Antitrust Law Daily Wrap Up, PRIVACY NEWS: Commissioner Brill speaks on data privacy concerns, proposes “Reclaim Your Name” initiative, (Jun 26, 2013)
By Tobias J. Gillett, J.D., LL.M.
FTC Commissioner Julie Brill delivered a speech today before the 23rd Annual Computers Freedom and Privacy Conference in Washington, D.C., in which she described the privacy challenges posed by personal data acquisition, and proposed a Reclaim Your Name initiative to give consumers more control over their data.
Brill began her speech, entitled “Reclaim Your Name,” by noting the spotlight on privacy issues the recent revelations about the National Security Administration’s data collection efforts have provided. She observed that increasing knowledge of the amount of privacy consumers have forfeited brings with it “the power to review, this time with eyes open, what privacy means—or should mean—in the age of the Internet.” “Big data” is not synonymous with “evil empire,” Brill asserted, and data acquisition provides many benefits to consumers. However, the use of the data, and the possibility of errors, also presents many challenges.
The first challenge raised by Brill was “how to educate the growing and highly decentralized community of big data purveyors about the rules already in place governing the ways certain kinds of data can be used.” An example of these laws is the Fair Credit Reporting Act (FCRA), which requires providers of information to make employment, credit, insurance, and housing decisions to ensure the information is accurate and used for appropriate purposes. Brill referred to the FTC’s warnings to and consent decrees with mobile app and online service providers regarding their FCRA compliance, but noted the difficulty of “reach[ing] all of those who may be—perhaps unwittingly—engaged in activities that fall into this category.”
Moreover, certain entities have begun “collecting and using information in ways that fall right on—or just beyond—the boundaries of the FCRA and other laws,” Brill observed. For instance, “e-scores” obtained through the compilation of a range of diverse data may not fall under the FCRA, since they are used for marketing purposes, but may prevent consumers from receiving certain offers, including those for financial products, without the consumer knowing or having the ability to access or correct the information. “Big data” may also be used to make “eligibility determinations” for a wide range of goods and services, without being subject to the FCRA.
The use of information by credit reporting agencies and data brokers also raises concerns about transparency, Brill stated. Although some data brokers have begun to permit consumers to access some of the information obtained about them, “most consumers have no way of knowing who these data brokers are, let alone finding the tools the companies provide,” and therefore those efforts “provide only the illusion of transparency.”
The third challenge discussed by Brill was that posed to “established privacy principles such as notice and choice.” Brill compared two examples of the use of “big data,” that of Artemis, a Toronto research project on premature newborns, and that of department store Target’s efforts to target pregnant customers at various stages of their pregnancies. She noted that Artemis’ project “allow[ed] for meaningful notice and choice within an appropriate regulatory regime, whereas Target did not—could not—provide meaningful notice and choice about its pregnancy predictor score project.” Projects like Artemis inform patients of the data being collected and receive consent, while “there is nothing in the context of a retail purchase that implies notice and consent—nothing that reasonably informs the consumer her data might be collected to make predictions about sensitive health conditions or seeks her consent to do so.”
Brill outlined three issues raised by the use of such information, including “how sensitive health information might be used to make decisions about eligibility that fall outside the contours of the FCRA,” “what will happen if this sensitive health information falls into the wrong hands through a data security breach,” and “what damage is done to our individual sense of privacy and autonomy in a society in which information about some of the most sensitive aspects of our lives is available for analysts to examine without our knowledge or consent, and for anyone to buy if they are willing to pay the going price.”
Finally, Brill addressed the challenge posed by “predictive analytics attaching its findings to individuals.” Although most data brokers and advertisers claim to employ de-identified data—data that does not include a name or address—Brill noted that “[g]iven how closely our smartphones and laptops are associated with each of us, information linked to specific devices is, for all intents and purposes, linked to individuals.” She cited research demonstrating the ease of re-identifying data that had supposedly been made anonymous, and noted the possible harm from data breaches that could expose the data.
Brill observed that the FTC, in its 2012 Privacy Report, called on companies involved in “big data” to “do everything technically possible to strip their data of identifying markers,” to “make a public commitment not to try to re-identify the data,” and to “contractually prohibit downstream recipients from doing the same.” Although such de-identification would resolve some of the concerns presented by “big data,” she noted that “chunks of big data will always be, by their very nature, identifiable or linkable to individuals.”
Having outlined the dimensions of the problem, Brill proceeded to discuss potential solutions. She observed that “privacy by design,” in which companies build privacy protections into their products and services, could help solve some of the problem. However, she contended that even if the private sector embraced privacy by design “we will not have met the fundamental challenge of big data in the marketplace: that is, consumers’ loss of control of their most private and sensitive information.”
Brill declared her support for legislation requiring “data brokers to provide notice, access, and correction rights to consumers scaled to the sensitivity and use of the data at issue,” but suggested that privacy concerns could be addressed prior to legislation through an initiative she dubbed “Reclaim Your Name.” According to Brill, “Reclaim Your Name would empower the consumer to find out how brokers are collecting and using data; give her access to information that data brokers have amassed about her; allow her to opt-out if she learns a data broker is selling her information for marketing purposes; and provide her the opportunity to correct errors in information used for substantive decisions—like credit, insurance, employment, and other benefits.”
Data brokers that participated in the initiative would “tailor their data handling and notice and choice tools to the sensitivity of the data at issue.” Brill also suggested that credit reporting agencies should improve consumers’ ability to access and understand their credit reports, and should develop a system where a correction in one agencies’ information would propagate to the other agencies as well.
“The Reclaim Your Name initiative meshes nicely with the FTC’s ongoing interest in a universal, simple, persistent, and effective Do Not Track mechanism that allows a consumer to stop companies from mining cyberspace for information about her for marketing purposes,” Brill observed. She noted the progress made through browser developers, advertisers, and the W3C standards-setting organization toward a Do Not Track system. If both were properly enacted, Brill contended, “Do Not Track would allow consumers to choose when their online data is monitored for marketing purposes,” while “Reclaim Your Name would give consumers the power to access online and offline data already collected, exercise some choice over how their data will be used in the commercial sphere, and correct any errors in information being used by those making decisions materially impacting consumers’ lives.”
“There is no reason that big data cannot coexist with an effective Do Not Track mechanism and with a system that empowers consumers to make real choices about how their private information will be used,” Brill concluded.
News: ConsumerProtection Privacy FederalTradeCommissionNews