Antitrust Law Daily Wrap Up, PRIVACY NEWS: Brill calls for more consumer control over gathering, use of device-collected data, (Jan 8, 2016)

By Edward L. Puzzo, J.D.

In an era of increasingly pervasive data collection from Internet-connected devices, consumers should have choices about where their data ends up and how it is used, according to FTC Commissioner Julie Brill.

In her January 5, 2016 address at Governor Jay Inslee’s summit on Cyber Security and Privacy in Seattle, Washington, Commissioner Brill argued that we are rapidly reaching a point where nearly every device will be connected to the Internet, and the Internet itself will become a nearly invisible presence, similar to electricity. Some of the devices will be conveying unencrypted sensitive personal information about our health, finances, and personal interactions, which may be analyzed by Big Data and acted upon, all without our direct input. In some cases, devices may record images and audio without the knowledge of the device owners or bystanders. These facts raise serious issues concerning privacy, data security, and consumer protection, Brill stated.

Privacy. In an era of Big Data and the Internet of Things, consumers should be able to easily find out what information companies are collecting on them, where they are sending it, and how they are using it, Brill stated. Data brokers, ad networks, analytics firms, and other "behind the scenes' operators use this data for advertising and other purposes, but consumers should have choices about where their data ends up and how it is used, said Brill. Consumers should know how long companies keeping the data will retain it and how the companies will keep it secure and be able to choose whether or not to permit their data to be collected.

She advocated for transparency on the part of companies using the data, but acknowledged that providing transparency is challenging, especially when many devices connected to the Internet of Things have no user interface to present information to consumers. She argued that, using creative thinking, devices could employ visual and auditory clues, apps, and websites to provide needed transparency. "Command centers" currently under development for the purpose of running multiple internet-connected household devices could be used to tell consumers the information the devices are gathering and to control where the information goes, she suggested.

Fairness in big data analytics. In addition to the data gleaned from Internet-connected devices, Brill is also concerned with the possible misuse of consumer profiles created from the gathered data. Data brokers and others, she explained, create profiles and group consumers into categories such as "Financially Challenged" and "Bible Lifestyle." But such categories created for benign marketing purposes could also be used to identify "troublesome" consumers, to discriminate along racial or ethnic lines, or to create scores, such as credit scores, that could harm consumers with regard to job offers, credit terms, and insurance coverage. Brill argues that the transparency mandated by Congress with regard to credit scores have been good for both consumers and business.

Analyzing scoring algorithms and statistical models used by Big Data is beyond the capacity of the FTC and other agencies, Brill stated. However, the effects of the use of these models are easier to measure. Brill suggested that companies using scoring models should themselves do more to determine whether their own data analytics result in unfair, unethical, or discriminatory effects, and to pass these results on to consumers.

Security research. Brill cited a recent Hewlett-Packard study, estimating that 90 percent of connected devices collect personal information and 70 percent of them are transmitting this data without encryption. Thus, device security is a major issue, but manufacturers may not have an economic incentive to notify consumers of vulnerabilities in Internet-connected devices when many such devices may become inexpensive and essentially disposable. The FTC therefore sees an important role for security researchers, who have previously found vulnerabilities in electronic voting systems, connected cars and online learning systems. The FTC's view of security researchers has at time put them at odds with companies, causing them to criticize an October Congressional proposal that would have made security research on connected cars illegal. Brill noted that security research issues would be the subjects of the FTC's upcoming security event, to be held February 9 at the University of Washington.

News: Privacy FederalTradeCommissionNews