Patient sues Novartis, claiming data-tracking privacy breach
A cancer patient in the US has filed a class action lawsuit against Novartis in the US, claiming that the company shared her private health information with third-party companies, including Google and ContentSquare.
The patient – identified only as P.M. and from Vermont – received treatment with Novartis breast cancer therapy Kisqali and visited the product website to find out about the drug and apply for a savings card.
The complaint alleges that the website transmitted her sensitive information to unauthorised third parties, using tracking pixels and other tools, without her consent. As a result, she started receiving targeted online advertisements for products and services related to her medical condition.
It claims that Novartis "is a company that chose to prioritise their marketing efforts and profits over their patients' privacy by installing the tracking tools on their websites," subjecting P.M. to invasion of medical privacy and emotional distress.
The lawsuit is the latest in a series in the US and elsewhere accusing corporations of illegally sharing website user data without consent, with many focusing on the use of tracking pixels from Google and Facebook parent Meta.
Last month, New York-based health system Northwell settled a class action lawsuit claiming it unlawfully shared private data harvested from its FollowMyHealth patient portal or appointment booking service for an undisclosed amount.
On the other hand, last year, a California federal court ruled that data collected by pixel trackers and other technologies did not constitute a breach of protected health information (PHI) if the data simply reflected a user's visits to public webpages. That case was brought by plaintiff Amy Wright against Truecare, a nonprofit community health centre.
Novartis is thought to be the most prominent big pharma group to be targeted by this form of litigation, and the lawsuit will be watched with interest, given that these tracking tools appear to be widely used on pharma products and corporate websites.
The complaint also alludes to the presence of trackers on several other Novartis product websites, such as immunology biologic Cosentyx (secukinumab), heart failure therapy Entresto (sacubitril/valsartan), cholesterol-lowering therapy Leqvio (inclisiran), and prostate cancer radiotherapy Pluvicto (lutetium (177Lu) vipivotide tetraxetan).
It claims the trackers violate privacy clauses in the US Health Insurance Portability and Accountability Act (HIPAA) and Electronic Communications Privacy Act (ECPA), constitute a breach of confidence, fiduciary duty, and contract, and amount to negligence and unjust enrichment.
The plaintiff is seeking an injunction on the use of these trackers, damages, and fees.
