Contextual integrity of loyalty programs, compromised? Interrogating consumer health data practices and networked actors in the U.S. retail sector

This study explores privacy issues complicated by the commodification of consumer health data in the United States by looking into loyalty programs (LPs). Three LPs – those of Nike, Walgreens, and DICK’S Sporting Goods – are examined because their incorporation of health technology represents retail data practices unregulated by the U.S. Health Information Portability and Accountability Act (HIPAA). Applying the framework of contextual integrity (Nissenbaum, 2004, 2009), the research conducted discourse analysis on corporate communications to identify whether and how privacy conflicts arise in a data economy composed of multiple business entities that use LP member data. The major contributions of this study are a clarification of shortfalls in multi-organizational governance of health-related consumer data outside the HIPAA regulation in the United States, and a recognition that businesses may optimize this data without adequately informing consumers about the risks and providing meaningful redress mechanisms. The paper concludes by urging policy-makers to target networked business relationships and externalities that result from collective behavior of firms trading in consumer health data.