by A Canadian class-action lawsuit accusing a popular fertility tracking app of sending users’ intimate health information – including details about their periods, sex lives and pregnancies – to companies has been allowed to proceed. such as Facebook without their knowledge.
The claim, upheld in BC Supreme Court on Thursday, said Flo Health collected their highly sensitive personal information, promised to keep that information private and then knowingly shared the data with third parties.
“There has been a significant exposure of Canadian women’s private information, and we are excited to move forward with the case to the next stage,” said Richard Parsons, co-counsel on the case.
The ruling is a critical step forward for the case. It will test Canada’s outdated privacy laws at a time when millions of people regularly spill their personal information on their phones. If the claim is successful, more than a million people who used Flo in Canada over a three-year period will be eligible to claim damages.
None of the lawsuit claims have been proven in court. In a statement to CBC News on Friday, Flo said it did not sell “user information or shared user information to third parties for advertising purposes.”
“Flo will vigorously defend against the allegations detailed in the case.”
The main plaintiff used an app while trying to get pregnant
Flo is an app that tracks users’ fertility and periods. Users submit personal information about their height, weight, sex life and reproductive cycles – including details of their periods, vaginal discharge, pregnancies, miscarriages, births and postpartum symptoms.
Jamie Kah Cate Lam, the lead plaintiff in the class action, said she used the Flo app for 18 months while she and her husband were trying to conceive. The RC woman provided the app with information about the different stages of her menstrual cycle and how often she and her husband had intercourse, according to an affidavit.
After conceiving her son in 2017, Lam continued to use the app in pregnancy mode. Her son was born in April 2018, after which she deleted the app.
SEE | Lawyer warns app data could be used to prosecute US women for having illegal abortions:
In 2019, The Wall Street Journal published an article saying that Flo had unknowingly given users’ sensitive personal information to Facebook and other companies. Tests commissioned by the newspaper showed that Flo told Facebook when an app user was on her period or trying to get pregnant.
Lam declined an interview request. In her affidavit, she said she was “surprised to learn that Flo Health disclosed my personal information to Facebook and others, despite my clear understanding when I downloaded the Flo App that my information would be kept private”.
The US Federal Trade Commission (FTC) launched an investigation after the Journal story, and alleged that the company broke its promise to keep user data private by sharing it.
As part of a settlement with the US agency in 2021, Flo was required to obtain users’ consent before sharing their health information. The company did not admit guilt in the settlement, and said it does not share data without people’s permission.
“Flo has never shared users’ names, addresses or birthdays with anyone. We do not, and will not, currently share any information about our users’ health with any company without their permission,” a the company said in its statement at the time.
He said he settled with the FTC “to avoid the time and expense of litigation.”
In dismissing the Canadian class action on Thursday, BC Supreme Court Justice Lauren Blake said the class would include all Canadian residents, excluding those in Quebec, who used the Flo app between June 1, 2016 and February 23, 2019. .
“The proposed class has over one million Canadian users of the app. I am satisfied that … a class action proceeding will still have significant advantages in judicial economy and efficiency,” Blake wrote.
Certification of a class action does not mean the allegations have been proven, but lawyers indicated that a group that could benefit from the case is going before a judge.
At the heart of the issue is an analytics tool that Facebook and Google both offer app developers software development kits, or SDKs. Developers use SDKs to better understand user behavior or collect data they can use to grow their user base.
In exchange, apps share user data with Facebook or Google so the tech giants can then personalize ads and other content — a mutually beneficial arrangement, in which a person’s personal information becomes a commodity, Parsons said.
“They’re bartering, and what they’re bartering with is user data.”
LISTEN | A tech expert explains how to protect your data:
In general, Parsons said, any information shared with an app using an SDK may also be shared with the company that owns the SDK — so personal user data shared with Flo could also be shared with Facebook, because it was Flo using the Facebook SDK .
Parsons said the problem was that Flo wasn’t happy with its users about how far their information could be shared.
“If an app developer wants to use the SDKs of these data collection agent companies, their privacy policy needs to clearly tell users that the data will be going to these third parties,” he said.
