Back to News & Commentary

Data Brokers Release Information 老澳门开奖结果 Their Operations In Response to Congressional Inquiry

Jay Stanley,
Senior Policy Analyst,
老澳门开奖结果 Speech, Privacy, and Technology Project
Share This Page
November 9, 2012

Yesterday Reps. Ed Markey (D, Mass.) and Joe Barton (R, Texas) a about the operation of the nation鈥檚 largest data broker companies. The information came in responses from nine data broker companies to a list of questions by a group of Members led by Markey and Barton seeking details of their operation in light of the privacy sensitivity of what they do. The responses released yesterday provide a good snapshot and reminder of what it is these companies are doing.

The most thorough response was provided by what is probably the biggest data broker, Acxiom. The company鈥檚 response contains a wealth of details about their gathering, buying, and selling of information about individuals (though it鈥檚 hard to know what they鈥檙e leaving out or smoothing over). But let me cover some highlights.

Acxiom takes the opportunity of the letter to engage in a lot of defensive propaganda about how 鈥渋nformation services fuel the global economy and infrastructure鈥 (which is not true; advertising may partly fuel the internet鈥攖hough some key sites such as Wikipedia are ad-free鈥攂ut personal information need not necessarily be involved). Acxiom also argues that 鈥淐onsumers Benefit from Appropriate Use of Information in Numerous Ways.鈥 Putting aside the loaded qualifier 鈥渁ppropriate,鈥 it is a bit鈥 spooky to tout the supposed benefits to consumers of dossier creation when individuals have not knowingly consented to those dossiers. (If the benefits are so great, let individuals opt-in.)

Acxiom also refused to respond to the members鈥 request that they list their sources of information, citing trade secrets. Instead the company responded generally that it received information from corporate, government and 鈥渟elf-reported鈥 sources, the latter meaning primarily consumer surveys and product registration forms.

On the government side, Acxiom says it receives

  • 鈥渧arious lists from the federal government, such as the Social Security Administration鈥檚 Deceased Master file, the State Department Terrorist Exclusion list, and the Office of Foreign Assets Control list.鈥

  • State and local government records 鈥渟uch as鈥 real estate assessor records, motor vehicle records, driver鈥檚 license data, professional licenses and other licenses such as hunting, voter records, and court records 鈥渋ncluding bankruptcies, liens, judgments and criminal convictions.鈥

On the corporate side, in the nonstop merry-go-round of data trading, much of Acxiom鈥檚 data is apparently fourth-hand: 鈥淎cxiom regularly procures data from other data compilers, like Acxiom, that compile data from hundreds of other sources. These commercial entities typically compile information from companies that collect the data directly from individuals.鈥 In other cases, the company says, it 鈥渁cquires data directly from the consumer-facing company without going through an intermediary.鈥

Acxiom says none of its corporate sources of data 鈥減rovide complete purchase transaction data, detailed financial information, credit information, financial account numbers, or protected health information.鈥 The company also states that it 鈥渁lso screens all businesses and data compilers from which we receive data to ensure the data has been legally and ethically obtained.鈥 That鈥檚 great, though I wonder how effective that can be when much of the data it鈥檚 receiving is fourth-hand? The company also says it screens companies to 鈥渆nsure that it can legally and ethically provide the data to a third party, such as Acxiom.鈥 Legally I do not doubt they do so, but the ethics of any company dumping its customer information into the hands of a third-party data aggregator are questionable at best.

As for the types of information the corporate giant is compiling on us, it lists

  • 鈥淚dentifying and contact information鈥

  • 鈥淐ourt & public record information鈥

  • Financial 鈥渋ndicators鈥

  • Health 鈥渋nterests鈥

  • Demographic information

  • 鈥淟ifestyle and interest indicators鈥

The health 鈥渋nterests鈥 (funny word, that) collected by the company include 鈥渋nterests in diabetes, arthritis, homeopathic, organic and senior needs.鈥 Diabetes and arthritis are listed, but they don鈥檛 state what and how many other medical conditions are tracked. Financial indicators include 鈥渆stimated net worth, estimated income, and type of credit card.鈥 The demographic information collected includes:

date of birth/age, race, ethnicity, religious affiliation, language preference, length of residence, home value, home characteristics, marital status, presence of children in the household, number of members in the household, education, occupation, and political party.

The lifestyle and interest indicators include:

cooking, sports, reading, computers, fashion, travel, exercise, crafts, movies, online shopper, retail purchase frequency and type of retail purchase (e.g., electronics, groceries, gas travel), media channel usage (e.g., Internet, TV, yellow pages, radio), type of social media user (e.g., Twitter, Facebook, LinkedIn, YouTube), license and registration data (e.g. professional, hunting, fishing, boaters, firearms, ATV, snowmobiles, aircraft) and Acxiom鈥檚 life-stage cluster.

Acxiom says its data products make up 15% of its revenue, with the rest coming from 鈥渋nformation services,鈥 which primarily seems to mean helping organizations make use of data they already possess. Its data products include:

  • Enhancement: 鈥淎cxiom offers our clients access to a database of [the collected data], which is used to enhance their customer or constituent file to better understand consumer interests, needs and changing life-stages.鈥

  • Lists: The company also sells lists of customers based on the above categories to businesses for 鈥減rospecting purposes.鈥 Clients can send Acxiom a list of their best customers and have Acxiom 鈥渋dentify similar households of potential new customers, supporters, or constituents,鈥 and the company also says it 鈥渓icenses our list database to 鈥 to other list providers for resale.鈥

  • Online advertising: the company offers organizations 鈥渢he ability to target online advertising鈥 using its data. It says that it does this in anonymous ways, but Acxiom also says, 鈥渋n some instances we enhance our publishing partner鈥檚 file of registered users with Acxiom enhancement data.鈥 It is not clear to me how that procedure would be anonymous. On its web site the company also clients, 鈥淯se what you already know about your audience in the offline world, combine it with the gigabytes of data available in the anonymous online world, and apply it with scale across emerging, addressable media channels.鈥 Axiom says it 鈥渄oes not collect online browsing or search activity on consumers,鈥 and 鈥淲e do not collect specific activity from social media sites such as individual postings, lists of friends or any data that is not public.鈥 That is good, but I do not understand how all these statements can be reconciled. It does seem clear the company is playing a key role in bridging online and offline data, which is a major threat to privacy.

Risk Mitigation

I was very interested to read about the company鈥檚 鈥淚dentity Verification鈥 and 鈥淩isk Mitigation鈥 products. 鈥淩isk mitigation鈥 is a term that often means 鈥渦sing data analysis to blacklist some individuals from access to certain things.鈥 This is where we get into due process questions over the algorithms used to create a score and how that may affect different people and groups.

The Identity Verification product, Acxiom says, simply 鈥渧erifies a potential customer鈥檚 identity by comparing the data supplied by the consumer against Acxiom鈥檚 database.鈥 As for the Risk Mitigation product, Acxiom says it:

provides information for the fraud department and other risk management departments, including the collections department, in businesses, non-profit organizations and government agencies to help them identify, investigate and prevent fraudulent transactions.

This is quite vague. What information is provided? Presumably the raw data includes nothing outside of what they list above, but the big question here is, does Acxiom do any risk scoring?

Which brings us to a related issue, that of access and correction by consumers. Acxiom鈥檚 policy is that consumers 鈥渁re not able to access the individual information we have in our marketing product line.鈥 Instead of access, we publish a booklet 鈥楿nderstanding Acxiom鈥檚 Marketing Products.鈥欌 They may, however, opt out of receiving marketing (that can be done ). And consumers may access and correct the information in Acxiom鈥檚 identity verification and risk mitigation products. The company says many people are steered to do so when faulty information results in them failing an identity check. Of course we don鈥檛 know how many people suffer some silent sanction because of errors in either of these products, and never know to correct it.

If some random guy on the street, or some company I鈥檇 never heard of, asked me to fill out a form listing all of the above information about me, I, and most people I think, would feel like they were filling out quite an intrusive questionnaire. The fact that these datasets are being bought and sold largely without the knowledge of the American people is a testament to how thoroughly profit-seeking companies will intrude upon our privacy when we don鈥檛 pass protections into law preserving our oldest traditions of privacy.

Learn More 老澳门开奖结果 the Issues on This Page