Tech & Science Women in private Facebook group for cancer gene carriers found marketers could get their names

08:08  13 july  2018
08:08  13 july  2018 Source:   cnbc.com

Women in private Facebook group for cancer gene carriers found marketers could get their names

  Women in private Facebook group for cancer gene carriers found marketers could get their names The leader of a private Facebook group for women with the BRCA gene became alarmed after discovering a Chrome plug-in for marketers that let them discover group members' names and other info.Facebook's decision came after members of a private group for women with a gene mutation associated with a higher risk breast cancer complained, concerned that their names might be exposed and open them to discrimination from insurers or other privacy violations. A spokesperson for Facebook said shutting down the ability to view members of closed groups was a recent decision based on "several factors," but was not related to this group's outreach.

  Women in private Facebook group for cancer gene carriers found marketers could get their names © Provided by CNBC Facebook recently closed a privacy loophole that allowed third parties to discover the names of people in private, "closed" Facebook groups. A Chrome extension that was made specifically for marketers to harvest this information en masse was also shut down prior to Facebook's move, after the social media network issued a cease-and-desist letter to the application's makers earlier this year, according to a spokesperson.

Facebook's decision came after members of a private group for women with a gene mutation associated with a higher risk breast cancer complained, concerned that their names might be exposed and open them to discrimination from insurers or other privacy violations. A spokesperson for Facebook said shutting down the ability to view members of closed groups was a recent decision based on "several factors," but was not related to this group's outreach.

J&J to pay $4.7bn in talc cancer case

  J&J to pay $4.7bn in talc cancer case It is the largest payout so far over allegations that the firm's talc-based products cause cancer.A jury in the US state of Missouri initially awarded $550m in compensation and added $4.1bn in punitive damages.

The privacy issue comes at a time when Facebook is trying to re-position itself as a gathering place for friends, family and those with common problems and interests, in an effort to shake off negative connections to malicious online trolls, political rancor and alleged widespread violations of privacy. Facebook has also prioritized “groups” as a business strategy, with Mark Zuckerberg telling CNN last year: “If what you’re trying to do is run a group that has thousands of people, you need tools to help manage that.”

The company is also dealing with fierce regulatory scrutiny, particularly in the European Union, where new General Data Protection Regulation has expanded the definition of "personal data" far beyond social security numbers, to include the kind of data, like locations, names and genetic markers, that had been available publicly on members of Facebook's closed groups.

Health shock for Australia's famous 'mega-mum'

  Health shock for Australia's famous 'mega-mum' Ray and Jeni Bonell are one of Australia's biggest families and when they've welcomed a new addition our cameras have been there to celebrate.   But A Current Affair can exclusively reveal they've faced their biggest challenge yet after a shock cancer diagnosis for the much-loved mother of 16.  Ray and Jeni have always been happy to share their news with us all, they just never expected it to be bad news. © Provided by Nine Digital Pty Ltd Ray and Jeni Bonell have one of Australia's biggest families - but recently had a health scare.

A women’s health group that wanted privacy

Andrea Downing helps moderate a members-only group for women that have a gene mutation associated with a higher-risk breast cancer, called BRCA (sometimes pronounced "brick-a"). The group is kept closed, and the women who are members of it often don't want their identities known. The group did not use Facebook's most restrictive privacy setting, "secret," because that would have made it invisible to people searching the site.

Downing said women who join the BRCA Sisterhood Facebook group are often dealing with private issues that make them feel vulnerable, and social media had offered an inviting way to share their stories intimately with other women experiencing the same concerns. Privacy has always been top-of-mind for the Sisterhood community and other groups and others that cater toward BRCA-positive women, she said, because members post pictures of surgical procedures and share private stories of their experiences managing the health matter.

J&J Hit With $4.7 Billion Jury Verdict in Baby Powder Suit

  J&J Hit With $4.7 Billion Jury Verdict in Baby Powder Suit A jury in St. Louis found that Johnson & Johnson should pay $4.69 billion in damages to 22 women and their families who blamed ovarian-cancer cases on asbestos in the company’s baby powder.The jury awarded $550 million and later added $4.14 billion in punitive damages against the company for allegedly failing to warn that its talcum powder raised the risk of ovarian cancer.

Downing grew concerned about the privacy of group members when she discovered an extension for the Chrome web browser called Grouply.io, which she saw could allow her to easily download names, employers, locations, email addresses and other personal details of all 9,000 people who had signed up for the group. She contacted a security researcher she knew who specialized in health care data, Fred Trotter, to see if her concerns were warranted.

Doctors trying to solve family's stunning medical mystery

  Doctors trying to solve family's stunning medical mystery Two California siblings, four and six years old, are battling the same kind of brain tumorAround Memorial Day, six-year-old Kalea Avery started experiencing severe headaches and vomiting. After repeated trips to the emergency room, an MRI revealed a tumor.

Trotter discovered that "closed" Facebook groups had a privacy loophole that would make it possible for third parties to discover the names of people in them, and that the Grouply.io application was made specifically for marketers to harvest this information en masse. Requests for comment submitted to a forwarding email for the Grouply.io application, which is no longer available, were not answered.

Trotter further discovered he could glean these details manually, without use of the browser extension. On May 29, he submitted a report on the problem to Facebook. A Facebook spokesperson said the social media network had previously made member lists for closed groups "viewable," but the ability to download the full list at once was not a feature on the platform.

On June 20, Trotter and the BRCA members received a response from Facebook, which included an acknowledgement that member lists for these closed groups were available publicly. According to the Facebook response provided by Trotter, a company representative said: "Our Groups team has been exploring potential changes related to group membership and privacy controls for groups, with the goal of understanding whether providing different options can better align the controls with the expectations of group administrators and members. That work is ongoing and may lead to changes that address some of your concerns going forward."

Michael Bublé has emotional first concert back since son's cancer diagnosis

  Michael Bublé has emotional first concert back since son's cancer diagnosis Michael Bublé has emotional first concert back since son's cancer diagnosisThe "Feeling Good" crooner shined before the audience with a comeback performance at Barclaycard presents British Summer Time in Hyde Park, just two years after his son Noah, 4, was diagnosed with liver cancer.

A Facebook spokesperson confirmed the interaction and said the company continues to emphasize its commitment to the groups concept in allowing individuals to share sensitive experiences.

Members of the BRCA group replied to Facebook that they were dissatisfied with the response on June 26. By June 29, the ability to harvest details in this way was shut down on Facebook, according to Trotter and Downing.

Social networking site not covered by HIPAA

During his research, Trotter found that he could use Grouply.io or a manual process to download the personal details of members of other closed Facebook groups – including other sensitive circles, such as those meant for people recovering from drug addiction, men living with HIV or individuals identifying as gay in countries where same-sex partnerships are criminalized. That functionality has since been disabled.

CNBC contacted three other security professionals who verified that the ability to download member information from "closed" groups was once enabled, but now appeared to be unavailable.

Data such as this is often used in a variety of ways for marketing goods and services, especially by companies looking to reach an audience of self-selected individuals who may be candidates for specific health treatment. Consumers might not realize that sharing information in a "confidential" context on a social network is not the same as sharing it in a medical context, one expert said.

“A genetic test result like BRCA is protected by HIPAA [the Health Insurance Portability and Accountability Act] and it can’t be shared with marketers, if it is in a medical record. But a social networking site is not covered by HIPAA,” said Deven McGraw, chief regulatory officer for Ciitizen, a health information sharing application. Ms. McGraw, who previously served as deputy director of health information privacy for the U.S. Department of Health and Human Services, said many people mistakenly believe their health information is regulated in the United States regardless of where that information is held.

Facebook may be facing challenges beyond the regulation of health care data, she said. The issue of whether users of a “closed” group had a reasonable expectation of privacy will be one that may catch the attention of EU regulators under GDPR, or even the U.S. Federal Trade Commission, which investigates deceptive practices related to privacy, she said.

Canadian family's bitter divide over massive lottery win .
Barbara Reddick claims she put her nephew's name on the ticket simply "for good luck".A Canadian family is in a bitter divide over a massive C$1.22 million (NZ$1.36 million) lottery win.

—   Share news in the SOC. Networks

Topical videos:

This is interesting!