And, other than the limits imposed by the FCRA, which Kamdar argues is somewhat easy to circumvent, there are few legal controls on data brokers. Kamdar said that while the Federal Trade Commission (FTC) has been looking into data brokers' practices, "they don't have to be licensed by the government."
Justin Brookman, director of consumer privacy at the Center for Democracy and Technology (CDT), said it would be difficult to impossible to license data brokers. "Are newspapers data brokers? Is Google.com a data broker? Data brokers by and large collect and sell truthful information about people, so any law is going to have to be fairly narrowly construed to avoid interference with the First Amendment," he said.
This, he added, does not make it impossible to curb egregious behavior by brokers. "We filed a complaint with the FTC a couple of years ago against Spokeo.com," he said. They had really detailed information about ethnicity, religion, and creditworthiness that was based on really sketchy data. The FTC eventually got an $800,000 settlement out of them for not complying with the Fair Credit Reporting Act."
Still, as is the case in anything facing the Internet, restrictions are only as good as those doing the restricting. Security blogger Brian Krebs reported this past week that a company bought by Experian, one of the nation's three major credit bureaus, was tricked into selling bank account and credit card data plus Social Security and drivers license numbers of at least a half-million Americans to an identity theft service.
Meanwhile, the prospects for consumers who want to control, block or delete the accumulating, micro-detailed dossiers of their lives are dim.
Julie Brill, a member of the U.S. Federal Trade Commission, proposed what she called the "Reclaim Your Name" initiative in an address at the 23rd Computers Freedom and Privacy Conference this past June. Brill, in an op-ed in the Washington Post in August, said the idea is to demand voluntary transparency from data brokers, "that know much more about us than we do about them."
The danger, she wrote, is that mountains of data are compiled into, "sophisticated algorithms that...may fuel more than just what ads we are served. They may also determine what offers we receive, what rates we pay, even what jobs we get."
Reclaim Your Name, she said, would have four components: Let people find out how brokers are collecting and using their data; give people access to the data collected about them; allow people to opt out of the use of their data; and to correct errors in information used for "decisions about substantive benefits."
Susan Grant calls Reclaim Your Name, "a great concept," but said it ought to be turned into legislation. And she argued that opting out should be the default for consumers. "Marketers talk about how much consumers want these benefits, but if that is the case, why not ask them to affirmatively agree to provide their data?" she said.
Sign up for CIO Asia eNewsletters.