Computers Freedom and Privacy Conference
June 15, 2010, San Jose State University
Panelists:
Joanne McNabb, moderator, Chief, California Office of Privacy Protection (see her panel introduction)
*Beth Givens, Director, Privacy Rights Clearinghouse
Pam Dixon, Executive Director, World Privacy Forum
Jim Adler, Chief Privacy Officer, Intelius Inc.
Les Rosen, President, Employment Screening Resources
To view video of the entire panel, visit:
http://www.cfp2010.org/wiki/index.php/Recorded_videos
NOTE: The audio portion of the moderator’s introductory remarks is missing. But the audio for the remaining panelists can be heard. You can scroll to 2 minutes 56 seconds where the audio can be heard for the remainder of the panel presentations. To read the panel Introduction, provided by Joanne McNabb, click here.
*Presentation by Beth Givens
Director, Privacy Rights Clearinghouse
First, a little about the PRC: The Privacy Rights Clearinghouse is a nonprofit consumer education and advocacy organization. Established in 1992 and located in San Diego. Our website has over 50 consumer guides on a wide range of informational privacy issues, including the topic of our panel. IN ADDITION to consumer education, we advocate for consumers’ privacy rights in the California state Legislature. Our website is privacyrights.org.
Regarding the topic of this session, we receive email messages and phone calls virtually daily on online information brokers. Some people are angry that this industry even exists. And they are upset that companies, without our consent, can compile personal information about us and sell it to anyone, no questions asked. Many ask, isn’t this illegal??
Others have very specific complaints about how they’ve been harmed. Here are just a few of their stories:
1. Last year, we were contacted by a woman who testified in an attempted murder case and needs to keep her home address and other information private. She thinks the murderer is due to be released on parole soon and she doesn’t want to be located. She found herself on the website of US SEARCH and phoned them, asking to be removed. They told her to fill out their opt-out form but she doesn’t want to give them all the information the form requires. And by the way, this is a common complaint – the amount of information some brokers require in order to suppress people’s records.
2. Late last year a police officer from New Jersey contacted us. She works in gang intelligence and wanted information on how to remove her personal data from info broker websites. She asked if there’s one-stop-shopping – one address she could contact for opting out of all of the info brokers. She was very disappointed to learn from us there is no such thing.
3. In April, we were contacted by a lawyer representing a victim of domestic violence. They have been successful in removing her client’s personal data from info broker websites, except one -- IntegraScan. The CEO of this company refused to remove her information even though two doctors and a therapist have written him, explaining that she is at risk of physical harm if her address remains online. According to the attorney, he claims his First Amendment right to post public records information outweighs the victim’s physical safety.
4. And a final story from our hotline: Last month, a woman contacted us who is the victim of a rape by a serial rapist. She testified at his trial after he raped another woman. She is enrolled in an address protection program provided by her state’s Secretary of State, which enables such victims to protect their home address by letting them use that program’s address as their own. Nonetheless, Blockshopper, which posts public records information about home ownership, including location and value, is publishing her address information and refuses to remove it. They asked to have a copy of her police report before considering removing her information. She does not want to provide that information because it has many graphic details involving her situation.
There are many more such stories I could share with you.
And now, just a bit about the online info broker industry:
We have been looking at this industry since 2004. We’ve compiled a list of more than 100 such companies, available on our website, although it’s not a complete list by any means.
My guess is that most of the online information brokers on our list are NOT household words to most of you. How many of you have heard of: [show of hands for each]
Abika – Veromi – Integrascan? [few hands raised]
How about ChoicePoint? [many hands raised]] (NOTE: Now LexisNexis)
Not surprising. It was the ChoicePoint data breach in February 2005 that first raised the awareness of the general public to the information broker industry.
At that time, ChoicePoint approved as customers people who lied about their credentials in order to get access to ChoicePoint’s data files. These so-called customers were a fraud ring that created fake business identities to subscribe to Choicepoint. They obtained more than 163,000 data profiles of individuals, including Social Security numbers. Using this data, the crime ring went on to commit about 5,000 cases of identity theft.
In the wake of this data breach, ChoicePoint was fined by the Federal Trade Commission $10 million in civil penalties and $5 million in consumer redress. And they have had to change their business model significantly. Their customers include companies like private investigators, debt collectors, the media, law firms, and law enforcement.
There are a few categories of information brokers. Many provide basic directory information about individuals free of charge – name, current and past addresses, phone number, and in some cases email addresses. You are likely to be aware of many of these. Examples are Switchboard, AnyWho, Zabasearch, and several with names beginning with the word People, such as People Find, People Lookup, People of America and so on. And let’s not forget Google and Yahoo.
Going beyond directory information, many online information brokers provide – for a fee – much richer profiles. Data sources for these info brokers include county property tax assessor files on home ownership, court files, bankruptcy records, business licensing data, tax liens and utility customer data.
LexisNexis (which purchased Choicepoint in February 2008) and Acxiom are examples of companies that sell the more expansive profiles. They attempt to confirm that the purchaser has a legitimate business purpose to obtain such records, although this is not fool-proof. In fact, Lexis Nexis had a breach affecting 40,000 people just last year.
A third category of info brokers is more recent. These are aggregators that add personal information from social networks to the mix. One example is Spokeo which was recently featured in a not-very-sympathetic article in the Los Angeles Times.
Spokeo combines data from social networks, phone books, marketing lists, business sites, and other public sources to build profiles that include a person's age, ethnicity, occupation, education, hobbies, relationship status, whether he or she has children, and the quality of the neighborhood – although the information is not always accurate. For a fee, subscribers can get even more information. PIPL.com is another aggregator. And with Intelius adding social network information to the profiles it compiles, it too is an aggregator.
In closing, as Joanne explained, the info broker industry is largely unregulated. Some companies offer opt-out opportunities, so you can suppress your personal information. Others do not. They don’t have to. A few have actually attempted to charge a fee for opting out. Some make their opt-out instructions easy to find. Others bury it. The definition of privacy that Joanne offered – the ability of individuals to control their personal information – is definitely NOT operative with the information broker industry.
And with that I close. Thanks for your attention.
__________________________________
Joanne McNabb's Panel Introduction
Introduction to Panel on Online Information Brokers
Computers Freedom and Privacy 2010 Conference
Tuesday, June 15, 2010
Joanne McNabb, panel moderator
1. This panel is Online Information Brokers and Privacy: Where’s the Balance?
2. I’m Joanne McNabb, Chief, California Office of Privacy Protection – Moderator.
3. What do we mean by “online information broker”?
- Many web sites sell (or give away) the personal information of individuals. They gather personal information from many sources including telephone directories and public records. Some also draw information from social networking sites
- Definition of the practice from recent FTC Privacy Roundtable:
“…the unregulated uses of consumer information. And by that we mean those that fall outside of the Fair Credit Reporting Act.”
- Definition from pending NY law:
“Individual reference services provider” is any …entity who primarily engages in the business of collecting, assembling, transmitting or maintaining sensitive personal information for the purpose of providing access to such information about individual data subjects to third parties for monetary compensation or other consideration….”
4. What do we mean by “privacy”?
- Right to be let alone (Brandeis)
- Right (desire? ability?) to control one’s personal information
5. There seems to be an inherent contradiction between the sale of personal information by a business and the individual’s right/desire to retain control of it.
6. Is that true? Can a balance be struck? This panel will provide some perspectives and some answers.
7. Introduce panelists:
- Beth Givens, Director, Privacy Rights Clearinghouse
- Pam Dixon, Executive Director, World Privacy Forum
- Jim Adler, Chief Privacy Officer, Intelius, Inc.
- Les Rosen, President, Employment Screening Resources
8. At end: Questions for panelists:
- Where is the balance between privacy of individuals and need for openness/public records?
- Is regulation of data brokers needed? Can self-regulation protect individual rights?
- Is there any pending legislation – state or federal – on data brokers or background screeners?
