Selling of information on physicians' prescribing patterns

PIPEDA Case Summary #2001-14

[Sections 2 and 3]

Two Complaints

In two separate complaints an individual and a physician complained that the Canadian arm of a U.S.-based international marketing firm was improperly disclosing personal information by gathering and selling data on physicians' prescribing patterns without their consent.

Summary of Investigation

The marketing firm in question gathers, from pharmacies and other Canadian sources, information related to medical prescriptions. The accumulated information includes names, identification numbers, telephone numbers, and prescribing details of physicians. This information is transferred to the firm's processing centre in the U.S., where the firm produces customized information products. These products typically identify physicians in a given territory and rank them, either individually or in groups, by monthly prescribing activity for various types or classes of drugs. The information products are then transferred to the firm's Montreal operation, where they are disclosed to clients for a fee. Pharmaceutical sales representatives from several Canadian provinces regularly buy these products.

Commissioner's Findings

Issued September 21, 2001

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act applies to any information disclosed outside a province for consideration. Since the information at issue was regularly transmitted across borders, the Commissioner determined that it was information disclosed outside a province for consideration and therefore that he was required to receive and investigate the complaint.

Application: Section 2 of the Act defines personal information as "information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization." Section 3 of the Act sets out the Act's purpose in terms of balancing the individual's right of privacy with the need of organizations to collect, use, or disclose personal information for purposes that a reasonable person would consider appropriate.

The primary consideration for the Commissioner was whether the information at issue was personal information within the meaning, scope, and purpose of the Act. In making this determination, the Commissioner took the view that the meaning of "personal information", though broad, is not so broad as to encompass all information associated with an individual. An individual prescription, though potentially revealing about a patient, is not in any meaningful sense about the prescribing physician as an individual. Rather, it is about the professional process that led to its issuance and should be regarded as a work product-that is, the tangible result of the physician's work activity.

The Commissioner determined that interpreting "personal information" so broadly as to include prescriptions or prescribing patterns would not fulfil the purpose set out in section 3 of the Act (see above). Specifically, it would not be reasonable to extend the definition to prescriptions, lest it be extended also to other work products such as legal opinions or documents written in the course of employment. Nor would it be reasonable to extend the definition to prescribing patterns, lest it be extended also to patterns discoverable among other types of work products and thus preclude many kinds of legitimate commercial consumer reporting.

In sum, the Commissioner found that prescription information, whether in the form of an individual prescription or in the form of patterns discerned from many prescriptions, is not personal information about a physician.

The Commissioner concluded therefore that the complaints were not well-founded.

Further Considerations

Because of widespread public interest in the case, the Commissioner published his letter of findings on October 2, 2001.