Contextual integrity of loyalty programs, compromised? Interrogating consumer health data practices and networked actors in the U.S. retail sector.

This study explores privacy issues complicated by the commodification of consumer health data in the United States by looking into loyalty programs (LPs). Three LPs – those of Nike, Walgreens, and DICK'S Sporting Goods – are examined because their incorporation of health technology represents retail data practices unregulated by the U.S. Health Information Portability and Accountability Act (HIPAA). Applying the framework of contextual integrity (Nissenbaum, 2004, 2009), the research conducted discourse analysis on corporate communications to identify whether and how privacy conflicts arise in a data economy composed of multiple business entities that use LP member data. The major contributions of this study are a clarification of shortfalls in multi-organizational governance of health-related consumer data outside the HIPAA regulation in the United States, and a recognition that businesses may optimize this data without adequately informing consumers about the risks and providing meaningful redress mechanisms. The paper concludes by urging policy-makers to target networked business relationships and externalities that result from collective behavior of firms trading in consumer health data. • Consumer loyalty programs expand beyond one brand and one consumer in the digital age. • Loyalty programs are increasingly entangled with health technologies like wearables. • Discourse analysis shows how loyalty programs naturalize more parties to member data. • Brands unevenly communicate consumer benefits and privacy risks of loyalty programs. • Loyalty programs point to need for system-level policy approaches to data governance. [ABSTRACT FROM AUTHOR]