Introduction:
Data Brokerage is the practice of collecting data about individuals and selling it to those with interest in such data. Data brokers create what's called "audience segments" which can help companies with targeted advertising. The audience segments are created with information such as name, age, gender, purchase history, income, education, etc. Most data brokers are primarily interesting in collecting information that is valuable to advertisers such as interest in sports, if someone is an impulse shopper, and where they typically purchase items from. There are other types of data brokerage, but brokerage for the purpose of marketing is the most common.
There are other types of data brokerage besides marketing brokerage. The other common three are Risk mitigation, Health insurance companies, and "people search" websites. Brokerage for risk mitigation purposes primarily serves those with a financial interest in an individual. Lenders will use brokerages to see if the information on a loan application to see if it is accurate. Cross referencing information like this can help to prevent fraud. Secondly, health insurance companies can utilize data brokers to see what drugs someone may be being or look at their internet search history to see if there are certain symptoms that people are searching for. These insurance companies use this information to see what rates they should be charging individuals. People search sites use brokers to create entries on their website with people's information. These sites often include information on people such as their home address, email, birthdate, occupation, etc.
There is a current lack of substantial regulation on data brokerage aside from a few states who have introduced some measures to regulate the industry.
Regulation:
Currently, there are no laws in effect which completely regulate the data brokerage industry. Only, four states have adopted any legislation regulating data brokers. those four states are California, Vermont, Oregon, and Texas. These states have adopted laws which require data brokerages to register with the state if they chose to operate there. In order to register with the state, brokerages must provide the state with basic information about the company, including their privacy policy. In addition to providing information about the company, they must also pay a fee so that the company can be seen on a registry by the public.
The California law is unique among the current state regulatory laws. The bill, SB-362 "Data broker registration: accessible deletion mechanism." allows for citizens to essentially "opt-out" of data collection done by brokerages. The act created the CPPA (California Privacy Protection Agency) to conduct data brokerage registry. The act dictates that the CPPA must create an accessible deletion mechanism where California citizens can a request to have all their personal information which is found in data brokerage registries to be deleted. Brokerages have 45 days to fulfill these requests, and upon their completion, the brokerage can not sell any new personal information that they may find about the individual.
The European union passed a law called the General Data Protection Regulation (GDPR). The GDPR has two important articles which are the most important for privacy concerns. These two articles are the Right to Rectification and the Right to Erasure. The right to rectification allows the "data subject" to request that any inaccurate information about them be fixed without "undue delay" and to have incomplete information be completed. The right to erasure allows for a data subject to have information about them deleted if meets any possible criterion listed in the law. The right to erasure is not as absolute as the California opt-out system. the European law requires there be a reason for data deletion, but does not allow for a restriction on collection of new information on the "data subject".
Where to go next:
On the federal level there should be comprehensive legislation to create standardized practices across the industry. Such regulation could require that all brokerages register with an authority such as the Consumer Fincial Protection Bureau. The CFPB itself has even said that an unregulated brokerage industry "enables espionage, allows thieves to target financially vulnerable people and allows potentially violent actors to target law enforcement officials and others."
In addition to register with a regulatory commision, brokerages should be required to go through periodic audits to ensure compliance. There also ought to be provisions ensuring that strong data security measures are in place to protect sensitive information tha tbrokerages may be collecting. I believe a federal law similar to the law of the state of California allowing individuals to opt out would also be of importance. With or without an opt-out option, regulations must empower individuals with the right to access information, correct or remove erroneous information, etc.
Sources:
Bill text. Bill Text - SB-362 Data broker registration: accessible deletion mechanism. (n.d.). https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362
Gillison, D. (n.d.). US watchdog proposes limits on “Data Brokers” sale of personal info | Reuters. https://www.reuters.com/world/us/us-watchdog-proposes-limits-data-brokers-sale-personal-info-2024-12-03/
Kaspersky. (2021, May 27). Data Brokers & Data Brokerage. /. https://www.kaspersky.com/resource-center/preemptive-safety/how-to-stop-data-brokers-from-selling-your-personal-information
Legal text. General Data Protection Regulation (GDPR). (2024, April 22). https://gdpr-info.eu/
Morris, H. &. (2024, January 25). Understanding the new data broker registration laws. Hosch & Morris, PLLC. https://www.hoschmorris.com/privacy-plus-news/data-broker-registration-laws
State Data Broker Laws. Willkie Compliance Concourse. (2023, January 24). https://complianceconcourse.willkie.com/resources/privacy-and-cybersecurity-us-state-data-broker-laws/
Wlosik, M. (2024, December 12). What is a data broker and how does it work?. Clearcode. https://clearcode.cc/blog/what-is-data-broker/#:~:text=The%20role%20of%20such%20companies%20is%20to,income%2C%20web%20history%2C%20purchase%20history%2C%20and%20interests.
I agree that there should be comprehensive legislation and audits to ensure compliance with regulatory rules. Data is valuable and even small things like purchase history or other things that might be of interest to those that data brokers are selling information can be aggregated to reveal lots of information about an individual. Therefore, I also agree with the point that the post brings up, that there also ought to be robust data security measures, potentially with encryption depending on how long the information is stored within a database.
ReplyDeleteLike Shreya mentioned, personal data that can indicate information about an individual's private life isn't limited to obvious things like their address, and even "innocuous" data about purchasing history can reveal a lot of information depending on context. We've actually already discussed one example of this in class where someone's parents found out she was pregnant because she was getting ads for baby supplies after buying a pregnancy test.
ReplyDeleteI think regulation should exist which not only requires data brokers to register and therefore be publicly known, but also at least to have certain minimum standards for data security, possibly also with limits on what sources data purchased can be collected from, etc.
As a general consumer of the internet, I'm less concerned with how long collected data is stored, or where, but rather what data is actually collected on me. I know laws like HIPPA and FERPA protect my privacy when it comes to medical and school records, but that doesn't protect my public browsing. For instance, if I visit a tutoring site, or purchase cream for athlete's foot or something like that on Amazon, that's not protected on those laws. I'm okay with data brokers collecting certain information, but when that bleeds over to areas like healthcare, that can seriously impact people. The blog post mentioned how healthcare companies can make decisions about insurance and policy pricing based on information they get from data brokers. That was kind of a surprise for me and I'm sure it would be for others in the general public as well. But how and where do we draw the line? Can we even do that? The internet is good, but it does tend to be hard to police.
ReplyDeleteAs is the norm in the digital age, technology and innovation tend to outpace legislation. This is an unfortunate but necessary side affect to our form of government. For a substantial number of the population, they are unaware that data brokerages are used so extensively. However, it is unwise to prevent data brokerages from operating. To do thus would make internet costly. Thus, the best solution is to follow(once again hilarious) the EU standard in considering data as property. In the digital age, innovation has placed the rights of the people on the sidelines to a degree. Thus, I agree that the best thing to do would be to implement a right to erasure and force data brokerages to register with the FEDERAL government, not just states. Just as there was regulation over media in the mid 20th century there must be regulation over the internet in today's age in a way that protects the rights of the people.
ReplyDeleteThere are many ways companies can collect information, whether that is through fingerprinting, web beacons, and/or cookies. Technology has quickly evolved, and will continue to do so. With that being said, there is always a new loophole that can/will be created. As much as I think regulations are important, developing and enforcing those regulations in this digital age poses problems due to some potential positives. In one of the readings for the week, it discussed that the information collected/tracked through cookies could be utilized to identify cybercrime, hackers, and so on. It can also be used to track analytics and make site improvements. There is an additional argument that preventing targeted advertisements would limit advancements and innovation in the digital space. One of the side effects is that free platforms would no longer be free, which would negatively impact underprivileged groups. Also, something to consider is that websites of all kinds commonly ask the consumer for their consent to collect information through pop-ups, which in itself is a step in the right direction. If companies, through the use of their website, continue to implement innovation (creating loopholes) tied to the restrictions of collecting data, a more effective approach would be to focus on the security/encryption of the collected information.
ReplyDeleteAs a few of my classmates mention, technology often moves faster than regulation. This is a case where I think this is true. The downsides of data brokering (predatory pricing, data leaks, etc.) seem to outweigh the potential positives (better advertising). I think there should be federal regulation so that these downsides can be minimized and power over data can be put in the hands of individuals. The ability to opt-out would be a priority to me since it gives a substantial amount of actionable power to consumers, but other things like standards for data storage and public registration would be important additions eventually.
ReplyDeleteI was most fascinated by the health insurance claim. At an initial glance it appears to be true! When you try to understand the world of health insurance things get super interesting because it's very regulated and received billions in subsidies to keep the companies afloat as a consequence. With all of that, I'm surprised this a practice they engage in. In terms of regulation, I would like to know what states without data broker registries do. Are they just the wild west of data? I assume not. I don't really have a problem with data collected from observations or observable things, which includes much activity on the internet. Before jumping head first into opinions on regulation, I'd like to be more familiar with the alternatives and times when harm was done.
ReplyDeleteAs the author depicted, I think it is essential for the federal government to mandate standardized practices regarding data brokerage regulation. Especially regarding the complexity of data maintenance, accessibility, and quantity, without a doubt, there should be a generalized notion for digital safety in this country. As Henry mentioned, there is a fine line where data should be shared amongst platforms. This can impact professional relationships and legal orientation amongst parties. Our social world has continuously crumbled into unease and panic, particularly within the media spheres of Meta. With federal regulation of data brokerage, I think we, as Americans, can feel slightly less vulnerable, and as the author mentioned, empowered as individuals, knowing we have a role in our data exposure.
ReplyDelete