was little to no oversight, no regulation, and no responsibility for data brokers to adequately protect sensitive data about consumers. A federal bill proposed in 2014 went nowhere in the U.S. Senate. You can assume that many data brokers operate in your state, too, since there's plenty of money to be made in the industry.

Portions of the new Vermont law went into effect in May, and the remainder went into effect on January 1, 2019. What has happened since then? Fast Company reported:

"So far, 121 companies have registered, according to data from the Vermont secretary of state’s office... The list of active companies includes divisions of the consumer data giant Experian, online people search engines like Spokeo and Spy Dialer, and a variety of lesser-known organizations that do everything from help landlords research potential tenants to deliver marketing leads to the insurance industry..."

The Fast Company site lists the 120 (so far) registered data brokers in Vermont. Regular readers of this blog will recognize some of the data brokers by name, since prior posts covered Acxiom, Equifax, Experian, LexisNexis, the NCTUE, Oracle, Spokeo, TransUnion, and others. (Yes, both credit reporting agencies and social media firms also operate as data brokers. Some states do it, too.) Reportedly, many privacy advocates support the new law:

"There’s companies that I’ve never heard of before," says Zachary Tomanelli, communications and technology director at the Vermont Public Interest Research Group, which supported the law. "It’s often very cumbersome [for consumers] to know where the places are that you have to go, and how you opt out."

Predictably, the industry has opposed (and continues to oppose) the legislation:

"A coalition of industry groups like the Internet Association, the Association of National Advertisers, and the National Association of Professional Background Screeners, as well as now registered data brokers such as Experian, Acxiom, and IHS Markit, said the law was unnecessary... Requiring companies to disclose breaches of largely public data could be burdensome for businesses and needlessly alarming for consumers, they argue... Other companies, like Axciom, have complained that the law establishes inconsistent boundaries around personal data used by third parties, and the first-party data used by companies like Facebook and Google."

So, no companies want consumers to own and control the data -- property -- that describes them. Real property laws matter. To learn more, read about data brokers at the Privacy Rights Clearinghouse site. Related posts in the Data Brokers section of this blog:

Kudos to Vermont lawmakers for ensuring more disclosures and transparency from the industry. Readers may ask their elected officials why their state has not taken similar action. What are your opinions of the new Vermont law?


Sackler Embraced Plan to Conceal OxyContin’s Strength From Doctors, Sealed Testimony Shows

[Editor's note: today's guest post explores issues within the pharmaceuticals and drug industry. It is reprinted with permission.]

By David Armstrong, ProPublica

In May 1997, the year after Purdue Pharma launched OxyContin, its head of sales and marketing sought input on a key decision from Dr. Richard Sackler, a member of the billionaire family that founded and controls the company. Michael Friedman told Sackler that he didn’t want to correct the false impression among doctors that OxyContin was weaker than morphine, because the myth was boosting prescriptions — and sales.

“It would be extremely dangerous at this early stage in the life of the product,” Friedman wrote to Sackler, “to make physicians think the drug is stronger or equal to morphine….We are well aware of the view held by many physicians that oxycodone [the active ingredient in OxyContin] is weaker than morphine. I do not plan to do anything about that.”

“I agree with you,” Sackler responded. “Is there a general agreement, or are there some holdouts?”

Ten years later, Purdue pleaded guilty in federal court to understating the risk of addiction to OxyContin, including failing to alert doctors that it was a stronger painkiller than morphine, and agreed to pay $600 million in fines and penalties. But Sackler’s support of the decision to conceal OxyContin’s strength from doctors — in email exchanges both with Friedman and another company executive — was not made public.

The email threads were divulged in a sealed court document that ProPublica has obtained: an Aug. 28, 2015, deposition of Richard Sackler. Taken as part of a lawsuit by the state of Kentucky against Purdue, the deposition is believed to be the only time a member of the Sackler family has been questioned under oath about the illegal marketing of OxyContin and what family members knew about it. Purdue has fought a three-year legal battle to keep the deposition and hundreds of other documents secret, in a case brought by STAT, a Boston-based health and medicine news organization; the matter is currently before the Kentucky Supreme Court.

Meanwhile, interest in the deposition’s contents has intensified, as hundreds of cities, counties, states and tribes have sued Purdue and other opioid manufacturers and distributors. A House committee requested the document from Purdue last summer as part of an investigation of drug company marketing practices.

In a statement, Purdue stood behind Sackler’s testimony in the deposition. Sackler, it said, “supports that the company accurately disclosed the potency of OxyContin to healthcare providers.” He “takes great care to explain” that the drug’s label “made clear that OxyContin is twice as potent as morphine,” Purdue said.

Still, Purdue acknowledged, it had made a “determination to avoid emphasizing OxyContin as a powerful cancer pain drug,” out of “a concern that non-cancer patients would be reluctant to take a cancer drug.”

The company, which said it was also speaking on behalf of Sackler, deplored what it called the “intentional leak of the deposition” to ProPublica, calling it “a clear violation of the court’s order” and “regrettable.”

Much of the questioning of Sackler in the 337-page deposition focused on Purdue’s marketing of OxyContin, especially in the first five years after the drug’s 1996 launch. Aggressive marketing of OxyContin is blamed by some analysts for fostering a national crisis that has resulted in 200,000 overdose deaths related to prescription opioids since 1999.

Taken together with a Massachusetts complaint made public last month against Purdue and eight Sacklers, including Richard, the deposition underscores the family’s pivotal role in developing the business strategy for OxyContin and directing the hiring of an expanded sales force to implement a plan to sell the drug at ever-higher doses. Documents show that Richard Sackler was especially involved in the company’s efforts to market the drug, and that he pushed staff to pursue OxyContin’s deregulation in Germany. The son of a Purdue co-founder, he began working at Purdue in 1971 and has been at various times the company’s president and co-chairman of its board.

In a 1996 email introduced during the deposition, Sackler expressed delight at the early success of OxyContin. “Clearly this strategy has outperformed our expectations, market research and fondest dreams,” he wrote. Three years later, he wrote to a Purdue executive, “You won’t believe how committed I am to make OxyContin a huge success. It is almost that I dedicated my life to it. After the initial launch phase, I will have to catch up with my private life again.”

During his deposition, Sackler defended the company’s marketing strategies — including some Purdue had previously acknowledged were improper — and offered benign interpretations of emails that appeared to show Purdue executives or sales representatives minimizing the risks of OxyContin and its euphoric effects. He denied that there was any effort to deceive doctors about the potency of OxyContin and argued that lawyers for Kentucky were misconstruing words such as “stronger” and “weaker” used in email threads.

The term “stronger” in Friedman’s email, Sackler said, “meant more threatening, more frightening. There is no way that this intended or had the effect of causing physicians to overlook the fact that it was twice as potent.”

Emails introduced in the deposition show Sackler’s hidden role in key aspects of the 2007 federal case in which Purdue pleaded guilty. A 19-page statement of facts that Purdue admitted to as part of the plea deal, and which prosecutors said contained the “main violations of law revealed by the government’s criminal investigation,” referred to Friedman’s May 1997 email to Sackler about letting the doctors’ misimpression stand. It did not identify either man by name, attributing the statements to “certain Purdue supervisors and employees.”

Friedman, who by then had risen to chief executive officer, was one of three Purdue executives who pleaded guilty to a misdemeanor of “misbranding” OxyContin. No members of the Sackler family were charged or named as part of the plea agreement. The Massachusetts lawsuit alleges that the Sackler-controlled Purdue board voted that the three executives, but no family members, should plead guilty as individuals. After the case concluded, the Sacklers were concerned about maintaining the allegiance of Friedman and another of the executives, according to the Massachusetts lawsuit. To protect the family, Purdue paid the two executives at least $8 million, that lawsuit alleges.

“The Sacklers spent millions to keep the loyalty of people who knew the truth,” the complaint filed by the Massachusetts attorney general alleges.

The Kentucky deposition’s contents will likely fuel the growing protests against the Sacklers, including pressure to strip the family’s name from cultural and educational institutions to which it has donated. The family has been active in philanthropy for decades, giving away hundreds of millions of dollars. But the source of its wealth received little attention until recent years, in part due to a lack of public information about what the family knew about Purdue’s improper marketing of OxyContin and false claims about the drug’s addictive nature.

Although Purdue has been sued hundreds of times over OxyContin’s marketing, the company has settled many of these cases, and almost never gone to trial. As a condition of settlement, Purdue has often required a confidentiality agreement, shielding millions of records from public view.

That is what happened in Kentucky. In December 2015, the state settled its lawsuit against Purdue, alleging that the company created a “public nuisance” by improperly marketing OxyContin, for $24 million. The settlement required the state attorney general to “completely destroy” documents in its possession from Purdue. But that condition did not apply to records sealed in the circuit court where the case was filed. In March 2016, STAT filed a motion to make those documents public, including Sackler’s deposition. The Kentucky Court of Appeals last year upheld a lower court ruling ordering the deposition and other sealed documents be made public. Purdue asked the state Supreme Court to review the decision, and both sides recently filed briefs. Protesters outside Kentucky’s Capitol last week waved placards urging the court to release the deposition.

Sackler family members have long constituted the majority of Purdue’s board, and company profits flow to trusts that benefit the extended family. During his deposition, which took place over 11 hours in a law office in Louisville, Kentucky, Richard Sackler said “I don’t know” more than 100 times, including when he was asked how much his family had made from OxyContin sales. He acknowledged it was more than $1 billion, but when asked if they had made more than $5 billion, he said, “I don’t know.” Asked if it was more than $10 billion, he replied, “I don’t think so.”

By 2006, OxyContin’s “profit contribution” to Purdue was $4.7 billion, according to a document read at the deposition. From 2007 to 2018, the Sackler family received more than $4 billion in payouts from Purdue, according to the Massachusetts lawsuit.

During the deposition, Sackler was confronted with his email exchanges with company executives about Purdue’s decision not to correct the misperception among many doctors that OxyContin was weaker than morphine. The company viewed this as good news because the softer image of the drug was helping drive sales in the lucrative market for treating conditions like back pain and arthritis, records produced at the deposition show.

Designed to gradually release medicine into the bloodstream, OxyContin allows patients to take fewer pills than they would with other, quicker-acting pain medicines, and its effect lasts longer. But to accomplish these goals, more narcotic is packed into an OxyContin pill than competing products. Abusers quickly figured out how to crush the pills and extract the large amount of narcotic. They would typically snort it or dissolve it into liquid form to inject.

The pending Massachusetts lawsuit against Purdue accuses Sackler and other company executives of determining that “doctors had the crucial misconception that OxyContin was weaker than morphine, which led them to prescribe OxyContin much more often.” It also says that Sackler “directed Purdue staff not to tell doctors the truth,” for fear of reducing sales. But it doesn’t reveal the contents of the email exchange with Friedman, the link between that conversation and the 2007 plea agreement, and the back-and-forth in the deposition.

A few days after the email exchange with Friedman in 1997, Sackler had an email conversation with another company official, Michael Cullen, according to the deposition. “Since oxycodone is perceived as being a weaker opioid than morphine, it has resulted in OxyContin being used much earlier for non-cancer pain,” Cullen wrote to Sackler. “Physicians are positioning this product where Percocet, hydrocodone and Tylenol with codeine have been traditionally used.” Cullen then added, “It is important that we be careful not to change the perception of physicians toward oxycodone when developing promotional pieces, symposia, review articles, studies, et cetera.”

“I think that you have this issue well in hand,” Sackler responded.

Friedman and Cullen could not be reached for comment.

Asked at his deposition about the exchanges with Friedman and Cullen, Sackler didn’t dispute the authenticity of the emails. He said the company was concerned that OxyContin would be stigmatized like morphine, which he said was viewed only as an “end of life” drug that was frightening to people.

“Within this time it appears that people had fallen into a habit of signifying less frightening, less threatening, more patient acceptable as under the rubric of weaker or more frightening, more — less acceptable and less desirable under the rubric or word ‘stronger,’” Sackler said at his deposition. “But we knew that the word ‘weaker’ did not mean less potent. We knew that the word ‘stronger’ did not mean more potent.” He called the use of those words “very unfortunate.”

He said Purdue didn’t want OxyContin “to be polluted by all of the bad associations that patients and healthcare givers had with morphine.”

In his deposition, Sackler also defended sales representatives who, according to the statement of facts in the 2007 plea agreement, falsely told doctors during the 1996-2001 period that OxyContin did not cause euphoria or that it was less likely to do so than other opioids. This euphoric effect experienced by some patients is part of what can make OxyContin addictive. Yet, asked about a 1998 note written by a Purdue salesman, who indicated that he “talked of less euphoria” when promoting OxyContin to a doctor, Sackler argued it wasn’t necessarily improper.

“This was 1998, long before there was an Agreed Statement of Facts,” he said.

The lawyer for the state asked Sackler: “What difference does that make? If it’s improper in 2007, wouldn’t it be improper in 1998?”

“Not necessarily,” Sackler replied.

Shown another sales memo, in which a Purdue representative reported telling a doctor that “there may be less euphoria” with OxyContin, Sackler responded, “We really don’t know what was said.” After further questioning, Sackler said the claim that there may be less euphoria “could be true, and I don’t see the harm.”

The same issue came up regarding a note written by a Purdue sales representative about one doctor: “Got to convince him to counsel patients that they won’t get buzzed as they will with short-acting” opioid painkillers. Sackler defended these comments as well. “Well, what it says here is that they won’t get a buzz. And I don’t think that telling a patient ‘I don’t think you’ll get a buzz’ is harmful,” he said.

Sackler added that the comments from the representative to the doctor “actually could be helpful, because many patients won’t get a buzz, and if he would like to know if they do, he might have had a good medical reason for wanting to know that.”

Sackler said he didn’t believe any of the company sales people working in Kentucky engaged in the improper conduct described in the federal plea deal. “I don’t have any facts to inform me otherwise,” he said.

Purdue said that Sackler’s statements in his deposition “fully acknowledge the wrongful actions taken by some of Purdue’s employees prior to 2002,” as laid out in the 2007 plea agreement. Both the company and Sackler “fully agree” with the facts laid out in that case, Purdue said.

The deposition also reveals that Sackler pushed company officials to find out if German officials could be persuaded to loosen restrictions on the selling of OxyContin. In most countries, narcotic pain relievers are regulated as “controlled” substances because of the potential for abuse. Sackler and other Purdue executives discussed the possibility of persuading German officials to classify OxyContin as an uncontrolled drug, which would likely allow doctors to prescribe the drug more readily — for instance, without seeing a patient. Fewer rules were expected to translate into more sales, according to company documents disclosed at the deposition.

One Purdue official warned Sackler and others that it was a bad idea. Robert Kaiko, who developed OxyContin for Purdue, wrote to Sackler, “If OxyContin is uncontrolled in Germany, it is highly likely that it will eventually be abused there and then controlled.”

Nevertheless, Sackler asked a Purdue executive in Germany for projections of sales with and without controls. He also wondered whether, if one country in the European Union relaxed controls on the drug, others might do the same. When finally informed that German officials had decided the drug would be controlled like other narcotics, Sackler asked in an email if the company could appeal. Told that wasn’t possible, he wrote back to an executive in Germany, “When we are next together we should talk about how this idea was raised and why it failed to be realized. I thought that it was a good idea if it could be done.”

Asked at the deposition about that comment, Sackler responded, “That’s what I said, but I didn’t mean it. I just wanted to be encouraging.” He said he really “was not in favor of” loosening OxyContin regulation and was simply being “polite” and “solicitous” of his own employee.

Near the end of the deposition — after showing Sackler dozens of emails, memos and other records regarding the marketing of OxyContin — a lawyer for Kentucky posed a fundamental question.

“Sitting here today, after all you’ve come to learn as a witness, do you believe Purdue’s conduct in marketing and promoting OxyContin in Kentucky caused any of the prescription drug addiction problems now plaguing the Commonwealth?” he asked.

Sackler replied, “I don’t believe so.”

Filed under:

ProPublica is a Pulitzer Prize-winning investigative newsroom. Sign up for The Big Story newsletter to receive stories like this one in your inbox.


Federal Reserve Enforcement Action Against Banking Executives

Last month, the Federal Reserve Board (FRB) announced several notable enforcement actions. A February 5th press release discussed a:

"Consent Notice of Suspension and Prohibition against Fred Daibes, former Chairman of Mariner's Bancorp, Edgewater, New Jersey, for perpetuating a fraudulent loan scheme, according to a federal indictment."

The order against Daibes described the violations:

"... on October 30, 2018, a federal grand jury in the United States District Court for the District of New Jersey charged [Diabes] and an accomplice by indictment with one count conspiracy to misapply bank funds and to make false entries to deceive a financial institution and the FDIC, five counts of misapplying bank funds, six counts of making false entries to decide a financial institution and the FDIC, and one count of causing reliance on a false document to influence the FDIC... During the relevant time period, Mariner’s was subject to federal banking regulations that placed limits on the amount of money that the Bank could lend to a single borrower... the Indictment charges that in about January 2008 to December 2013, Daibes and others orchestrated a nominee loan scheme designed to circumvent the Lending Limits by ensuring that millions of dollars in loans made by the Bank (the “Nominee Loans”) flowed from the nominees to Daibes, while concealing Daibes’ beneficial interests in those loans from both the Bank and the FDIC. Daibes recruited nominees to make materially false and misleading statements and material omissions..."

The FRB and the U.S. Federal Deposit Insurance Corporation (FDIC) are two of several federal agencies which oversee and regulate the banking industry within the United States. The order bars Daibes from working within the banking industry.

Then, a February 7th FRB press release discussed a:

"Consent Prohibition against Alison Keefe, former employee of SunTrust Bank, Atlanta, Georgia, for violating bank overdraft policies for her own benefit."

The order against Keefe described the violations:

"... between September 2017 and May 2018, while employed as the manager of the Bank’s Hilltop Branch in Virginia Beach, Virginia, Keefe repeatedly overdrew her personal checking account at the Bank and instructed Bank staff, without authorization and contrary to Bank policies, to honor the overdrafts... Keefe’s misconduct described above constituted unsafe or unsound banking practices and demonstrated a reckless disregard for the safety and soundness of the Bank..."

Keefe was fired by the bank on July 12, 2018, and has repaid the bank. The order bars Keefe from working within the banking industry.

A February 21st press release discussed the agency's enforcement action against a former manager at J.P. Morgan Chase bank. The FRB:

"... permanently barred from the banking industry Timothy Fletcher, a former managing director at a non-bank subsidiary of J.P. Morgan Chase & Co. Fletcher consented to the prohibition, which includes allegations that he improperly administered a referral hiring program at the firm by offering internships and other employment opportunities to individuals referred by foreign officials, clients, and prospective clients in order to obtain improper business advantages for the firm. The FRB is also requiring Fletcher to cooperate in any pending or prospective enforcement action against other individuals who are or were affiliated with the firm. The firm was previously fined $61.9 million by the Board relating to this program. In addition, the Department of Justice and the Securities and Exchange Commission have also fined the firm."

The $61.9 million fine was levied against J.P. Morgan Chase in November, 2016. Back then, the FRB found that the bank:

"... did not have adequate enterprise-wide controls to ensure that referred candidates were appropriately vetted and hired in accordance with applicable anti-bribery laws and firm policies. The Federal Reserve's order requires J.P. Morgan Chase to enhance the effectiveness of senior management oversight and controls relating to the firm's referral hiring practices and anti-bribery policies. The Federal Reserve is also requiring the firm to cooperate in its investigation of the individuals..."

Last month's order against Fletcher described the violations:

"... from at least 2008 until 2013 [Fletcher] engaged in unsafe and unsound practices, breaches of fiduciary duty, and violations of law related to his involvement in the Firm’s referral hiring program for the Asia-Pacific region investment bank, whereby candidates who were referred, directly or indirectly, by foreign government officials and existing or prospective commercial clients were offered internships, training, and other employment opportunities in order to obtain improper business advantages for the Firm... the Firm’s internal policies prohibited Firm employees from giving anything of value, including the offer of internships or training, to certain individuals, including relatives of public officials and relatives and associates of non-government corporate representatives, in order to obtain improper business advantages for the Firm..."

Kudos to the FRB for its enforcement action. Executives must suffer direct consequences for wrongdoing. After reading this, one wonders why direct consequences are not applied against executives within the social media industry. The behaviors there do just as much damage; and cross borders, too. What are your opinions?


Brave Alerts FTC On Threats From Business Practices With Big Data

The U.S. Federal Trade Commission (FTC) held a "Privacy, Big Data, And Competition" hearing on November 6-8, 2018 as part of its "Competition And Consumer Protection in the 21st Century" series of discussions. During that session, the FTC asked for input on several topics:

  1. "What is “big data”? Is there an important technical or policy distinction to be drawn between data and big data?
  2. How have developments involving data – data resources, analytic tools, technology, and business models – changed the understanding and use of personal or commercial information or sensitive data?
  3. Does the importance of data – or large, complex data sets comprising personal or commercial information – in a firm’s ordinary course operations change how the FTC should analyze mergers or firm conduct? If so, how? Does data differ in importance from other assets in assessing firm or industry conduct?
  4. What structural, behavioral or conduct remedies should the FTC consider when remedying antitrust harm in a market or industry where data or personal or commercial information are a significant product or a key competitive input?
  5. Are there policy recommendations that would facilitate competition in markets involving data or personal or commercial information that the FTC should consider?
  6. Do the presence of personal information or privacy concerns inform or change competition analysis?
  7. How do state, federal, and international privacy laws and regulations, adopted to protect data and consumers, affect competition, innovation, and product offerings in the United States and abroad?"

Brave, the developer of a web browser, submitted comments to the FTC which highlighted two concerns:

"First, big tech companies “cross-use” user data from one part of their business to prop up others. This stifles competition, and hurts innovation and consumer choice. Brave suggests that FTC should investigate. Second, the GDPR is emerging as a de facto international standard. Whether this helps or harms United States firms will be determined by whether the United States enacts and actively enforces robust federal privacy laws."

A letter by Dr. Johnny Ryan, the Chief Policy & Industry Relations Officer at Brave, described in detail the company's concerns:

"The cross-use and offensive leveraging of personal information from one line of business to another is likely to have anti-competitive effects. Indeed anti-competitive practices may be inevitable when companies with Google’s degree of market dominance update their privacy policies to include the cross-use of personal information. The result is that a company can leverage all the personal information accumulated from its users in one line of business to dominate other lines of business too. Rather than competing on the merits, the company can enjoy the unfair advantage of massive network effects... The result is that nascent and potential competitors will be stifled, and consumer choice will be limited... The cross-use of data between different lines of business is analogous to the tying of two products. Indeed, tying and cross-use of data can occur at the same time, as Google Chrome’s latest “auto sign in to everything” controversy illustrates..."

Historically, Google let Chrome web browser users decide whether or not to sign in for cross-device usage. The Chrome 69 update forced auto sign-in, but a Chrome 70 update restored users' choice after numerous complaints and criticism.

Regarding topic #7 by the FTC, Brave's response said:

"A de facto international standard appears to be emerging, based on the European Union’s General Data Protection Regulation (GDPR)... the application of GDPR-like laws for commercial use of consumers’ personal data in the EU, Britain (post EU), Japan, India, Brazil, South Korea, Malaysia, Argentina, and China bring more than half of global GDP under a common standard. Whether this emerging standard helps or harms United States firms will be determined by whether the United States enacts and actively enforces robust federal privacy laws. Unless there is a federal GDPR-like law in the United States, there may be a degree of friction and the potential of isolation for United States companies... there is an opportunity in this trend. The United States can assume the global lead by adopting the emerging GDPR standard, and by investing in world-leading regulation that pursues test cases, and defines practical standards..."

Currently, companies collect, archive, share, and sell consumers' personal information at will -- often without notice nor consent. While all 50 states and territories have breach notification laws, most states have not upgraded their breach notification laws to include biometric and passport data. While the Health Insurance Portability and Accountability Act (HIPAA) is the federal law which governs healthcare data and related breaches, many consumers share health data with social media sites -- robbing themselves of HIPAA protections.

Moreover, it's an unregulated free-for-all of data collection, archiving, and sharing by telecommunications companies after the revoking in 2017 of broadband privacy protections for consumers in the USA. Plus, laws have historically focused upon "declared data" (e.g., the data users upload or submit into websites or apps) while ignoring "inferred data" -- which is arguably just as sensitive and revealing.

Regarding future federal privacy legislation, Brave added:

"... The GDPR is compatible with a United States view of consumer protection and privacy principles. Indeed, the FTC has proposed important privacy protections to legislators in 2009, and again in 2012 and 2014, which ended up being incorporated in the GDPR. The high-level principles of the GDPR are closely aligned, and often identical to, the United States’ privacy principles... The GDPR also incorporates principles endorsed by the U.S. in the 1980 OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data; and the principles endorsed by the United States this year, in Article 19.8 (3) of the new United States-Mexico-Canada Agreement."

"The GDPR differs from established United States privacy principles in its explicit reference to “proportionality” as a precondition of data use, and in its more robust approach to data minimization and to purpose specification. In our view, a federal law should incorporate these elements too. We also recommend that federal law should adopt the GDPR definitions of concepts such as “personal data”, “legal basis” including opt-in “consent”, “processing”, “special category personal data”, ”profiling”, “data controller”, “automated decision making”, “purpose limitation”, and so forth, and tools such as data protection impact assessments, breach notification, and records of processing activities."

"In keeping with the fair information practice principles (FIPPs) of the 1974 US Privacy Act, Brave recommends that a federal law should require that the collection of personal information is subject to purpose specification. This means that personal information shall only be collected for specific and explicit purposes. Personal information should not used beyond those purposes without consent, unless a further purpose is poses no risk of harm and is compatible with the initial purpose, in which case the data subject should have the opportunity to opt-out."

Submissions by Brave and others are available to the public at the FTC website in the "Public Comments" section.


Google To End Forced Arbitration For Employees

This news item caught my attention. Axios reported:

"Google will no longer require current and future employees to take disputes with the company to arbitration, it said on February 21st... After protests last year, the search giant ended mandatory arbitration for individual cases of sexual harassment or assault for employees. Employees have called for the practice to end in other cases of harassment and discrimination. Google appears to be meeting that demand for employees — but the change will not apply in the same blanket way to the many contractors, vendors and temporary employees it uses."

Reportedly, the change will take effect on March 21, 2019.


Study: Privacy Concerns Have Caused Consumers To Change How They Use The Internet

Facebook commissioned a study by the Economist Intelligence Unit (EIU) to understand "internet inclusion" globally, or how people use the Internet, the benefits received, and the obstacles experienced. The latest survey included 5,069 respondents from 100 countries in Asia-Pacific, the Americas, Europe, the Middle East, North Africa and Sub-Saharan Africa.

Overall findings in the report cited:

"... cause for both optimism and concern. We are seeing steady progress in the number and percentage of households connected to the Internet, narrowing the gender gap and improving accessibility for people with disabilities. The Internet also has become a crucial tool for employment and obtaining job-related skills. On the other hand, growth in Internet connections is slowing, especially among the lowest income countries, and efforts to close the digital divide are stalling..."

The EIU describes itself as, "the world leader in global business intelligence, to help companies, governments and banks understand changes in the world is changing, seize opportunities created by those changes, and manage associated risks. So, any provider of social media services globally would greatly value the EIU's services.

The chart below highlights some of the benefits mentioned by survey respondents:

Chart-internet-benefits-eiu-2019

Other benefits respondents said: almost three-quarters (74.4%) said the Internet is more effective than other methods for finding jobs; 70.5% said their job prospects have improved due to the Internet; and more. So, job seekers and employers both benefit.

Key findings regarding online privacy (emphasis added):

"... More than half (52.2%) of [survey] respondents say they are not confident about their online privacy, hardly changed from 51.5% in the 2018 survey... Most respondents are changing the way they use the Internet because they believe some information may not remain private. For example, 55.8% of respondents say they limit how much financial information they share online because of privacy concerns. This is relatively consistent across different age groups and household income levels... 42.6% say they limit how much personal health and medical information they share. Only 7.5% of respondents say privacy concerns have not changed the way they use the Internet."

So, the lack of online privacy affects how people use the internet -- for business and pleasure. The chart below highlights the types of online changes:

Chart-internet-usage-eiu-2019

Findings regarding privacy and online shopping:

"Despite lingering privacy concerns, people are increasingly shopping online. Whether this continues in the future may hinge on attitudes toward online safety and security... A majority of respondents say that making online purchases is safe and secure, but, at 58.8% it was slightly lower than the 62.1% recorded in the 2018 survey."

So, the percentage of respondents who said online purchases as safe and secure went in the wrong direction -- down. Not good. There were regional differences, too, about online privacy:

"In Europe, the share of respondents confident about their online privacy increased by 8 percentage points from the 2018 survey, probably because of the General Data Protection Regulation (GDPR), the EU’s comprehensive data privacy rules that came into force in May 2018. However, the Middle East and North Africa region saw a decline of 9 percentage points compared with the 2018 survey."

So, sensible legislation to protect consumers' online privacy can have positive impacts. There were other regional differences:

"Trust in online sources of information remained relatively stable, except in the West. Political turbulence in the US and UK may have played a role in causing the share of respondents in North America and Europe who say they trust information on government websites and apps to retreat by 10 percentage points and 6 percentage points, respectively, compared with the 2018 survey."

So, stability is important. The report's authors concluded:

"The survey also reflects anxiety about online privacy and a decline in trust in some sources of information. Indeed, trust in government information has fallen since last year in Europe and North America. The growth and importance of the digital economy will mean that alleviating these anxieties should be a priority of companies, governments, regulators and developers."

Addressing those anxieties is critical, if governments in the West are serious about facilitating business growth via consumer confidence and internet usage. Download the Inclusive Internet Index 2019 Executive Summary (Adobe PDF) report.


New Bill In California To Strengthen Its Consumer Privacy Law

Lawmakers in California have proposed legislation to strengthen the state's existing privacy law. California Attorney General Xavier Becerra and and Senator Hannah-Beth Jackson jointly announced Senate Bill 561, to improve the California Consumer Privacy Act (CCPA). According to the announcement:

"SB 561 helps improve the workability of the [CCPA] by clarifying the Attorney General’s advisory role in providing general guidance on the law, ensuring a level playing field for businesses that play by the rules, and giving consumers the ability to enforce their new rights under the CCPA in court... SB 561 removes requirements that the Office of the Attorney General provide, at taxpayers’ expense, businesses and private parties with individual legal counsel on CCPA compliance; removes language that allows companies a free pass to cure CCPA violations before enforcement can occur; and adds a private right of action, allowing consumers the opportunity to seek legal remedies for themselves under the act..."

Senator Jackson introduced the proposed legislation into the sate Senate. Enacted in 2018, the CCPA will go into effect on January 1, 2020. The law prohibits businesses from discriminating against consumers for exercising their rights under the CCPA. The law also includes several key requirements businesses must comply with:

  • "Businesses must disclose data collection and sharing practices to consumers;
  • Consumers have a right to request their data be deleted;
  • Consumers have a right to opt out of the sale or sharing of their personal information; and
  • Businesses are prohibited from selling personal information of consumers under the age of 16 without explicit consent."

State Senator Jackson said in a statement:

"Our constitutional right to privacy continues to face unprecedented assault. Our locations, relationships, and interests are being tracked without our knowledge, bought and sold by corporate interests for their own economic gain and conducted in order to manipulate us... With the passage of the California Consumer Privacy Act last year, California took an important first step in protecting our fundamental right to privacy. SB 561 will ensure that the most significant privacy protections in the nation are effectively and robustly enforced."

Predictably, the pro-business lobby opposes the legislation. The Sacramento Bee reported:

"Punishment may be an incentive to increase compliance, but — especially where a law is new and vague — eliminating a right to cure does not promote compliance," the California Chamber of Commerce released in a statement on February 25. "SB 561 will not only hurt and possibly bankrupt small businesses in the state, it will kill jobs and innovation."

Sounds to me like fearmongering by the Chamber. Senator Jackson has it right. From the same Sacramento Bee article:

"If you don’t violate the law, you won’t get sued... To have very little recourse when these violations occur means that these large companies can continue with their inappropriate, improper behavior without any kind of recourse and sanction. In order to make sure they comply with the law, we need to make sure that people are able to exercise their rights."

Precisely. Two concepts seem to apply:

  • If you can't protect it, don't collect it (e.g.,  consumers' personal information), and
  • If the data collected is so value, compensate consumers for it

Regarding the second item, the National Law Review reported:

"Much has been made of California Governor Gavin Newsom’s recent endorsement of “data dividends”: payments to consumers for the use of their personal data. Common Sense Media, which helped pass the CCPA last year, plans to propose legislation in California to create such a dividend. The proposal has already proven popular with the public..."

Laws like the CCPA seem to be the way forward. Kudos to California for moving to better protect consumers. This proposed update puts teeth into existing law. Hopefully, other states will follow soon.


Facebook Admits More Teens Used Spyware App Than Previously Disclosed

Facebook logo Facebook has changed its story about how many teenagers used its Research app. When news first broke, Facebook said that less than 5 percent of the mobile app users were teenagers. On Thursday, TechCrunch reported that it:

"... has obtained Facebook’s unpublished February 21st response to questions about the Research program in a letter from Senator Mark Warner, who wrote to CEO Mark Zuckerberg that “Facebook’s apparent lack of full transparency with users – particularly in the context of ‘research’ efforts – has been a source of frustration for me.”

In the response from Facebook’s VP of US public policy Kevin Martin, the company admits that (emphasis ours) “At the time we ended the Facebook Research App on Apple’s iOS platform, less than 5 percent of the people sharing data with us through this program were teens. Analysis shows that number is about 18 percent when you look at the complete lifetime of the program, and also add people who had become inactive and uninstalled the app.”

Three U.S. Senators sent a letter to Facebook on February 7th demanding answers. The TechCrunch article outlined other items in Facebook's changing story: i) it originally claimed its Research App didn't violate Apple's policies and we later learned it did; and ii) it claimed to have removed the app, but Apple later forced that removal.

What to make of Facebook's changing story? Again from TechCrunch:

"The contradictions between Facebook’s initial response to reporters and what it told Warner, who has the power to pursue regulation of the the tech giant, shows Facebook willingness to move fast and play loose with the truth... Facebook’s attempt to minimize the issue in the wake of backlash exemplifies the trend of of the social network’s “reactionary” PR strategy that employees described to BuzzFeed’s Ryan Mac. The company often views its scandals as communications errors rather than actual product screwups or as signals of deep-seeded problems with Facebook’s respect for privacy..."

Kudos to TechCrunch on more excellent reporting. And, there's more regarding children. Fortune reported:

"A coalition of 17 privacy and children’s organizations has asked the Federal Trade Commission to investigate Facebook for allowing children to make unauthorized in-app purchases... The coalition filed a complaint with the FTC on Feb. 21 over Facebook doing little to stop children from buying virtual items through games on its service without parental permission and, in some cases, without realizing those items cost money... Internal memos show that between 2010 and 2014, Facebook encouraged children, some as young as five-years old, to make purchases using their parents’ credit card information, the complaint said. The company then refused to refund parents..."

Not good. Facebook's changing story makes it difficult, or impossible, to trust anything its executives say. Perhaps, the entertainer Lady Gaga said it best:

"Social media is the toilet of the internet."

Facebook's data breaches, constant apologizing, and shifting stories seem to confirm that. Now, it is time for government regulators to act -- and not with wimpy fines.