On June 26th, United States FTC Commissioner Julie Brill spoke to over 100 activists, advocates, journalists, attorneys, and industry professionals at the 2013 Computers, Freedom and Privacy Conference in Washington, D.C. about the challenges she and others are facing with privacy and rising tide of data flooding the world. While extolling the benefits of Big Data, she identified four specific challenges and introduced her suggestions to solve these challenges.
Challenge Number 1 – The Fair Credit Reporting Act (FCRA
The FTC is the regulator in the US for FCRA. FCRA governs the use of data collected on individuals for making business decisions about them, such as employment and credit. Commissioner Brill identified two problems both related to uses of data that FCRA should arguably cover but that are just outside it’s jurisdiction. The first is where consumer profiles are used, not for eligibility decisions, but rather for marketing decisions. Consumers may never know about the products if they are not introduced to them because they fail to meet the criteria to be marketed to. And because these dossiers are outside of FCRA, the consumer has no legal right to see the profile or contest inaccurate information. The second problem is the use of dossiers to make decisions for other purposes. There already exists dating services for only attractive people or only wealthy individuals, one could easily imagine a service that only allows members who have a certain threshold of Facebook ‘friends’ or one that requires a high enough Klout score.
Challenge Number 2 – Transparency
Consumers know little about the major data brokers. Most of these companies are not consumer facing and even if they have a consumer facing service (for correction or date removal), those companies are not household names and consumers may not know how to access them all.
Challenge Number 3 – Notice and Consent
Commissioner Brill echoed much of the problems I identified in my previous blog post. In her speech she contrasted the experiences of new born babies in Artemis, a Toronto research project into infections of newborns, and that of the new mother in the Target pregnancy scandal. Artemis, she argued, provided clear informed consent to the parents of their inclusion. Further, the goal of Artemis, improving the health care of newborns, is clearly within the context of the relationship between patient and healthcare provider. Target’s targeting of pregnant women provided neither notice, nor consent, nor was it clear within the context of retailer and consumer that they would be doing this.
Challenge Number 4 – De-identification
While most Big Data companies realize the risks of identified data, they feel that proper technical de-identification can solves those problems thus giving companies the ability to work with anonymized data. As the Commissioner points out, re-identification is a real world phenomenon, especially when the datasets are robust and can be correlated with other data sets. The Commissioner called for companies to provide binding clauses in contracts with service providers not to re-identify and continue to treat the data as personal information because of the possibility of re-identification.
Reclaim Your Name
Commissioner Brill proposed an initiative she entitled Reclaim Your Name, a broader version of the Do Not Track idea that has been discussed. While still a work in progress, the basic idea is that consumer would be able to get access to offline and online data about them and set appropriate controls on how the data can be used in the commercial sphere. In remains to be seen if the idea will fly, especially given the FTC limited jurisdictional power, but it certainly would be wise for Big Data providers, both from a public relations and future regulatory preparedness standpoint, to build such functionality into their designs.
