Big Data is the term used to describe the enormous datasets that are beyond the ability of most software to process. Statistical analysis of these giant data sets can allow the holder to predict baseball outcomes (think Moneyball), pregnancy and, apparently, the stock market.
These enormous data sets however, are made up of data pertaining to individuals and the data brokers who amass these data sets have been less than forthcoming about the personal information they hold, raising privacy concerns.
This is the conclusion of a U.S. Federal Trade Commission (“FTC”) report last week which found “data brokers operate with a fundamental lack of transparency”. The FTC recommended that Congress consider enacting legislation to make data broker practices more visible to consumers and to give consumers greater control over the immense amounts of personal information collected about them and shared by data brokers.
The report, “Data Brokers: A Call for Transparency and Accountability” examines the activities of nine representative data brokers. While the FTC concludes that there are consumer benefits from data broker practices, it also cautions:
The extent of consumer profiling today means that data brokers often know as much – or even more – about us than our family and friends, including our online and in-store purchases, our political and religious affiliations, our income and socioeconomic status, and more…It’s time to bring transparency and accountability to bear on this industry on behalf of consumers, many of whom are unaware that data brokers even exist.
The risk to consumers is that the information held by data brokers is often outdated, inaccurate or used to make decisions about the individual to whom it pertains, often unbeknownst to the that person. The example the FTC gives is around “Biker Enthusiasts.” If you fall into this category, you can expect to be targeted for road gear, bike discounts and helmet advertisements. However, insurance companies may use an interest in motorcycles to infer you engage in “risky behaviour” and your premiums will be higher than those of your non-Biker Enthusiast neighbour.
The FTC also had difficulty with the fact that the data is often stored “indefinitely” and used for numerous unidentified purposes, something of particular note given the recent European decision ordering Google to implement a mechanism to allow people to invoke their “right to be forgotten”.
The FTC outlines the areas that it wants Congress to address. Many of these items will not come as a surprise to Canadian and European companies, as their respective laws already include many, if not all, of these features.
For data brokers that provide marketing products, the FTC recommends that legislation should:
- Require the creation of a centralized portal where data brokers can identify themselves, describe their information collection and use practices, and provide links to access tools and opt- outs;
- Require data brokers to give consumers access to their data, including any sensitive data, at a reasonable level of detail;
- Require opt-out tools as a way for consumers to suppress the use of their data;
- Require data brokers to tell consumers that they derive certain inferences from raw data;
- Require data brokers to disclose the names and/or categories of their data sources, to enable consumers to correct wrong information with an original source;
- Require consumer-facing entities – such as retailers – to provide prominent notice to consumers when they share information with data brokers, along with the ability to opt-out of such sharing; and
- Require further protection for sensitive information, including requiring retailers and other consumer-facing entities to obtain affirmative express consent from consumers before such information is collected and shared with data brokers.
For brokers that provide “risk mitigation” products, the FTC recommends that legislation should:
- require the consumer-facing company to tell consumers which data broker’s information the company relied on when it is used to limit a consumers’ ability to complete a transaction; and
- Require the data broker to allow consumer access to the information used and the ability to correct it, as appropriate.
For brokers that provide “people search” products, the FTC recommends that legislation should:
- Require data brokers to allow consumers to access their own information, opt-out of having the information included in a people search product, disclose the original sources of the information so consumers can correct it, and disclose any limitations of an opt-out feature.
While the Report is only a recommendation, it represents a fairly aggressive stance on the part of the FTC, which has called repeatedly on advertisers to self-regulate in the area of data collection. This Report instead calls directly for legislation requiring transparency and accountability from data brokers and the availability of access and correction rights for consumers. While the Report is limited to a specific area (consumer information held by data brokers) it signals the position the FTC may take in other related areas.