---

An investigation at the end of May by The Observer, a sister paper to The Guardian, found a covert tracking tool was being used by the websites of 20 NHS trusts to collect browsing information and share it with the tech giant in a major breach of privacy.

The Meta Pixel tool passed on intimate details about patients to Facebook, including private health records, without people’s consent. The data obtained can be used by the social media giant’s parent company, Meta, for business purposes, including targeted advertising.

The tool can track pages viewed and keywords searched. The data – which included information about patients’ medical conditions, appointments and treatments – was matched to the user’s IP address, enabling it to be linked to individuals in a significant breach.

Many of the trusts said they installed the tracking pixels to monitor recruitment or charity campaigns and were not aware that they were sending patient data to Facebook.

Earlier this month, Meta was fined 1.2 billion euro (£1 billion) and ordered to stop transferring user data from European users to its US servers. The record fine was levied by Ireland’s Data Protection Commission (DPC) after a 3-year probe into the social media giant.

According to The Observer, 17 of the 20 NHS trusts found to be using Meta Pixel confirmed they had pulled the tracking tool from their websites over the weekend.  Digital Health has a list of the 20 trusts affected.

An NHS spokesman told Digital Health: “NHS trusts are responsible for their own websites, and they must follow data protection laws about the use of cookies on their websites. The NHS is looking into this issue and will take further action if necessary.”

Read more:

• NHS Trusts Shared Private Patient Information with Facebook, Medscape UK, 30 May 2023
• NHS could take action against trusts for Facebook breach – spokesman, Digital Health, 31 May 2023