Antitrust Law Daily Wrap Up, PRIVACY NEWS: Brill calls for technological solutions to big data privacy concerns, (Oct 23, 2013)

By Tobias J. Gillett, J.D., LL.M.

FTC Commissioner Julie Brill today delivered a Sloan Cyber Security Lecture at the Polytechnic Institute of New York University in Brooklyn, in which she urged her audience of engineers, technologists, students, and professors to devise solutions to the privacy problems posed by the use and collection of big data.

Brill began her speech, entitled “Reclaim Your Name: Privacy in the Age of Big Data,” by calling for a public debate on the balance between consumer privacy and the potentially transformative uses of big data in the commercial sphere. She contended that reaping the benefits of big data would not require scrapping privacy principles that protect consumers. She called on her audience “to help create technological solutions to some of the most vexing privacy problems presented by big data.”

Credit reporting. The first such problem addressed by Brill concerned the Fair Credit Reporting Act (FCRA), which the FTC enforces. The FCRA gives consumers certain rights with respect to their data, including the right to access it, challenge its accuracy, and be notified when they are denied credit or receive a loan at less than favorable rates because of negative information. Brill noted the FTC’s recent study that found that one in twenty U.S. consumers had serious errors in their credit reports that could result in them receiving less favorable credit. She argued that “[t]he time has come for the credit reporting industry to address its error rate” and advocated for an improved dispute resolution system and new technological tools to help consumers understand and manage their credit information.

Interconnectivity. The second challenge posed by Brill concerned the “Internet of Things” created by the interconnectivity of consumer products. She raised two questions related to by this connectivity: (1) “without an interface, how can a company provide effective notice about the data it collects and how that data is used,” and (2) “should society permit the data harvested from interconnected devices to be combined with other online and offline data, creating mega-profiles that have very rich details about each of our behavior?” Brill noted the FTC’s 2012 privacy report, which provided a privacy framework for companies and policymakers and set forth the three best practices that should be considered when designing connected devices. The best practices are:

• “Ensure that these connected devices build in privacy from the start.”

• “Make sure that the device collects no more data than is necessary for the device’s functioning and that the data is held securely and for the minimum time necessary.”

• “Ensure that consumers are given simplified notice—even if the device has no interface—by creating a consumer friendly online dashboard that explains through pictures, graphs or other simple terms the data the device collects about consumers, the uses of the data, and who else might see the data.”

Data brokers. Brill’s third challenge involved the data collection and profiling performed by data brokers. She focused on three categories of data broker practices: (1) the sale of consumer-specific data for purposes on or just beyond the boundaries of the FCRA and other laws, such as e-scores collected from social networks and other online sources; (2) eligibility determinations that do not necessarily fall within the scope of the FCRA; and (3) the collection and use of data to make sensitive predictions about consumers, such as those involving sexual orientation, health conditions, and religion.

Brill noted Target’s recent use of purchase data to offer pregnant customers coupons tailored to their stage of pregnancy, and other use and sale of consumer health data that occurs without notice to consumers and that could go beyond consumer expectations. She raised three concerns regarding the use of such data outside the environment protected by HIPAA: (1) “how sensitive health information can be used to make decisions about eligibility that fall outside the contours of the FCRA, without notice to the consumer or an opportunity to challenge the accuracy of the data used to make the decisions”; (2) “what happens if sensitive health information falls into the wrong hands through a data breach”; and (3) “what damage is done to our sense of privacy and autonomy in a society in which information about some of the most sensitive aspects of our lives is available for analysts to examine without our knowledge or consent, and for anyone to buy if they are willing to pay the going price?”

The commissioner observed that one solution would be to ensure that such data was truly deidentified, but that a standard requiring companies to make reidentification of the data impossible could make the data “effectively useless.” Moreover, “[t]he entire data broker enterprise is aimed at developing greater insight into the activities, status, beliefs, and preference of individuals.”

Brill encouraged the creation of “algorithmist” positions—licensed professionals with ethical responsibilities for an organization’s appropriate handling of consumer data—and more ethical training in engineering and computer science programs. However, she observed that the new positions and training would not solve the fundamental problem—“consumers’ loss of control of their most private and sensitive information.”

Reclaim Your Name. To address this problem, Brill advocated for her “Reclaim Your Name” initiative. Reclaim Your Name would permit consumers to use user-friendly online services to find out how brokers were collecting and using the consumer’s data, give the consumer access to that information, and provide the consumer with the opportunity to correct errors in information used for substantive decisions. Data brokers participating in Reclaim Your Name “would agree to tailor their data handling and notice and choice tools to the sensitivity of the information at issue.”

She noted that data broker Acxiom had responded to Reclaim Your Name by launching its own “About the Data” tool, permitting consumers to view portions of their marketing profile and tell Acxiom to stop using erroneous data or opt of Acxiom’s marketing profile system entirely. However, Brill observed that Acxiom may not provide all the information that it markets to its clients, that the data consumers choose to suppress is not deleted, and that the data Acxiom shows consumers currently only relates to marketing, not eligibility and other decisions.

“We all have a vital role to play,” Brill concluded. But it is important to recognize that you—the computer scientists, the engineers, the programmers, the technologists—have a unique set of skills that are key to solving these critical privacy issues. If you join me in this effort, I think that together we can help big data operate in a system that respects consumer privacy and engenders consumer trust, allowing big data to reach its full potential to benefit us all.”

News: Privacy ConsumerProtection FederalTradeCommissionNews