We know who you are and what you are made of: the illusion of Internet anonymity and its impact on protection from genetic discrimination.

• Author: Davik, Christine Suzanne

ABSTRACT

Recent advances in technology allow the online activities of Internet users to be monitored, gathered, and recorded without their knowledge. New electronic tools can compile extensive data on exactly what an individual is doing on the Web. This information can then be almost simultaneously cross-referenced with additional data to create detailed dossiers, including the user's age, zip code, gender, and even health-related issues. While there is a vast amount of consumer information that can easily be accessed, at present there are very few restrictions on how the data amassed can be used. As a result, when consumers go online to search for medical knowledge or to find needed support, they risk providing marketers, data brokers, and, consequently, even employers with a host of sensitive information. Such a possibility is more than theoretical because comprehensive background screening reports currently exist that profile one's social media activities or participation in purportedly anonymous Internet discussion groups. Furthermore, even when Internet users take steps to conceal their online activities, job applicants are increasingly required to provide log-in information.

Apprehension over the potential for misuse of personal health information and genetic data by employers is not entirely new. In 2008, Congress enacted the Genetic Information Nondiscrimination Act (GINA), a law designed to provide protection from not only the utilization of genetic data and family health history in connection with employment-related decisions but also the initial acquisition of such data. However, when the Act and its regulations are examined closely in light of advancements in the manner in which data is now gathered and the increasing ease with which seemingly anonymized data can be linked to a particular individual, only then do serious deficiencies become apparent. These defects must be corrected to alleviate patients' fears over obtaining genetic testing today due to their concerns regarding the use of their genetic information tomorrow.

CONTENTS

INTRODUCTION I. MONITORING TECHNOLOGY A. Electronic Building Blocks of Online Monitoring 1. "Ordinary" Cookies 2. "Special" Cookies 3. Beacons B. Regulation of Tracking Activities 1. Lawsuits 2. Congressional Measures 3. Administrative Action 4. Industry Response II. TRACKING, MEDICAL-RELATED INFORMATION, AND LACK OF ANONYMITY A. A OL Search Inquiries B. Professor Sweeney Study C. The "Fiction" of Non-personally Identifiable Information III. THE PROVISIONS OF GINA AND CURRENT REGULATIONS A. The "Publicly Available Information" Exception B. The "Electronic Water Cooler" Exception C. The "Aggregated Data from Voluntary Wellness Programs" Exception CONCLUSION INTRODUCTION

Recently, there has been an astonishing increase in not only the pervasiveness but also the invasiveness of new computer technology that can monitor and chronicle InterAct users' online activities without their knowledge. (1) These electronic tools can provide instantaneous information on exactly what an individual is doing on the Web by surreptitiously recording extensive information regarding the computer user's keystrokes and mouse movements on a particular site. This information can then be almost simultaneously cross-referenced to provide additional data often including the user's age, zip code, gender, income, and even health-related issues--to create detailed dossiers on individual computer users. (2) This is accomplished through computer software (3) that gathers the small bits of data individuals leave in a wide variety of places throughout cyberspace and then employs sophisticated algorithms that allow for this information to be linked to a particular person.

Information-gathering companies commonly argue that their actions are not an invasion of privacy because the individual pieces of data frequently obtained are not in and of themselves personally identifying. (4) However, this line of reasoning is increasingly less persuasive due, in significant part, to recent technological advances. For example, just a few years ago, a group of researchers from the University of Minnesota published a study describing how easy it has become for data-mining companies to create exceptionally detailed profiles of Internet users, even when they post information anonymously or pseudonymously. (5) Additionally, these scholars found that by using only three pieces of data Internet users commonly divulge when registering at a website (one's zip code, birth date, and gender), most Americans can be identified by name and address. (6)

Such data gathering has become big business and is only expected to continue growing. Spending on information from online sources is predicted to more than double from $410 million in 2009 to $840 million in 2012. (7) While there is now a vast amount of consumer data that can easily be purchased, at present there are very few restrictions on the use of such scraping and tracking devices to collect the information or, of arguably greater concern, how the amassed data can be utilized. (8) This is true even when it includes sensitive categories of information such as health-related data. Instead, information-gathering companies are left to develop their own seemingly incongruous policies. An example is Healthline Networks, Inc., one of the healthcare industry's leading providers of advertising services. Healthline does not track users viewing "sensitive topics" relating to eating disorders and impotence but admits to gathering data when individuals instead look up information on bipolar disorder, anxiety, and overactive bladders. (9)

Apprehension over the potential for misuse of personal medical information and genetic data is not, however, entirely new. By the time the international Human Genome Project had officially begun in 1990, with the stated goal of fully identifying the genes and determining the sequence of human DNA, (10) substantial concerns had already emerged about how such data might be utilized. This was particularly true in the context of employment and insurance-related decisions. Consequently, in the mid-1990s several bills were introduced in Congress in an attempt to alleviate the public's growing worries. (11) Research studies (12) showed that patients were increasingly avoiding genetic testing and participating in related clinical trials due to fears of how test results aright be used against themselves or family members. (13) This was problematic from a public health standpoint on numerous accounts. First, the information from such tests is often exceptionally helpful in taking preventive measures to minimize the likelihood of the occurrence of the disease in the first place. Additionally, at the onset of a disease, such data may be essential to making fully informed treatment decisions and provide for the possibility of lessening the severity of the now present condition. Moreover, without patients willing to enroll in research studies, future medical advancements could be considerably impeded.

Almost two decades after the first attempt to pass genetic nondiscrimination legislation, the Genetic Information Nondiscrimination Act (GINA) was signed into law in May 2008, although it did not become fully effective until May 2010. (14) GINA prohibits not only the utilization of genetic information in connection with employment-related decisions but also the initial acquisition of such data. (15) The original statute had numerous, serious deficiencies due in part to a combination of factors, including GINA's interplay with preexisting laws and the inclusion of several broadly worded exceptions in the statute itself. Further complicating matters was the complete absence of some definitions altogether or the lack of clear and meaningful definitions, which was surprisingly the case with the term "genetic information."

Partially in an attempt to alleviate some of the inadequacies of the Act, the Equal Employment Opportunity Commission (EEOC) proposed and then implemented regulations in 2012. (16) At first glance, the regulations' various additions, clarifications, and modifications appear to improve many of the statute's prior shortcomings. But when examined closely in light of technological advancements in how data is now gathered, stored, and used--as well as the increasing ease with which seemingly anonymized data can be linked to a particular individual--serious deficiencies once again become apparent. These defects threaten the overall goal of GINA and must be corrected to ensure that patients are not deterred from obtaining pertinent healthcare information out of fear regarding how such data might be later utilized.

This Article begins in Part I by discussing in more detail the various technologies that have made it possible to collect, categorize, and retain large quantities of data, as well as the various proposals to regulate such activities. Next, Part II examines whether the concept of non-personally identifiable data truly exists, ultimately concluding that the ability to remain anonymous on the Internet has become, for all intents and purposes, impossible. Part III reviews the provisions of GINA in its current form and the recent regulations promulgated by the EEOC. Part III also provides a comprehensive analysis of the considerable weaknesses of the Act which are exposed when evaluated in light of the recent technological advancements in data gathering--and proposes model language to eliminate the current gaps in protection. Such changes are imperative to alleviate patients' fears over obtaining genetic testing today due to their concerns regarding the use of their genetic information tomorrow.

1. MONITORING TECHNOLOGY

   The Interact has had a dramatic impact on the daily life of most individuals. It has changed the way we interact with one another, conduct business transactions, and access various forms of entertainment. It has also revolutionized...