FTC Unveils Sweeping Legislative Proposals for Data Brokers

If enacted, the recommendations would require data brokers to clearly signal what information they're collecting, for what purposes and for which decisions. Data brokers would then be required to give consumers access to that information through some central online portal. Some sensitive data collection -- such as health or financial information -- might even require a consumer’s opt-in consent, said the report. Consumer-facing entities sharing information with data brokers, like retailers and websites, would have to give notice and opt-out ability to consumers, the report said.

Privacy advocates and consumer interest groups told us the change is necessary and long-overdue. “Especially in light of the many recent security breaches, data brokers harvesting and storing sensitive, personal information poses a huge security risk,” said Electronic Frontier Foundation Legislative Analyst Mark Jaycox. Center for Digital Democracy Executive Director Jeff Chester called the report a “powerful and disturbing privacy wake-up.” But Jaycox cautioned: “It hinges on if the bill preempts state notification laws. ... Any floor of a federal bill must incorporate the strongest state standards."

Industry groups said the legislative proposals aren’t feasible and won’t achieve the FTC’s stated goals of transparency and access. “It’s a whole approach that puts a lot of responsibility on users that they don’t necessarily want,” Software & Information Industry Association Senior Director-Public Policy David LeDuc told us. “The costs of requiring every marketer, agency, and publisher to provide consumers access to their marketing databases would be immense,” Interactive Advertising Bureau Executive Vice President-General Counsel Mike Zaneis told us. “It’s difficult to see the consumer interest in being able to ‘correct’ non-sensitive data, such as whether you read a story about the weather versus the sports page."

With any legislation a far-off hypothetical, this is the FTC’s “way of trying to force action” on industry codes of conduct, TechFreedom President Berin Szoka told us. The Direct Marketing Association (DMA), which backs a data collection code of conduct, said the report failed to identify failures in the current industry codes of connect. “The report finds no actual harm to consumers, and only suggests potential misuses that do not occur,” said DMA Senior Vice President-Government Affairs Peggy Hudson in a statement.

Operating in the Dark

The FTC report examined the data collection and use practices of nine data brokers, it said. The FTC found the industry “largely operates in the dark,” Ramirez said Tuesday, with a “fundamental lack of transparency.” Ramirez said she was struck by the “sheer breadth and complexity of the data broker industry,” which creates robust profiles of individuals using billions of data points from such diverse sources as the DMV, social media and property records. The industry uses individuals’ offline purchasing habits to “target you online,” Ramirez said.

The sum of the collected information is used to segment consumers into potentially discriminatory categories like “urban scramblers,” and “rural everlasting,” based on categories like race, ethnicity, income and political affiliations, the report said. “Does it mean many among us will be cut off from being offered the same goods and services, at the same prices, as our neighbors?” Ramirez asked. “Will these classifications mean that some consumers will only be shown advertisements for subprime loans while others will see ads for credit cards?” The report urged data brokers to “ensure that downstream users of their data do not use it for eligibility determinations or for unlawful discriminatory purposes.” It’s one of the few best-practice suggestions in the report not already covered by industry codes of conduct, TechFreedom’s Szoka said.

"We share the concerns about sensitive data,” said Acxiom Chief Privacy Officer Jennifer Barrett Glasgow in an email. The FTC has praised the company for creating a portal for consumers to view, correct or delete some data collected by Acxiom and opt out of types of data collection (WID Dec 20 p1). “We generally agree with the FTC report observations about the industry which -- for the most part -- refer to practices that have been part of our code of conduct, as well as the industry’s code of conducts for many years,” Glasgow said. ID Analytics “takes consumer privacy very seriously” and “does not sell data for marketing purposes,” said a spokeswoman. Other data brokers involved in the study didn’t provide comment by deadline.

In a concurring memo, Commissioner Julie Brill pressed for legislation where the FTC report suggested industry best practices (http://1.usa.gov/1oqkq3o). While the report urges data brokers to take industry responsibility for the “downstream” flow of their data, Brill said Congress should legislate data flows both downstream and upstream -- “from data suppliers to data brokers.” This legislation “could include requirements for data brokers to verify the identity of their customers, and conduct due diligence and other monitoring, to provide a level of accountability,” she said. Congress should also require data brokers to “ensure that their original sources of information obtained appropriate consent from consumers.”

Brill “highlights some of the concerns” about “slicing and dicing the population” that the FTC and White House reports (WID May 2 p1) raised without presenting legislative solutions, said Deirdre Mulligan, who co-directs the Berkeley Center for Law and Technology, in an interview. Unlike those two reports, she said Brill presents some initial policy recommendations to address the issues, which need a “broader public discussion.”

Working with Capitol Hill

Other than naming Senate Commerce Committee Chairman Jay Rockefeller, D-W.Va., the commission did not identify lawmakers it was working with to push its agenda. “Given his deep interest in the subject, we hope [Rockefeller] will be interested” in working on the FTC’s legislative proposals, Ramirez said. “Congress can no longer put off action on this important issue,” Rockefeller said Tuesday in a statement. The report “reflects growing consensus,” he said, that “big data practices pose risks of consumer harm including discrimination based on financial, health, and other personal information.” Rockefeller and Sen. Ed Markey, D-Mass., introduced in February S-2025 targeting data brokers, mandating certain levels of data collection transparency and consumer access (http://1.usa.gov/1lPkUcW). “The FTC’s report makes clear that data mining and information brokerage firms do not believe there is such a thing as privacy,” Markey said Tuesday in a statement.

Reps. Joe Barton, R-Texas, and Bobby Rush, D-Ill., introduced in April HR-4400 to give the FTC rulemaking authority over data brokers and implement notice and accuracy requirements on certain data collection (http://bit.ly/1oFZD9t). “The data broker industry is one that is largely unregulated and currently collects large sums of data on consumers,” Barton said Tuesday. Rush called the report “essential reading for consumers,” in a statement. No pending bills include the FTC’s full stable of recommendations, including the centralized online portal. “We stand ready to work with anyone in Congress,” said Ramirez.