Data Broker's Transparency Isn't Quite In Both Directions

Attorney Mark D. Rasch is the former head of the U.S. Justice Department's computer crime unit and today is a lawyer in Bethesda, Md., specializing in privacy and security law.

In a move that will satisfy nobody, data broker Acxiom announced that, beginning Sept. 4, it has launched a new website,, where people can log in and see some of what the data broker knows about them. This is supposed to be a move toward greater transparency and openness, and toward that end is a good move, but ultimately may result in data brokers having more information about consumers. What appears to be a service for consumers is, in fact, a service that benefits the data broker and its customers—and only indirectly the consumer.

The term "data broker" always reminds me of the movie Brazil, in which the torturers worked for a department called "Information Retrieval." Data brokers like Experian and Acxiom, DataLogix and Lexis/Nexis and others collect information about people and package, analyze and resell this information.

The information can come from many sources: public records and licensing (including 911 calls and police reports filed by rape victims), court records and filings, civil case files, purchasing history and loyalty program information, prescription drug information, certain web browsing history, subscription information (magazines, newspapers, online publications, possibly TV subscriptions), salary and paystub information, spending habits and locations. Taken together, many bits of data paint a detailed profile of just about every consumer in America.

Other data brokers use different techniques. For example, MVTrac uses its network of cameras to capture license plate data to track any car (and presumably its owner) wherever it is.

Add to this information the data that brokers can glean or purchase from social networking sites, including now possible access by Facebook to its database of facial recognition of members' (public) pictures, and the data brokers have a very detailed profile of just about everyone.

The data brokers don't just collect and sell this data. They manipulate and massage the data, categorizing consumers into groups that might be of interest to their potential customers. Selling baby lotion? They can identify consumers who are likely to have a baby in the near future. Looking for people who might default on a mortgage? They have data from which you can infer creditworthiness (although such data may be protected under the Fair Credit Reporting Act.) If you are lumped into the wrong category, your data may be less accurate, and may be less useful to their customers.

This is where Acxiom's new policy can help them out—them meaning data brokers and their customers, of course. On Acxiom's new website, consumers will be able to log in, provide their name, address and last four digits of their social security number (sure, that's a great idea) to authenticate themselves to the server, and then see what it is that Acxiom knows about them. The website notes that it will enable consumers to "know what data says about you and how it is used."

Well, sort of. There is some transparency about how the data is used, but the consumer still can't know how each specific bit of information was collected, who has sold it, how much they got for it, and how it is being used by the purchaser. So if you go to see the movie Kick-Ass 2, does the local googaplex sell that information to Acxiom, who then sells it to the CVS drug store, and if so, what does CVS do with the information?

So I logged into the website to see what Acxiom tells other people about me.So I logged into the website to see what Acxiom tells other people about me. Besides the standard name, address and contact information, size, cost and mortgage of my house, there were few tidbits of information. They knew my profession, my salary, my level of education. They also knew that my surname was German (Russian, actually), that I was a devout Christian (um, no, but Happy New Year anyway), that I was interested in high fashion (comfy jeans and a sweatshirt), that I like sweepstakes and lotteries (well, except that I have never bought a ticket), that I enjoy natural foods (cheese doodles are natural, right?), that I enjoy cooking (does thawing count?), that I am into aerobics (clicker, please), and that I like RVs (Right Ventricular? Release Valve?)

The site then invites me to change my profile data, and update it at any time.

So I have the ability to provide Acxiom, and whomever its customers might be, with a more detailed profile of me, and give up more personally identifiable information about me so that they can sell my data for a higher price (because it is more accurate and more valuable) and so I can get more and more targeted ads.

Now don't get me wrong. I have nothing against targeted ads, if the alternative is untargeted ads. But I am not crazy about things like being charged higher rates for life insurance because the insurance company thinks I enjoy skydiving when I don't, or correcting my profile to indicate that I am not crazy about vegetables (French fries are vegetables, right?) only to have my medical insurance rates go up.

In other words, what is valuable to me is not just to know what they know about me, but for me to know about them. Who are Acxiom's customers? To whom did they "sell" my information? What are the people they sold my data to doing with that information? How are they targeting me or discriminating against me based on the data they think they know? That's the kind of openness that would be useful to know. And that is precisely what Acxiom and other data brokers seek to protect as trade secrets.

Acxiom has several interests in providing this information. The first is undoubtedly a move toward some form of openness—even if for marketing or PR purposes. Second, people who see their own reports may decide that the Acxiom service is something they want to buy to check up on their employees, customers, babysitters, etc. Third, of course, is the fact that customers provide personal information that makes their product more valuable. Finally, this is an effort by at least part of the industry to ward off the potential that there will be additional regulation of what is essentially an unregulated industry.

But the efforts at transparency are shallow at best. A consumer wants to know that CVS examined the fact that I have foot problems, and as a result sent this information to Dr. Scholl's, which sent me a coupon for orthopedics. Or that the local Safeway thinks that I like Brussels sprouts and sent me a coupon. In other words, the openness goes the wrong way—my life is an open book, but theirs is turbid. That's what needs to change if data brokers want to avoid regulation.

As one of the guards said while wrestling a prisoner to the ground in Brazil, "Don't fight it, son. Confess quickly! If you hold out too long you could jeopardize your credit rating."

If you disagree with me, I'll see you in court, buddy. If you agree with me, however, I would love to hear from you.