Written Evidence from Privacy International [WRH0035]

Privacy International (“PI”) is a London-based non-profit, non-governmental organisation that works internationally to protect people’s privacy, dignity, and freedoms.[1] Through our work we aim to build a world where technology will empower and enable us, not exploit our data for profit and control. PI works globally with partners to challenge overreaching state and corporate surveillance so that people everywhere can have greater security and freedom through greater personal privacy.

We welcome the Women and Equalities Committee’s call for evidence on women’s reproductive health. PI’s submission to this inquiry is to highlight concerns about the management of women’s reproductive healthcare through digital health initiatives. These initiatives can be privacy-invasive and result in highly sensitive personal information being shared in unexpected and potentially dangerous ways.[2]

Introduction

Digital health initiatives (for example apps and other online tools) have been rapidly expanding[3] and the NHS is taking steps towards digitalising its services.[4] Developments in digital healthcare can contribute towards the realisation of the right to health through increased access to information and accessibility. This is certainly the case for reproductive healthcare: period-tracking apps can provide users with insights into their menstrual cycle, be used as a contraceptive tool, or assist with fertility tracking. They can empower women and help overcome stigma and taboo.

However, they also raise serious concerns regarding privacy, security and data protection, as well as wider issues relating to dignity, non-discrimination, and equality.[5] In particular, PI is concerned that:

• Private companies and app developers are not upholding privacy requirements by sharing users’ sensitive health data, whether knowingly or unknowingly, with advertisers, data brokers and other third parties.[6]
• Too often, there is an absence of human rights and privacy considerations in the design and implementation of digital health technologies.[7]
• Data acquired for one purpose is used for another (‘function creep’). The risk of function creep (and data breaches) increases when the use of digital tools within healthcare becomes compulsory.[8]
• The provision of online information about healthcare, in particular reproductive healthcare, has become a battle ground for targeted advertising and misinformation. Data-mining information relevant to pregnancy is an invasion of the right to privacy of women and girls and can be a powerful disincentive to seeking healthcare services.[9]

Period-tracking apps

PI has investigated various menstruation apps across the world to document how they function and operate, including what data is generated, collected and processed through their use.[10] Our research reveals the extensive nature of the data collection and data-sharing practices of some of these companies and their direct impact on users’ privacy.

Our research in 2020 into five popular period-tracking apps uncovered that they were obtaining intimate health related-data, often beyond the purpose of the functioning of the app. Many of them were then sharing data with third-party entities including Facebook, online advertisers and data brokers.[11] Yet, this sharing of data was not disclosed in any of the apps’ privacy policies. This can result in extremely sensitive data being used to profile and exploit users’ data for profit, usually without their knowledge.

Companies developing period-tracking apps claim to offer free (i.e., unpaid for), transparent and efficient means for users to manage their reproductive health. However, there can be hidden costs to these free services: in some instances, companies make their profit by collecting, sharing and/or selling users’ personal data to third companies for advertising purposes. This data can include menstrual information, trends in the purchase of pregnancy tests and fertility-tracking. This collection of data and sharing it with profit-seeking parties is intrusive and has the potential to be done without consent.[12]

The market for data is driven by financial incentives. For example, expecting parents are consumers who are likely to change their purchasing habits, therefore their data is particularly valuable to advertisers. In the UK, Bounty were fined £400,000 by the Information Commissioner’s Office (ICO) for illegally sharing the personal information of mothers and babies as part of its services as a “data broker”.[13] Between 1 June 2017 and 30 April 2018, Bounty collected personal data from a variety of channels both online and offline through its website, mobile app, claim cards and directly from new mothers at hospital bedsides. The ICO’s decision named only the four largest recipients of the data collected and shared by Bounty, but there were 37 in total. One of these companies was Sky, to which Bounty provided over 30 million records.[14]

Access to reproductive health information

Having access to accurate and reliable information is essential to women’s reproductive health and increasingly people are seeking this information online. However, some actors wish to restrict access to reproductive healthcare rather than provide impartial information. For example, those in opposition to abortion have been known to exploit data to use targeted advertising to curtail, restrict or delay women seeking accurate reproductive health information.[15]

Our research with our network of global partners has identified the use of targeted advertising to provide scientifically inaccurate health information as a tactic deployed by those opposing access to reproductive services.[16] By way of example, ads about “abortion pill reversal” have continued to make the rounds on social media platforms since we first spotted them in 2020.[17]

Shortcomings of the Women’s Health Strategy for England

The Women's Health Strategy for England envisages and supports growth in this sector. [18] Among its 10 year ambitions are:

• “Greater use of digital health technologies to empower women – such as period tracking or menopause apps” and;
• “Closer working and collaboration between [sic] with the digital health technology sector – especially FemTech – to deliver collaborative innovation within the NHS in areas such as menstrual problems, access to contraception, fertility and pregnancy complications, to plug evidence gaps, and reach a wider audience, particularly women in inclusion health groups”.[19]

However, the Strategy fails to properly engage with the important concerns that FemTech can raise for people’s privacy and data protection. Improving rights-based health outcomes is dependent on the development of healthcare that respects confidentiality and privacy. Data relating to women’s reproductive and menstrual health is sensitive health data that requires additional protections.

Public-private partnerships must be designed with safeguards to ensure that women’s sensitive health data will be protected and not used for profit by private companies.[20] Companies must review their business models and rethink the design of their products to protect their users from targeting, profiling, and undue harm.

The UN Special Rapporteur (UNSR) on the right to health, in her recent thematic report on digital innovation, technologies and the right to health, has recalled these concerns[21], and further articulated them in relations to the right to sexual and reproductive health.[22] In this report, while recognising the tremendous opportunities that come with digital innovation and technology, she highlights the accompanying risks and need for strengthened governance to ensure that States, the private sector and other third parties respect, protect and fulfil their duties regarding the right of everyone to the highest attainable standard of physical and mental health. She recommends that impact assessments must be embedded as well as reviews of designs, development, and implementation of digital technologies and that the entire technology, innovation and data pipeline must be participatory and ensure the meaningful engagement of stakeholders.

Conclusion

Technology and digital tools have the potential to provide information and offer women and girls a way of making informed decisions about their sexual and reproductive health. However, the proliferation of digital technologies within women’s reproductive healthcare must not exacerbate nor create new threats to individuals’ privacy. We encourage the Committee to consider the expanding use of FemTech and the consequences it may have on women’s privacy, in particular for those in vulnerable situations.

September 2023