Unveiling actors in the network of patients’ data disclosure

4As she tracks the companies that are tracking her personal data, Ebeling takes us from hospitals and medical centers, where data are recorded, to trade shows and conferences attended by data brokerage professionals. The reader gradually discovers a complex ecosystem of private businesses and public institutions (including the US government) all turned into data brokers. These heterogeneous actors more or less consciously collect, trade, analyze and re-package publicly available information, such as birth records, as well as non-public information, such as credit card records and health data. They then sell them to a wide variety of clients, from university institutes looking for data for research purposes, to maternity-focused magazines developing targeted advertising campaigns.

5Ebeling examines the conditions that make it possible to transfer personal data ownership to the data brokers and describes the legal and administrative infrastructure in which “innovation equals ownership” (p. 44). According to the US law, ownership is granted to those that innovate on the data – that is, who modify the data. Patient data are first “de-identified” (p. 44), and therefore made “clean” (p. 15). Second, these datasets are innovated upon through analytical operations, for both research and marketing purposes. Thus, innovators gain ownership of the data on which they can build new revenue streams, even if their core business does not consist in data aggregation or sales. Through this process, personal data are transformed into immaterial commodities through various algorithmically based innovations across databases.

6This infrastructure is built on specific legislation, such as the HIPAA – Health Insurance Portability and Accountability Act – and subsequent laws, which regulate the definitions of terms like “privacy”, “consent”, “trust” and “security”. These regulations “create a regulatory information system that can securely disclose patients’ data for the necessary functioning of healthcare provision and medical capitalism” (p. 72). The federal government implemented a “nation-wide electronic health infrastructure to enable the unhindered flow of medical records” (p. 78). However, as medical records digitalized, companies sold web-based software to medical institutions, in exchange for the ownership and exploitation of the data.

7Ebeling argues that these regulations secure data brokerage companies to such a point that some were able to refuse to cooperate when subpoenaed in 2012 by a US Senate Committee investigating the data broker industry. Three of these companies invoked the secret of trade to protect their algorithms. Indeed, data brokers maintain their power in the way they “build their data assets” and “claim ownership over our data” (p. 44). If these regulations apply to patients and to organizations directly involved in the production of medical personal data, they do not apply to third-party entities such as credit card companies. Consequently, data brokers can “easily receive, disclose, buy, and sell protected health data” (pp. 78-79) and by doing so become the owners of patients’ data.

Patients and health professionals unknowingly recruited as data producers

8The actors of what Ebeling calls the “network of disclosure” (p. 82) recruit allies with no apparent connection with business activities involving personal data. Health professionals themselves actively take part in feeding this network. The author shows these practices are in contradiction with the ethics of their profession. For most of those interviewed by Ebeling, patients' privacy means HIPAA. However, through the bureaucratic practices of the institutions for which they work (e.g. hospitals or clinics) or the scripts of the software programs they use, they unknowingly disseminate patients’ data: “[d]espite their lack of knowledge of their practices’ privacy policies, most [of them] expressed deep concern about protecting their patient’s privacy” (p. 82). However, once the data are online, privacy is no longer the priority. The legislation aims to facilitate the circulation of the data, not guarantee privacy. Therefore, while health professionals are required to maintain privacy – risking huge fines or even jail if they breach patients’ confidentially, data brokers benefit from a network fed by health institutions administratively and financially incentivized to share personal healthcare data.

9These tensions in healthcare practice echo patients’ paradoxical position, conscious of “being tracked, watched, recorded, and gathered, especially digitally [not only online, but offline as well]” (pp. 50-51) and desiring privacy. According to the author, private information collection may not be an issue as long as people have control over the disclosure context. Building on an extensive literature review, Ebeling shows that since 1973, privacy has been apprehended through two mechanisms: consent and anonymization. Both are severely criticized throughout the book. First, grounding her analysis on Nissenbaum (2011, pp. 35-36), the author argues the notion of consent is “deeply flawed and increasingly meaningless” as “most of our daily lives are enacted online” (p. 57). Second, the notion of anonymization appears as a de jure legal rule, but contrasts not only with the de facto hauntings she personally experiences, but also with the re-identification techniques developed by data brokers (e.g. triangulation).

10Ebeling argues that patients are “required to acknowledge that the practice’s privacy regulations were presented to them, but they are not consenting to anything that the practice might do with their private data” (p. 62). She illustrates this argument with one of her own experience as a patient facing Notice of Privacy Practices written in an “obfuscating language” (p. 69) that she was required to sign to benefit from healthcare services. In other words, Ebeling shows that “by agreeing to receive medical support through the clinic, [people are] also ceding control over any data that is produced out of that relationship to the clinic” (p. 70). Even if regulations and consent forms theoretically give patients some rights, Ebeling shows data collection cannot be avoided without giving up on healthcare.

A headless conspiracy lying in biocommodity activation

11Ebeling concludes that her “marketing baby” is the result of the “activation” of biocommodities built upon her personal data. Drawing on Rajan (2006), Ebeling argues that biocommodities markets are based on a new form of commoditizing bodies: biovalue (p. 96). Such value is produced by the confluence of both biomediecine and capitalism. It results in a new industry of data extraction and production prospering of the free biolabor provided by unwitting patients. Once de-identified and analyzed, the patients’ data indeed become a “data commodity, a biocommodity, a data thing activated by lively capital” (p. 120). The author argues that “in the process of rematerialization, [that data commodities] can cause real, material harm” (p. 122). Through a process of “interpellation”, the “thing” hails the patient directly (p. 123). In other words, once “activated”, the data becomes a thing, in the case of Ebeling, her “marketing baby”.

12The story may stop here: another example of capitalism’s progress into a new area of our lives, the creation of a new market and the exploration of the technical and legal infrastructure that enables it. However, as in all good romans noirs, things are less simple and Manichaean. Most of the “insiders” of this conspiracy (p. 145) met by Ebeling were shocked to learn that one could be haunted by data revenants as a kind of collateral damage of personal data collection. The violence wrought by “dumb” data was, according to them, “not supposed to happen” (p. 145).

13In Ebeling’s own words: “The story of [her] marketing baby became a story about a machine-controlled network of data and disclosure where the human agents who are tasked with its stewardship don’t understand all of the ways that data is coming together and being used. They know how it is supposed to work, yet not how it really does work” (p. 145). This leads the author to conclude that “big data becomes a black box that ensnares all of us—database marketers and consumers alike—into a “whirring assemblage” of algorithms, data, and marketing. Big data is a black box for the insiders that construct the box as much as it is for the subjects of the black box.” (p. 146).