FTC Calls For Greater Data-Broker Transparency

Today, Big Data is all the rage, as retailers, banks and others in the payments and commerce ecosystems want to know more about their customers so they may support targeted promotions offering products and services most appropriate for them. Technology also is coming more into play, as “beacons,” for example, can identify when customers are within stores so merchants may send offers directly to their smartphones.

Information used to determine what to offer consumers often is gleaned not just from internal resources, but often also from large data brokers that collect vast amounts of useful tidbits, some of which individuals might not want shared. Many consumers, however, are unaware of the extent to which this information-gathering is going on.

Noting data brokers operate “with a fundamental lack of transparency,” the Federal Trade Commission last week called on Congress to enact legislation to make their practices more visible to consumers and to give consumers greater control their personal information.

The commission’s recommendations are based on the findings of an internal report, “Data Brokers: A Call for Transparency and Accountability,” that resulted from a study of nine data brokers representing a cross-section of the data broker industry. The nine data brokers in the study are Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf and Recorded Future. The FTC voted in December 2012 to issue orders requiring the companies to produce the information used in the study.

In a blog post, Jennifer Glasgow, who oversees Acxiom’s information-use policies, acknowledges that the privacy landscape is evolving as technology moves from primarily collecting and using data individuals consciously provide to collecting observed data about individual behavior. In recent years, the post notes, the FTC increasingly has been using “unfair and deceptive” powers arguments in Big Data cases.

“As enforcement increases, both the product and marketing departments of all organizations should get to know their privacy and compliance departments well,” Glasgow said. “Make them your partner, not you adversary.”

In the FTC’s announcement of its report’s findings and its call for congressional action, the commission noted that data brokers obtain and share vast amounts of consumer information, typically behind the scenes, without consumer knowledge. They then sell the information for marketing campaigns and fraud prevention, among other purposes. Although such data can help consumers, for example, find and enjoy the products and services they prefer, data-broker practices also raise privacy concerns, the commission said.

“The extent of consumer profiling today means that data brokers often know as much – or even more – about us than our family and friends, including our online and in-store purchases, our political and religious affiliations, our income and socioeconomic status, and more,” FTC Chairwoman Edith Ramirez said in the announcement. “It’s time to bring transparency and accountability to bear on this industry on behalf of consumers, many of whom are unaware that data brokers even exist.”

Citing an example, the FTC noted that one of the data brokers studied holds information on more than 1.4 billion consumer transactions and 700 billion data elements, and another adds more than 3 billion new data points to its database each month.

According to the FTC report, data brokers collect extensive amounts of information, ranging from consumer purchase data, social media activity, warranty registrations, magazine subscriptions, religious and political affiliations, and other details of consumers’ everyday lives. They then combine and analyze the information to make inferences about consumers, including potentially sensitive inferences such as those related to ethnicity, income, religion, political leanings, age, and health conditions.

Potentially sensitive categories from the study were “Urban Scramble” and “Mobile Mixers,” both of which include a high concentration of Latinos and African-Americans with low incomes. The category “Rural Everlasting” includes single men and women older than 66 with “low educational attainment and low net worths.” Other potentially sensitive categories included health-related topics or conditions, such as pregnancy, diabetes, and high cholesterol, the FTC said.

To the extent data brokers offer consumers choices about their data, the choices are largely invisible and incomplete, the commission said.

To help rectify a lack of transparency about data-broker industry practices, the commission encouraged Congress to consider enacting legislation that would enable consumers to learn of their existence and activities, and provide them with reasonable access to the information about them such entities hold.

For data brokers that provide marketing products, the FTC called on Congress to consider legislation requiring the creation of a centralized mechanism, such as an Internet portal, where data brokers can identify themselves, describe their information-collection and use practices, and provide links to access tools and opt-outs. The agency also recommended that data brokers or users of their data, such as retailers:

Give consumers access to their data, including any sensitive information, at a reasonable level of detail.

Require opt-out tools so consumers may suppress the use of their data.

Tell consumers that they derive certain inferences from raw data.

Disclose the names and/or categories of their data sources so consumers may correct wrong information with an original source.

Provide prominent notice to consumers when they share information with data brokers, along with the ability to opt-out of such sharing.

Further protect sensitive information, including health information, by requiring retailers and other consumer-facing entities to obtain affirmative express consent from consumers before such information is collected and shared with data brokers.

The FTC also called for legislation requiring consumer-facing companies to tell consumers which data broker’s risk-mitigation product was used to base limiting their ability to complete a transaction. It also recommended that data brokers be required to allow consumers access to the information used and provide the ability to correct it, as appropriate.

In addition, the commission asked Congress to require data brokers to allow consumers to access their own information, opt out of having the information included in a people-search product, disclose the original sources of the information so consumers can correct it, and disclose any limitations of an opt-out feature.

The Commission vote approving the issuance of the report was 4-0, with Commissioner Terrell McSweeny not participating. Commissioner Julie Brill issued a concurring statement.

Other recent Big Data reports include one from the Executive Office of the President, “Big Data: Seizing Opportunities, Preserving Values,” ad a White House Fact Sheet on Big Data and privacy. The president’s Council of Advisors on Science and Technology also examined current and likely future capabilities of key technologies, both those associated with the collection, analysis, and use of big data, and those that can help to preserve privacy.