Big data is big. So big in fact, Science Daily claimed in May that 90 percent of all the world’s data have been generated in the last two years. In early 2012, the New York Times’ Steve Lohr reported that the total amount of data in the entire world would double every two years from that point on. Much of these data are personal information. The same personal information that we now know the National Security Administration routinely and baselessly collects as part of its PRISM program. The same personal information that data brokers and other companies buy and sell and analyze with no little or no consent to consumers as part of an increasingly lucrative and largely unregulated industry.
These were among the facts highlighted in a keynote speech at the 23rd Computers Freedom and Privacy Conference in which Julie Brill, Commissioner of the Federal Trade Commission, made the argument that the very people to whom this personal information supposedly belongs have very little control over it. She proposes a plan called “Reclaim Your Name” under which the big data brokers – Acxiom premiere among them – should exist under conditions and scrutiny similar to those imposed upon the big credit firms – Equifax, Experian, and Transunion – by the Fair Credit Reporting Act of 1970 (FCRA).
We hemorrhage astonishing amounts of information in ways we don’t even think about. The things we buy, the places we go, the incredibly personal and hypochondriasis inspiring attempts we make to self-diagnose ourselves on Google, and everything in between and beyond. Governments, firms, and people amass this information with no consent, Brill says, and use it in surprising ways that consumers do not understand. This should not be the case, according to the FTC Commissioner, who claims that this information should be easily reviewable and revisable, like credit information, and that consumers should be able to opt out of certain kinds of data collection in a fashion similar to Do Not Track.
“Reclaim Your Name would give consumers the knowledge and the technological tools to reassert some control over their personal data – to be the ones to decide how much to share, with whom, and for what purpose – to reclaim their names,” Brill said. “[It] would empower the consumer to find out how brokers are collecting and using data; give her access to information that data brokers have amassed about her; allow her to opt-out if she learns a data broker is selling her information for marketing purposes; and provide her the opportunity to correct errors in information used for substantive decisions – like credit, insurance, employment, and other benefits.”
The FCRA made it so the groups that collect information from various sources and hand it over to other groups making decisions about housing, employment, credit, and insurance had to ensure that they collected accurate information and therefore, Brill claims, the FCRA has a number of elements capable of regulating parts of what the big data machine is pushing. The FTC has already warned criminal- and background-screening services that their businesses may fall within the authority of the FCRA and that they are required to give consumers notice, access, and correction rights.
There are grayer areas however that remain out of reach of regulation and ungoverned by U.S. law. One of them is an e-score system that seems to let companies selectively market only those customers that they are interested in. Brill’s concern is that this sort of marketing behavior could drive consumers to higher insurance or loan costs without any ability to challenge the accuracy of these reports or even know that they are the genesis of the prices they are paying in the first place.
In short, as part of Reclaim Your Name, Brill and the FTC are proposing that all handlers and sellers of data uniformly adopt policies of transparency that are understandable and allow users to easily navigate their data dossiers. Even in circumstances unrelated to those covered by the FCRA, consumers should be notified the ways their data is being used and given a choice to whether they want it to be used that way or not – whether the data is being used personal predictive retailing that targets consumers based collected data or if it is used in an analysis of infant behavior that leads to earlier recognition of infections in infants. The FTC’s policy would also force these companies to truly strip the information they collect of any identifiable element. All the data brokers claim to do this already, but it’s well known that it is very easy re-identify de-identified data. Brill says:
“They should do everything technically possible to strip their data of identifying markers; they should make a public commitment not to try to re-identify the data; and they should contractually prohibit downstream recipients from doing the same.”
