Written By Thomas Ahearn
The Federal Trade Commission (FTC) has issued a report – “Data Brokers: A Call for Transparency and Accountability” – that claims data brokers operate with a fundamental lack of transparency and recommends Congress consider enacting legislation to make data broker practices more visible to consumers and to give consumers greater control over their personal information collected and shared by data brokers. The FTC report, the result of a study of nine data brokers representing a cross-section of the industry, is available at http://www.ftc.gov/system/files/documents/reports/data-brokers-call-transparency-accountability-report-federal-trade-commission-may-2014/140527databrokerreport.pdf.
“The extent of consumer profiling today means that data brokers often know as much – or even more – about us than our family and friends, including our online and in-store purchases, our political and religious affiliations, our income and socioeconomic status, and more,” FTC Chairwoman Edith Ramirez stated in a press release available at http://www.ftc.gov/news-events/press-releases/2014/05/ftc-recommends-congress-require-data-broker-industry-be-more. “It’s time to bring transparency and accountability to bear on this industry on behalf of consumers, many of whom are unaware that data brokers even exist.”
The FTC report found that data brokers collect and store billions of data elements covering nearly every U.S. consumer. Just one of the data brokers studied held information on more than 1.4 billion consumer transactions and 700 billion data elements and another adds more than 3 billion new data points to its database each month. Data brokers obtain and share vast amounts of consumer information, typically behind the scenes and without consumer knowledge, and sell this information. Although consumers may benefit from data brokers in some situations, data broker practices also raise privacy concerns.Among the report’s findings:
- Data brokers collect consumer data from extensive online and offline sources, largely without consumers’ knowledge.
- Consumer data often passes through multiple layers of data brokers sharing data with each other.
- Data brokers combine online and offline data to market to consumers online.
- Data brokers combine and analyze data about consumers to make inferences about them, including potentially sensitive inferences such as those related to ethnicity, income, religion, political leanings, age, and health conditions.
- Many of the purposes for which data brokers collect and use data pose risks to consumers, such as unanticipated uses of the data.
- Some data brokers unnecessarily store data about consumers indefinitely, which may create security risks.
- To the extent data brokers currently offer consumers choices about their data, the choices are largely invisible and incomplete.
In the report, the FTC encourages Congress to consider enacting legislation that would enable consumers to learn of the existence and activities of data brokers and provide consumers with reasonable access to information about them held by these entities to help rectify a lack of transparency about data broker industry practices. For data brokers that provide marketing products, Congress should consider legislation to:
- Require the creation of a centralized mechanism, such as an Internet portal, where data brokers can identify themselves, describe their information collection and use practices, and provide links to access tools and opt- outs;
- Require data brokers to give consumers access to their data, including any sensitive data, at a reasonable level of detail;
- Require opt-out tools, that is, a way for consumers to suppress the use of their data;
- Require data brokers to tell consumers that they derive certain inferences from from raw data;
- Require data brokers to disclose the names and/or categories of their data sources, to enable consumers to correct wrong information with an original source;
- Require consumer-facing entities such as retailers to provide prominent notice to consumers when they share information with data brokers, along with the ability to opt-out of such sharing; and
- Further protect sensitive information, including health information, by requiring retailers and other consumer-facing entities to obtain affirmative express consent from consumers before such information is collected and shared with data brokers.
For data brokers that provide “risk mitigation” products, legislation should:
- When a company uses a data broker’s risk mitigation product to limit a consumers’ ability to complete a transaction, require the consumer-facing company to tell consumers which data broker’s information the company relied on;
- Require the data broker to allow consumer access to the information used and the ability to correct it, as appropriate.
For data brokers that provide “people search” products, legislation should:
- Require data brokers to allow consumers to access their own information, opt-out of having the information included in a people search product, disclose the original sources of the information so consumers can correct it, and disclose any limitations of an opt-out feature.
In December 2012, the FTC voted to issue orders requiring the nine data brokers used in the study – Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf, and Recorded Future – to produce the information found in the study. More information about these orders from the FTC – the agency that works for consumers to prevent fraudulent, deceptive, and unfair business practices – is available at http://www.ftc.gov/news-events/press-releases/2012/12/ftc-study-data-broker-industrys-collection-use-consumer-data.
In April 2014, two data brokers that sell public record information about consumers agreed to settle FTC charges that they violated the Fair Credit Reporting Act (FCRA) by allegedly providing reports about consumers to users such as prospective employers and landlords without taking reasonable steps to make sure that they were accurate or that their users had a permissible reason to have those reports. More information is available at http://www.ftc.gov/news-events/press-releases/2014/04/two-data-brokers-settle-ftc-charges-they-sold-consumer-data.
Attorney Lester Rosen, Founder and CEO of Employment Screening Resources® (ESR), commented on the difference between data brokers and professional background screening companies like ESR: “A professional background screening firm is not a data broker. A professional screening firm does not store data for future use or re-use past data but prepares each background check report when requested based upon the most current information. A CRA may access some information from data brokers as a secondary research tool for purposes of determining where to do additional searching, but a professional background screening firm has an obligation to verify that any information reported is complete, accurate, and up to data as of the time it is reported.”
More Information about Data Brokers
Employment Screening Resources® (ESR) – “The background Check Authoirty®” – is a nationwide background screening firm accredited by the National Association of Professional Background Screeners® (NAPBS). For more ESR News blogs about data brokers, visit http://www.esrcheck.com/wordpress/tag/data-broker/.
The post FTC Issues Report Examining Data Brokers appeared first on ESR News Blog.