Data Broker Legislation

Data brokers, who are they and how do they impact your privacy?

Data brokers work for companies that collect information about people from a wide range of sources in order to make a personal profile. These profiles are then sold to companies that desire personal information in order to market product.

Data brokers sell complied personal data to other companies (including other data brokers), organizations, government agencies, or other persons.  In some cases, they exchange this information under cooperative arrangements rather than sell it.  In other instances, they provide the information at no cost, making money through advertising or referrals.

The Federal Trade Commission (FTC) has defined data brokers as “companies that collect information, including personal information about consumers, from a wide variety of sources for the purpose of reselling such information to their customers for various purposes, including verifying an individual’s identity, differentiating records, marketing products, and preventing financial fraud.”  Protecting Consumer Privacy in an Era of Rapid Change (March 2012) at page 68.

Where do data brokers get your personal information?

1. Data brokers can get information from a wide range of public records such as court filings, real property and tax assessor records; mortgages, driver’s license records, motor vehicle records, voter registrations, telephone directories, real estate listings, birth, marriage, divorce and death records, professional license filings, recreational (hunting and fishing) licenses, and census demographic information.
2. Self reported information such as contest entries, sweepstakes and warranty cards.
3. Social media such as Facebook. Data brokers can use these sites to gain access to a user's name, gender, location, and level of education.  
4. Cooperative arrangements in which companies will exchange existing information about their customer for additional information gathered by data brokers.
5. Buying information from other data brokers, retailer or financial institutions. This may include consumer's’ web browsing activities from online advertising networks, data about purchases from retailers, catalog companies and magazines and data from websites where consumers register or login to obtain services, such as retail, news, and travel sites

Privacy concerns

The general population is largely unaware that their data is being collected and stored.  Data broker companies prefer it this way. Data brokers are largely unregulated. If the population had a better understanding of what was being done with their data, it is likely there would be more concern.  

A good example a data brokers company is Ebureau. This is a company you may remember from a video by Professor Dryer.  This company is one of the top data collecting companies. Before this class I had never heard of it. Ebureau knows everything about us. Ebureau creates what is called an Escore, an Escore is like a credit score, except a Escore contains a lot more information. This information is then sold to companies who use it to decide if someone will be a profitable customer.

Companies can use this information to discriminate against users. They don’t just use cold hard facts either. Data brokers are notorious for inferring details based on the information gathered. Here is an example: if a user belongs to a data segment called “Biker Enthusiasts” that offers motorcycle related coupons to its customers, an insurance company using that same segment might infer that the consumer engages in risky behavior. Thus, information compiled by data brokers can seriously affect someone's life yet only one of the major data broking companies allows users to correct inaccurate data that has been compiled about them.

There are benefits of data brokers. Data brokers help create targeted ads which are efficient to both the company and the consumer. Data brokers also help prevent fraud. Four of the major data broking companies sell risk mitigation products. These products help companies ensure that Jane Doe of 123 Main street who wants to buy a boat is actually Jane Doe.

What is being done to protect user privacy?

The FTC first became concerned with the inner workings of data brokers in 1990. After conducting a thorough investigation the FTC suggested to congress that something should be done to increase transparency in the data broking business. Despite this, no legislations was enacted.

In 2012 the FTC tried to redirect interest in data brokers by issuing a report. This report called for more transparency in the data broker business, this report suggested that data brokers create a centralized website that anyone could access. This website would identify data broker companies, detailing their data gathering methods, as well as how the data are being used. This website would also give users the opportunity to correct incorrect data on them or opt out of having their information used completely.  

The FTC also issued administrative subpoenas to nine data broker companies: Acxiom, Corelogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf, and Recorded Future. This subpoena requires these companies to respond to a detailed set of information requests. The Orders requested detailed information regarding the data brokers’ practices, including the nature and sources of consumer data they collect; how they use, maintain, and disseminate the data; and the extent to which the data brokers allow consumers to access and correct data about them or to opt out of having their personal information sold or shared. Their response has not yet been made public.

Congress has had a much more proactive responses to the FTC’s latest findings then it did in 1990. In 2014 a bill was introduced in an effort to protect consumer privacy. This bill did not make it through the Senate but a similar bill was introduced in 2015 by Edward Markey.

The “Data Broker Accountability and Transparency Act of 2015.”

“Prohibits data brokers from obtaining or causing to be disclosed personal information or any other information relating to any person by making a false, fictitious, or fraudulent statement or representation, including by providing any document that the broker knows or should know to: (1) be forged, counterfeit, lost, stolen, or fraudulently obtained; or (2) contain a false, fictitious, or fraudulent statement or representation.”

Senator Markey stats that the data broker industry is a  "shadow industry of surreptitious data collection that has amassed covert dossiers on hundreds of millions of Americans, Data brokers seem to believe that there is no such thing as privacy." In addition, co-sponsoring Senator Richard Blumenthal (D - Conn) thinks that brokers are "insidious, invisible threats" to privacy.

The Direct Marketing Association, a trade group that represent data brokers, believes that brokers are taking steps on their own to improve transparency and that the industry should be self-regulating.

While the Data Broker  Accountability and Transparency Act requires that the FTC set up a website for consumers to make some decisions regarding their personal data, it requires the  FTC to proffer specific rules about how this is done. This is a standard method used by the Congress to get things done. The Congress lays out concepts and a plan of action and then requires a department of the executive branch to specify regulations through a public process.

There are two failings to this approach. The first is that the public process involved in rulemaking favors industry. In order for consumers to contribute to the making of rules and statutes through a public process, they must be involved and knowledgeable. This is difficult for individual consumers. On the other hand, industry has resources and can hire analysts and lobbyist to engage in these processes, follow process and influence the making of statutes.

The second failing is that industry self-regulation is an historic myth. The history of industry in the United States is that of aggressive marketing and innovation. This has led to centuries of economic growth. Occasionally however, government regulation is necessary. Information is a commodity and can be privately owned and traded on the market. But personal informations is naturally owned by individuals and should be traded at the behest of the owner and under conditions the owner specifies.

The Data Broker Accountability and Transparency Act, therefore is flawed in that it doesn’t specifically recognize that individuals own their own data. The act should require that data be kept by the individual unless contracted for otherwise.