Eli Lilly and Company

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF ELI LILLY and COMPANY CONSENT ORDER, ETC., IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket C-4047; File No. 0123214 Complaint, May 8, 2002--Decision, May 8, 2002 This consent order addresses representations made by Respondent Eli Lilly and Company – a pharmaceutical company that manufactures, markets, and sells drugs such as the anti-depressant medication Prozac, and operates the Prozac.com W eb site – through Lilly’s privacy policies, and during the sign-up process for Medi-Messenger, a service that enabled its subscribers to receive individualized email reminders from Lilly concerning their Prozac medication or other matters. The order, among other things, prohibits the respondent from misrepresenting the extent to which it maintains and protects the privacy or confidentiality of any personally identifiable information collected from or about consumers. The order also requires the respondent to implement a fourstage information security program designed to establish and maintain reasonable and appropriate administrative, technical, and physical safeguards to protect consumers’ personal information against any reasonably anticipated threats or hazards to its security, confidentiality, or integrity, and to protect such information against unauthorized access, use, or disclosure. Participants For the Commission: Mamie Kresses, Dean C. Forbes, Heather Hippsley, Mary K. Engle, Louis Silversin, and Gerard R. Butters.

For the Respondent: Karen Silverman and J. Thomas Rosch, Latham & Watkins, and Rebecca O. Kendall and Stanley W. Crosley, Eli Lilly.

COMPLAINT The Federal Trade Commission, having reason to believe that Eli Lilly and Company, a corporation (“respondent”) has violated the provisions of the Federal Trade Commission Act, and it VOLUME 133 Complaint appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent Eli Lilly and Company is an Indiana corporation with its principal office or place of business at Lilly Corporate Center, Indianapolis, Indiana 46285. Respondent, a pharmaceutical company, has advertised and promoted its antidepressant medication, Prozac, through the company’s Web sites www.prozac.com and www.lilly.com.

2. The acts and practices of respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the Federal Trade Commission Act. 3. Respondent promotes its Prozac.com Web site as “Your Guide to Evaluating and Recovering from Depression.” From March 15, 2000 until June 22, 2001, respondent advertised, promoted, and marketed via www.Prozac.com and www.Lilly.com an email reminder service known as “Medi-messenger.” Consumers who utilized the Medi-messenger service could design and receive personal email reminder messages from respondent concerning their medication or other matters. Once a visitor registered for Medi-messenger, the reminder messages were automatically emailed from Prozac.com to the subscriber at the email address s/he provided, and according to the schedule established by the subscriber.

4. Subscribers to the Medi-messenger service registered by providing an email address, a password, the text of the reminder message they wanted to receive, and the schedule for sending the reminder messages. (Complaint Exhibit A, pp.1-4). After providing information to register for Medi-messenger, the subscriber was invited to view the Prozac.com “Privacy Statement” via a hyperlink, which was positioned just above the “Submit” and “Reset” buttons. (Complaint Exhibit A, p.4) 5. Respondent has disseminated or has caused to be disseminated privacy policies on Prozac.com and Lilly.com, including but not VOLUME 133 Complaint necessarily limited to the attached Exhibits B and C. These privacy policies contain the following statements regarding the privacy and confidentiality of personal information collected through respondent’s Web sites:

A. “Your Privacy This Web site has been created to provide our visitors with information on certain medical conditions. Eli Lilly and Company respects the privacy of visitors to its Web sites, and we feel it is important to maintain our guests' privacy as they take advantage of this resource. As a result, we have developed this privacy code.

* * * We will use Your Information to respond to requests you may make of us, and from time to time, we may refer to Your Information to better understand your needs and how we can improve our Web sites, products and services. Any and all uses would comply with all applicable laws. We may also use Your Information to contact you. However, the provision of Your Information will only be necessary if you choose to use or receive certain tools or services, such as a newsletter or our medical reminder service.

* * * Our Web sites have security measures in place, including the use of industry standard secure socket layer encryption (SSL), to protect the confidentiality of any of Your Information that you volunteer; however, to take advantage of this your browser must support encryption protection (found in Internet Explorer release 3.0 and above). These security measures also help us to honor your choices for the use of Your Information.” VOLUME 133 Complaint Exhibit B: “Prozac.com | Privacy Statement,” http://www.prozac.com/your_privacy.jsp; and https://secure.prozac.com/your_privacy.jsp. B. “privacy Eli Lilly and Company respects the privacy of visitors to its websites, and we feel it is important to maintain our guests’ privacy as they take advantage of this resource. As a result, we have developed this privacy code.

* * * We will use Your Information to respond to requests you may make of us, and from time to time, we may refer to Your Information to better understand your needs and how we can improve our Web sites, products and services. Any and all uses would comply with all applicable laws. We may also use Your Information to contact you in connection with your requests.

* * * Our Web sites have security measures in place, including the use of industry standard secure socket layer encryption (SSL), to protect the confidentiality of any of Your Information that you volunteer; however, to take advantage of this your browser must support encryption protection (found in Internet Explorer release 3.0 and above).”

Exhibit C: “Lilly: Privacy,” http://www.lilly.com/privacy.html. 6. On June 27, 2001, at respondent’s direction, an Eli Lilly employee sent an email message to Medi-messenger subscribers announcing the termination of the Medi-messenger service. To do this, the employee created a new computer program to access subscribers’ email addresses and send them the email. The June VOLUME 133 Complaint 27th email disclosed the email addresses of all 669 Medimessenger subscribers to each individual subscriber by including all of the recipients’ email addresses within the “To:” line of the message. (Complaint Exhibit D, email addresses redacted from original). By including the email addresses of all Medimessenger subscribers within the June 27th email message, respondent unintentionally disclosed personal information provided to it by consumers in connection with their use of the Prozac.com Web site.

7. The June 27th disclosure of personal information resulted from respondent’s failure to maintain or implement internal measures appropriate under the circumstances to protect sensitive consumer information. For example, respondent failed to provide appropriate training for its employees regarding consumer privacy and information security; failed to provide appropriate oversight and assistance for the employee who sent out the email, who had no prior experience in creating, testing, or implementing the computer program used; and failed to implement appropriate checks and controls on the process, such as reviewing the computer program with experienced personnel and pretesting the program internally before sending out the email. Respondent’s failure to implement appropriate measures also violated certain of its own written policies.

8. Through the means described in Paragraph 5, respondent has represented, expressly or by implication, that it employs measures and takes steps appropriate under the circumstances to maintain and protect the privacy and confidentiality of personal information obtained from or about consumers through its Prozac.com and Lilly.com Web sites.

9. In truth and in fact, as described in Paragraphs 6 and 7, respondent has not employed measures and has not taken steps appropriate under the circumstances to maintain and protect the privacy and confidentiality of personal information obtained from or about consumers through its Prozac.com and Lilly.com Web VOLUME 133 Complaint sites. Therefore, the representation set forth in Paragraph 8 was, and is, false or misleading.

10. The acts and practices of respondent as alleged in this complaint constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this eighth day of May, 2002, has issued this complaint against respondent. By the Commission.

tg By =f Prozac® | Recovery Tools | MediMessenger - Microsoft | Disease Information About Prozac Taking Controt Recovery Tasts nternet Explorer provided by Eh Lilly and Company(20010711.01} Caring f for Gthers community NO.

Frozac® | Recovery Tools | MediMessenger - Microsoft intemet Explorer provided by Eli Lilly and Company{20010711.01} Disease Information About Prozac Taking Contract Recovery Tacs Caring for Others Community Recovery5 1 9 1 1 2 444 1038 64 61 74.465607 Tools5 1 9 1 1 3 539 1049 3 2 27.486504 ©2 1 10 0 0 0 348 1117 191 59 -1 3 1 10 1 0 0 348 1117 191 59 -1 4 1 10 1 1 0 348 1117 191 25 -1 5 1 10 1 1 1 348 1113 47 38 42.884422 Self5 1 10 1 1 2 398 1117 141 25 73.075798 Assessment:4 1 10 1 2 0 349 1148 121 28 -1 5 1 10 1 2 1 349 1149 12 24 90.467606 &5 1 10 1 2 2 368 1148 102 28 75.066902 Tracking2 1 11 0 0 0 349 1210 596 44 -1 3 1 11 1 0 0 349 1210 596 44 -1 4 1 11 1 1 0 349 1210 479 23 -1 5 1 11 1 1 1 349 1210 167 23 47.472954 MediMessenge5 1 11 1 1 2 824 1217 4 6 32.234406 '4 1 11 1 2 0 489 1213 456 41 -1 5 1 11 1 2 1 489 1213 36 24 61.872219 oer5 1 11 1 2 2 662 1221 96 30 87.727486 Letus5 1 11 1 2 3 765 1216 105 33 87.727486 remind5 1 11 1 2 4 879 1215 66 39 95.654007 you!2 1 12 0 0 0 350 1269 224 25 -1 3 1 12 1 0 0 350 1269 224 25 -1 4 1 12 1 1 0 350 1269 224 25 -1 5 1 12 1 1 1 350 1270 77 24 90.935783 Patients 1 12 1 1 2 433 1269 141 24 77.781570 Assaciations2 1 13 0 0 0 351 1301 1049 48 -1 3 1 13 1 0 0 351 1301 1049 48 -1 4 1 13 1 1 0 351 1301 127 24 -1 5 1 13 1 1 1 351 1301 16 24 93.008530 &5 1 13 1 1 2 374 1301 29 23 62.024788 Re:5 1 13 1 1 3 471 1317 7 6 50.593811 g4 1 13 1 2 0 405 1302 995 47 -1 5 1 13 1 2 1 405 1304 88 20 34.703705 Sources5 1 13 1 2 2 663 1316 56 33 94.325256 Signs 1 13 1 2 3 730 1322 30 26 94.325256 up5 1 13 1 2 4 770 1295 78 45 82.561089 helow5 1 13 1 2 5 856 1315 21 24 84.981552 to5 1 13 1 2 6 888 1310 77 28 59.566582 receives 1 13 1 2 7 976 1309 61 33 92.758881 daily,5 1 13 1 2 8 1045 1307 80 34 88.856735 weekly5 1 13 1 2 9 1136 1306 41 27 96.747658 ands 1 13 1 2 10 1185 1304 92 33 85.079224 monthly5 1 13 1 2 11 1285 1302 115 27 96.874153 reminders2 1 14 0 0 0 352 1348 848 50 -1 3 1 14 1 0 0 352 1348 848 50 -1 4 1 14 1 1 0 352 1348 848 50 -1 5 1 14 1 1 1 352 1355 118 43 80.403633 Newsletters 1 14 1 1 2 612 1371 20 23 0.000000 -»5 1 14 1 1 3 662 1356 28 26 96.526398 for5 1 14 1 1 4 701 1363 44 26 96.715576 any5 1 14 1 1 5 754 1354 52 27 96.784241 tasks 1 14 1 1 6 814 1353 60 33 96.521637 using5 1 14 1 1 7 885 1358 35 20 76.192856 ours 1 14 1 1 8 930 1350 68 27 43.930031 e-mails 1 14 1 1 9 1007 1348 100 27 2.887497 reminders 1 14 1 1 10 1116 1346 84 27 0.582390 semice.2 1 15 0 0 0 989 1420 304 10 -1 3 1 15 1 0 0 989 1420 304 10 -1 4 1 15 1 1 0 989 1420 304 10 -1 5 1 15 1 1 1 989 1420 304 10 95.000000 2 1 16 0 0 0 742 1429 270 49 -1 3 1 16 1 0 0 742 1429 270 49 -1 4 1 16 1 1 0 742 1429 270 49 -1 5 1 16 1 1 1 742 1435 119 27 48.024639 Usemame5 1 16 1 1 2 870 1441 23 18 85.368317 or5 1 16 1 1 3 899 1431 71 27 25.534813 Allas.:5 1 16 1 1 4 989 1429 23 49 10.679787 |2 1 17 0 0 0 990 1495 305 11 -1 3 1 17 1 0 0 990 1495 305 11 -1 4 1 17 1 1 0 990 1495 305 11 -1 5 1 17 1 1 1 990 1495 305 11 95.000000 2 1 18 0 0 0 845 1503 161 54 -1 3 1 18 1 0 0 845 1503 161 54 -1 4 1 18 1 1 0 845 1503 161 54 -1 5 1 18 1 1 1 845 1503 112 54 93.729401 Passwords 1 18 1 1 2 967 1514 3 18 87.463669 :5 1 18 1 1 3 990 1505 16 49 14.827278 [2 1 19 0 0 0 992 1571 304 10 -1 3 1 19 1 0 0 992 1571 304 10 -1 4 1 19 1 1 0 992 1571 304 10 -1 5 1 19 1 1 1 992 1571 304 10 95.000000 2 1 20 0 0 0 736 1569 310 61 -1 3 1 20 1 0 0 736 1569 310 61 -1 4 1 20 1 1 0 736 1569 310 61 -1 5 1 20 1 1 1 736 1582 101 40 30.804581 Confirms 1 20 1 1 2 846 1569 112 58 96.503548 Passwords 1 20 1 1 3 968 1589 8 19 46.003464 :5 1 20 1 1 4 991 1580 55 50 4.367325 [2 1 21 0 0 0 993 1647 304 10 -1 3 1 21 1 0 0 993 1647 304 10 -1 4 1 21 1 1 0 993 1647 304 10 -1 5 1 21 1 1 1 993 1647 304 10 95.000000 2 1 22 0 0 0 656 1788 774 250 -1 3 1 22 1 0 0 656 1788 774 250 -1 4 1 22 1 1 0 656 1788 774 70 -1 5 1 22 1 1 1 656 1825 2 17 0.000000 :5 1 22 1 1 2 670 1814 53 42 92.974808 yours 1 22 1 1 3 729 1815 93 43 81.545799 security5 1 22 1 1 4 839 1798 46 53 33.169754 e.g.5 1 22 1 1 5 884 1816 60 42 68.857147 Jane5 1 22 1 1 6 956 1841 17 5 79.892059 D5 1 22 1 1 7 954 1788 55 57 80.722488 Doe.4 1 22 1 2 0 671 1814 751 80 -1 5 1 22 1 2 1 671 1861 36 27 92.676323 Be.5 1 22 1 2 2 710 1861 27 25 92.505646 sures 1 22 1 2 3 768 1856 151 39 52.120720 to-memorize5 1 22 1 2 4 932 1855 43 43 96.176300 yours 1 22 1 2 5 982 1843 127 51 96.232918 information5 1 22 1 2 6 1117 1849 24 28 46.291405 or5 1 22 1 2 7 1145 1837 56 40 46.291405 writes 1 22 1 2 8 1202 1820 32 66 54.942497 it5 1 22 1 2 9 1244 1844 51 43 28.256104 were:5 1 22 1 2 10 1296 1819 49 64 95.127213 ands 1 22 1 2 11 1343 1814 68 66 54.710892 keeps 1 22 1 2 12 1418 1854 4 17 64.469505 :4 1 22 1 3 0 849 1887 567 51 -1 5 1 22 1 3 1 849 1899 7 2 54.816608 é5 1 22 1 3 2 988 1902 26 36 89.655418 ny5 1 22 1 3 3 1025 1888 106 38 93.131050 changes.5 1 22 1 3 4 1139 1885 96 32 32.640869 You-cans 1 22 1 3 5 1271 1897 13 18 96.887169 uses 1 22 1 3 6 1292 1881 39 34 96.414719 thes 1 22 1 3 7 1336 1881 80 43 85.063202 same:4 1 22 1 4 0 751 1922 642 53 -1 5 1 22 1 4 1 751 1932 38 43 86.477821 me5 1 22 1 4 2 796 1933 45 41 92.674301 ands 1 22 1 4 3 847 1933 75 39 63.014629 passwords 1 22 1 4 4 963 1934 23 29 63.014629 fo5 1 22 1 4 5 1009 1934 33 39 86.995171 signs 1 22 1 4 6 1051 1941 37 26 86.995171 up5 1 22 1 4 7 1086 1933 45 26 81.925781 forts 1 22 1 4 8 1159 1922 61 52 7.409882 Zung5 1 22 1 4 9 1232 1922 97 52 94.502678 Tracking5 1 22 1 4 10 1341 1927 52 35 84.725296 Fook4 1 22 1 5 0 672 1967 679 69 -1 5 1 22 1 5 1 672 1976 68 50 94.906586 Enters 1 22 1 5 2 742 1969 41 60 96.956131 thes 1 22 1 5 3 786 1972 41 62 87.661049 tasks 1 22 1 5 4 851 1975 40 49 95.583824 ands 1 22 1 5 5 896 1970 158 66 1.946945 the‘fequency5 1 22 1 5 6 1062 1973 24 32 92.503517 of5 1 22 1 5 7 1133 1967 63 53 77.831039 task.5 1 22 1 5 8 1196 1963 19 46 80.626480 if5 1 22 1 5 9 1226 1963 32 46 93.014984 you5 1 22 1 5 10 1268 1972 66 33 74.705322 enter.5 1 22 1 5 11 1337 1976 14 35 95.848946 a4 1 22 1 6 0 1185 2018 15 20 -1 5 1 22 1 6 1 1164 2012 36 26 60.594521 ise2 1 23 0 0 0 1935 1943 89 3 -1 3 1 23 1 0 0 1935 1943 89 3 -1 4 1 23 1 1 0 1935 1943 89 3 -1 5 1 23 1 1 1 1935 1943 89 3 95.000000 2 1 24 0 0 0 1966 2006 75 4 -1 3 1 24 1 0 0 1966 2006 75 4 -1 4 1 24 1 1 0 1966 2006 75 4 -1 5 1 24 1 1 1 1966 2006 75 4 95.000000 2 1 25 0 0 0 1996 1914 3 108 -1 3 1 25 1 0 0 1996 1914 3 108 -1 4 1 25 1 1 0 1996 1914 3 108 -1 5 1 25 1 1 1 1996 1914 3 108 95.000000 2 1 26 0 0 0 2015 1925 3 98 -1 3 1 26 1 0 0 2015 1925 3 98 -1 4 1 26 1 1 0 2015 1925 3 98 -1 5 1 26 1 1 1 2015 1925 3 98 95.000000 2 1 27 0 0 0 289 538 29 1531 -1 3 1 27 1 0 0 289 538 29 1531 -1 4 1 27 1 1 0 289 538 29 1531 -1 5 1 27 1 1 1 289 538 29 1531 95.000000 2 1 28 0 0 0 629 1429 17 629 -1 3 1 28 1 0 0 629 1429 17 629 -1 4 1 28 1 1 0 629 1429 17 629 -1 5 1 28 1 1 1 629 1429 17 629 95.000000 2 1 29 0 0 0 231 202 2180 1996 -1 3 1 29 1 0 0 231 202 2180 1996 -1 4 1 29 1 1 0 231 202 2180 1996 -1 5 1 29 1 1 1 231 202 2180 1996 95.000000 c® | Recovery Tools | MediMessenger - Microsoft Intemnet Explorer provide eCodelwebroot\4_rec\4rec201. htm SS Disease Information About Prozac Taking Control Recovery Tools Home | Prozac inthe News. “contacts | Suwey | VistorPol | Safety Caring for Others Product Lael“ Search:

Community Privacy Statement With respect to this Web site, Eli Lily and Company will only collect, store, or use personally identifiable information, such as “your name, address, telephone number, or e-mail address This Web site has been created:to provide our visitors with information on certain medical conditions. Eli Lilly and Company respects the privacy of visitors to its Web sites, and we feel it is important te maintain our quests’ privacy as they take * advantage of this resource: As a result, we ‘have developed this privacy code.

oe information’), when it is voluntarily submitted tous. We- ‘use Your Information to respond to requests you may make us, and from time te time, we may refer to Your information to elter understand. your needs and how-we can improve our Web : sites, products. and services. Any. and all uses would. compl cwith all applicable: laws. We may also use Yo it Information:t However, the provision of You formation will only. Th majority of th Web site does not require. the atovision of Your Information, Any-other information transferred by you in at Prozac® | Privacy Statement - Mi ided by Eli Lilly and Company(20010711.01) vomnection wih your vat 10 | ris site = Cole! imation =e, information that cannot be used to identify you) may be included in databases owned and maintained by El Lily and Company, o its agents: Lily retains all rights tot o these databases and the information ci cont tained rather :

Our Web sites, 3, tke neatly dis sites ont the tema, wl use Other inforenati on-and pool it with information. that: tracks the “tot al number of visitors to our site, the number visitors to each page of our site, and the domain names of our visitors’ Internet 5 1 16 1 5 2 621 1089 80 34 12.718269 semvice5 1 16 1 5 3 712 1085 110 47 82.794624 providers.5 1 16 1 5 4 836 1083 106 43 77.955872 However,5 1 16 1 5 5 953 1085 13 34 80.877182 it5 1 16 1 5 6 975 1085 19 34 93.946365 is5 1 16 1 5 7 1004 1078 145 51 61.884224 important5 1 16 1 5 8 1128 1074 22 62 80.702339 to5 1 16 1 5 9 1157 1075 52 41 88.849945 notes 1 16 1 5 10 1218 1070 86 45 64.700623 that5 1 16 1 5 11 1275 1066 33 64 64.700623 ne4 1 16 1 6 0 621 1134 719 52 -1 5 1 16 1 6 1 621 1143 119 43 75.912918 personally5 1 16 1 6 2 752 1141 126 35 91.874435 identifiable5 1 16 1 6 3 888 1138 129 36 92.568184 information5 1 16 1 6 4 1028 1138 18 33 94.690514 is5 1 16 1 6 5 1057 1136 103 36 96.217117 available5 1 16 1 6 6 1168 1146 24 24 96.201866 or5 1 16 1 6 7 1200 1135 71 34 96.804665 used5 1 16 1 6 8 1267 1130 15 60 96.858475 in5 1 16 1 6 9 1296 1134 44 34 95.991066 this4 1 16 1 7 0 622 1205 463 35 -1 5 1 16 1 7 1 622 1205 98 35 68.442596 process.2 1 17 0 0 0 582 573 4 521 -1 3 1 17 1 0 0 582 573 4 521 -1 4 1 17 1 1 0 582 573 4 521 -1 5 1 17 1 1 1 582 573 4 521 95.000000 2 1 18 0 0 0 592 1294 851 560 -1 3 1 18 1 0 0 586 1294 857 526 -1 4 1 18 1 1 0 622 1294 708 47 -1 5 1 18 1 1 1 586 1302 5 47 44.360390 _5 1 18 1 1 2 622 1303 18 33 44.360390 In5 1 18 1 1 3 652 1302 99 39 56.809406 addition,5 1 18 1 1 4 762 1310 64 25 96.881172 some5 1 18 1 1 5 838 1300 21 34 96.575699 of5 1 18 1 1 6 872 1309 32 25 95.971214 ours 1 18 1 1 7 925 1299 39 34 95.971214 Web5 1 18 1 1 8 978 1299 55 33 96.418724 sites5 1 18 1 1 9 1044 1306 41 25 95.548004 uses 1 18 1 1 10 1096 1306 13 24 96.352219 a5 1 18 1 1 11 1117 1295 132 43 96.404396 technology5 1 18 1 1 12 1261 1294 69 34 92.415779 called4 1 18 1 2 0 623 1348 755 48 -1 5 1 18 1 2 1 623 1355 117 34 0.000000 “cookies”.5 1 18 1 2 2 759 1355 10 33 92.271950 A5 1 18 1 2 3 781 1354 76 34 92.271950 cookies 1 18 1 2 4 869 1353 19 34 94.483627 is5 1 18 1 2 5 899 1362 12 24 83.896332 a5 1 18 1 2 6 921 1352 61 44 92.012604 pieces 1 18 1 2 7 994 1351 22 34 96.984467 of5 1 18 1 2 8 1024 1349 129 35 90.950378 information5 1 18 1 2 9 1162 1349 46 33 96.995491 that5 1 18 1 2 10 1217 1348 38 33 96.948524 thes 1 18 1 2 11 1265 1351 113 40 72.123627 computer4 1 18 1 3 0 622 1402 715 48 -1 5 1 18 1 3 1 622 1409 44 34 87.799240 that5 1 18 1 3 2 677 1409 65 33 87.799240 hosts5 1 18 1 3 3 752 1418 37 24 88.130157 ours 1 18 1 3 4 799 1407 40 34 95.517197 sites 1 18 1 3 5 850 1406 59 44 95.517197 gives5 1 18 1 3 6 918 1409 22 31 96.175484 to5 1 18 1 3 7 951 1415 52 34 96.175484 yours 1 18 1 3 8 1012 1407 112 40 96.279579 computers 1 18 1 3 9 1133 1402 101 44 95.253654 (actually5 1 18 1 3 10 1243 1405 22 30 91.570236 to5 1 18 1 3 11 1276 1410 61 35 43.539959 your:4 1 18 1 4 0 623 1453 717 53 -1 5 1 18 1 4 1 623 1462 109 44 19.340134 browser)5 1 18 1 4 2 732 1461 62 34 96.853233 when5 1 18 1 4 3 804 1470 42 34 94.840248 you5 1 18 1 4 4 857 1468 86 25 95.170212 access5 1 18 1 4 5 953 1468 12 24 81.957809 a5 1 18 1 4 6 974 1458 56 33 90.930817 Web5 1 18 1 4 7 1041 1457 47 34 83.774933 site.5 1 18 1 4 8 1101 1454 44 35 92.847664 Ours 1 18 1 4 9 1154 1454 93 35 91.435905 cookies5 1 18 1 4 10 1257 1453 83 49 96.459473 provide4 1 18 1 5 0 624 1507 711 50 -1 5 1 18 1 5 1 624 1499 110 62 90.926193 additional5 1 18 1 5 2 749 1513 135 44 34.907692 functionality5 1 18 1 5 3 908 1510 12 36 94.100922 to5 1 18 1 5 4 930 1512 32 33 96.929222 thes 1 18 1 5 5 977 1511 40 34 96.417259 sites 1 18 1 5 6 1028 1510 42 34 95.008331 ands 1 18 1 5 7 1081 1503 52 50 95.008331 helps 1 18 1 5 8 1139 1503 30 40 96.699280 us5 1 18 1 5 9 1178 1508 93 43 96.699280 analyzes 1 18 1 5 10 1281 1507 54 34 78.273109 site.4 1 18 1 6 0 594 1559 798 52 -1 5 1 18 1 6 1 594 1566 101 49 0.000000 usage5 1 18 1 6 2 705 1577 59 31 96.438057 more5 1 18 1 6 3 773 1563 131 46 92.423012 accurately.5 1 18 1 6 4 916 1565 40 35 95.611916 For5 1 18 1 6 5 964 1564 109 40 95.878990 instance,5 1 18 1 6 6 1083 1572 38 25 75.783081 aur5 1 18 1 6 7 1129 1562 44 34 86.768898 sites 1 18 1 6 8 1182 1570 58 34 92.749245 may5 1 18 1 6 9 1244 1564 37 31 92.749245 sets 1 18 1 6 10 1290 1570 14 24 59.265297 a5 1 18 1 6 11 1313 1559 79 34 87.560486 cookie4 1 18 1 7 0 592 1612 819 54 -1 5 1 18 1 7 1 592 1632 62 23 31.108170 on5 1 18 1 7 2 662 1631 52 35 39.507759 yours 1 18 1 7 3 722 1621 95 34 91.769043 browsers 1 18 1 7 4 822 1619 46 34 96.545227 that5 1 18 1 7 5 878 1618 73 51 90.715248 keeps5 1 18 1 7 6 960 1628 61 34 93.137184 you5 1 18 1 7 7 1010 1614 16 59 81.993958 f5 1 18 1 7 8 1000 1613 63 46 62.994095 from5 1 18 1 7 9 1068 1614 100 52 96.079262 needing5 1 18 1 7 10 1174 1614 29 34 80.306023 to5 1 18 1 7 11 1208 1606 127 54 71.864525 remember5 1 18 1 7 12 1338 1612 43 33 42.912262 anda 1 18 1 8 0 610 1665 833 54 -1 5 1 18 1 8 1 593 1669 24 52 34.935951 --5 1 18 1 8 2 622 1669 83 40 34.935951 enter-a5 1 18 1 8 3 715 1670 134 49 94.259254 passwords 1 18 1 8 4 839 1681 60 37 94.259254 more5 1 18 1 8 5 907 1666 54 49 95.529556 than5 1 18 1 8 6 969 1679 63 40 70.693481 once5 1 18 1 8 7 1034 1663 93 49 70.085991 during5 1 18 1 8 8 1117 1654 12 62 63.184723 a5 1 18 1 8 9 1138 1668 49 34 63.184723 visits 1 18 1 8 10 1192 1671 28 38 72.292984 to5 1 18 1 8 11 1225 1666 39 35 72.292984 thes 1 18 1 8 12 1273 1658 54 50 42.318096 site.5 1 18 1 8 13 1333 1665 22 35 42.318096 In5 1 18 1 8 14 1364 1665 79 35 41.525146 all4 1 18 1 9 0 600 1708 762 76 -1 5 1 18 1 9 1 600 1734 2 2 16.152145 ~5 1 18 1 9 2 615 1738 81 35 52.923935 Cases5 1 18 1 9 3 705 1727 22 34 44.103107 in5 1 18 1 9 4 733 1724 115 46 68.812660 which5 1 18 1 9 5 819 1720 24 57 94.797638 we5 1 18 1 9 6 854 1735 43 28 93.392014 uses 1 18 1 9 7 907 1716 100 48 76.677101 cookies,5 1 18 1 9 8 1015 1724 34 33 96.037361 we5 1 18 1 9 9 1056 1721 43 42 87.090424 will5 1 18 1 9 10 1105 1715 45 56 80.056015 not5 1 18 1 9 11 1148 1711 6 64 73.015961 |5 1 18 1 9 12 1152 1708 81 69 85.270515 callect5 1 18 1 9 13 1230 1710 132 74 78.450653 personally4 1 18 1 10 0 625 1769 544 85 -1 5 1 18 1 10 1 625 1781 74 71 53.394070 Hens 1 18 1 10 2 702 1781 48 70 78.408295 able5 1 18 1 10 3 760 1779 111 71 13.841141 ior5 1 18 1 10 4 846 1780 44 43 87.475006 tions 1 18 1 10 5 896 1778 91 69 0.000000 vahaut5 1 18 1 10 6 994 1773 54 81 72.336639 jour5 1 18 1 10 7 1054 1769 115 81 38.836979 pemissi2 1 19 0 0 0 835 1781 467 92 -1 3 1 19 1 0 0 835 1781 467 92 -1 4 1 19 1 1 0 835 1781 467 92 -1 5 1 19 1 1 1 835 1781 467 92 95.000000 2 1 20 0 0 0 570 1841 852 333 -1 3 1 20 1 0 0 612 1841 762 100 -1 4 1 20 1 1 0 612 1841 762 100 -1 5 1 20 1 1 1 612 1856 52 66 86.618408 We5 1 20 1 1 2 676 1897 35 33 95.760757 ares 1 20 1 1 3 693 1857 10 2 0.146027 e5 1 20 1 1 4 726 1847 120 82 74.358971 committed5 1 20 1 1 5 865 1895 14 32 63.528107 05 1 20 1 1 6 889 1849 118 92 12.603516 stetg5 1 20 1 1 7 1014 1851 46 77 71.317184 the.5 1 20 1 1 8 1062 1863 79 63 31.220871 orvacy5 1 20 1 1 9 1163 1922 3 1 71.657410 05 1 20 1 1 10 1154 1858 24 57 95.589111 of5 1 20 1 1 11 1184 1841 122 82 38.204208 siden.5 1 20 1 1 12 1296 1847 48 66 90.370880 You5 1 20 1 1 13 1368 1881 6 6 6.398926 ;3 1 20 2 0 0 570 1932 852 216 -1 4 1 20 2 1 0 627 1932 767 44 -1 5 1 20 2 1 1 627 1940 79 36 90.061386 should5 1 20 2 1 2 713 1940 39 35 95.020149 he5 1 20 2 1 3 750 1939 74 41 90.677399 aware5 1 20 2 1 4 822 1933 54 47 96.721230 that5 1 20 2 1 5 882 1936 47 44 96.907288 this5 1 20 2 1 6 937 1935 56 51 76.831062 sites 1 20 2 1 7 987 1937 25 44 76.831062 is5 1 20 2 1 8 1017 1935 44 35 92.359276 not5 1 20 2 1 9 1064 1930 87 46 90.971535 intended5 1 20 2 1 10 1164 1929 63 50 58.817425 for,5 1 20 2 1 11 1222 1931 25 44 96.169571 or5 1 20 2 1 12 1251 1932 143 53 93.533371 designed5 1 20 2 1 13 1368 1925 27 64 96.275078 to4 1 20 2 2 0 570 1977 847 59 -1 5 1 20 2 2 1 570 2026 4 2 5.472595 |5 1 20 2 2 2 626 1988 84 50 43.420891 attracts 1 20 2 2 3 719 1986 93 51 89.497108 children5 1 20 2 2 4 821 1982 71 45 96.517929 under5 1 20 2 2 5 896 1984 41 52 96.124016 thes 1 20 2 2 6 943 1984 42 50 96.124016 ages 1 20 2 2 7 995 1979 38 45 85.522827 of5 1 20 2 2 8 1033 1989 28 40 88.482277 13.5 1 20 2 2 9 1081 1978 32 55 91.288574 We5 1 20 2 2 10 1118 1982 35 54 93.820061 do5 1 20 2 2 11 1156 1977 46 59 76.245529 nats 1 20 2 2 12 1205 1977 118 58 43.734512 collects 1 20 2 2 13 1375 2023 42 5 7.686623 ot4 1 20 2 3 0 627 2017 795 85 -1 5 1 20 2 3 1 627 2037 120 65 80.405159 personally5 1 20 2 3 2 756 2031 128 63 61.116859 identifiable5 1 20 2 3 3 893 2030 133 65 88.685135 information5 1 20 2 3 4 1031 2042 71 34 76.178825 from5 1 20 2 3 5 1093 2038 32 37 36.917019 ani5 1 20 2 3 6 1146 2033 80 59 94.548897 persons 1 20 2 3 7 1242 2036 27 51 88.090012 we5 1 20 2 3 8 1279 2017 109 84 60.017441 actualy5 1 20 2 3 9 1397 2034 25 24 27.679512 a4 1 20 2 4 0 605 2084 688 90 -1 5 1 20 2 4 1 605 2108 13 40 0.000000 :5 1 20 2 4 2 623 2095 97 79 37.708282 knows5 1 20 2 4 3 695 2099 51 59 86.904327 isa5 1 20 2 4 4 732 2099 57 67 66.986526 chi5 1 20 2 4 5 790 2099 17 65 73.116951 d5 1 20 2 4 6 783 2088 101 80 31.335655 under5 1 20 2 4 7 888 2098 42 49 93.726425 thes 1 20 2 4 8 929 2088 74 85 38.829460 aed5 1 20 2 4 9 983 2084 28 59 92.846924 of5 1 20 2 4 10 1017 2095 36 70 64.626213 8.5 1 20 2 4 11 1062 2095 2 6 34.090912 .5 1 20 2 4 12 1270 2104 23 16 0.000000 zs2 1 21 0 0 0 2253 1883 1 88 -1 3 1 21 1 0 0 2253 1883 1 88 -1 4 1 21 1 1 0 2253 1883 1 88 -1 5 1 21 1 1 1 2253 1883 1 88 95.000000 2 1 22 0 0 0 2178 1970 77 1 -1 3 1 22 1 0 0 2178 1970 77 1 -1 4 1 22 1 1 0 2178 1970 77 1 -1 5 1 22 1 1 1 2178 1970 77 1 95.000000 2 1 23 0 0 0 2074 1984 184 3 -1 3 1 23 1 0 0 2074 1984 184 3 -1 4 1 23 1 1 0 2074 1984 184 3 -1 5 1 23 1 1 1 2074 1984 184 3 95.000000 2 1 24 0 0 0 2196 1948 3 79 -1 3 1 24 1 0 0 2196 1948 3 79 -1 4 1 24 1 1 0 2196 1948 3 79 -1 5 1 24 1 1 1 2196 1948 3 79 95.000000 2 1 25 0 0 0 2189 1963 3 97 -1 3 1 25 1 0 0 2189 1963 3 97 -1 4 1 25 1 1 0 2189 1963 3 97 -1 5 1 25 1 1 1 2189 1963 3 97 95.000000 2 1 26 0 0 0 833 2119 498 69 -1 3 1 26 1 0 0 833 2119 498 69 -1 4 1 26 1 1 0 833 2119 498 69 -1 5 1 26 1 1 1 833 2119 498 69 95.000000 2 1 27 0 0 0 2104 2163 124 6 -1 3 1 27 1 0 0 2104 2163 124 6 -1 4 1 27 1 1 0 2104 2163 124 6 -1 5 1 27 1 1 1 2104 2163 124 6 95.000000 2 1 28 0 0 0 2137 2168 91 3 -1 3 1 28 1 0 0 2137 2168 91 3 -1 4 1 28 1 1 0 2137 2168 91 3 -1 5 1 28 1 1 1 2137 2168 91 3 95.000000 2 1 29 0 0 0 2145 2111 1 86 -1 3 1 29 1 0 0 2145 2111 1 86 -1 4 1 29 1 1 0 2145 2111 1 86 -1 5 1 29 1 1 1 2145 2111 1 86 95.000000 2 1 30 0 0 0 571 2160 848 382 -1 3 1 30 1 0 0 571 2160 848 305 -1 4 1 30 1 1 0 627 2160 761 97 -1 5 1 30 1 1 1 627 2183 47 74 79.772133 ur5 1 30 1 1 2 676 2182 62 60 93.600853 Web5 1 30 1 1 3 740 2179 61 61 15.756516 sis5 1 30 1 1 4 807 2182 56 58 83.002304 have5 1 30 1 1 5 867 2177 98 76 9.850578 security5 1 30 1 1 6 983 2181 30 52 66.519180 me5 1 30 1 1 7 977 2186 119 57 91.867828 measures5 1 30 1 1 8 1100 2192 29 43 88.691353 in5 1 30 1 1 9 1134 2200 74 50 94.353302 place,5 1 30 1 1 10 1210 2160 110 89 41.201607 inching5 1 30 1 1 11 1335 2167 53 69 41.201607 he4 1 30 1 2 0 599 2250 785 53 -1 5 1 30 1 2 1 599 2262 2 2 27.223404 ~5 1 30 1 2 2 627 2255 44 40 92.284515 uses 1 30 1 2 3 679 2260 25 35 90.123795 of5 1 30 1 2 4 707 2259 102 44 90.123795 industry5 1 30 1 2 5 812 2252 108 41 95.541595 standards 1 30 1 2 6 925 2257 81 44 96.185074 secures 1 30 1 2 7 1015 2249 87 51 94.867958 socket5 1 30 1 2 8 1107 2248 59 50 96.595810 layers 1 30 1 2 9 1176 2247 118 50 96.565346 encryption5 1 30 1 2 10 1307 2250 77 45 67.245644 (SSL),4 1 30 1 3 0 571 2294 816 70 -1 5 1 30 1 3 1 571 2318 30 22 0.000000 »)5 1 30 1 3 2 626 2313 164 52 32.107384 to-protects 1 30 1 3 3 752 2309 40 60 88.561737 thes 1 30 1 3 4 795 2294 165 70 14.413055 confidentiality5 1 30 1 3 5 970 2309 24 35 40.688816 af5 1 30 1 3 6 998 2318 43 35 40.688816 any5 1 30 1 3 7 1051 2308 24 35 96.641403 of5 1 30 1 3 8 1088 2299 51 59 61.673790 Yours 1 30 1 3 9 1139 2303 142 51 29.705765 information5 1 30 1 3 10 1286 2305 48 34 95.356773 that5 1 30 1 3 11 1341 2313 46 35 95.356773 you4 1 30 1 4 0 582 2350 837 76 -1 5 1 30 1 4 1 582 2364 25 36 41.366425 > volunteer, however, to take advantage ofthis your browser must . ~ guoport encryption: protection (found in Intern and above). These secunly measu D:\My Documents grozacS ouceCode webroot Vege pracy Mim FL-14317-10126652 Copyright 2000, Eli Lily and Company. All rights reserved. PROZAC is a registered trademark of El Lilly and Company. Prozac.com | Privacy Statement http://www.prozac.comyyour_privac' 1 of 1 How Prog.

Your Privacy This Web site has been created to provide our visitors with information on certain medical conditions. Eli Lilly and Company respects the privacy of visitors to its Web sites, and we feel it is important to maintain our guests’ privacy as they take advantage of this resource. As a result, we have developed this privacy code. With respect to this Web site, Eli Lilly and Company will only collect, store, or use personally identifiable information, such as your name, address, telephone number, or e-mail address ("Your Information"), when it is voluntarily submitted to us. We will use Your Information to respond to requests you may make of us, and from time to time, we may refer to Your Information to better understand your needs and how we can improve our Web sites, products and services. Any and all uses would comply with all applicable laws. We may also use Your Information to contact you. However, the provision of Your Information will only be necessary if you choose to use or receive certain tools or services, such as a newsletter or our medical reminder service. The majority of this. Web site does not require the provision of Your Information. Any other information transferred by-you in connection with your visit to this site ("Other Information” — i.e., information that cannot be used to identify you) may be included in databases owned and maintained by Eli Lilly and Company or its agents. Lilly retains all rights to these databases and the information contained in them.

Our Web sites, like nearly all sites on the Internet, will use Other Information and pool it with information that tracks the total number of visitors to our site, the number of visitors to each page of our site, and the domain names of our visitors’ Internet service providers. However, it is important to note that no personally identifiable information is available or used in this process.

In addition, some of our Web sites use a technology called cookies. A cookie is a piece of information that the computer that hosts our site gives to your computer (actually to your browser) when you access a Web site. Our cookies provide additional functionality to the site and help us analyze site usage more accurately. For instance, our site may set a cookie on your browser that keeps you from needing to remember and enter a password more than once during a visit to the site. in all cases in which we use cookies, we will not collect personally identifiable information without your permission.

We are committed to protecting the privacy of children. You should be aware that this site is not intended for, or designed to attract, children under the age of 13. We do not collect personally identifiable information from any person we actually know is a child under the age of 13. Our Web sites have security measures in place, including the use of industry standard secure socket layer encryption (SSL), to protect the confidentiality of any of Your Information that you volunteer; however, to take advantage of this your browser must support encryption protection (found in Internet Explorer release 3.0 and above). These security measures also help us to honor your choices for the use of Your Information. As. a convenience to our visitors, this Web site currently contains links to a number of sites that we believe may offer useful information. The policies and procedures we described here do not apply to:those sites. We suggest contacting those sites directly for information on their privacy, security, data collection, and distribution policies. We may update this Web site Privacy Policy from time to time. When we do update it, for your convenience, we will make the updated policy available on this page. Generic or brand name? Are there differences? site ma Prozac.com en Espafiol Information about generic fluoxetine She Tap FL-14317-10126552 Copyright 2001, Eli Lilly and Company. All rights reserved. PROZAC is a registered trademark of Eli Lilly and Company. This site is intended for U.S. Residents only. To visit the Healthcare Professional site, click here EXHIBIT PENGAD-Bayonne, no, © 10/11/2001 2:22 Lilly: Privacy http://www_lilly.com/privacy.! healthinfo alliances news careers aboutus global contact home privacy Eli Lilly and Company respects the privacy of visitors to its websites, and we feel it is important to maintain our guests’ privacy as they take advantage of this resource, As a result, we have developed this privacy code. With respect to this website, Eli Lilly and Company and its agents will only collect, store or use personally identifiable information, such as your name, address, social security number, stockholder account number, or e-mail address ("Your Information"), when it is voluntarily submitted to us. We will use Your Information to respond to requests you may make of us, and from time to time, we may refer to Your Information to better understand your needs and how we can improve our websites, products and services. Any and all uses would comply with all applicable laws. We may also use Your Information to contact you in connection with your requests. Any other information transferred by you in connection with your visit to this site ("Other Information” -- i.e., information that cannot be used to identify you) may be included in databases owned and maintained by Eli Lilly and Company or its agents. Lilly retains all rights to these databases and the information contained in them.

Our web sites, like nearly all sites on the internet, will use Other Information and pool it with information tracking the total number of visitors to our site, the number of visitors to each page of our site, and the domain names of our visitors’ Internet service providers. However, it is important to note that no personally identifiable information is available or used in this process. In addition, some of our websites use a technology called cookies. A cookie is a piece of information that the computer that hosts our site gives to your computer (actually to your browser) when you access a website. Our cookies help provide additional functionality to the site or to help us analyze site usage more accurately. For instance, our site may set a cookie on your browser that keeps you from needing to remember and then enter a password more than once during a visit to the site. In all cases in which we use cookies, we will not collect personally identifiable information except with your permission. Our websites have security measures in place, including the use of industry standard secure socket layer encryption (SSL), to protect the confidentiality of any of Your Information that you volunteer; however, to take advantage of this your browse must support encryption protection (found in Internet Explorer release 3.0 and above).

As a convenience to our visitors, this website currently contains links to a number of sites that we believe may offer useful information. The policies and procedures we described here do not apply to those sites. We suggest contacting those sites directly for information on their privacy, security, data collection and distribution policies.

We may update this Website Privacy Policy from time to time. When we do update it, however, for your convenience, we will make the updated policy available on this page.

EXHIBIT -NO. C PENGAD-Bayonne, 1 of 2 10/11/2001 2:21 | Lilly: Privacy http://www.lilly.com/privacy.| Copyright © 2001 Eli Lily and Company. Allrights reserved. Search | Site Map 2 of 2 10/11/2001 2:21 From:

Sent:

[email protected] , 2001 8:37-PM Wool.com —_ hotmail.com:

hotmail.com; yahoo.com Baol. com, rr ayes; we) yahoo.com:

BPearthiink, net;

@ mirid Spring, com;

. Pore an: [email protected]:

yahoo.co: x @hotmail.comalaes a il.com§ '1@ i Gy yanoo. .CON wanes Wemail.uc.edu:

Z } home. com @aol.com; i @atiglobal.net;

Oe o [email protected]:

aD a Beduy Matt.net.mx;

penotmat com; @ ! @cs.com [email protected]:

} @icqmail.com <a f - @juno.co :

@yahoo.com; aol.com, Seat. Co @datnow.com; Qo cor gaan Roerem aol. congpi@hotmai i.comy; Weed or Ca @s @aol.co @gateway.n Mail.state.mo. u P wordnelati.net Ie me promt a Cong iLcom;

a otmall.com @gguapeaee aol. ‘CON QRS @20!.com: @peoplepc. ° : . @Qwebtv. NQSEEEFQ yahoo.com: Bornail. pol.ne _ Maol. @home.com;

a a yQaocl. COMET @a0l. com;

(@cs.com@uaamm a @hatmail.com;

@webtiv.net des @earthlink.n @aol.com; aol .Co: ELIYCOS 4 hotmail.com; GUA sh00.00.uk ey pineal. com: qlaiatiagcacs.com; aol.com; ER communica ons.com;

@hotmail.com; @onebox.comy edu;

oP uiuc.edu; @cabdleinet.co.u Ne @aol.cd aR y2i 00. coral. SE Oaci.

_ poimail com; Ca;@eoaol.com a eed col.com: meee Ceohotnail.com, @juno.corns baci.com: aol. cam:

_: COMME acl. com;

aol, comauaal Pwebiv.n hatmaii.co aol.com; . aol Se Re pene Sn; @yahoo.com:

pacbell.ne @hotmail.com:

arpa kaa ‘ ile excite. com;

EXHIBIT D even PENGAD-Bayonne, NO.

To:

B2tesconet;

OIUNG ico = ellsouth.nek yahoo.co! hotmail.co hotmail.com: # | WEBS carthiini not {mail.com aal.cam:

~hotmail.com;

Kbaol.com:

com;

Myahoo.chm:

Oe . Bt;

@yahoo.com;

7 @aal.com;

N@yahoo,com;

fDpg.com:

BAUp.CO EMD beliatiantic net:

Ol .COMMMENEREEED 20!.com;

@providence.edu aol.com;

. darthlink net;

hotmail.com:

WEED 'sland.not, rt : @lilly.com:

@hoimail_com @yahoo:com:

@aol.com;

@netzero.nct quae aol.com:

mea Oho ERE 201 corm;

: [email protected]:

S.cOom @ aD Biuno.co setaf.army.mil} oo rotmail com Se otc ne excits.come a pay BPC.Co @aol.com bellsouth:ne du;

[email protected] a Veines ganorizonview.neé a ‘@msn.com eal CO aera ee eR 5 ociay not Daol.com mae Y™antec.com net: se@aal. or lias:

ain @bellsouth.ne Gao!.con Mil hotmail. con ec T@ gaol com;

yahoo.co.uk:

a Madeiphia.net:

. - 0 aa By ~ ;

oY) paol.gom [email protected] {ws mM;

Mastound.net:

aol.com;

dspring.co OM;

al wy th.com; Bhotmaill.com:

‘ols.com; [email protected]:

co [email protected]; Benet @aol.comy com; , Rvistar.cg [email protected] et; cq Secor @mMediconsult.com;

oom atl.COm: | wool.coih;

Comm yahoo.com;

yahoo.co otmail.cam;

Subject: Medi-Messenger Dear Medi-Messenger User:

We're listening! This week Eli Lilly and Company relaunched Prozac.com with a new navigation and feel. Based upon feedback from consumers like you, we have discontinued our Medi-Messenger e-mail reminder service. We are appreciative of your comments, and hope this does not cause any inconvenience to those of you who were using this feature. VOLUME 133 Decision and Order DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the respondent named in the caption hereof, and the respondent having been furnished thereafter with a copy of a draft of complaint which the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge respondent with violation of the Federal Trade Commission Act; and The respondent, its attorneys, and counsel for Federal Trade Commission having thereafter executed an agreement containing a consent order, an admission by the respondent of all the jurisdictional facts set forth in the aforesaid draft of complaint, a statement that the signing of said agreement is for settlement purposes only and does not constitute an admission by respondent that the law has been violated as alleged in such complaint, or that the facts as alleged in such complaint, other than jurisdictional facts, are true and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it had reason to believe that the respondent has violated the said Act, and that complaint should issue stating its charges in that respect, and having thereupon accepted the executed consent agreement and placed such agreement on the public record for a period of thirty (30) days, and having duly considered the comment received, now in further conformity with the procedure prescribed in § 2.34 of its Rules, the Commission hereby issues its complaint, makes the following jurisdictional findings and enters the following order:

1. Respondent Eli Lilly and Company is a corporation organized, existing, and doing business under and by virtue of the laws of the State of Indiana, with its principal office or place of business at Lilly Corporate Center, Indianapolis, Indiana 46285. VOLUME 133 Decision and Order 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of the respondent, and the proceeding is in the proceeding is in the public interest. ORDER DEFINITIONS For purposes of this order, the following definitions shall apply: 1. “Personally identifiable information” or “personal information” shall mean individually identifiable information from or about an individual consumer including, but not limited to: (a) a first and last name; (b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name that reveals an individual’s email address; (d) a telephone number; (e) a social security number; (f) an Internet Protocol (“IP”) address or host name that identifies an individual consumer; (g) a persistent identifier, such as a customer number held in a “cookie” or processor serial number, that is combined with other available data that identifies an individual consumer; or (h) or any information that is combined with (a) through (g) above. Provided that, this definition shall not include personally identifiable information about physicians, nurses, or other health care professionals, or their staff, that is collected in connection with such persons’ professional duties.

2. Unless otherwise specified, “respondent” shall mean Eli Lillyand Company, its successors and assigns and its officers, agents, representatives, and employees acting within the scope of their authority on behalf of, or in active concert or participation with, Eli Lilly and Company.

3. “Lilly USA division” shall mean Lilly USA, a division of Eli Lilly and Company, and Lilly USA's successors, assigns, officers, representatives, agents, employees, and other entities responsible for the development, control, support, or oversight of U.S. product or service sales, advertising, or marketing, information management, VOLUME 133 Decision and Order or information technology. Provided that, the Lilly USA division shall be treated as a corporation under the control of Eli Lilly and Company for the purpose of determining whether any other entity is Lilly USA division’s successor or assign. 4. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44.

I.

IT IS ORDERED that respondent shall not misrepresent in any manner, expressly or by implication, the extent to which it maintains and protects the privacy or confidentiality of any personally identifiable information collected from or about consumers, in connection with the advertising, marketing, offering for sale or sale, in or affecting commerce, of any pharmaceutical, medical or other health-related product or service by respondent’s Lilly USA division, directly or through any corporation, subsidiary, division, or other entity.

II.

IT IS FURTHER ORDERED that respondent shall establish and maintain an information security program for the protection of personally identifiable information collected from or about consumers in connection with the advertising, marketing, offering for sale, or sale of any pharmaceutical, medical, or other healthrelated product or service, in or affecting commerce, by respondent’s Lilly USA division, directly or through any corporation, subsidiary, division, or other entity. Such program shall consist of: A. designating appropriate personnel to coordinate and oversee the program;

B. identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of personal information, including any such risks posed by lack of training, and addressing these risks in each relevant area of its operations, whether performed by employees or VOLUME 133 Decision and Order agents, including: (i) management and training of personnel; (ii) information systems for the processing, storage, transmission, or disposal of personal information; and (iii) prevention and response to attacks, intrusions, unauthorized access, or other information systems failures; C. conducting an annual written review by qualified persons, within ninety (90) days after the date of service of this order and yearly thereafter, which review shall monitor and document compliance with the program, evaluate the program’s effectiveness, and recommend changes to it; and D. adjusting the program in light of any findings and recommendations resulting from reviews or ongoing monitoring, and in light of any material changes to its operations that affect the program.

III.

IT IS FURTHER ORDERED that respondent shall for a period of five (5) years after the date of service of this order maintain and upon request make available to the Federal Trade Commission for inspection and copying a print or electronic copy of the following documents relating to compliance with Parts I and II of this order by respondent’s Lilly USA division, directly or through any corporation, subsidiary, division, or other entity: A. a sample copy of each different consumer-targeted print, broadcast, cable, or Internet advertisement, promotion, information collection form, Web page, screen, email message, or other document containing any representation regarding the Lilly USA division’s collection, use, and security of personal information from or about consumers. Each Web page copy shall be dated and contain the full URL of the Web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting the information on the Web. Provided, however, that after VOLUME 133 Decision and Order creation of any Web page or screen in compliance with this order, the Lilly USA division shall not be required to retain a print or electronic copy of any amended Web page or screen to the extent that the amendment does not affect its compliance obligations under this order; B. all reports, studies, reviews, audits, audit trails, policies, training materials, and plans, whether prepared by or on behalf of respondent, relating to the Lilly USA division’s compliance with the information security program required by Part II of this order; and C. any documents, whether prepared by or on behalf of the Lilly USA division, that contradict, qualify, or call into question its compliance with the information security program required by Part II of this order, maintained through reasonable efforts in accordance with a document retention program. IV.

IT IS FURTHER ORDERED that respondent Eli Lilly and Company, and its successors and assigns, shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities relating to the subject matter of this order. Respondent shall deliver this order to such current personnel within thirty (30) days after the date of service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities. V.

IT IS FURTHER ORDERED that respondent Eli Lilly and Company, and its successors and assigns, shall notify the Commission at least thirty (30) days prior to any change in the corporation that may affect compliance obligationsarising under this order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, VOLUME 133 Decision and Order parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which respondent learns less than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580. VI.

IT IS FURTHER ORDERED that respondent Eli Lilly and Company, and its successors and assigns, shall within one hundred and twenty (120) days after service of this order, and at such other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which they have complied with this order. This report shall include a copy of the initial annual review required by Part II.C of this order.

VII.

This order will terminate on May 8, 2022, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part in this order that terminates in less than twenty (20) years;

B. This order's application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

VOLUME 133 Decision and Order Provided, further, that if such complaint is dismissed or a federal court rules that the respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. By the Commission.

VOLUME 133 Analysis Analysis of Proposed Consent Order to Aid Public Comment The Federal Trade Commission has accepted, subject to final approval, an agreement containing a consent order from Eli Lilly and Company (“Lilly”).

The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. Lilly is a pharmaceutical company that manufactures, markets, and sells drugs, including the anti-depressant medication Prozac. To market Prozac, among other things Lilly operates the Prozac.com Web site, which the company promotes as “Your Guide to Evaluating and Recovering from Depression.” The Prozac.com site, like Lilly.com and several of Lilly’s other product Web sites, collects personal information from visitors. From March 2000 through June 2001, Lilly offered through Prozac.com a service called “Medi-Messenger,” which enabled its subscribers to receive individualized email reminders from Lilly concerning their Prozac medication or other matters. On June 27, 2001, Lilly sent a form email to subscribers to the service, which disclosed all of the subscribers’ email addresses to each individual subscriber by including all of their addresses within the “To:” entry of the message.

This matter concerns allegedly false or misleading representations, made through Lilly’s privacy policies and during the sign-up process for Medi-Messenger. The Commission’s proposed complaint alleges that Lilly claimed that it employs measures and takes steps appropriate under the circumstances to maintain and protect the privacy and confidentiality of personal information obtained from or about consumers through its VOLUME 133 Analysis Prozac.com and Lilly.com Web sites, when in fact Lilly had not employed such measures and had not taken such steps. As set forth in the complaint, Lilly’s unintentional June 27th disclosure of Medi-Messenger subscribers’ personal information (i.e., email addresses) resulted from its failure to maintain or implement internal measures appropriate under the circumstances to protect sensitive consumer information. For example, Lilly failed to provide appropriate training for its employees regarding consumer privacy and information security; failed to provide appropriate oversight and assistance for the employee who sent out the email, who had no prior experience in creating, testing, or implementing the computer program used; and failed to implement appropriate checks and controls on the process, such as reviewing the computer program with experienced personnel and pretesting the program internally before sending out the email. Lilly’s failure to implement appropriate measures also violated certain of its own written policies.

The proposed consent order contains provisions designed to prevent Lilly from engaging in similar acts and practices in the future.

The proposed order applies to the collection of personal information from or about consumers in connection with the advertising, marketing, offering for sale, or sale of any pharmaceutical, medical, or other health-related product or service by Lilly’s USA division.

Part I of the proposed order prohibits misrepresentations regarding the extent to which Lilly maintains and protects the privacy or confidentiality of any personally identifiable information collected from or about consumers. Part II of the proposed order requires Lilly to implement a four-stage information security program designed to establish and maintain reasonable and appropriate administrative, technical, and physical safeguards to protect consumers’ personal information against any reasonably anticipated threats or hazards to its VOLUME 133 Analysis security, confidentiality, or integrity, and to protect such information against unauthorized access, use, or disclosure. Specifically, Part II requires Lilly to: • designate appropriate personnel to coordinate and oversee the program;

• identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of personal information, including any such risks posed by lack of training, and to address these risks in each relevant area of its operations, whether performed by employees or agents, including: (i) management and training of personnel; (ii) information systems for the processing, storage, transmission, or disposal of personal information; and (iii) prevention and response to attacks, intrusions, unauthorized access, or other information systems failures; • conduct an annual written review by qualified persons, within ninety (90) days after the date of service of the order and yearly thereafter, which review shall monitor and document compliance with the program, evaluate the program’s effectiveness, and recommend changes to it; and • adjust the program in light of any findings and recommendations resulting from reviews or ongoing monitoring, and in light of any material changes to Lilly’s operations that affect the program.

Parts III through VI of the proposed order are reporting and compliance provisions. Part III requires Lilly’s retention of materials relating to its privacy and security representations and to its compliance with the order’s information security program. Part IV requires dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the order. Part V ensures notification to the FTC of changes in corporate status. Part VI mandates compliance reports, including a copy of the initial annual review required by Part II.C within one hundred and twenty (120) days after service of the order. Part VOLUME 133 Analysis VII is a provision “sunsetting” the order after twenty (20) years, with certain exceptions.

The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the agreement and proposed order or to modify their terms in any way.

VOLUME 133 Statement Concurring Statement of Commissioner Orson Swindle I am pleased with the consent agreement that the Commission has reached with Eli Lilly and Company. Lilly’s unfortunate and unintended disclosure of prescription drug users’ personal information has given us all the opportunity to evaluate how to improve upon security practices for confidential information. Lilly should be respected for its long-standing efforts in development of its privacy practices, its acceptance of responsibility for the internal failures that resulted in the alleged violation of its privacy policy, and its willingness to take appropriate steps to correct those mistakes. I appreciate the company’s leadership in cooperating with us to improve its security measures, and I believe the firm will fully carry out its commitments under the proposed order. Lilly’s responsiveness and its efforts to improve corporate privacy practices can be a model for others to follow.

VOLUME 133 Complaint