Data Broker Practices in the Crosshairs
Last week CDT asked the FTC and several state AGs to end the deceptive business practices of Spokeo.com and to crack down on bad data broker practices in-general using existing fair credit reporting laws. Spokeo offers a "people search" service where you can find extremely detailed profiles about millions of Americans. Because these profiles also purportedly include information about person's credit and are explicitly marketed to employers, we argue that Spokeo is bound by the terms of the Fair Credit Reporting Act (FRCA), and should offer the consumer and privacy protections available under that law. Spokeo doesn't offer any of those protections, and we believe that puts them in violation of the law.
The FRCA was passed in 1970, in response to a pattern of abuse in the consumer reporting industry. Many data brokers at that time were selling incorrect and outdated information about consumers, including assessments of consumers' lifestyle, such as sexual orientation, relationship status, and the dubious category of "cleanliness." Congress responded by passing a law to address these problems, finding:
• Consumer reporting agencies have assumed a vital role in assembling and evaluating consumer credit and other information on consumers.
• There is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy.
FCRA is built on a simple idea: if a data broker is going sell the profiles and assessments of consumers there should be protections in place to guarantee that the information is correct. These baseline protections include a consumers' right to access the information a data broker has assembled about them, and to petition to correct inaccuracies. The law limits how long negative information can be reported, and requires brokers to give the data out only to persons with a legitimate business purpose. If someone makes an adverse determination about an individual based on the consumer report, the consumer has to be told why and given the chance to correct any misinformation that might have weighed on the negative decision. The law was written for two primary purposes, credit and employment; however, FCRA's protection extends to reports used for a wide range of other important activities as well.
Spokeo has responded to our complaint by saying that FCRA doesn't apply to them. They say their "credit estimates" aren't really based on facts about the individual, and therefore they're not really credit assessments. How Spokeo figures out its ratings isn't relevant — they're still marketing them as "credit estimates," and they're still marketing them to employers. That the reports are essentially worthless may make them deceptive — a separate violation of the law — but it doesn't mean the law concerning credit estimates doesn't apply to them.
Spokeo's defense is, however, representative of the data broker industry as a whole. There are dozens — if not hundreds — of other Spokeo-like businesses out there—online and off-line—which gather and sell detailed profiles about consumers without their permission or understanding. Like Spokeo, these data brokers may include disclaimers saying that these profiles are not regulated by FRCA, all the while marketing them for important business purposes. In response to the passage of FCRA, a shadow data broker industry sprung up, purporting to operate outside Act's structure, but offering in many cases the same data and conclusions about consumers, only without any of FRCA's legal protections.
Today, it is unclear under the law how far FCRA's protections apply — the law is murky, and some data brokers are taking advantage of this uncertainty to skirt the clear intention of the Act. And that is the primary reason why we brought our complaint against Spokeo. It is clear, to us at least, that Spokeo is offering profiles that fall within FCRA's scope. But we hope that the Spokeo case can offer guidance to the other marketers of data products. There has been an awful lot of discussion about privacy in Washington and elsewhere in the past few months, but much of the focus has been on online advertising; data brokers have, by and large, escaped public scrutiny. This is an area of the law that desperately needs FTC guidance, and we think a shining a spotlight Spokeo is a good place to start.
