Data brokers have certainly been in the news in the last week. CBS’s 60 Minutes show did a segment on them in which FTC Commissioner Julie Brill was interviewed. Commissioner Brill also gave a speech last week at the International Association of Privacy Professional’s conference about her priorities, which include data brokers. Let me take a minute to provide some personal observations about both.
There are a number of issues that have plagued the data broker industry for some time. I would like to address them from Acxiom’s perspective.
Data Brokers Are Not All the Same: The industry isn’t monolithic, but because it’s easier to think of it that way, it often is portrayed as one business model. However- there are many different types of business models. There are data brokers that provide information for marketing purposes. There are data brokers who provide data for preventing fraud and helping companies verify the identity of their customers. There are data brokers who specialize in public records for a variety of uses – marketing, fraud and general look-up/locate. There are data brokers who specialize in background checks, and of course there are credit bureaus. It is easy to confuse these and to lump them together.
Each of these business models operate under different regulatory and self-regulatory regimes. Employment background checks and credit are highly regulated by the Fair Credit Reporting Act and the FTC has aggressively enforced this law with data brokers in recent years. The other business models are regulated by the sources of data they use, some of which are highly regulated, like financial data and health data. Marketing in particular is governed by self-regulatory guidelines enforced by the Direct Marketing Association and the Digital Advertising Alliance.
Have Consumers Lost Control? A common assertion is that consumers have lost all control over their personal information and that dossiers are being created that consumers have no idea exist. While it is true that the data we collect and use for all these purposes grows every year, consumers are getting more and more savvy about the information age and actually starting to selectively provide data about themselves to curate the profile they want – and thereby influence the offers they get. But, based on our experience, we don’t see the majority of consumers as being overly anxious about data for marketing purposes.
Concerns about Sensitive Data: There has been a lot of concern expressed about health data – addictions such as alcoholism, diseases like depression, psychiatric problems, genetic problems, and sexual orientation. Treatment and prescription data from health care providers is governed by HIPAA and requires opt-in consent before it can be used for marketing purposes. If health data is being sold by data brokers to prospective employers, this practice is currently illegal because the Fair Credit Reporting Act prohibits the sale of marketing data for employment purposes. Health data that is sold by data brokers either comes from the consumer as self-reported on a survey or is inferred from retail, non-prescription purchases. In no way should this data be interpreted to mean the individual has the ailment, but instead it only indicates they have an interest in a medical condition. We are often interested in conditions that our family or close friends may have and search or visit websites with information about such conditions.
Acxiom’s Position on Sensitive Data: It would be appropriate for me to explain Acxiom’s position on health data that is not regulated by HIPAA. Acxiom classifies all health data we have in our data products as either restricted or prohibited. For restricted data, even that which has been self-reported, we only provide this data to a business in the health field. Such data can be very helpful in informing people about new treatments and support groups when used by companies offering related products or services. We exclude all prohibited data from our data products which is information about sensitive health conditions like addictions, mental disorders and sexually transmitted diseases. We believe the responsible use of health data should be a practice of all data brokers. Obviously, based on some examples of lists one can buy, other data brokers might be well advised to follow Acxiom’s policy.
Criticism of Big Data Brokers: In a Senate Commerce Committee hearing late last year, three companies (Acxiom, Epsilon and Experian) were criticized because we refused to cooperate with their investigation. What, in fact, we did was refuse to give a complete list of our customers. However, they failed to mention that we took that position to honor the confidentiality agreements in our contracts with clients and that we did provide very detailed descriptions of the industries we sell to, so the committee had a good idea of who Acxiom’s clients are.
At a conference last week held by the International Association of Privacy Professionals, Commissioner Brill reiterated her concerns about the lack of transparency around data brokers and that much of the data is highly sensitive, citing health data. She also criticized using race and economic status to create audience segments. We should expect her to continue her focus in this area.
Consumer Interest in Data Brokers: On a positive note, the Commissioner was complementary of Acxiom’s website www.aboutthedata.com and called on the industry to do more. She also acknowledged that consumers accessing their data should expect some kind of authentication to be sure they are seeing data about them and not someone else. We urge our fellow data brokers to take steps to improve their transparency.
Interestingly, with all this news lately about data brokers, Acxiom and www.aboutthedata.com one might expect a sharp spike in visitors to the site, but this didn’t happen. I think it says that most individuals enjoy the benefits data about them can provide when appropriately used and aren’t experiencing the harms that are often reported.
Other key issues to watch include:
- No word as to when, but the FTC report on their investigation into data brokers is still expected soon.