Lawmakers Take Aim at Data Brokers: Regulation Looms to Protect Privacy
A growing number of lawmakers and regulators are taking steps to control the activities of data brokers, businesses that profit from collecting and selling private data. These brokers amass extensive information about individuals, including financial details, personal identifying data, and even travel history, usually without the individuals’ knowledge or consent.
Data brokering is currently unregulated at the federal level, but a bipartisan group of lawmakers is looking to change that.
Two entities, the Consumer Financial Protection Bureau (CFPB) and the state of Massachusetts, have initiated efforts to increase oversight of data collection and protect individuals’ privacy.
The CFPB, under the leadership of Director Rohit Chopra, plans to establish rules for data brokers, specifically focusing on the use of artificial intelligence and its impact on consumer financial health. Chopra has expressed concerns about the potential misuse and abuse of private data, particularly when it comes to important life events such as obtaining a loan or interviewing for a job. The CFPB intends to release a proposal next month to place data brokers under the Fair Credit Reporting Act, a law that sets standards for fairness and privacy in organizations like credit bureaus. The proposed rules will be made available for public comment in 2024.
Massachusetts legislators are also exploring regulations to limit the activities of data brokers. State Rep. Kate Lipper-Garabedian and state Sen. Cynthia Creem introduced the Location Shield Act, which seeks to ban the sale of cellphone location data by brokers. The proposed legislation aims to protect sensitive information that can reveal personal, religious, political, and sexual beliefs. Additionally, the bill addresses concerns about tracking and prosecuting women who have had abortions by prohibiting the sale of location data related to visits to abortion clinics. Massachusetts would become the first state to ban the collection of location data if the bill passes.
The risks associated with data brokering have been a point of discussion among lawmakers, particularly regarding circumvention of warrant requests and indirect targeting of individuals. While technically legal, data brokerages often go unnoticed or are not fully understood by the public. Data can be collected through various means, such as purchasing from third-party companies, scraping public databases, or using popular apps. Users unknowingly share their data with brokers when they consent to data sharing with third-party partners.
Recent revelations have shown that federal agencies have also been acquiring location data through brokers, even though the Supreme Court prohibits such practices. The Department of Homeland Security has used purchased data to track millions of citizens without obtaining a warrant, and the Centers for Disease Control and Prevention tracked phone data to monitor compliance with COVID-19 lockdown orders.
To address these concerns, some states have attempted to establish guidelines for data brokering. For example, Vermont requires data brokers to register in a public database and disclose their operations, while California allows residents to request copies of data that mention them. However, critics argue that these rules still provide ample leeway for companies to operate freely.
In August 2022, the Federal Trade Commission sued data broker Kochava over its collection of sensitive location data related to visits to abortion clinics and religious locations. Additionally, some members of Congress have pressed data brokers, such as Equifax, Oracle, and Whitepages, about their data collection practices. House Energy and Commerce Committee Chairwoman Cathy McMorris Rodgers has advocated for a national privacy framework that encompasses regulations for data brokers, although the proposal has yet to gain traction in Congress.
As the discussion around data brokering continues to evolve, lawmakers and regulators are increasingly recognizing the need to protect individuals’ privacy and ensure accountability for the use and abuse of private data. The efforts by the CFPB and Massachusetts signify a growing shift toward regulating data brokers and increasing transparency in how personal data are collected and used.
