Millions of women in childbearing years are using digital payments as their default method of payment. What will their financial app providers and credit card issuers do when they are asked for their transaction data by prosecutors during an investigation into abortion?
It’s a hypothetical question that’s almost certainly an inevitable one in the wake of the overturning of Roe v. Wade last week. Criminal investigators will soon be looking for evidence to prosecute those who have violated the law, now that abortion is illegal in many states.
Although medical records are the most reliable evidence of a crime, officials who cannot obtain them may seek other evidence. The payment trail is likely a top priority.
This seems to be a relatively new territory for banks and other payments companies that are on the receiving end criminal inquiries. Card issuers have become accustomed to requests for user information in terrorism, money laundering and illegal-trafficking investigation. None of these have caused the political, legal, and emotional backlash that abortion investigations are likely.
The Fourth Amendment gives individuals protections from government intrusion. Legal experts stated that these protections become less effective if people share information with a third party. That means that law enforcement officials can typically ask financial institutions for customer data via a simple subpoena.
Even sensitive information about medical or health can be made public. The Health Insurance Portability and Accountability Act, known as HIPAA — which governs the privacy of a patient’s health records — permits medical and billing records to be released in response to a warrant or subpoena.
“There is a very broad exception to the HIPAA protections for law enforcement,” said Marcy Wilder, a partner and co-head of the global privacy and cybersecurity practice at Hogan Lovells, a law firm. Ms. Wilder said that law enforcement officials cannot have access to information that is too broad or irrelevant to the request. “That is why it matters how companies and health plans are interpreting this.”
Most card networks and issuers like Mastercard and Visa don’t have an itemized list of all the items people pay when they order prescription drugs online or when they buy services from health care providers. Evidence of patronage by, for example, a pharmacy that only sells abortion pills could be used to identify someone.
At the same time, according to lawyers and privacy experts, if an investigator has collected other data on a person’s travels, then a charge at, for example, an out-of-state Planned Parenthood for an amount that’s much higher than a standard checkup would be useful evidence, depending on the laws in play and how they evolve in the coming months. Same applies to a patient who is in an illegal state for abortion pills and seeks them out via tele-health with an outside doctor.
Some financial institutions are ready to resist requests for this data.
Amalgamated Bank is based in New York.
“Amalgamated Bank will carefully scrutinize any subpoenas for information related to the prosecution of women for exercising their right to choose and object to the fullest extent possible,” the bank said in a statement. It will notify customers about the subpoenas unless investigators are able to force the bank to not disclose its existence.
Law enforcement officers could also subpoena companies that issue debit cards with flexible spending account dollars loaded. Many employers offer these health care spending accounts.
HealthEquity is a prominent administrator of these accounts and said it was hesitant to give up transaction information. The company “does not comply with requests for medical expense data — including from law enforcement and other governmental entities — unless we are specifically compelled by law to do so,” Jon Kessler, its chief executive, said in an email. “We seek to apply the narrowest possible interpretation of what is required and would vigorously oppose any request to broadly search member data.”
The New York Times contacted roughly two dozen large financial firms — including several that have announced plans to reimburse employees for abortion-related expenses — to ask how they would approach data privacy around abortion.
American Express, Citigroup and Coinbase, Frost Banks, JPMorgan Chase, Mastercards, 1199 SEIU Federal Credit Unions, Visa, USAA declined to comment
“I’m not able to speculate about the situations you describe,” said Bill Day, a spokesman for Frost, which is based in San Antonio and is among the 50 biggest banking companies in the United States. “They’re all hypothetical at this point.”
USAA also declined information about how or whether it is instructing bank employees on how to handle conversations customers. It is based Texas, where a new Texas law allows residents to file lawsuits against anyone who facilitates an abortion.
“With the ruling only coming down late last week, it’s premature to understand the full impact at the state level,” Brad Russell, a USAA spokesman, said via email. “However, USAA will always comply with all applicable laws.”
American Airlines Credit Union and Bank of America, Capital One. Discover, Goldman Sachs. Prosperity Bank USA, Navy Federal Credit Union. US Bank, University of Wisconsin Credit Union. Wells Fargo. Western Union.
American Express, Bank of America Goldman Sachs JPMorgan, JPMorgan, Wells Fargo and Bank of America have all announced plans to reimburse employees for expenses when they travel abroad for abortions. None have yet commented on how they would handle a subpoena asking for transaction records from employees who might be eligible for employer reimbursement.
The fact that so many financial services companies are silent isn’t surprising. Like nearly everyone else, they’re scrambling to navigate a landscape that has changed entirely. The American Bankers Association declined to comment.
There are also digital payment services that cross the line between finance and technology: Apple Pay, PayPal and its Venmo offering; Square and its Cash app.
None of the companies replied to at least two messages requesting comment.
Alejandra Caraballo, a clinical instructor at Harvard Law School’s Cyberlaw Clinic, read these companies’ user agreements with her students for a recent course. “We came to the realization that essentially all of them are bad,” she said. “They’ve all said they will comply with the legal process and will turn over documents either through warrants or a subpoena.”
Tech companies have more experience with deliberating over whether to stand up to subpoenas for users’ private data. By comparison, financial services companies generally haven’t faced that much complexity, because new forms of payment don’t come along nearly as frequently as new forms of communication, many of which introduce novel legal questions and the possibility of outrage from consumers and others.
Privacy activists and abortion rights advocates are gearing up for the fight.
“I think everyone, including these companies, is trying to figure out what, if anything, can be done,” said Dana Sussman, acting executive director at the National Advocates for Pregnant Women. “One thing we are hoping to do is apply public pressure to fight these subpoenas. If they do, it will make it a lot harder for these prosecutors, who have limited resources and a lot of work to do in their communities with other issues.”
Amie Stepanovich, vice president of U.S. policy at the Future of Privacy Forum, a nonprofit focused on data privacy and protection, said warrants and subpoenas can be accompanied by gag orders, which can prevent companies from even alerting their customers that they’re being investigated.
“They can choose to battle the use of gag orders in court,” she said. “Sometimes they win, sometimes they don’t.”
In other instances, prosecutors may not say exactly what they’re investigating when they ask for transaction records. In that case, it’s up to the financial institution to request more information or try to figure it out on its own.
Paying for abortion services with cash is one possible way to avoid detection, even if it isn’t possible for people ordering pills online. Many abortion funds will pay for financial assistance for people who are in need.
Cash and electronic transfers of cash are not foolproof.
“Even if you are paying with cash, the amount of residual information that can be used to reveal health status and pregnancy status is fairly significant,” said Ms. Stepanovich, referring to potential bread crumbs such as the use of a retailer’s loyalty program or location tracking on a mobile phone when making a cash purchase.
Sometimes, users may accidentally give up sensitive information by using apps that track and share financial activity.
“The purchase of a pregnancy test on an app where financial history is public is probably the biggest red flag,” Ms. Stepanovich said.
Others suggested the possibility of prepaid cards with fixed amounts like those that can be purchased from a drugstore rack. They also said that cryptocurrency leaves enough trail that anonymity can be difficult to achieve.
Experts all stressed the uncertainty. There is a strong feeling that corporations will be as prominent as judges.
“Now, these payment companies are going to be front and center in the fight,” Ms. Caraballo said.
Source: NY Times
