The Unregulated Underground Market for Your Data: Providing Adequate Protections for Consumer Privacy in the Modern Era

• Author: Brittany A. Martin
• Position: J.D. Candidate, The University of Iowa College of Law, 2020; B.A., The University of Iowa, 2017
• Pages: 865-900

865

The Unregulated Underground Market

for Your Data: Providing Adequate

Protections for Consumer Privacy in

the Modern Era

Brittany A. Martin*

ABSTRACT: In the United States, there is a billion-dollar industry that

revolves around consumer data, but most consumers do not know it exists.

Data brokers are companies that collect information from consumers to buy

and sell. These companies also derive further valuable information from

consumers. Data brokers use their data for several things, one of which is for

marketing purposes. In the United States, there is no legislation on the federal

level to regulate the collection and use of this data by data brokers. The United

States has failed its consumers by not providing regulation. There are a few

states that have taken initiative to protect consumer data online, namely

Vermont and California. Additionally, the European Union recently

implemented the General Data Protection Regulation (“GDPR”). The GDPR

provides a vast range of protection for EU citizens concerning their online

data. Congress should follow guidance from Europe, California, and

Vermont regarding digital consumer privacy. Congress should include in its

legislation: a meaningful notice-and-choice requirement, an option for

consumers to have access to and the ability to edit data held by data brokers,

require companies to minimize the amount of the data that they collect and

retain, have strict penalties for noncompliance, and create quasi-

governmental entities to assist in regulation.

I.INTRODUCTION ............................................................................. 866

II.WHO DATA BROKERS ARE AND HOW THEY ARE REGULATED ....... 868

A.DATA BROKERS AND HOW THEY COLLECT AND USE

CONSUMER DATA .................................................................... 868

1.How Do They Know That? ............................................ 870

2.What Do Data Brokers Do with This Data? ................. 872

*

J.D. Candidate, The University of Iowa College of Law, 2020; B.A., The University of

Iowa, 2017.

866 IOWA LAW REVIEW [Vol. 105:865

B.FEDERAL REGULATION OF DATA BROKERS IN THE UNITED

STATES ................................................................................... 872

1.Congressional Protection of Digital Consumer

Privacy ............................................................................ 872

2.Protection of Digital Consumer Privacy at the

Administrative Level ..................................................... 875

3.Judicial Treatment of Invasions of Digital Privacy ...... 878

C.STATE REGULATION OF DATA BROKERS .................................... 880

1.The California Consumer Privacy Act of 2018 ........... 880

2.Vermont Directly Regulates Data Brokers ................... 883

D.EUROPEAN PRIVACY LAWS AND DATA BROKERS ......................... 884

III.CONSUMERS IN THE UNITED STATES NEED PROTECTION

FROM THE HIGHLY EVASIVE AND INVASIVE PRACTICES OF

DATA BROKERS ............................................................................. 887

IV.RECOMMENDATIONS FOR FEDERAL LEGISLATION ......................... 890

A.MEANINGFUL NOTICE-AND-CHOICE OF DATA COLLECTION ........ 891

B.PROVIDE CONSUMERS WITH THE OPTION TO EDIT THEIR

DATA ...................................................................................... 894

C.DATA MINIMIZATION .............................................................. 896

D.STIFF PENALTIES FOR FAILURE TO COMPLY ............................... 897

E.CREATION OF AN ENTITY TO ASSIST IN REGULATION ................. 898

V. CONCLUSION ................................................................................ 900

I. INTRODUCTION

If you are a consumer in the United States who uses the Web, the chances

are high that you see a plethora of advertisements while you browse. This is

often true regardless of whether you are actively online shopping. Perhaps

you have been online shopping, moved on to something else, and then see an

item you previously lingered on but did not buy. With the average American

spending 23.6 hours a week online,1 this is a common experience for many.2

While these targeted ads can sometimes be helpful, other times they serve as

an unwanted temptation or simply an annoyance. Some individuals may also

find them creepy.

1. HARLAN LEBO, THE 2017 DIGITAL FUTURE REPORT: SURVEYING THE DIGITAL FUTURE 6

(2017), available at http://www.digitalcenter.org/wp-content/uploads/2013/10/2017-Digital-

Future-Report.pdf [https://perma.cc/ZRE7-UD5H].

2. Christopher Elliot, Why Does Tha t Online Ad Keep Following Me?, USA TODAY (Nov. 6,

2016, 6:01 PM), https://www.usatoday.com/story/travel/advice/2016/11/06/retargeting-

online-ads/93282408 [https://perma.cc/9JTK-MSBM].

2020] UNDERGROUND MARKET FOR YOUR DATA 867

The idea gets creepier once you explore the reason behind these ads

popping up on your computer or mobile device. On every site you visit on the

Web, there are often several entities following you around as you browse.3

These entities study you extensively; they learn demographics such as age,

location, and interests.4 Once these entities have a sufficient level of

information, they are able to target you more accurately.5 Some of these

entities are commonly known and used by consumers, such as Facebook or

Twitter; however, there are several other companies you have probably never

heard about that exist solely to collect consumer information. These include

Acxiom, Experian, Datalogix, and Statlistics.6 At least some of these

companies likely have information about you in their databases right now.7 If

you are unaware of the data broker industry, you are not alone; it keeps a low

profile.8 There would also be no reason for you to know who they are, since

you have likely never interacted with one directly.

One may wonder why these companies have so much information about

you when you know so little about them. The answer to that question is that

there is no federal regulation of the collection of consumer data for

marketing purposes.9 Data brokers and companies you interact with are free

to collect and sell your data without your knowledge. One may have a problem

with this for several reasons. For starters, it seems to be an invasion of

consumer privacy. After all, in “real life,” a regular person would not let a

stranger follow them around the mall taking notes on their behavior and to

report them back to some company they have never heard of—which begs the

question: Why is this practice okay when it is done online?

Another concern is related to the security practices of big data

companies. In 2018, there was a swarm of data breaches, affecting millions all

around the world.10 The European Union (“EU”) has taken the threat to

online privacy seriously by enacting the General Data Protection Regulation

3. Max Eddy, How Compan ies Turn Your Data into Money, PCMAG (Oct. 10, 2018, 8:00 AM),

https://www.pcmag.com/article/364152/how-companies-turn-your-data-into-money [https://

perma.cc/Y8SN-TS53].

4. Id.

5. Id.

6. Paul Boutin, T he Secretive World of Selling Data About You, NEWSWEEK (May 30, 2016, 2:30

PM), https://www.newsweek.com/secretive-world-selling-data-about-you-464789 [https://

perma.cc/7RPT-8ZCF].

7. Id.

8. Id.

9. Id.; Eddy, supra note 3.

10. Kyunghee Park & Jinshan Hong, Millions of Passengers Hit in Worst Ever Airline Data Hack,

BLOOMBERG (Oct. 24, 2018, 7:02 PM), https://www.bloomberg.com/news/articles/2018-10-

25/cathay-pacific-reports-data-breach-affecting-9-4-million-fliers [https://perma.cc/7J9N-NSF5];

Jacob Taylor, Ticketmaster Data Theft Part of Larger Credit Card Scheme, Security Firm Says, NBC NEWS

(July 10, 2018, 12:33 PM), https://www.nbcnews.com/business/business-news/ticketmaster-

data-theft-part-larger-credit-card-scheme-security-firm-n890206 [https://perma.cc/9YLP-L4V8].