Data Brokers in the FTC’s Sights
posted by Danielle Citron
The ethos of our age is the more data, the better, and nowhere is that more true than the data-broker industry. Data-broker databases contain dossiers on hundreds of millions of individuals, including their Social Security numbers, property records, criminal-justice records, car rentals, credit reports, postal and shipping records, utility bills, gaming, insurance claims, divorce records, social network profiles, online activity, and drug- and food-store records. According to FTC Chairman Jon Leibowitz, companies like Acxiom are the ‘invisible cyberazzi’ that follow us around every where we go on- and offline, or as Chris Hoofnagle has aptly called them “Little Brothers” helping Big Brother and industry. Data brokers are largely unbridled by regulation. The FTC’s enforcement authority over data brokers stems from the Fair Credit Reporting Act (FCRA), which was passed in 1970 to protect the privacy and accuracy of information included in credit reports. FCRA requires consumer reporting agencies to use reasonable procedures to ensure that entities to which they disclose sensitive consumer data have a permissible purpose for receiving that data. Under FCRA, employers are required to inform individuals about intended adverse actions against them based on their credit reports. Individuals get a chance to explain inaccurate or incomplete information and to contact credit-reporting agencies to dispute the information in the hopes of getting it corrected. During the past two years, the FTC has gone after social media intelligence company and online people search engine on the grounds that they constituted consumer reporting agencies subject to FCRA. In June 2012, the FTC settled charges against Spokeo, an online service that compiles and sells digital dossiers on consumers to human resource professionals, job recruiters, and other businesses. Spokeo assembles consumer data from on- and offline sources, including social media sites, to create searchable consumer profiles. The profiles include an individual’s full name, physical address, phone number, age range, and email address, hobbies, photos, ethnicity, religion, and social network activity. The FTC alleged that Spokeo failed to adhere to FCRA, including its obligation to ensure the accuracy of consumer reports. Ultimately, it obtained a $800,000 settlement with the company. That’s helpful, to be sure, but given the FTC’s limited resources may not lead to more accurate dossiers. (It also may mean that employers will keep online intelligence in-house and thus their use of unreliable online information outside the reach of FCRA, as my co-blogger Frank Pasquale wrote so ably about in The Offensive Internet: Speech, Privacy, and Reputation). More recently,the FTC issued orders requiring nine data brokerage companies to provide the agency with information about how they collect and use data about consumers. The agency will use the information to study privacy practices in the data broker industry. The nine data brokers receiving orders from the FTC were (1) Acxiom, (2) Corelogic, (3) Datalogix, (4) eBureau, (5) ID Analytics, (6) Intelius, (7) Peekyou, (8) Rapleaf, and (9) Recorded Future. In its press release, the FTC explained that it is seeking details about: “the nature and sources of the consumer information the data brokers collect; how they use, maintain, and disseminate the information; and the extent to which the data brokers allow consumers to access and correct their information or to opt out of having their personal information sold.” The FTC called on the data broker industry to improve the transparency of its practices as part of a Commission report, Protecting Consumer Privacy in an Era of Rapid Change: Recommendations for Businesses and Policymakers. FTC Commissioner Julie Brill has been a tireless advocate for greater oversight over data brokers–here is hoping that her efforts and those of her agency produce important reforms.
February 1, 2013 at 4:20 pm
Posted in: Privacy, Privacy (Consumer Privacy)
Print This Post
Responses (1)
Frank - February 1, 2013 at 6:05 pm
Thanks for the shout-out!
This is a very important investigation, and I do hope we find out more about what the data brokers are doing.
I used to think that there should be strong intervention to stop them from creating reputations about data subjects based on health status. But I have a sense that the First Amendment will be used to stop such regulation. So the only remaining solution is probably to stop employers, insurers, and other important decisionmakers from using such reputational information in their decisionmaking about hiring, firing, raises, rates, etc. At some point there must be a line between speech (the collection and analysis of data) and conduct (use of data to influence a result).
Leave a Reply