Consumers Need More Control Over How Is Data Collected, Markey, Barton, Brill Say

Consumers don’t have access to any information about data brokers or what data they collect, FTC Commissioner Julie Brill said. Data are moving in ways that are “rapidly changing and rapidly evolving,” she said, citing the agency’s report this week on how third parties get user data from mobile apps. “How can we make, in general, this industry more transparent?” she asked. Brill said one option is a government-created website where users can see what kind of data profiles exist on them, providing a “centralized way for consumers to access the kind of information that [data brokers] are giving” to third parties like marketing firms. Jim Adler, chief privacy officer of Intelius, a user-facing site that lets clients access and correct profiles based on public records, said users “should be able to somehow let your side of the story be heard in this public realm."

Any action regarding data brokers should focus on how data are used, not just that data are collected, industry members said, and lawmakers need to better define data brokers if they hope to move this conversation forward. “There are thousands of data brokers in the nation, so we're got to define them,” said Tony Hadley, Experian senior vice president-government affairs and public policy. Markey suggested that lawmakers focus on the top 100 or 200 data brokers to start, if the field is so wide. Most industry representatives speaking at the event agreed sensitive information needs to be protected online and said that would be a good place to start. Health information is protected “in fairly limited circumstances,” Brill said, because the Health Insurance Portability and Accountability Act doesn’t apply to many health information websites.

Markey repeatedly mentioned developing online privacy rules for Internet users 15 years and under. The Do Not Track Kids Act (HR-1895), authored by Markey and Barton, would prohibit targeted advertising for users under 18, in addition to expanding Children’s Online Privacy Protection Act (COPPA) protections for users younger than 13. Markey asked whether COPPA protections should apply to 15-year-olds.

Industry members stressed they don’t knowingly collect information from children, meaning they're not subject to COPPA as it currently stands. Jennifer Glasgow, chief privacy officer at Acxiom, said her company doesn’t knowingly collect any information from users who are under 18. If the standard is changed -- such as to the “reason to know” standard that has been present in recent COPPA update proposals -- companies will have to collect more information from users to determine if those users are children, said Jerry Cerasale, senior vice president-government affairs for the Direct Marketing Association. There’s a “fear there of forcing companies to collect information” it wouldn’t otherwise, he said. FTC Chairman Jon Leibowitz said many comments responding to the COPPA proposals brought up that point. “I can’t tell you where we're going to conclude,” he said, but “we're taking them very seriously."

How do “e-scores” attached to user data profiles compare to data that are regulated by the Fair Credit Reporting Act (FCRA), asked Brill. Those aren’t like credit ratings, Hadley said. They're “propensity scores,” he continued, and are used by marketing firms to determine how likely an individual user is to buy a certain product. While those products may include credit cards or loans, the propensity score just determines whether it’s worth advertising to users, he said: “That’s not an eligibility determination,” which falls under FCRA. Experian doesn’t engage in “dynamic pricing,” he said, referring to the practice of offering different prices to different users based on their data profiles. Showing a user ads for subprime mortgages does not mean that he can’t go to his bank and procure a loan with more favorable terms, Cerasale said. A user’s propensity score has no bearing on his eligibility, he said, because there’s a “firewall” between the two functions.

Brill pushed back against the idea of a firewall. “I'm not sure it’s as bright a line as you're describing,” she said. Ed Mierzwinski, consumer program director at U.S. PIRG, agreed. “The line is blurred, or the line is moved,” he said, and “we really need to look at where has the line moved.” Any attempts at industry self-regulation should be underpinned by law, Mierzwinski said, calling FCRA the “strongest and most robust privacy law” and a good model for online privacy.

The industry is addressing these concerns through self-regulatory programs, Cerasale said, pointing to the AdChoices Icon initiative by the Digital Advertising Alliance. The program provides information and offers users “an easy, single click to opt out” of online behavioral advertising, he said, and industry developed it “much more rapidly” than the government could have. “I think the self-regulatory endeavors … are making progress,” agreed Epsilon General Counsel Jeanette Fitzgerald. Jeff Chester, executive director of the Center for Digital Democracy, disagreed and called for legislation. “Self-regulation and icons are simply not cutting it yet,” he said.