The UK privacy watchdog's ruling against Experian is a warning to data brokers that hoover up personal details
Summary List Placement
Credit agency Experian got slapped on Tuesday with an enforcement notice from the UK's data watchdog, the Information Commissioner's Office (ICO). The notice informed Experian that it will have to "make fundamental changes to how it handles people's personal data" because of its business as a data broker. The enforcement notice is the culmination of a two-year investigation, which was sparked by a 2018 complaint from digital rights nonprofit Privacy International. Although it doesn't come with an immediate fine – Experian has nine months to comply or face a penalty of up to £20 million ($25.7 million) – it has the potential to significantly shape the future how companies hoover up, package, and sell on your personal data in future. What are data brokers? Due to Facebook, Google, and Amazon taking up headline space on stories about hoovering up your digital footprints, data brokers such as Experian tend to fly under the radar. They are, however, an integral part of the adtech economy, as they do a huge amount of the legwork that lets companies microtarget you with ads. It works like this: data brokers assimilate vast amounts of people's personal data. They they then place you in distinct profile "sets", which can be sold on and used to target digital marketing at you. These profile sets are then sold on to the marketing companies that deploy them. Caroline Wilson Palow, legal director and general counsel at Privacy International, told Business Insider: "That data then becomes the basis of how those businesses choose to advertise to you on a platform like Facebook, when they're bringing that data into Facebook, as opposed to using Facebook's [own] data," Caroline Wilson Palow, Legal Director and General Counsel at Privacy International, told Business Insider." The names of some of these profile sets, which were unearthed in Privacy International's original 2018 complaint (page 56), offers some insight into the assumptions Experian makes about people using categories such as their age, income bracket, and internet usage. Examples include: "Uptown Elite," "Bank of Mum and Dad," "Classic Grandparents," "Childcare Squeeze," and "Asian Heritage" (which Experian describes as "Large extended families in neighborhoods with a strong South Asian tradition"). A "serious breach" of people's rights Although the ICO's enforcement notice was focused on Experian, it highlighted what the watchdog views as serious problems with the data broking industry. This is namely that it acquires and passes on people's data without enough checks and balances, nor without obtaining proper consent. The information commissioner, Elizabeth Denham, said in a statement: "The data broking sector is a complex ecosystem where information appears to be traded widely, without consideration for transparency, giving millions of adults in the UK little or no choice or control over their personal data. The lack of transparency and lack of lawful bases combined with the intrusive nature of the profiling has resulted in a serious breach of individuals' information rights." Palow added that from a privacy perspective, data brokers pose a particularly large threat because they are generally opaque organisations that people aren't aware of in their daily lives. "It's [a] lack of transparency and the fact that they're not household names that make them such a big problem," she said. "People just don't understand that they're collecting their data and that that data collection can have such major impacts on their lives." Facebook and Google are more transparent in the sense that most people know about them, she added. "They expect that they do have their data."
Another cause for concern is that data brokers are no longer just selling people's data on to advertisers. As Palow notes: "We know that data brokers' data has fed into how political campaigns decide who to target and even how to craft their messages [...] even more troubling now it's started to be used in some cases by law enforcement." Police can glean facial recognition data from data brokers, she adds. What will the new ruling change? The first part of the ICO's ruling orders Experian to inform people that it has their data, and to tell them exactly how it plans to use it or sell it on for marketing purposes. The ruling could also set a precedent by stopping companies from taking data from a different part of their business and quietly selling it on as data brokers. Another significant part of the ICO order means that from January 2021, Experian won't be allowed to take data from the credit referencing side of its business and fold that into its data broking business. Palow said this is significant, because people who give their data over to Experian to get a mortgage or a credit card don't realise it could then be repurposed for data brokerage. The ICO also found Experian was buying up data from other sources, for example other data brokers, without obtaining sufficient consent from people – i.e. they had no say in whether that data could be sold on to Experian. Experian is appealing against the ICO's decision so there's a chance it could weaken the enforcement notice, but it's still got huge potential to set the tone for how governments rein in data brokers. Palow is encouraged by the ICO's decision. She said: "I think that the enforcement notice is pretty powerful." She believes it could set a good international precedent, which is essential given that data brokerage is rapidly expanding in many countries. "They [data brokers] are based all around the world because I think a lot of companies are seeing that this is quite big business now, to collect the data in all its forms," she added. The ICO's findings were an interpretation of GDPR, Europe's strict overarching data protection laws, which came into force in 2018. This means they have the potential to quickly set an international precedent within Europe. If similar rulings start to snowball elsewhere in the world, it might not be long before smaller, little-known data brokers face the same intense scrutiny reserved for the likes of the big tech platforms.Join the conversation about this story » NOW WATCH: Why Pikes Peak is the most dangerous racetrack in America
More like this (3)
Identity theft is such a growing problem that it’s become almost routine—Marriott, MyFitness Pal, LinkedIn, Zynga,...Identity theft is such a growing problem that it’s become almost routine—Marriott, MyFitness Pal, LinkedIn, Zynga, and even Equifax (of all places) have had high-profile online data breaches in recent years, affecting hundreds of millions of people. To help combat this problem, Experian and other companies are…Read more...
Big Law firms are launching new groups dedicated to data privacy and biometrics. Here's why they're betting changes in regulations are creating a huge opportunity.
Summary List Placement Data privacy seems to be top of mind for all companies these days....Summary List Placement Data privacy seems to be top of mind for all companies these days. As more parts of consumers' lives are being digitized — from banking and transportation to retail and social interaction — there's been an accompanying surge in privacy regulations, which are designed to protect the personal information that's collected in the process. Legal experts cite data protection and cybersecurity...
An Uber-backed influence campaign against bike and scooter 'rider surveillance' lost the support of major privacy groups once they found out the company was involved (UBER)
Several major digital privacy groups pulled their support for an Uber-backed influence campaign after learning of...Several major digital privacy groups pulled their support for an Uber-backed influence campaign after learning of the company's involvement, WIRED first reported Thursday. The campaign, Communities Against Rider Surveillance, is a coalition of 25 organizations that Uber helped form to steer the debate around cities' use of scooter and e-bike trip data. Fight for the Future deputy director Evan Greer told Business Insider she...