The Federal Trade Commission is urging Congress to provide new legislation it says is needed to demand greater transparency and consumer control over the information collected by data brokers.

A report issued this week by the FTC, “Data Brokers: A Call for Transparency and Accountability,” studied how these firms obtain and share consumer information, typically behind the scenes and without consumer knowledge, for marketing campaigns and fraud prevention. Raising privacy concerns, the report finds that data brokers collect and store billions of data elements covering nearly every U.S. consumer. For example, one of the brokers studied holds information on more than 1.4 billion consumer transactions and 700 billion data elements and another adds more than 3 billion new data points to its database each month.

Among the report's findings are that data brokers collect consumer data from extensive online and offline sources, largely without consumers' knowledge, ranging from consumer purchase data, social media activity, warranty registrations, magazine subscriptions, religious and political affiliations, and other details of everyday lives. This information often passes through multiple layers of data brokers sharing data with each other. Seven of the nine data brokers in the Commission study shared information with another data broker researched for the study.

Data brokers combine and analyze data about consumers to make inferences about them, including potentially sensitive inferences such as those related to ethnicity, income, religion, political leanings, age, and health conditions,” the report says. The category “Rural Everlasting,” for example, includes single men and women over age 66 with “low educational attainment and low net worth.” Other potentially sensitive categories include health-related topics or conditions, such as pregnancy, diabetes, and high cholesterol.

Many of the purposes for which data brokers collect and use data pose risks to consumers, such as unanticipated uses of the data. For example, the category "Biker Enthusiasts” could be used to offer discounts on motorcycles to a consumer, but could also be used by an insurance provider as a sign of risky behavior, the report suggests.

The FTC is urging Congress to consider legislation that would enable consumers to learn of the existence and activities of data brokers and provide consumers with reasonable access to information about them held by these entities. For data brokers that provide marketing products, it urges Congress to consider legislation to:

Require the creation of a centralized Internet portal, where data brokers can identify themselves, describe their information collection and use practices, and provide links to access tools and opt-outs.

Require data brokers to give consumers access to their data, including any sensitive data, at a reasonable level of detail.

Require opt-out tools and a way for consumers to suppress the use of their data.

Require data brokers to tell consumers that they derive certain inferences from raw data.

Require data brokers to disclose the names and categories of their data sources, to enable consumers to correct wrong information with an original source.

Require consumer-facing entities – such as retailers – to provide prominent notice to consumers when they share information with data brokers, along with the ability to opt-out of such sharing.

Further protect sensitive information, including health information, by requiring retailers and other consumer-facing entities to obtain affirmative express consent from consumers before information is collected and shared with data brokers.

For brokers that provide “risk mitigation” products, suggested legislation should require the data broker to allow consumer access to the information used and the ability to correct it, as appropriate.

For brokers providing “people search” products, legislation could require data brokers to allow consumers to access their own information, opt-out of having the information included in a people search product, disclose the original sources of the information so consumers can correct it, and disclose any limitations of an opt-out feature.                

The data brokers studied in the report were Acxiom, CoreLogic, Datalogix, eBureau, ID Analytics, Intelius, PeekYou, Rapleaf, and Recorded Future. In December 2012, FTC commissioners voted to issue orders requiring these firms to produce the information that was used in the study.

Topics