Also $1.5 million, in relative terms, seems pretty small. So again, data violations just seem to be the cost of doing business.
In one situation you have a company sharing data with other companies and the laws around that form of data sharing.
In the other situation you have what companies can own or buy in terms of other companies.
The situations are very different.
On one hand you have the FTC fining a company for violations of data sharing, which I am assuming of the one of the concerns is patient privacy. Which to me, seems like a net good thing. Again I would prefer it to be more, but better then not doing nothing at all I suppose.
On the other hand, you have one giant company with access to mounds of consumer data purchasing even more sensitive healthcare data without even a blink of the eye.
Why was this not challenged? Why fine one company? I might be overthinking it but it seems like a misalignment of priorities. The point of the FTC is to protect consumers, shouldn't both have been investigated? I guess that was the point I was trying to make. Idk, I feel like I'm just rambling at this point.
Edit: so I looked it up
https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-give...
“As required by law, Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer,” an Amazon spokesperson said in an email. “Should the deal close, One Medical customers’ HIPAA Protected Health Information will be handled separately from all other Amazon businesses, as required by law.”
Basically, like I thought, they can’t commingle or share data between the two companies. But if something being clearly illegal isn’t enough to convince people (or even the journalist), then that’s a different much bigger issue.
Also this:
https://www.investopedia.com/terms/s/subsidiary.asp
A subsidiary is an independent company that is more than 50% owned by another firm—called the parent company or holding company. Subsidiaries are separate and distinct legal entities from their parent companies.
> https://www.cnbc.com/2022/07/23/amazon-one-medical-deal-give...
> > “As required by law, Amazon will never share One Medical customers’ personal health information outside of One Medical for advertising or marketing purposes of other Amazon products and services without clear permission from the customer,” an Amazon spokesperson said in an email. “Should the deal close, One Medical customers’ HIPAA Protected Health Information will be handled separately from all other Amazon businesses, as required by law.”
> Basically, like I thought, they can’t commingle or share data between the two companies.
Unfortunately, that's not at all what it says. Amazon has included so many qualifiers that they are disclaiming only a very specific subset of data transfer.
I invite you to read it again, word by word and clause by clause.
Lots of loopholes in there. But even if there weren't, doesn't it feel dangerous to take Amazon at their word with this?
The FTC doesn't operate based on sentiment. Even if the people who work on this have the same feelings they need to operate within laws.
and companies have never reneged immediately after promising not to do bad things.
https://www.cnbc.com/2023/01/25/the-live-nation-and-ticketma...
https://www.nytimes.com/2022/11/18/technology/live-nation-ti...
There’s a similar problem for any private companies that have outstanding debt or payment obligations. If they default or go bankrupt, then the courts will force them to sell user data to help generate the missing cash. This will override any user agreements, since the creditors are generally first in line when a company goes under.
The only difference between One Medical and GoodRX here is that One Medical only sold account data to one advertising firm (that I know of).
Nothing odd about retailers acquiring other retailers.