Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC Commissioner Brill proposes remedies to improve consumers’ control over private information gathering, (Feb 24, 2014)

By Edward L. Puzzo, J.D.

In a recent address at Princeton University, FTC Commissioner Julie Brill discussed the privacy implications of the increasing use of big data analytics on consumer data, and suggested certain remedies to return control of this information to consumers.

Brill began by outlining the voluminous amount of data that is now being generated by consumers, in ways not fully understood by most, and the uses to which the resultant data is being used and may be used in the future. The data, she explained, is generated not only by our use of credit cards, and tracking of online and social media use, but also by security cameras, cell phone signals and our own automobiles recording our movements and locations. We are moving into an era of the “internet of things”, she said, where appliances in our homes or wearable medical devices on our bodies will be generating additional data uploaded to the Internet for analysis without our intervention.

“This gold mine of data can be put to important, even transformative uses,” Brill stated, including more efficient use of electricity, providing first-responders with real-time information in emergency situations, and providing constant updates to medical personnel about our health status. But these “smart” devices also generate vast amounts of deeply personal information about us for which we have forfeited control.

The accumulated data has “the potential to create alarmingly personal consumer profiles”, according to Brill. One of the most troubling practices is the use of data to make sensitive predictions about consumers, such as those involving their sexual orientation, health conditions, financial condition, and race. One data broker, she stated, is known to include information about more than 28 specific diseases in its profiles of consumers, and another uses data from social media to predict those who are likely to have certain diseases. “All of this creation, analysis and use of consumers’ health information is happening outside of HIPAA - outside the US regulatory regime designed to protect health information” stated Brill. “Some of the most sensitive aspects of our lives is available for analysts to examine without our knowledge or consent, and for anyone to buy if they are willing to pay the going price.”

To address these privacy concerns, Brill suggests four steps to restore consumer trust while allowing the positive potential of big data analytics:

De-identification. Brill recommends that companies be encouraged to de-identify the data they collect whenever feasible. The FTC has developed best practices around de-identification that strike an appropriate balance and include both robust de-identification technologies and social agreements to not re-associate de-identified data with particular individuals. Merely stripping identifiers such as names and address is insufficient; it is too easy to re-identify data.

Ethical monitoring. The creation of entities to monitor the ethical use of data also was recommended. This monitoring will only work, Brill warned, for firms that understand the legal and ethical dimensions of the use of algorithms to make decisions about individuals, and embrace “privacy by design”.

Changes to the law. Brill urged the enactment of three types of legislation: (1) data security legislation, (2) baseline privacy legislation for the commercial arena, and (3) data broker legislation. The proposed “Data Broker Accountability and Transparency Act of 2014” (S. 2025), for instance, would require data brokers to provide notice, access, and correction rights to consumers. Under such a law, data brokers would be required to give consumers the ability to access their information and correct it when it is used for eligibility determinations, and the ability to opt-out of information used for marketing.

“Reclaim your name.” Consumers’ loss of control over their most private and sensitive information should be addressed now, Brill stated, even before legislation is enacted. Brill reiterated her push for a “Reclaim Your Name” initiative, intended to be an online resource to give consumers more control over data collected about them. The initiative would allow consumer to find out how data brokers are collecting and using their data; give them access to information that data brokers have amassed about them; allow them to opt-out if they learn a data broker is selling their information for marketing purposes; and provide them the opportunity to correct errors in information used for substantive decisions. Data brokers that participated in Reclaim Your Name would agree to tailor their data handling and notice and choice tools to the sensitivity of the information at issue. As the data they handle or create becomes more sensitive - relating to health conditions, sexual orientation, and financial condition, for example - data brokers would provide greater transparency and more robust notice and choice to consumers.

The address, entitled ““Big Data and Consumer Privacy: Identifying Challenges, Finding Solutions,” was made to the Woodrow Wilson School of Public and International Affairs at Princeton University on February 20, 2014.

News: Privacy ConsumerProtection FederalTradeCommissionNews