Collection of personal data by the cigarette manufacturer Philip Morris

On November 2, 2020, a complaint was filed in the New York court by a former consultant of Philip Morris International (PMI)[1]The complaint reveals some questionable business practices such as the manufacturer's insecure storage of consumers' personal data.

In 2018, an online platform owned by PMI that stored survey results and information from its suppliers suffered a serious security breach, leaving the data accessible without credentials and without any control.

This vulnerability has provided an opportunity to highlight the business practices used by tobacco company Philip Morris. The current complaint primarily raises the issue of compliance of the manufacturer's practices with the General Data Protection Regulation (GDPR) and other international user security codes of conduct aimed at protecting personal data.

The tobacco giant is building a database of IQOS customers. Upon purchasing an IQOS device, the customer's personal information is requested. The app installed on the phone then allows the user to connect the device via Bluetooth to their device and receive notifications.

Furthermore, this complaint highlights certain promotional methods for the manufacturer's new heated tobacco device "IQOS". Unlike traditional tobacco products, these new products easily allow the collection of personal data from customers or people connected with the brand, as well as information on their smoking habits.[2]-[3].

This data collection is part of a direct marketing and product promotion approach. According to Shiro Masaoka, a former Philip Morris Japan employee, the app could extract information about the device user's smoking habits and use it for marketing purposes. This data would include average daily consumption but could even be refined to the user's number of puffs.

These elements are confirmed by a Canadian company specializing in technological devices, TechInsights Inc. The company, which analyzed the components of the IQOS for the media Reuters, claims that IQOS is equipped with two chips, one of which, with modifications made to the device, could store usage information transmitted to Philip Morris. Based on the product description of the chips used, the data could include details such as the number of puffs taken by a user and the number of times a person smoked with the device in a given day.