This blog is a part of the S.J. Quinney College of Law Spring semester 2016 Information Privacy Law course. This blog features a "Question of the Week" (which all students answer "yes" or "no"); a weekly "Featured Blog Topic" (where one student writes about a selected course topic on which all students comment); and a weekly "What Have I Learned" summary based on the week's readings, posts and class discussions.
Thursday, March 24, 2016
Question of the Week No. 10
Should data brokers be legally required to
disclose to consumers what information they have compiled on an individual and
to whom the information has been sold?
Yes, data brokers should be required to disclose what information they are collecting and who they are selling it to. This would address many of the concerns regarding transparency and access that surround the data broker industry. It would also remove some of the mystery for customers in the sense of “how did they know I am in a certain demographic looking at certain items or interests?” Finally, requiring this disclosure could give consumers a choice in some circumstances. Consumers could choose not to use certain companies that sell to data brokers (assuming that in the data broker’s disclosures they tell consumers where they got the data). This may not work in some areas where consumers may not have a real choice, but at least the consumer would be aware that data brokers have this information and who they are selling it to.
Yes, data brokers should be required to disclose this information, for all of the reasons Laura pointed out. Consumers should know what information has been collected by them and who has accessed that information and/or to whom it has been sold. Also, as Laura mentioned, it would allow consumers to have a voice in the process and disincentivize companies that broker in an individual's data (or just refuse to enter into transactions with them in order to avoid having your information collected). However, the one concern I would have with increased transparency or disclosure is a risk of access to the information. There would need to be sufficient authentication procedures so that only the individual to whom the data pertains can access and review the collected information. Otherwise, there is the risk that employers and others could gain access and learn potentially harmful (or even just embarrassing) information regarding the individual.
Yes, as inferences that big data can make on a person that aids in their identification is scary. Brokers should allow consumers to know how their data is being used and given the opportunity and knowledge to know when their information is being collected and how. Consumers should be able to make a choice on whether or not their information is being gathered for advertisements, research, or just to gather it for some future use--especially when it is used for demographic tracking.
Yes. Given markets cannot optimally function without consumers being fully informed, data brokers should be required to disclose this information. Data brokers are presumably the only entities that know the full extent of this information, so the onus should be on them to provide this information. The only qualification I can think of is perhaps brokers should not be required to disclose how unidentifiable, commercial information is used and to whom it is sold to. For example, if a data broker is aggregating data concerning a certain demographic's spending habits, assuming this information is unidentifiable, I think the commoditization of this information is sufficiently innocuous to not require brokers to use the resources to disclose it to consumers. However, when brokers sell data that reveals the identify of the consumer (i.e. name, address, income, etc) this information is sufficiently sensitive to impose this mandate on brokers.
Yes, although if the goal is to promote transparency, then only making data brokers accountable for disclosure may not serve the goal. Data brokers aggregate personal information from a variety of sources including public records, social media services, and other websites where people voluntarily provide personal data. Whereas consumers have no expectation of privacy with regard to public records, and limited expectation of privacy from social media services that allow some degree of control, there can be a reasonable expectation of privacy from websites that collect personal information under the auspices of providing some service, but are inherently opaque when it comes to disclosing how they share the personal information they collect. Additionally, the transfers of personal information to data brokers could occur through third party intermediaries that do not necessarily fall within the legal definition “data broker,” but still be one of the “affiliates” mentioned in service level agreements by certain websites. The connection between these intermediaries and the website that actually collected personal information now sitting with a data broker may not be apparent to the consumer, and merely making them reveal their sources will not go far enough in ensuring transparency. However, this goal could be realized by putting the burden of revealing the provenance of any personal information they make available, making it illegal to provide such information without revealing the primary sources where the consumer first provided that personal information. Additionally, data brokers should also be required to reveal the accuracy and completeness of each and every data point they provide, so that a third party relying on that information may not be misled by the mere presence of such a data point. For example, if a data broker is publicly information about a person’s divorce records and political preferences on their website, then they need to also display the primary source of both records (e.g. utahsright.com for the divorce information and voter registration or social media posts for the political preferences). For each of those two data points, the data broker needs to publish the inherent accuracy, say, for example, ~90% for divorce records and 45% for social media inference of political preferences, or something similar.
Yes I think that Data Brokers should be required to disclose to consumers what information they have gathered and to whom it is being sold. Logically this seems the least that they should do. If they are permitted to collect this data and then profit from it then consumers should be informed by the brokers. That way consumers will have more influence on the market by making informed choices. While this may not be the single solution to the problem, it will likely help and be a step in the right direction.
Yes, data brokers should be required to disclose what information they are collecting and who they are selling it to. This would address many of the concerns regarding transparency and access that surround the data broker industry. It would also remove some of the mystery for customers in the sense of “how did they know I am in a certain demographic looking at certain items or interests?” Finally, requiring this disclosure could give consumers a choice in some circumstances. Consumers could choose not to use certain companies that sell to data brokers (assuming that in the data broker’s disclosures they tell consumers where they got the data). This may not work in some areas where consumers may not have a real choice, but at least the consumer would be aware that data brokers have this information and who they are selling it to.
ReplyDeleteYes, data brokers should be required to disclose this information, for all of the reasons Laura pointed out. Consumers should know what information has been collected by them and who has accessed that information and/or to whom it has been sold. Also, as Laura mentioned, it would allow consumers to have a voice in the process and disincentivize companies that broker in an individual's data (or just refuse to enter into transactions with them in order to avoid having your information collected). However, the one concern I would have with increased transparency or disclosure is a risk of access to the information. There would need to be sufficient authentication procedures so that only the individual to whom the data pertains can access and review the collected information. Otherwise, there is the risk that employers and others could gain access and learn potentially harmful (or even just embarrassing) information regarding the individual.
ReplyDeleteYes, as inferences that big data can make on a person that aids in their identification is scary.
ReplyDeleteBrokers should allow consumers to know how their data is being used and given the opportunity and knowledge to know when their information is being collected and how. Consumers should be able to make a choice on whether or not their information is being gathered for advertisements, research, or just to gather it for some future use--especially when it is used for demographic tracking.
Yes. Given markets cannot optimally function without consumers being fully informed, data brokers should be required to disclose this information. Data brokers are presumably the only entities that know the full extent of this information, so the onus should be on them to provide this information. The only qualification I can think of is perhaps brokers should not be required to disclose how unidentifiable, commercial information is used and to whom it is sold to. For example, if a data broker is aggregating data concerning a certain demographic's spending habits, assuming this information is unidentifiable, I think the commoditization of this information is sufficiently innocuous to not require brokers to use the resources to disclose it to consumers. However, when brokers sell data that reveals the identify of the consumer (i.e. name, address, income, etc) this information is sufficiently sensitive to impose this mandate on brokers.
ReplyDeleteYes, although if the goal is to promote transparency, then only making data brokers accountable for disclosure may not serve the goal. Data brokers aggregate personal information from a variety of sources including public records, social media services, and other websites where people voluntarily provide personal data. Whereas consumers have no expectation of privacy with regard to public records, and limited expectation of privacy from social media services that allow some degree of control, there can be a reasonable expectation of privacy from websites that collect personal information under the auspices of providing some service, but are inherently opaque when it comes to disclosing how they share the personal information they collect. Additionally, the transfers of personal information to data brokers could occur through third party intermediaries that do not necessarily fall within the legal definition “data broker,” but still be one of the “affiliates” mentioned in service level agreements by certain websites. The connection between these intermediaries and the website that actually collected personal information now sitting with a data broker may not be apparent to the consumer, and merely making them reveal their sources will not go far enough in ensuring transparency. However, this goal could be realized by putting the burden of revealing the provenance of any personal information they make available, making it illegal to provide such information without revealing the primary sources where the consumer first provided that personal information. Additionally, data brokers should also be required to reveal the accuracy and completeness of each and every data point they provide, so that a third party relying on that information may not be misled by the mere presence of such a data point. For example, if a data broker is publicly information about a person’s divorce records and political preferences on their website, then they need to also display the primary source of both records (e.g. utahsright.com for the divorce information and voter registration or social media posts for the political preferences). For each of those two data points, the data broker needs to publish the inherent accuracy, say, for example, ~90% for divorce records and 45% for social media inference of political preferences, or something similar.
ReplyDeleteYes I think that Data Brokers should be required to disclose to consumers what information they have gathered and to whom it is being sold. Logically this seems the least that they should do. If they are permitted to collect this data and then profit from it then consumers should be informed by the brokers. That way consumers will have more influence on the market by making informed choices. While this may not be the single solution to the problem, it will likely help and be a step in the right direction.
ReplyDelete