Challenges in Regulating Data Brokers and Aggregators

For years, Congress has struggled to provide Americans with control over their personal data. Efforts to allow individuals to see, edit, and delete their data have repeatedly failed. This lack of action leaves Americans without options against data misuse. Meanwhile, the data broker industry continues to thrive, selling personal information in an uncontrolled market.

Some states, including California, Virginia, and Texas, have attempted to address these gaps. They’ve enacted laws requiring data brokers to register, honor deletion requests, and disclose the data they gather. However, enforcement is inconsistent. Companies operating across state lines rarely face serious consequences for non-compliance.

Two new bills in Congress, the SECURE Data Act and the GUARD Financial Data Act, aim to bring data brokers under legal scrutiny. These bills present a chance for federal intervention. A recent hearing exposed resistance within Congress to establishing a national standard, revealing a preference for retaining existing state laws. The lack of federal action leaves consumers with unequal protections based on their location.

A significant problem is that some companies avoid classification as data brokers to bypass even state-level regulations. Unlike traditional brokers, large data aggregators don’t sell raw personal data. They collect data and create profiles that influence various aspects of life, from mortgage approvals to loan interest rates. These profiles operate without consumer protection despite having serious consequences.

The gap in regulation exists because current laws target companies generating 50% of revenue from data sales. Massive data aggregators make money through the sale of derived profiles, not raw data. This loophole allows them to operate without oversight.

The new bills represent a step towards regulating the industry. The GUARD Financial Act recognizes financial data aggregators in federal law, and the SECURE Data Act proposes data minimization and consent requirements. However, both bills have limitations. The SECURE Data Act’s revenue threshold excludes aggregators whose revenue comes from profile sales. The GUARD Financial Data Act requires disclosure, but aggregators can still collect and sell data if consumers miss these disclosures.

The SECURE Data Act allows opting out of certain profiling but falls short of limiting the use or sale of derived data. Gerard Scimeca, an attorney and chairman of CASE, a consumer advocacy group, remains engaged in these developments, emphasizing their implications.