Businesses Take Heed: FTC's Recent Report, Conference Signal Big Data’s the Big Deal in 2016

FTC Kicks Off New Year with New Report on Growing Use of Big Data Analytics Across All Industries Without so much as a week of 2016 having lapsed, the Federal Trade Commission (“FTC” or “Commission”) released a new report with recommendations to businesses on the growing use of big data. The report, “Big Data: A Tool for Inclusion or Exclusion?  Understanding the Issues” (“Report”), is based primarily on the FTC’s synthesis of the numerous discussions and written public comments submitted in connection with FTC’s September 2014 public workshop exploring the use of big data and its impact on American consumers, as well as a prior FTC seminar on alternative scoring products.  The primary purpose of the Report is to ensure that businesses’ use of big data analytics, while producing many benefits for consumers, avoids outcomes that may be exclusionary or discriminatory, in particular with respect to low-income and underserved populations.

Big Data Defined

“Big data,” as the Report explains, refers to a confluence of factors, including: (i) the nearly ubiquitous collection of consumer data from a variety of (primarily, but not exclusively) online sources, whether by shopping, visiting websites, paying bills, connecting with family and friends through social media, using mobile applications, or using connected devices (e.g., fitness trackers, smart televisions, etc.); (ii) dramatic reductions in the cost of data storage; and (iii) the growing availability of powerful new data processing capabilities, which can analyze data, draw connections, and make inferences and predictions with ever-increasing speed and accuracy.

Big Data: Benefits and Risks

In the Report, the Commission acknowledges full well that the era of big data has arrived, and that the role of big data is growing rapidly across virtually all industries, which, in turn, is producing tremendous benefits for both businesses and consumers, as well as for society as a whole. At the same time, advocates, academics, and others have raised concerns about whether certain uses of big data analytics may harm consumers, violate consumer protection or equal opportunity laws, or more generally detract from the core values of inclusion and fairness.  Thus, a central focus of the Report is to examine the intersection of big data’s benefits and risks for businesses and consumers alike, in an effort to avoid discriminatory data use (which was a key topic at the recent FTC conference, PrivacyCon, discussed below).

The Report sets forth a number of improvements to society that are made possible through big data analytics. In addition to more effectively matching products and services to consumers, big data can create opportunities for low-income and underserved communities, for example, by:

• increasing educational attainment for individual students;
• providing access to credit using non-traditional methods;
• providing healthcare tailored to individual patients’ characteristics;
• providing specialized healthcare to underserved communities; and
• increasing equal access to employment

At the same time, the Report notes that some researchers and others have expressed concern that the use of big data analytics may result in the exclusion of certain populations from the benefits that society and businesses have to offer, based on issues related to the quality of data, including its accuracy, completeness, and representativeness, as well on whether there are uncorrected biases in the underlying consumer data. For example, businesses could use big data to exclude low-income and underserved communities from credit and employment opportunities, or to create and reinforce disparities in the pricing and availability of certain products and services.

Highlighting Numerous Laws Potentially Applicable to Big Data Practices

In addition to the potential for diminishing inclusion and fairness, the Report also makes clear that certain uses of big data could violate various existing laws governing big data practices, such as the Fair Credit Reporting Act (“FCRA”), equal opportunity laws, and the Federal Trade Commission Act (“FTC Act”). The Report attempts to guide businesses in this regard by providing an overview of the existing legal framework established by these laws.  However, the Report also emphasizes that it is not intended to identify or fill any legal or policy gaps, so businesses need to ensure they have a complete understanding of these and any other laws that may be implicated at any stage in the life cycle of big data.  To this end, the advice of counsel is strongly recommended, particularly given that the FTC reiterates throughout the Report that it will continue to monitor areas where big data practices could violate existing laws and that it will bring enforcement actions where appropriate.

Key Considerations for Assessing Compliance with Laws Identified in the Report

For businesses already using or considering engaging in big data analytics, the Report offers a number of key questions (set forth below) to consider as a starting for assessing an entity’s compliance, or lack thereof, with the existing laws addressed in the Report. Predictably, these questions focus, to a great extent, on certain disclosures that may need to be made to consumers in connection with the use and sharing/transfer of big data (or “little” data that may become “big” data), as well as on the security of such information. Among other things, businesses should consider the following:

• If you compile big data for others who will use it for eligibility decisions (such as credit, employment, insurance, housing, government benefits, and the like), are you complying with the accuracy and privacy provisions of the FCRA? FCRA requirements include requirements to (1) have reasonable procedures in place to ensure the maximum possible accuracy of the information you provide, (2) provide notices to users of your reports, (3) allow consumers to access information you have about them, and (4) allow consumers to correct inaccuracies.
• If you receive big data products from another entity that you will use for eligibility decisions, are you complying with the provisions applicable to users of consumer reports? For example, the FCRA requires that entities that use this information for employment purposes certify that they have a “permissible purpose” to obtain it, certify that they will not use it in a way that violates equal opportunity laws, provide pre-adverse action notice to consumers, and thereafter provide adverse action notices to those same consumers.
• If you are a creditor using big data analytics in a credit transaction, are you complying with the requirement to provide statements of specific reasons for adverse action under Equal Credit Opportunity Act (“ECOA”)? Are you complying with ECOA requirements related to requests for information and record retention?
• If you use big data analytics in a way that might adversely affect people in their ability to obtain credit, housing, or employment:
  • Are you treating people differently based on a prohibited basis, such as race or national origin?
  • Do your policies, practices, or decisions have an adverse effect or impact on a member of a protected class, and if they do, are they justified by a legitimate business need that cannot reasonably be achieved by means that are less disparate in their impact?
• Are you honoring promises you make to consumers and providing consumers material information about your data practices?
• Are you maintaining reasonable security over consumer data?
• Are you undertaking reasonable measures to know the purposes for which your customers are using your data?
  • If you know that your customer will use your big data products to commit fraud, do not sell your products to that customer. If you have reason to believe that your data will be used to commit fraud, ask more specific questions about how your data will be used.
  • If you know that your customer will use your big data products for discriminatory purposes, do not sell your products to that customer. If you have reason to believe that your data will be used for discriminatory purposes, ask more specific questions about how your data will be used.

FTC Enforcement Actions Expected

With the FTC’s release of the big data Report on January 6, and considering that the Commission held a major conference (discussed below) just over a week later, which focused in part on the latest research and commercial trends in big data, we expect big data to be a very big deal in 2016. Further, now that the Commission has provided businesses additional substantive and actionable guidance in the realm of big data, enforcement actions from the FTC are likely forthcoming.  This is something we will continue to watch.

PrivacyCon 2016: FTC Conference Intensifies Spotlight on Big Data

On January 14, just eight days after the FTC released its latest Report on big data (discussed above), the Commission hosted PrivacyCon, a first-of-its-kind multi-stakeholder conference focused on the latest research and commercial trends in big data, consumer privacy, and related areas. PrivacyCon featured presentations and discussions by a diverse group of stakeholders, including whitehat researchers, academics, industry representatives, consumer advocates, and government regulators.

The original research presented at the day-long event centered on such issues as how consumers’ understanding of privacy online squares with the options about their privacy that they are provided, tools to analyze the way consumers’ information is shared and used online, and the effectiveness of programs to track security vulnerabilities. Within this broader context, the FTC put big data on center stage for the second time in just over a week when Commissioner Brill kicked off an afternoon session on big data and algorithms, during which several academics presented research and findings on the importance of transparency tools in revealing and avoiding data discrimination. The slide deck used during this session can be found here.