The Federal Trade Commission (FTC) published on May 27 a report on “Data Brokers: A Call for Transparency and Accountability” which details data brokers practices and recommends legislation to regulate the Big Data industry.
The FTC used its power provided by section 6(b) of the Federal Trade Commission Act to issue identical Orders to File Special Reports to nine data brokers, representatives of the industry, and to seek information about their data collection and use practices. The FTC used their answers to write the report.
What is a data broker?
There are three main categories of data brokers services: marketing services, risk mitigation services, or people search services. This personal data industry is quite successful, as all these products “generated a combined total of approximately $426 million in annual revenue in 2012 for the nine data brokers” (p. 23).
The FTC’s complaint against Spokeo, where the FTC alleged that data broker Spokeo had breached the Fair Credit Reporting Act (FCRA), provides a glimpse into what may be a data broker business model:
“Spokeo assembles consumer information from “hundreds of online and offline sources,” such as social networking sites, data brokers, and other sources to create consumer profiles, which Defendant promotes as “coherent people profiles” and “powerful intelligence.”These consumer profiles identify specific individuals and display such information as the individual’s physical address, phone number, marital status, age range, or email address, Spokeo profiles are further organized by descriptive headers denoting, among other things, a person’s hobbies, ethnicity, religion, or participation on social networking sites, and may contain photos or other information, such as economic health graphics, that Spokeo attributes to a particular individual.”
It should be noted that collecting data that way is legal, as are the activities of the nine data brokers which participated in the FTC review of their industry. .
How is Data Collected?
Data brokers do not only collect personal data directly from consumers, but also from a variety of sources. Some are government sources, such as public licensing, real estate records or court records. Some are online sources, such as social media sites or blogs. Others are commercial sources, such as information provided by a consumer when purchasing an item online. Brokers acquire data ownership of the data, contract to use it for a limited period, or only acquire the right to resell the data (p. 16).
How Data Brokers Develop their Products
After collecting personal data, data brokers use the information to create derivative products, such as lists of consumers sharing the same characteristics or interests. They do so by inferring that, because a particular person likes something or has made a particular purchase, then this person has an interest in an activity or product, or is part of a group, such as ““Financially Challenged” (p.25). This is the part that I find the most troubling, because inferring something about an individual reduces his or her personality, is dehumanizing, and may lead to discrimination. \However, in the data brokers’ world, we all end up in little boxes, such as “Allergy Sufferer” or “Modest Wages” based on assumptions.
How is the Data Used?
These profiles can be used by third parties for marketing and risk mitigation purposes, or to search for people. If the data is used for marketing purposes, it allows a site to customize the pages viewed when a consumer visits it, or it can be used to gain knowledge of users‘interests in order to sell advertising space. The report also explains how data brokers are able to connect the dots between consumers’ online and offline interests. The process is called “onboarding” (p.27-30).
If data is used for risk mitigation purposes, it may allow third parties to verify the identity of a particular person or to prevent fraud. For instance, data brokers may provide their clients with a quiz about a particular user, which asks simple questions such as “what is your mother’s birthday?” to verify if the user is indeed who he claims he is.
Consumers Should Have More Control Over Their Data
Consumers do benefit from the work of data brokers, as their products can be used to prevent fraud and identity theft or to deliver tailored advertisements (p.47). However, while data brokers collect and aggregate consumers’ personal information on a large scale, and then sell this information to third parties, most consumers are not aware of this use of their data, nor which data is collected and how, even as this is done on such a massive scale.
The FTC Protecting Consumer Privacy in an Era of Rapid Change report, published in March 2012, already recommended that data brokers provide consumers with reasonable access to their data. In the 2014 report, the FTC found that out of the nine data brokers selling marketing products, only four provide consumers with access to certain limited information. These four data brokers also allow consumers to opt out of the use or sharing of their personal information for marketing purposes (p.43), but only two of them allow consumers to correct their information (p.42).
Two of the data brokers providing people search services give consumers an opt-out option. None of these particular brokers provide an option to delete information, as “such measures would be futile” according to them because, since they automatically refresh their data by web crawling or other similar methods, the same information as the one deleted would appear again on the Internet and in their databases (p.45). This casts further doubt as to whether a ‘right to be forgotten’ is even possible.
Current Legislation
The Fair Credit Reporting Act (FCRA) is a federal law enacted in 1970 to regulate the consumer reporting industry. The FCRA regulates consumer credit reports, which are defined as “any written [or] oral communication of any information by a consumer reporting agency, bearing on a consumer’s credit worthiness, (…) general reputation, personal characteristics, or mode of living which is used or expected to be used or collected (…) for the purpose as a factor in establishing the consumer’s eligibility for credit or insurance to be used primarily for personal, family, or household purposes; (…) employment purposes; or(…) any other purpose” such as issuing a license, 15 U.S.C. § 1681a(d)(1). As defined, the FCRA applies to some of the data brokers’ activities, but not to all. For instance, if data brokers ‘products are used as risk mitigation products, but only to confirm a person’s identity, not to determine his eligibility, the FCRA does not apply.
Legislative Recommendations
The FTC deplored “a fundamental lack of transparency about data broker industry
practices” (p.49). While data is collected on a massive scale, consumers are not aware of how data is collected, analyzed, and which information is inferred based on this data. This is why the FTC “ unanimously recommends that Congress should consider enacting legislation that would enable consumers to learn of the existence and activities of data brokers and provide consumers with reasonable access to information about them held by these entities” (p. 49).
The FTC recommended legislation requiring data brokers to give consumers (1) access to their data and (2) the ability to opt out of having it shared for marketing purpose. Such access should include any sensitive data, and should be at “a reasonable level of detail” that is,“enough detail that a consumer can see the breadth of categories the data broker has about them, including any sensitive data.”
The FTC also recommends legislation requiring data brokers to clearly disclose to consumers that they use the data and that they make some inferences based on this data. The FTC also recommends legislation requiring data brokers “to clearly disclose the names and/or categories of their data sources, so that consumers are better able to determine if, for example, they need to correct their data with an original public record source” (p.52).
The FTC also unanimously recommended legislation requiring data brokers offering people search products to:
(1) allow consumers to access their own information;
(2) allow consumers to opt out of the use of this information;
(3) clearly disclose to consumers the data brokers’ sources of information, so that, if possible, the consumer can correct his or her information at the source; and
(4) clearly disclose any limitations of the opt out, such as the fact that close matches of an individual’s name may continue to appear in search results.
Best Practice Recommendations
The FTC called on all data brokers to adopt the principles in the 2012 FTC Privacy Report, which proposed a privacy framework focusing on three principles, privacy by design, simplified consumer choice and transparency. Privacy by design means that one considers privacy issues at every stage of product development.
What’s Next?
In its report on the practices of data brokers published in September 2013, the U.S. Government Accountability Office had also called on Congress to enact legislation to regulate the data broker industry. The White House published last month a report on Big Data: Seizing Opportunities, Preserving Values, where it notes that Big Data may lead to discrimination and states that “[w]e must begin a national conversation on big data, discrimination, and civil liberties” (p.64 of the White House report).
Senators Jay Rockefeller and Ed Markey have introduced last February the “Data Broker Accountability and Transparency Act” bill. The Act requires data brokers to establish procedures to ensure the accuracy of data collected, assembled and maintained. The Act would also give consumers the power to review and to correct personally identifiable information. This would be done through a web site and data brokers would have to place a clear and conspicuous notice on that site telling consumers ow they can review their personal information and how they can express their preference about its use for marketing purposes. Consumers would also have the power to correct their information.
This bill has been referred to the Committee on Commerce, Science, and Transportation. Similar bills are likely to be introduced following the FTC report.
Image is courtesy of Flickr user Philippe Put under a CC BY 2.0 license
by 
