Antitrust Law Daily Wrap Up, PRIVACY NEWS: Brill discusses the role of privacy and fairness in big data analytics, (Apr 3, 2015)

By Linda O’Brien, J.D., LL.M.

Data scientists examine some of the most challenging problems in a way that combines scientific, social, economic, and business perspectives, FTC Commissioner Julie Brill observed in an April 1 speech at the Columbia University Data Science Institute Symposium on “Data on a Mission: Transforming Privacy, Cities, and Finance,” in New York City. All of those perspectives will be needed to understand the role that big data plays, and will continue to play, in society, the Commission said.

Brill began her keynote address, entitled “Navigating the Trackless Ocean: Privacy and Fairness in Big Data Research and Decision Making,” by stating that the benefits that can be realized from a data-driven society could be tremendous. Healthcare, education, transportation, agriculture, conservation, and the planning and delivery of government services are all areas being transformed by data analytics. But with these opportunities come challenges.

Big data challenges notions of privacy and creates data security risks on a large scale, Brill noted. Some uses of big data could undermine principles about the fair treatment of individuals. For data scientists, there are some well settled principles of privacy and fairness that can used as data driven research projects are developed at Columbia and other research institutions. There is a wide expanse of solid land for applying principles of privacy and data security protections to such research, and data scientists should not resign themselves to “drifting on a trackless ocean.” Whether you’re running a company or doing research supervised by an institutional review board, your work depends on the trust of those who provide data to you. Thinking carefully through the issues and putting reasonable protections in place is critical to building this trust, Brill stated.

According to the Commissioner, one of the FTC’s highest priorities is protecting consumer privacy and data security. The Commission enforces several sector-specific privacy and data security laws—such as those dealing with financial information, children’s information, and credit reporting—and also enforces Section 5 of the FTC Act to address unfair or deceptive acts and practices that these more specific laws do not cover. Over the past 15 years, the FTC has brought nearly 100 actions under Section 5 protecting millions of consumers – in the United States and Europe – from deceptive and unfair data practices. Most importantly, the broad reach and remedial focus of Section 5 allows the FTC to protect consumers from harm as new technologies and business practices emerge.

A set of Fair Information Practice Principles (FIPPs), which have been part of the privacy landscape for at least four decades, are invaluable in analyzing the challenges that come up in big data analytics today, Brill continued. In 2012, the FTC set out a framework for thinking about how these principles can be applied in this data-intensive, highly connected world. The FTC’s framework has three basic elements: privacy by design, effective transparency, and simplified consumer choice. These three elements incorporate many of the individual principles that are part of the FIPPs, including data minimization, data security, access, and accuracy. The framework focuses on an additional important concept – sensitive information. Some types of data are more deeply personal or potentially more damaging than others, such as information about health, finances, precise location, and children. Such sensitive data deserves stronger protections than other kinds of personal data, including more rigorous security and more robust notice and choice before collection.

HIPAA, the federal law that protects personal health information, is a long-standing piece of the landscape of privacy and data security protection, Brill explained. However, HIPAA mainly covers traditional health care providers and insurers, and their business associates. Health information is now flowing in many more places than doctors’ offices and hospitals. Some of the most exciting prospects for society-changing innovations come from wearable devices and mobile apps that encourage consumers to collect and store their own health data. This information may be just as detailed and sensitive as what a doctor collects, but it generally falls outside the current boundaries of HIPAA because of who collects it and where it is collected.

Brill urged companies to recognize that individual control and transparency for personal information is an enduring expectation and a much broader concept than simply permitting or refusing information collection at one point in time. Connected devices are no different, but providing transparency and control will require some creative thinking. Embracing transparency and data subject control will benefit big data analytics and research efforts, particularly where sensitive data are concerned.

According to Brill, there is no tried and tested framework ready to address every consumer protection challenge that will arise with big data analytics. There are some emerging areas where the basic principles are incomplete or unclear. The questions in these areas go beyond privacy to encompass broader questions of fairness. Companies are reaching further for data that could shed light on individual traits and characteristics. Much of the individual-level analysis is done in the context of “marketing.” Marketing based on such profiles could benefit consumers. The same data that fuels marketing based on individual consumer profiles can also be used for more substantive decisions about consumers. In these circumstances, consumers do not have the right to know when their profiles are being used to reach adverse decisions about them or to dispute and correct inaccurate information in those profiles.

In Brill’s view, there should be more transparency and accountability, and everyone who participates in the very broad range of settings – companies, technologists, consumers, and policymakers – has a role to play. Companies should do more to determine whether their own data analytics result in unfair, unethical, or discriminatory effects on consumers. Also, data scientists and technologists in the audience have a key role to play as having the technical insights that are necessary to determine whether specific analytics practices pose risks of excluding, or otherwise placing at a disadvantage, groups defined according to sensitive traits. Examining personal data intensively and on a large scale is integral to many research and commercial ventures. Like any efforts that expand the boundaries of knowledge, research will raise lots of difficult questions. To answer these questions, new guidelines, principles, or best practices are needed, and the FTC is committed to working with academics, industry, and others to help develop them when the need arises, Brill concluded.

News: Privacy FederalTradeCommissionNews