This post was written by Frederick Lah and Michael E. Strauss.
On May 27, 2014, the FTC released its report “Data Brokers: A Call for Transparency and Accountability”. In the report, the FTC advocates for more transparency from data brokers, defined in the report as “companies that collect consumers’ personal information and resell or share that information with others.”
Expounding upon findings from its 2012 privacy report, and gleaning new information from nine data brokers, the Commission’s latest paper characterizes data brokers and their products as both beneficial and risky to consumers. While the FTC did acknowledge that data brokers’ marketing products – for example, the sale of consumer data to businesses – “improve product offerings, and deliver tailored advertisements to consumers,” its praise of the industry was short-lived. Instead, the FTC emphasized risk, noting that data brokers are storing delicate consumer information, which in the event of a security breach could expose consumers to fraud, theft, and embarrassment. As the report describes, “identity thieves and other unscrupulous actors may be attracted to the collection of consumer profiles that would give them a clear picture of the consumers’ habits over time, thereby enabling them to predict passwords, challenge questions, or other authentication credentials.”
Perhaps the FTC’s most significant finding – the one driving its push for legislation – is its determination that consumers have little access or control over their information once data brokers obtain it. Since consumer information is gathered, analyzed, and disseminated from and to a variety of sources, and because data brokers are not consumer-facing entities, the FTC believes that it is virtually impossible for consumers to trace their personal data back to where it originated. For example, according to the FTC, some data brokers are creating detailed individual consumer profiles that may include sensitive inferences about consumers, such as their ethnicity, income levels, and health information. If a consumer is denied the ability to complete a transaction based on such profiles, the consumer would have no way of knowing why he or she was denied, and would therefore not be able to take steps to prevent the problem from recurring. As a result, and in light of the foregoing, the Commission contends that the data broker industry is insulated from accountability, and proposes that Congress adopt the following legislative recommendations:
- Give consumers an easy way to identify which data brokers have their information, and establish a mode of contact and ability to control such data
- Force data brokers to disclose the type of information they acquire and subsequently sell to businesses
- Require that data brokers disclose the original source of the data
- Require businesses that share consumer data with data brokers to give notice of such, and allow consumers to prevent businesses from doing so
If Congress were to adopt the FTC’s recommendations, the data broker industry would be widely affected. Not only would data brokers be subject to additional requirements, but businesses on the sale and buy side of the industry would also be subject to greater transparency requirements. We will be following this issue closely to see if and how Congress acts.