In a 110 page report issued yesterday, the Federal Trade Commission suggested that data brokers operate without transparency and asked Congress to consider enacting legislation to make data broker practices more visible to consumers and to give consumers greater control over personal information that is collected and shared by data brokers.

The report, "Data Brokers: A Call for Transparency and Accountability" is the result of a study of nine data brokers undertaken by the FTC to shed light on the data broker industry. The report found that data brokers collect and store billions of data elements covering nearly every U.S. consumer. Just one of the data brokers studied holds information on more than 1.4 billion consumer transactions and 700 billion data elements and another adds more than 3 billion new data points to its database each month. Among the report's other findings:

  • Data brokers collect consumer data from extensive online and offline sources, largely without consumers' knowledge, ranging from consumer purchase data, social media activity, warranty registrations, magazine subscriptions, religious and political affiliations, and other details of consumers' everyday lives.
  • Consumer data often passes through multiple layers of data brokers sharing data with each other. Seven of the nine data brokers in the Commission study had shared information with another data broker in the study.
  • Data brokers combine online and offline data to market to consumers online.
  • Data brokers combine and analyze data about consumers to make inferences about them, including potentially sensitive inferences such as those related to ethnicity, income, religion, political leanings, age, and health conditions. Potentially sensitive categories from the study are "Urban Scramble" and "Mobile Mixers," both of which include a high concentration of Latinos and African-Americans with low incomes. The category "Rural Everlasting" includes single men and women over age 66 with "low educational attainment and low net worths." Other potentially sensitive categories include health-related topics or conditions, such as pregnancy, diabetes, and high cholesterol.
  • Many of the purposes for which data brokers collect and use data pose risks to consumers, such as unanticipated uses of the data. For example, a category like "Biker Enthusiasts" could be used to offer discounts on motorcycles to a consumer, but could also be used by an insurance provider as a sign of risky behavior.
  • Some data brokers unnecessarily store data about consumers indefinitely, which may create security risks.
  • To the extent data brokers currently offer consumers choices about their data, the choices are largely invisible and incomplete.

Despite the FTC's concern, consumers seem largely unphased. Even so, in speaking with Law360, I noted that:

"Any time an enforcement agency issues a report like this that points out the potential for problems, and if those problems pop up, there's certainly a chance that the plaintiffs' bar can point to it and say that a company should have known because the FTC warned it about the problems," said Foley Hoag LLP privacy and data security practice co-chairman Colin Zick. "Often, these types of actions result in some form of self-government by companies that decide to get their houses in order voluntarily, which the FTC might find quite appropriate. Ultimately, it could be beneficial to be proactive here, given that the FTC is laying out exactly what it's interested in rather than surprising the industry with enforcement actions."

To view Foley Hoag's Security, Privacy and The Law Blog please click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.