Justin Sherman on Regulating the Data Broker Industry
Jun 9, 2023
auto_awesome
Justin Sherman, Founder and CEO of Global Cyber Strategies and a Senior Fellow at Duke University’s Sanford School of Public Policy, discusses the data broker industry and the need for federal legislation to regulate the collection and sale of personal information, including scams and harms caused by data brokers. They also talk about the manipulation of ads targeting reproductive health care facilities and the importance of privacy concerns for Congress.
The data broker industry collects and sells various types of data, including sensitive health information, which can be exploited for commercial gain.
Two proposed bills, ADPA and the DELETE Act, aim to regulate data brokers by creating registries and giving consumers the ability to opt out of data sales.
Data brokers have been associated with scams, targeting vulnerable populations and enabling stalking, highlighting the need for federal legislation to address these risks.
Deep dives
Data brokers and the data they collect
Data brokers are companies that collect, aggregate, and sell various types of data, ranging from individuals' interests to health data. They package and sell this data to advertisers, law enforcement, and other parties. Many data broker companies are not well known to consumers but play a significant role in the multi-billion dollar industry, collecting data on nearly every American. They gather data from a variety of sources, including public records, cookies, and mobile apps. Today, mobile apps are a major source of data, collecting information like health conditions, location, and even behavioral and personal details.
Challenges with Health Data and HIPAA
Health data and its sale is a major concern in the data broker industry. The Health Insurance Portability and Accountability Act (HIPAA) regulates health data, but it was passed in 1996 before the rise of smartphones, social media, and widespread data brokers. As a result, many companies that collect health data are not covered by HIPAA. For example, telehealth apps or meditation apps that are not associated with HIPAA-covered entities can legally sell people's health data. This poses risks as sensitive health information, such as mental health conditions, can be exploited for commercial gain.
The Importance of Regulating Data Brokers
Data brokers and their practices are under scrutiny, and there are efforts to develop federal legislation to regulate them. Two bills, ADPA (American Data Privacy Protection Act) and the DELETE Act, have been proposed. ADPA aims to create a registry of third-party data brokers and grants consumers the ability to opt out of data sales. The DELETE Act has a similar registry provision but uses hashing technology to protect privacy during the opt-out process. Both bills address important concerns regarding data broker transparency and consumer protection.
Scams and Harms Caused by Data Brokers
Data brokers have been associated with various scams and harms. For example, they sell data about active-duty military personnel, potentially exposing them to scams and targeting by foreign actors. Data brokers also provide access to personal information through search websites, enabling stalking, harassment, and even violence. Additionally, vulnerable populations, such as elderly Americans and people with Alzheimer's, have been targeted by scammers who exploit data sold by brokers. These examples highlight the risks and potential dangers of unregulated data broker practices.
The Path Forward and the Need for Federal Legislation
Federal legislation is necessary to address the issues surrounding data brokers. While some states have passed privacy protections, federal legislation would provide cohesive and comprehensive regulations for all Americans. Reintroducing bills like ADPA and the DELETE Act offer potential paths forward. ADPA, although comprehensive, needs to address exemptions for credit reporting agencies and strengthen penalties for non-compliance. The DELETE Act, more targeted, focuses on data broker registry and efficient opt-out processes. Both bills, with their strengths and improvements, play a crucial role in addressing the challenges posed by data brokers and protecting consumer privacy.
The data broker industry and its role in the digital economy is under scrutiny from Congress. Lawfare Senior Editor Stephanie Pell sat down with Justin Sherman, the Founder and CEO of Global Cyber Strategies and a Senior Fellow at Duke University’s Sanford School of Public Policy, to discuss the data broker ecosystem and the recent article he published in Lawfare about two bills from a previous congress that seek to give consumers more control over the information that data brokers collect and sell about them. They talked about some of the scams and other harms caused by data brokers, the regulatory approaches taken by each bill, and whether federal legislation regulating data brokers will get passed.