FTC Data Broker Report Highlights Need for Oversight

Yesterday, the Federal Trade Commission (FTC) released a long-awaited report on the data broker industry. The report provides a great deal of insight into an opaque group of companies that create massive databases about individual consumers and then sell access to their data to marketers, advertisers, other data brokers, and other clients. The increased congressional interest in the data broker industry and the White House’s recent big data review point to the need for a better understanding of what data brokers are, what they do, and how the data they trade in may shape commerce and society. The FTC report explains how data brokers operate and outlines the areas in which Congressional and regulatory attention and oversight may be needed. The call for better consumer protections was especially notable in that it was unanimous, supported by both Republican and Democratic Commissioners. We hope that Congress takes up the FTC’s calls for legislation to provide more oversight over data brokers and empower users to more effectively control their data. In the interim, the FTC should continue to pay close attention to data brokers and to aggressively enforce the Fair Credit Reporting Act (FCRA) and Section 5 of the FTC Act to go after practices that violate existing law.

We hope that Congress takes up the FTC’s calls for legislation to provide more oversight over data brokers and empower users to more effectively control their data.

The report begins with an overview of the data broker ecosystem – how data brokers operate and what major services they provide. Data brokers generate their databases from a variety of disparate sources – from online web browsing to public records to loyalty cards used at brick-and-mortar stores – and then create sophisticated profiles of individual consumers, selling the information to a variety of clients. The report classifies data brokers into three categories: direct marketing (targeting consumers by demographic details such as age, gender, or residence), risk mitigation (allowing clients to reduce risk through identify verification and fraud prevention), and people search. Data brokers also frequently share data with each other, and have data points on almost every American consumer. While the report states that there’s no evidence that this massive database has been used in unlawful or discriminatory ways, it observes that such uses are certainly foreseeable. Current law may not cover such uses, depending on the context. As a result, the report advocates for specific legislative reforms, including requiring increased consumer access to their data and opt-out capabilities, mandating disclosures stating that data brokers draw inferences from the data they amass, creating a one-stop shop for opting out of certain practices, and allowing consumers to control their records and update them to remove incorrect or inaccurate information.

CDT supports these recommendations for legislative reform. While data brokers and other uses of big data can provide consumer benefits (such as reconnecting with old friends or providing more relevant advertising), the potential for abuse is high. Moreover, the lack of opacity concerning the data broker industry means that most consumers have no idea the extent of these databases, or the possibility of misuse of data sets that may be able to sort people by race, gender, sex, age, or sexual orientation. The report does a good job of educating consumers about what the current state of play is, but it at best serves a starting point. The FTC clearly recognizes this, and the legislative reforms recommended in the report would benefit consumers by providing better notice and choice provisions, increased consumer access, and the ability to ensure data quality – all elements of the Fair Information Practice Principles, which we advocate for as the best model for ensuring responsible data practices.

Consumers should not have to do all the legwork into limiting data collection, or preventing misuse of their data.

In a concurring statement to the report, FTC Commissioner Julie Brill argues that some of the report’s legislative reforms should be extended to prohibit discriminatory practices, and to require data brokers to ensure that their clients are not using their data for such purposes. Commissioner Brill also argues for requiring data brokers to ensure that their sources obtain consent before data collection begins. We agree with Commissioner Brill’s recommendations – consumers should not have to do all the legwork into limiting data collection, or preventing misuse of their data. We also think legislation should do more on data minimization, so that consumers can reasonably expect that some or all of their information will be deleted from marketing data brokers (or de-identified) when they opt out.

While legislative reforms are the most permanent solution, there are some existing laws that can ensure that consumers are protected and that data brokers act appropriately in collecting and reselling data. The report recognizes that in some cases, FCRA can prevent unlawful discrimination by data brokers; in other instances, the FTC Act may apply, as it prevents businesses from using unfair or deceptive practices against consumers. By continuing to enforce FCRA and the FTC Act ban on unfair and deceptive trade practices, the FTC can work to protect consumers and promote responsible practices by the data broker industry. The legislative proposals are a long-term solution; hopefully, the increased regulatory attention to data brokers and the issues posed by pervasive data collection and big data analytics will, in the interim, help protect consumers, encourage better transparency, and promote responsible innovation.