DrewFeb 13, 2023
Drew Harwell

New: Data brokers are selling extremely sensitive info on Americans' mental health. One company advertised the names and home addresses of people with depression, anxiety, post-traumatic stress or bipolar disorder

https://www.washingtonpost.com/technology/2023/02/13/mental-health-data-brokers/

Now for sale: Data on your mental health

For years, data brokers have collected and resold Americans’ personal information. But the pandemic-fueled rise telehealth and therapy apps has spurred an even more contentious product line: Americans’ mental health data.

The Washington Post
Feb 13, 2023 at 1:52pmWeb
Show threadDrew HarwellFeb 13, 2023

Ten years ago, Congress was told of a data broker selling a list of "rape sufferers." No laws have reformed the practice since - and, in some ways, the health-data trade has gotten worse.

"They’re building inferences and scores and categorizations from patterns in your life, your actions, where you go, what you eat — and what are we supposed to do, not live?"

https://www.washingtonpost.com/technology/2023/02/13/mental-health-data-brokers/

Now for sale: Data on your mental health

For years, data brokers have collected and resold Americans’ personal information. But the pandemic-fueled rise telehealth and therapy apps has spurred an even more contentious product line: Americans’ mental health data.

The Washington Post
Show threadDrew HarwellFeb 13, 2023

The great @alng has more on the new mental-health data-broker research here:

https://subscriber.politicopro.com/article/00000186-3d43-d45e-a18e-fd63faa40001

POLITICO Pro

Show threadDrew HarwellFeb 13, 2023

Here's the full research:

https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-americans-mental-health-data/

Data Brokers and the Sale of Americans’ Mental Health Data - Tech Policy @ Sanford

Data Brokers and the Sale of Americans’ Mental Health Data The Exchange of Our Most Sensitive Data and What It Means for Personal Privacy  By: Joanne Kim   Overview: This...

Tech Policy @ Sanford
Show threadChristopher NoyesFeb 18, 2023
@drewharwell very troubling
Show threadChristopher NoyesFeb 18, 2023
@drewharwell @alng very icky
Show threadhanahelenaFeb 13, 2023
@drewharwell what??? Never heard of this.
Show threadsandywb14Feb 13, 2023
@drewharwell 😡
Show threadWilf K 🇬🇧 🇨🇦Feb 13, 2023
@drewharwell That should constitute a grave breach of medical confidentiality, and should also be considered a criminal act.
Show threadSinner BOFHFeb 13, 2023
@drewharwell that should be a breach of HIPAA law
Show threadairportlineFeb 13, 2023
@drewharwell I hate it here
Show threadKateFeb 13, 2023

@drewharwell Is it new? Or is it just a new article?

I really wish we would take consent to the next level. GDPR is a good start. It would be even better if my preferences could be set from within my browser rather than each and every website I click on. Surely it can't be that hard?

Show threadLisPiFeb 13, 2023

@funficient @drewharwell The technical part isn't the problem. It's trivial.

The #DoNotTrack header has existed for a long time, but it's completely ignored & actually used as another point of data for tracking by malicious actors.

The problem is meaningful legal enforcement of non-consent to tracking.

Show threadKateFeb 16, 2023
@lispi314 @drewharwell Yes. It would be great if it was possible to have some kind of consequence.
Show threadBill SeitzFeb 13, 2023
@drewharwell thank god for SSL-everywhere
Show threadLisPiFeb 13, 2023
@billseitz @drewharwell That doesn't help when the endpoint you're browsing is malicious or includes trackers from malicious parties (isn't this just the same?).
Show threadEstelle4565Feb 13, 2023

@lispi314
@billseitz @drewharwell
I am not entirely sure that this fixes this last part but there are a few tools that block trackers.

UBlock Origin
Privacy Badger
Ghostery
Privacy Possum

All are available in Firefox which has itself heightened privacy protections which can be activated in Settings -> Privacy.
Going for the Custom option and activating everything is the optimal option.

Show threadLisPiFeb 13, 2023

@Estelle4565 @billseitz @drewharwell Those can help depending on how they're including the tracking and specifics of implementation.

But in general, the 100% certainty way is to interact with neither malicious parties nor those that support them.

Show threadEstelle4565Feb 13, 2023

@lispi314
@billseitz @drewharwell
Of course. I was talking about the present and with what tools already exist.

Other than forcing a change in the laws, I do not see how not interacting with bad actors is even possible in the US at the moment.

You need a GDPR of your own. And ours needs some serious improvements like some very enhanced penalties and better implementation.

Show threadBill SeitzFeb 13, 2023
@lispi314 @drewharwell yes, my snarky point is that the SSL bandwagon may have been solving the wrong problem, at the cost of stack complexity.
Show threadLisPiFeb 13, 2023

@billseitz @drewharwell I disagree, drive-by interactions on public wifi were an increasingly significant problem at the time (and would still be here & in any other country where datacaps are a thing), and ISPs haven't gotten any more trustworthy in the decades since.

Particularly with governments adding mandatory retention requirements.

Both are problems that needed addressing. Only one has been more or less addressed.

Show threadBill SeitzFeb 13, 2023
@drewharwell "**There are six worst offenders.** Apps with the very worst privacy and security are Better Help, Youper, Woebot, Better Stop Suicide, Pray.com, and Talkspace. Their flaws entail incredibly vague and messy privacy policies (Better Help, Better Stop Suicide); sharing personal information with third parties (Youper, Pray.com, Woebot); and even collecting chat transcripts (Talkspace)." https://foundation.mozilla.org/en/blog/top-mental-health-and-prayer-apps-fail-spectacularly-at-privacy-security/
Top Mental Health & Prayer Apps Fail at Privacy, Security

Despite dealing with issues like depression, suicide, domestic violence, and PTSD, these apps share data freely and raise many security concerns

Mozilla Foundation
Show threadSlayerranger/CrackamphetamineFeb 13, 2023
@drewharwell God, fucking hate this country. Doxxes their own citizens for a profit. In other parts of the world, they have data protection laws
Show threadOpioid Policy InstituteFeb 13, 2023
@drewharwell
this is a massive issue especially when applied to stigmatized conditions like addiction
better regs, more enforcement is urgent
Show threadLonewolfFeb 13, 2023
@drewharwell John Oliver collected data from targeted ads in Washington
He should really release that Info
I wanna know who clicked on Ted Cruz erotic fan fiction
Show threadChris MerleFeb 13, 2023
@drewharwell @dangillmor of course they are.
Show threadDarwin WoodkaFeb 13, 2023
@drewharwell I mean it's pretty much everybody anyway tho
Show threadFUNKbrsFeb 13, 2023
@drewharwell I got hit badly by this one. Clicked attending on an event where someone killed themselves, I've been getting hounded by mental health ads for the past 6 years.
Show threadJenXFeb 13, 2023
@drewharwell This is so highly disturbing.
Show threadSavageVagabondFeb 13, 2023

@drewharwell So, I read the article and then found the reference study:
https://techpolicy.sanford.duke.edu/wp-content/uploads/sites/4/2023/02/Kim-2023-Data-Brokers-and-the-Sale-of-Americans-Mental-Health-Data.pdf

I understand the legal issues that may have arisen if Duke had published names instead of "Data Broker X," but I wish Kim had published names. Oh well, guess I'll contact my telehealth provider.

Show threadGil Friend, sustainability OGFeb 13, 2023
@drewharwell
Probably wouldn't be legal in Europe…
Show threadHistory on the FoxFeb 13, 2023
@drewharwell I take it that, somehow, there's a loophole in HiPAA that allows this to happen?
Show threadCaffe NekoFeb 13, 2023
@drewharwell "Several senators, including Elizabeth Warren (D-Mass.), Ron Wyden (D-Ore.) and Bernie Sanders (I-Vt.), backed a bill that would strengthen state and federal authority against health data misuse and restrict how much reproductive-health data tech firms can collect and share."
Show threadOceanicEternityFeb 13, 2023
@drewharwell this is... Beyond abhorrent.
Show threadThe Old Reading RoomFeb 13, 2023

@drewharwell

Thank god for the European Union and the General Data Protection Regulations

#privacy #dignity #HumanRights

Show threadSane ThinkerFeb 13, 2023
@drewharwell Our lives are open books now for exploitation. We aren't people, just potential units of profit.
Show threadニルス・スキニールFeb 13, 2023
@drewharwell Anyone who thinks private corpserations are any better than than government entities has never worked for either
Show threadsolientFeb 14, 2023
@drewharwell oof. That's gonna keep even more people from seeking treatment. :T
Show threadSterlingFeb 14, 2023
@drewharwell
Sad. Just what we need: a reason for people not to seek help.
People will always rise to your worst fear and profit off of any human suffering.
Show threadnotbencarterFeb 14, 2023

@drewharwell This seems to be getting pretty close to the tort of Invasion of Privacy.

I’d be interested to know if there are any cases attacking data brokers and the sale of sensitive health information.