You Know What Your Shoppers Did Last Summer

Attorney Mark D. Rasch is the former head of the U.S. Justice Department’s computer crime unit and today serves as Director of Cybersecurity and Privacy Consulting at CSC in Virginia.

Think of what you know about your customers. No, what you really know about them. Everything. If consumers make purchases both online and in brick-and-mortar stores, you know a great deal. You have surveillance pictures of them in the store. You know what they purchased and what they looked at. You have browser information. If you subscribe to any of the dozens of data aggregation or marketing sites, you know whatever is shared. With "big data" you have aggregated this data, too. And you routinely make automated decisions based on the collected data. You decide how to market to the consumer, what prices to set, how to target advertising. You decide whether to offer savings and, if so, on what products. Now imagine if you had to tell each and every one of your customers exactly what you collected and what you did with that information. I mean everything.

That is already the law outside the United States and Canada, and it may already be the law in those two holdout countries. It's a matter of interpretation.

Max Shrems is an Austrian data guy who is also a law student. One day, pursuant to the EU Data Privacy Directive, he decided to ask Facebook (NASDAQ:FB)—an Irish company, for tax purposes—to provide him with all the information it had about him for the three years he had been on the social networking site. The company gave Shrems a CD with more than 1,222 pages of data—every login, every communication, every "Like," E-mail addresses he had never provided (but others had), deleted pictures, deleted communications, deleted postings, and IP address and cookie information.

Facebook refused to give him information that it either contended was not "readily accessible" (too expensive to produce) or constituted a trade secret—two exemptions under EU data privacy directives. Shrems then started a Web site called Europe v. Facebook and initiated complaints with the Data Protection authorities in Dublin seeking greater transparency under EU Law.

CRM gives retailers the power to collect massive amounts of information about actual or potential customers and to use that data for order fulfillment, sales, advertisement, marketing and a host of other purposes. A retailer can know what a consumer reads, buys and looks at, in addition to who may be the consumers friends and associates. Using data analytics and merging data pools, a retailer can get a very granular picture of who its consumer is. That data can be merged with other data (or with purchased data analytics) and further refined and processed. The combined and analyzed data can then be used to decide how to target advertising, marketing and other resources.

But the EU data privacy law seems to require that the consumer, upon demand, be granted access not only to the data collected but to information about that data—including how has it been accessed and used. It also permits the data subject to correct that data.

What Do You Know About Your Consumers?

It's a lot more than you think. If you are a typical retailer, with a brick-and-mortar presence, a loyalty program, an online presence and a social networking marketing presence (Facebook and Twitter), in addition to a subscription to a host of third-party marketing data, you know quite a bit.

Every time an identified consumer visits a Web site, a record is created—either by the consumer's computer MAC address, by a cookie stored and retransmitted or by an affinity program identity. The Web site records basic information about the consumer (the type of OS used, the browser type, the referring page, etc.), the IP address used and the physical location associated with the IP address—all before the first mouse-click. The retailer's Web site then records exactly what the consumer does on the site, what he or she reads, what he or she clicks through, what is purchased, what is looked at but not purchased and what is placed in the basket but not purchased.

The surveillance cameras at the store collect data about consumers, including their physical activities, who they came in with, what they did, what they looked at, what they purchased, what they didn't. So the retailer "knows" this information, too, although it probably hasn't (yet) linked it to a specific individual. The retailer knows whether a consumer paid in cash, by check or by credit or debit card for each individual purchase. It knows the make, model, size, price, SKU and other data about the product purchased. The retailer knows how the product was delivered, when it was delivered and, often, whether it was signed for. It knows if the product was returned.The retailer knows all the information provided in a loyalty program, including the consumer's name, address, phone numbers, E-mail addresses, etc. If the retailer performs (or purchases) independent research about the consumer (e.g., from social networking sites), then it "knows" this, too.

The data protection laws permit the consumer data subject to have access to the data "collected" or processed by the data processor. All in all, that's a lot of data.

The law outside the United States and Canada expressly recognizes the right of consumers to know what data has been collected about them, and what has been done with it. Section 7 of the EU Data Protection Act gives data subjects the right to see a copy of the information an organization holds about them. The data subject must also be:

  • Told whether any personal data is being processed.
  • Given a description of the personal data, the reasons it is being processed and whether it will be given to any other organizations or people.
  • Given a copy of the information comprising the data.
  • Given details of the source of the data (where this is available).
  • Told why automated decisions about them have been made.

Thus, if a data subject is denied credit because of something a computer said, that person has a right to know that. Presumably, if a data subject is denied a discount, denied a coupon, denied an advertisement or provided with a different advertisement because of what the computer said (based on data collected), the consumer has the right not only to have access to the underlying data upon which the automated decision was made but also to at least the non-trade-secret portions of the algorithm that made the decision.

OK. But I don't do business outside the United States or knowingly collect data about non-U.S. citizens, so I am safe, right? Not so fast.

Although there is no current law in the United States granting consumers general access to personal data collected (the Fair Credit Reporting Act and the Privacy Act grant some limited rights) by U.S. companies, those companies collecting data about U.S. citizens shouldn't assume they are off the hook. The U.S. Federal Trade Commission's Fair Information Practices Principles outline what U.S. companies should do to ensure they are not committing unfair or deceptive trade practices. The FTC states that a core principle is to ensure a data subject has an ability to both access data about himself or herself (to view the data in an entity's files) and to contest that data's accuracy and completeness. This principle was reinforced in the White House's document, released almost exactly a year ago, entitled "Consumer Data Privacy in a Networked World."

Retailers need to be very concerned about these principles. The FTC, as part of its statutory mission to prevent trade practices that are either "deceptive" or "unfair," has recently gone after a number of entities for doing things that were not—by its terms—against the law. For example, the FTC went after cell phone hardware manufacturer HTC for selling phones that failed "take reasonable steps to secure the software it developed for its smartphones and tablet computers, introducing security flaws that placed sensitive information about millions of consumers at risk."

Now, no law requires phone software to be secure. No FCC regulation mandates it. Congress never gave the FTC express authority to regulate the security of cell phone software. But the FTC felt that, by selling what consumers believed to be a secure Android phone, HTC's actions in bypassing some of the inherent security in the operating system constituted either a deceptive or an unfair trade practice. HTC settled the case by agreeing to fix the flaws and to make the OS more secure.

Similarly, there is no "law" that currently permits U.S. consumers to have access to all the data collected about them, but the FTC's regulatory authority may grant the agency the power to enforce its Fair Information Practices Principles. If the principles are "fair," then not following them is "unfair" and, therefore, potentially actionable under the FTC's authority.

So retailers, even in the United States, might have to be prepared to tell customers exactly what they know about them. Remember, the truth will set you free. The burden of complying, not so much.

If you disagree with me, I'll see you in court, buddy. If you agree with me, however, I would love to hear from you.