To this point, U.S. congressional hearings regarding privacy and data protection could be best characterized as fact-finding missions or information sessions. While the discussions have yet to produce the results lawmakers are hoping for — federal privacy legislation and appropriate consumer protections to name a couple — they're certainly providing windows into all facets of the privacy conversation.
Congress' latest view into the privacy world came Tuesday as members of the Senate Committee on Finance's Subcommittee on Fiscal Responsibility and Economic Growth convened a hearing to bring light to a number of ongoing issues concerning data brokers at the domestic and international levels. Committee members and witnesses outlined growing concerns with the indiscriminate sale of individuals' data and the potential consequences of that data falling into the wrong hands.
Coincidentally, the hearing comes days after public allegations were made regarding location data sales to brokers by family safety application Life360, which has 33 million users worldwide. Another instance of the brokerage industry's reach popped up in November when digital advertising company Mobilewalla detailed its sale of cellphone data to a third-party broker that turned around and provided the acquired data to U.S. government agencies.
"Data brokers are profiting off the vulnerability and insecurity of the U.S. and its citizens. Comprehensive federal privacy legislation is vital, but Congress need not wait to resolve this debate to resolve data brokerage," said Justin Sherman, a Duke University Fellow and research lead of the Sanford School of Public Policy's Data Brokerage Project. "Companies selling this data conduct very little 'know your customer' due diligence. For those that do, it's unclear how strong it is in practice. Brokers also make buyers sign non-disclosure agreements stopping them from saying where they obtain citizens' information."
Domestically, the U.S. has state data broker laws in California, Nevada and Vermont while some federal sectorial laws also include provisions against brokers. Sherman, Future of Privacy Forum Senior Counsel Stacey Gray, CIPP/US, and New America Cyber Policy Fellow Samm Sacks each proposed comprehensive federal privacy legislation with specific provisions on limits to data collection, use and sales would be the ideal fix to curtail data brokers' activities.
Data inference in focus
The data broker industry thrives off piecemealing data. As noted in testimony from Sherman and Gray it is the collection and acquisition of different types of data that allow brokers to build profiles that can be flipped to third parties for advertising or malicious purposes.
Even without stringing together full profiles, single pieces of various data can be equally effective to target an individual with the right amount of inference. Sherman explained some of the common data inference scenarios he's seen, including information belonging to U.S. military personnel, victims of intimate partner violence, and individuals with mental health conditions.
"The collection, buying and selling of this information is so unregulated that it's very easy for a company to put information together to figure out how you are," Sherman said. "Much like they might track where you go every day or what you spend to figure out how much money you and your household make, they might look at where you travel to figure out if you're in the military."
U.S. Sen. Bill Cassidy, R-La., focused his questioning on the perils of inference with location data. More specifically, Cassidy took issue with potential exploitation of those health conditions through the brokerage market.
"The thought has always occurred to me that we have (Health Insurance Portability and Accountability Act) penalties if I as a physician was to reveal someone was HIV positive or had a mental health illness," Cassidy said. "The mental illness is actually well known though. It makes total sense to me when you have location data that shows that someone goes to a clinic … every two weeks or every month and then a pharmacy afterwards. They can infer the patient has an illness. Doesn't this kind of violate the spirit and letter of the HIPAA regulations?"
Addressing national security threats
Witnesses made clear that data brokerage is far from a domestic issue. Present concerns at an international level focus on China's recent tightening of privacy and data security laws. Sacks, who also serves as a senior fellow at Yale Law School's Paul Tsai China Center, explained China's Personal Information Protection Law and overall data strategy work toward "acquiring, controlling and unlocking the value of data," with government control and access at the heart of that model.
Sacks indicated a "more comprehensive data governance vision" would be required from the U.S. to avoid foreign surveillance issues from China or other adversaries through third-party data sales.
"If location, health and social media data were to be acquired on the open data market and combined with what Beijing already has, China could target individuals in sensitive government national security positions or military positions for manipulation, coercion or blackmail," Sacks said.
The issues of data brokers and foreign surveillance have been top of mind for U.S. Sen. Ron Wyden, D-Ore., in recent years. In April, Wyden introduced the Protecting Americans’ Data From Foreign Surveillance Act with the aim of withholding U.S. citizens' data from countries like China. He indicated Tuesday that another related bill will be "introduced shortly" on the matter of data sales to foreign nations.
"I've come to the conclusion privacy is a massive economic and national security issue," Wyden said. "You can't just separate these all out into separate boxes."
As far as immediate remedies for the potential Chinese pitfalls, Sacks hopes lawmakers will consider an opportunity to "address transnational security threats, but while also advancing a more secure, ethical and democratic internet." Such action would involve philosophical tweaks to approaching the data economy.
"The analogy of data as the new oil is false and leads to bad policy," Sacks said. "It assumes data is a finite state resource. Efforts by China or U.S. to hoard and wall off data will only lessen national power."
Photo by Harold Mendoza on Unsplash
