Eli Lilly Fined for Accidental Disclosure of Personal Information

Eli Lilly has reached a settlement with a number of states in the U.S. including New York in connection with its accidental disclosure of personal information of subscribers to an e-mail reminder service for the drug Prozac. On one occasion, the company sent an e-mail reminder using the "To:" button to address the e-mail as opposed to the blind copying feature. The settlement agreement requires Eli Lilly to strengthen its internal standards relating to privacy protection, training, and monitoring. Eli Lilly will also institute automated checks for any of its software that accesses consumer information databases. The company will also undergo annual, independent compliance reviews over the next five years and report the findings of those reviews to the states. This is in addition to a payment of $160,000 to the states involved. Eli Lilly was previously the subject of an administration proceeding brought by the U.S. Federal Trade Commission for the same disclosure. In that proceeding, Eli Lilly agreed to "establish and maintain an information security program for the protection of personally identifiable information". Eli Lilly. For a copy of the press release by New York Attorney General in the proceedings by the states, visit: http://www.oag.state.ny.us/press/2002/jul/jul25c_02.html To view a copy of the settlement agreement/order in the federal proceedings, visit: http://www.ftc.gov/os/2002/01/lillyagree.pdf