ACLU Urges Government to Impose Fines for Eli Lilly Prozac Privacy Breach

FOR IMMEDIATE RELEASE

NEW YORK–In written comments submitted today to the Federal Trade Commission, the American Civil Liberties Union urged the agency to impose a fine on drug giant Eli Lilly and require that the company pay damages to the nearly 700 Prozac users whose identities were disclosed by Lilly without their prior consent or knowledge.

“By leveling a fine and ordering damages to be paid to the victims of Eli Lilly’s serious privacy breach, the trade commission would be sending a message to online medical providers that there is a price to pay for being careless with highly sensitive information,” said Ann Beeson, an ACLU staff attorney and co-signer of the ACLU’s comments to the agency.

The ACLU had brought the privacy breach to the attention of the Federal Trade Commission in July 2001, when it learned from a patient that Lilly had sent out an e-mail containing the Internet addresses of all 669 patients who had signed up for “Medi-Messenger,” a service that reminds customers to take their anti-depressant medication. The FTC then launched an investigation, resulting in a settlement last month.

The settlement requires the Indianapolis-based company to create better safeguards for sensitive information. The security program must be reviewed every year and the company will be fined for any more violations.

Those future privacy compliance records should be made available to the public in order to prevent additional privacy violations, the ACLU said today in its letter.

“Based on the FTC’s investigation, Lilly’s past failure to be open and forthcoming with the way it handled sensitive data made it more difficult to prevent incidents such as the one that formed the basis for our complaint,” the ACLU letter said. “Claims of company confidentiality should not be used as an excuse to avoid such inquiries.”

The ACLU has asked to receive copies of all documents submitted by Lilly in connection with the final order of settlement. While urging that the information be made public “to the greatest extent possible,” the ACLU noted that the privacy of Lilly’s individual customers should be maintained.