FTC Recommends Congress Enact Laws Requiring Data Broker Transparency

To further protect personal sensitive information, including health information, the Federal Trade Commission (FTC) has recommended that Congress require retailers and other consumer-facing entities to obtain affirmative express consent from consumers before such information is collected and shared with data brokers, according to an FTC news release. Data brokers operate with a fundamental lack of transparency about industry practices, according to the findings of an FTC report titled “Data Brokers – A Call for Transparency and Accountability.” Based on its findings, the FTC has asked Congress to consider enacting legislation that would make data broker practices more transparent to consumers and enable consumers to have more control over the personal information data brokers collect about them and sell.

The Report

The report arose from an FTC study of nine data brokers, representing a cross-section of the industry, to shed light on the data broker industry. Data brokers collect, analyze, and package sensitive personal information and resell the information to others without the direct knowledge of consumers. Personal information is collected from a wide range of sources for a variety of purposes, including verifying an individual’s identify, marketing products, and detecting fraud, according to the report. Information is obtained from government records such as from the Department of Motor Vehicles, and public voting records, commercial sources such as retailers, and other publicly available sources as well as from the Internet. Data brokers sell marketing products such as e-mail addresses and information about customer interests for advertising purposes. They also sell risk mitigation products which clients use to verify their customers’ identities or detect fraud. Other data brokers study people search websites for publicly available information about consumers.

Comments from Experts

In an interview for CBS News on March 9, 2014, FTC Commissioner Julie Brill, told correspondent Steve Kroft that most people have no idea that personally identifiable sensitive data about them is being collected. Tim Sparapani, Vice President, Law, Policy and Government Affairs at Application Developers Alliance, told Kroft that data brokers sell “lists of individuals in America who are afflicted with a particular disease,” psychiatric problems, a history of genetic problems, among other things. Sparapani explained that based on a series of data points the data broker bought and sold, they can determine a variety of personal information about an individual. He added that “most retailers are finding out that they have a secondary income, which is the data about their customers is probably just about as valuable, maybe even more so, than the actual product or service that they’re selling to the individual.” He also pointed out that data becomes more valuable when it is connected to personal information volunteered on the Internet. Though an individual may not give a real name, the IP and the computer ID are recorded and the data brokers can match the information without other online identifiers, Ashkan Soltani, an independent researcher and consultant who focuses on privacy, security, and behavioral economics explained to Kroft.