States Settle With Lilly on E-mail
Originally published by The Associated Press, July 25, 2002
BOSTON — Eight states, including Massachusetts, will divide $160,000 in a settlement with Eli Lilly and Co. over allegations the drug maker unintentionally released the e-mail addresses of more than 600 people taking Prozac.
Indianapolis-based Lilly settled a suit over the matter with the Federal Trade Commission in January, promising better safeguards. It was the first time the FTC had prosecuted an unintentional violation of a Web site's privacy policies.
On Thursday, Massachusetts Attorney General Thomas Reilly said the company would pay $160,000 to Massachusetts and seven other states: California, Connecticut, Idaho, Iowa, New York, New Jersey and Vermont.
The people taking Prozac had signed up at a Lilly Web site for an automated e-mail reminding them to take their dose of the company's anti-depressant. In June 2001, an e-mail announcing the end of the service included the e-mail addresses of all 669 subscribers.
The agreement did not specify how the money would be divided. Sarah Nathan, a spokeswoman for Reilly, said those whose e-mail addresses were released would not get restitution because the states do not know their names and don't want them brought to light again.
"As we have said from the onset, Lilly sincerely regrets that one of our employees made a mistake, which resulted in the disclosure of individual e-mail addresses to all subscribers of our Medi-Messenger service," Lilly said in a statement. "As a result, we promptly put into place additional measures to prevent it from ever happening again."
Those measures include appointing a director of global privacy, periodic reporting to the FTC, and new security measures that "place personal information from our customers in an environment as secure as Lilly's trade secrets."
