Eli Lilly has reached a settlement with a number of states in the U.S. including New York in connection with its accidental disclosure of personal information of subscribers to an e-mail reminder service for the drug Prozac. On one occasion, the company sent an e-mail reminder using the "To:" button to address the e-mail as opposed to the blind copying feature. The settlement agreement requires Eli Lilly to strengthen its internal standards relating to privacy protection, training, and monitoring. Eli Lilly will also institute automated checks for any of its software that accesses consumer information databases. The company will also undergo annual, independent compliance reviews over the next five years and report the findings of those reviews to the states. This is in addition to a payment of $160,000 to the states involved. Eli Lilly was previously the subject of an administration proceeding brought by the U.S. Federal Trade Commission for the same disclosure. In that proceeding, Eli Lilly agreed to "establish and maintain an information security program for the protection of personally identifiable information". Eli Lilly. For a copy of the press release by New York Attorney General in the proceedings by the states, visit: http://www.oag.state.ny.us/press/2002/jul/jul25c_02.html To view a copy of the settlement agreement/order in the federal proceedings, visit: http://www.ftc.gov/os/2002/01/lillyagree.pdf


02 08 01

Disclaimer: This Newsletter is intended to provide readers with general information on legal developments in the areas of e-commerce, information technology and intellectual property. It is not intended to be a complete statement of the law, nor is it intended to provide legal advice. No person should act or rely upon the information contained in this newsletter without seeking legal advice.

E-TIPS is a registered trade-mark of Deeth Williams Wall LLP.