The Ethics Of Data Brokers

c0d3h4x0r writes "MSNBC's Bob Sullivan asks, Whatever happened to the ChoicePoint bill? and raises some good points: 'Few experts believe that there was a sudden lack of computer security this year. Rather, there was a sudden bout of truth, thanks to California state law. [...] But in other ways, all the legislation misses the point. The ChoicePoint data leak story was not really about identity theft. It was about this: "Who the hell is ChoicePoint, and why is it making money selling my personal information?"' This makes me wonder what the Slashdot crowd thinks: should anyone be able to sell information about you at all? The general public seems to think not, while our elected officials seem to think it's just fine. How does the information gathered and sold by data brokers differ from the information collected and sold by a private investigator, or is there even a real difference?"

Comments

someone has to...

[Anonymous Coward]

someone has to collect and distribute this stuff for things like background checks. are we suggesting the govt should do it instead of the private sector?

Re:someone has to...

[CosmeticLobotamy]

Yes. If ever there was something that the government should be doing instead of Wal-Mart, it's handling background checks.

Re:someone has to...

[kiatoa]

Government or private sector what difference? Historical evidence suggests to me that neither is trustworthy. Now, if there was a 50% cut to me every time $$ were made on selling my data I probably wouldn't care anymore about who else profits.

Re:someone has to...

[max born]

Not necessarily.

We could go back to the way it used to be done before the credit reporting bureaus. If somebody wants to give you a credit card or a loan they can ask you for a reference. You go to your bank or your current creditors and authorize them to give the you a reference in the form of a summary of your financial history or whaterver they need that you're prepared to give.

We could close all the other agencies down and the system would still work.

Sell Me Out

[fishybell]

Sure, why not? Sell all the information you have about me.

How else would I be able to find out what credit cards I pre-approved for?

copyright time?

[user32.ExitWindowsEx]

if collections of facts can be copyrighted (e.g. maps & dictionaries), couldn't you copyright your personal data?

it's all a collection of facts, generated by you being alive and doing stuff. so you should automatically own copyright.

so therefore anyone who knows anything about you should be guilty of infringement..and if they sell it, they should be guilty of distribution.

Re:copyright time?

[slicer622]

interesting idea. slashdot has an incredible double standard when it comes to freedom of information. we don't want to pay for any of 'the man's' information, but if you want our information, you'll have to not only pay for it, but then also pry it from our cold dead fingers.

hmm, i guess i don't have a point here. move along

Re:copyright time?

[cpt kangarooski]

No. In fact, not just no, but hell no. It's a stupid idea.

Facts are not copyrightable. So if you write down that you have brown hair, I can extract that fact and use it myself without infringing. Since there's no copyright, there's nothing to infringe on.

Compilations of facts might be copyrightable, but are not necessarily so. In order to be copyrightable, a compilation must possess originality, i.e. a creative selection and arrangement of components. All facts is not a creative selection. Ordinary arrangements, e.g. chronological, or alphabetical, is not a creative arrangement. It is fairly difficult to construct a copyrightable factual compilation (mostly it is a matter of creative selection).

As facts remain uncopyrightable, they can be copied from the copyrighted compilation, so long as the compilation itself is not copied. Furthermore, they can be observed from the source. So long as the copyrighted work is not itself copied, it is not infringing to have an identical, independently produced work, however the facts within are obtained. While it's possible to claim that sufficient similarity is indicative of copying (think of the odds of monkeys on typewriters) access is required to allege this. Since we're talking about information you don't want made public, there would presumably be no public copies which a purported infringer could've copied from, so similarity doesn't work for you.

But this is all dancing around the central issue: living your life and in the process producing facts is not an act of creative authorship. Just because you do something doesn't mean that you own the fact of it, or that the fact of it, by itself, is a creative work. You'd need to write it down. And even then, you can only protect what you write, as opposed to the uncopyrightable material within or the independently observable facts your writing is based upon.

Privacy is an interesting issue, particularly given the ability to store, search, and correlate vast quantities of information quickly and automatically. But it has nothing to do with copyright. Again, your post was pretty stupid.

Re:copyright time?

[cpt kangarooski]

If my neighbor collects a database about me which outlines my entire life it's typically viewed as stalking. If a company does it then it's a legal business.

What gives?

This depends on the specific elements of criminal stalking as set forth by statute. A quick glance at the Massachusetts statute (chosen because I live there; I have no idea whether there's a model act, or what) includes some elements that distinguish the two scenarios:

The defendant has to be malicious, their acts have to be directed at a particular person (presumably as opposed to observing everyone, or everyone that meets some particular criteria), the acts have to cause a reasonable person to suffer substantial emotional distress, and make a threat, with the intent of placing the person in imminent fear of death or bodily injury. (There are other elements, but these are the most pertinent ones)

So apparently, at least with regards to criminal stalking, just collecting every scrap of data about someone or someones is not criminal. (There might be some other crime involved, or maybe a tort or something -- I'm not going to exhaustively research this for a /. post)

If stalking is about motive it can be demonstrated that the company compiling the database is not worried in the least about my best welfare.

So? Virtually no one is worried in the least about your welfare. The duty of caring about you is very rare. People are only obligated, generally, to not hurt other people. They don't have to help. Sometimes people might assume a duty to care about you, e.g. your doctor. But this is pretty unusual, and not something you'd see between all the strangers in the world. From the MGL statute discussed above, there has to be actual malice and an intent to make you afraid of injury or death; few if any people will have that mental state.

If stalking is about the nature of the data collected

Apparently it's not. This seems sensible. I'm less worried, in a stalking context, about someone who looks up where I live, than someone who actively follows me around all day, even if they aren't collecting any data at all. The researcher is more of a concern from a fraud angle, than a threat to my person.

how is it that the consumer database agencies are not empowering employees who may be stalkers?

Maybe they are. Do they have a duty not to? Does the phone company have a duty not to give my address and number to my stalker when they're passing out the phone book?

Certainly there have been cases of stalkers that used commonly available data about people. I recall a case in NH where a man stalked a woman, primarily by gathering or buying copies of data about her, finally resulting in his murdering her and killing himself. It's sad, I guess, but I'm not sure if there's a good way to prevent it without resulting in significant burdens on everyone else. While I'm no (naive) Libertarian, I do tend to find that it's better to be free and unsafe than unfree and safe... especially since you're probably not all that safe in the latter case, anyway. See any safe police states lately?

Re:copyright time?

[SilverspurG]

There's still a vast conflict of interest which should be cause enough for a grand scale investigation by the Better Business Bureau, or someone.

Credit agencies, insurance agencies, and banking agencies are tied together. All of these agencies have a profit motive. That profit margin can be increased if a greater number of people have a lower credit score because a lower credit score is justification for higher interest rates. Higher interest rates will result in higher default rates if their income level decreases or the cost of living for their area increases more than their income. Higher default rates will further reduce the ability to advance income level and will also result in higher insurance rates--of which car insurance is legally mandatory in most states. While one can easily say "it's the consumers fault" it's impossible to deny that the businesses involved actually have an interest in encouraging this downward spiral. As long as they properly profile their customers ahead of time (those who we can screw, those who we can milk, and those we shouldn't mess with) there's little risk of a political or even media backlash. This profiling is justifiable from a business perspective. From the standpoint of "truth, justice, the American way, and leader of the Free World", however, one would expect that our tax dollars are working to prevent this wholesale exploitation of consumers.

As a basic business model this conflict of interest is very likely especially with the fanaticism for corporate growth and quarterly earnings on the stock market. From what I've seen my tax dollars have been aiding and abetting more than they've been securing me from this conflict of interest.

When it's my own tax money contributing to systems trying to lock me down as someone else's legally indentured servant I start to question everyone's motives.

Sue the bastards and shut them down

[rimcrazy]

These bastards almost shut down the sale of my home due to incorrect info in their database and then they want me to pay to correct it. If I had my way they should require me to approve who they want to sell my info to before a sale goes through and then I deserve a cut of every sale.

Who Do you Trust More

[linuxbert]

Choicepoint existed to collect information government needed access to but was not legally able to collect for themsleves. Gov't couldn't collect it but they could buy it.

This led to many departments haveing the small bits of information they needed about you being aggrigated into a large clearing house.

In the case of collecting information, i think the government may be better equiped to do it. at least there are independent auditors who keep tabs on the collectors. what did choicepoint have?

-Peter

Many claim ChoicePoint helped steal 2000 election

[Serveert]

They own DBT Online which royally screwed up in Florida during the 2000 election.

http://www.gregpalast.com/detail.cfm?artid=122&row =1

A scary look into the future...

[Chris Huelsbeck]

http://www.adcritic.com/interactive/view.php?id=59 27

Its' not that difficult

[the_mighty_$]

should anyone be able to sell information about you at all?

Answer: it depends.

If someone is going to sell information about you, they should ask your permission first. If you grant them that permission, then they should be allowed to do it. If you do not, then they should not be allowed to do it.

I don't see how this is hard to understand.

Re:Its' not that difficult

[Jherek Carnelian]

If someone is going to sell information about you, they should ask your permission first. If you grant them that permission, then they should be allowed to do it. If you do not, then they should not be allowed to do it.

I don't see how this is hard to understand.

The hard part is the conditions under which you agree to let your information be sold. For example - most public utilities require SS# in order to get service. This means you really have no choice about providing that information to them - and today they can do whatever they want with it.

If laws were put in place to require permission, they will need to address the case providers of essential and nearly-essential services (airlines, banks, insurance, driver's licenses, etc) from demanding permission as a requirement of doing business with you. Because if such organizations are allowed to do that, then the concept of permission becomes meaningless.

Re:Its' not that difficult

[slavemowgli]

The problem with that approach is that asking for people's permission is much like requiring them to click "accept" on an EULA. Most will simply sign documents required for certain things like obtaining credit cards without reading them in great detail; and even those who do would still be forced to accept these terms if they want a credit card, for example.

Choice is only choice if there really *is* a choice. What I'd like to see would be a "privacy seal of quality", so to speak - awarded by an independent non-profit organisation which'd hold the trademarks to the seal and who'd make sure that those who use it actually take privacy concerns seriously. Of course, the guidelines for that would have to be written in a clear and unambiguous way so that you could actually take the thing seriously, too; a privacy equivalent of the CAN-SPAM act would obviously do no good.

But once such a seal would exist, it would at least be easier for consumers to choose between different vendors/stores/... and factor in privacy concerns into their decision by taking into account whether the seal was awarded or not.

Re:Its' not that difficult

[sconeu]

You misinterpret the GP.

He's not saying they need to get your permission to use your personal info, but that they need it to sell it!

Why, pray tell, do providers of "essential and nearly-essential services" need to sell your personal info? Why would they need an exemption from "Get permission *before* you sell personal info"?

Caveat Emptor

[plopez]

I know for a fact there is incorrect information about me circulating. Some of it I put out there myself :)

Anybody buying my info may be in for a disappointment.

This is not uncommon, there is no way to enforce consistency between the large information resellers. Having been in jobs where we bought mailing lists etc. from resellers I can whole heartedly say that most data resellers have no interest in quality. Quality is expensive, they just pump out the data. Which is why when we tried to contact the potential customers, some 25% of the addresses we had were wrong.

The question of people taking some data dump from questionable sources as the gospel and then using it for reasons which can screw up a person's life. Take the government drive to 'Total Information Awareness' (or what ever more palatble cover name they are now trying to slip it past people as), where a false positive can land a person in jail for an extended period of time without knowing what you are charged with or legal counsel.

Or less extreme, you may never be able to borrow for a house.

AFAIAC, my personal information is my property. Unfortunately in the US, it is a considered a common resource, with all the problems associated with a common resource.

Re:Caveat Emptor

[Karma_fucker_sucker]

I know for a fact there is incorrect information about me circulating

You remind me of a couple of things:

I did a credit check on myself during the free period that we get here in GA. One of the credit bureaus still had me living in Florida! Dumb asses! As a result of their incompetence, I couldn't verify my own identity to get my free report. Interesting isn't it?

The other thing, lying about your SSN for credit or government is illegal, otherwise, it doesn't matter - even medical doesn't need it. How do I know? Well, unless it's for credit or for government stuff (Taxes especially) I either plead stupid or just "accidently" write down the wrong SSN. Oops! So far, nobody has ever called me on it, including the medical folks! It's bullshit! People are just collecting it because they can.

The marketing folks have this saying: If you want the information; just ask for it. Most people will just turn it over without even asking.

Re:Caveat Emptor

[polv0]

I am a data mining consultant for insurance companies, and I specialize in part in assembling external sources of data for use in predictive modeling. I have seen the other side of how useful this data can be for individual companies, marketplaces and society as a whole.

For example, consider personal credit for automobile insurance - one of Choicepoint's major markets. It's not suprising that a person with a credit score in the 500s, who hasn't paid a bill on time since college is going to be a bad insurance risk. If you're totally irresponsible with your finances, you probably haven't got the rest of your life in order, and there's a higher chance reckless behavior or fraud. Regardless, statistical modeling can show that these people can be orders of magnitude more expensive to insure - and that's based on analysis of data sets with millions of insureds.

With credit-scoring, those drivers can be identified and charged a premium commensurate with their risk. Without it, you me and every other responsible driver has to subsidize their behavior. Not only isn't that fair, but it gives the person no incentive to improve their behavior. Credit-scores are only one of many variables used in these models, and overall, their use in pricing has dramatically lowered the cost of insurance, and the frequency of accidents.

Certainly, I'm concerned about the security breaches that have occurred at these vendors, and the quality of the data is often a serious problem. But I hope the regulation of the industry doesn't throw the baby out with the bath-water.

Pay Attention: YOU own your own data

[jdigital]

Check out Attention Trust. These guys are onto something. Recently Bezos from Amazon was asked (I'm paraphrasing) "So, who owns my purchase history?", the answer being "Well, you own a copy. And we own a copy.". Think about that.

Direct marketers have developed the art and science of buying and selling personal data. But when you think about it, you should really be able to control that flow. If you want, you should be able to set your price, if you are interested in selling at all.

Disclaimer: I work for a company that upholds the Attention Trust principles.

Re:Pay Attention: YOU own your own data

[wfeick]

Every time this subject comes up, I want to try a ballot measure here in California. The idea is to force accountability about where they got my data from. I should be able to go in and audit not only the information they have on me, but also where they got it from. Similarly, anyone who sends me direct mail must include a traceback of where they got my information. This likely would be something like "ChoicePoint - CitiBank" or "Choicepoint - {Citibank, AT&T}", although realistically it would be "ChoicePoint - {every compnay I do business with}".

The idea is that every piece of junk mail that gets sent to me should clearly list which companies that I do business with are turning around and selling my information. I suspect this would provide some back pressure on companies, not just through shame but also because the added expense of tracking all this information. This will hopefully change the economics of junk mail such that they're forced to either abandon the practice or more accurately focus their efforts. Either way, I'd get less junk mail.

The alternate thought is to embrace junk mail and do everything I can to receive as much of it as possible, then burn it as a way to heat my home.

Corporate Double-Standard

[Vicissidude]

Actually, if you reverse your argument and apply it to corporations, then you see they have a huge double-standard as well. They want access to all our private information that by all rights belongs to us. And they want it for free. And they want to be able to buy and sell it at will. Further, they have actually gotten everything they wanted.

However, corporations go apeshit if you suggest that we should have access to all of their private information that belongs to them. They go even more apeshit if you then go out and sell that information. And even more, they bitch and moan and lobby to further restrict access to that information.

Apples and Oranges

[umbrellasd]

How does the information gathered and sold by data brokers differ from the information collected and sold by a private investigator, or is there even a real difference?

You seek out and pay a private investigator a substantial fee to obtain information about one or a small group of individuals. A data broker seeks you out and offers you similar information about a large group of individuals for a very tiny $/head fee. Yes, there is a real difference.

It's mine, all mine!

[FreeBSD evangelist]

I believe all personal information should be the property of whomever is being profiled. You could =sell= your information to EquiFax et. al., but they couldn't use it if you didn't.

I mostly agree with that.

[khasim]

Your approval should be REQUIRED before any private firm/individual accesses your data. And mostly, this is already the case. Any credit apps (even movie rental agreements) allow them to check your info.

The only time this should not apply is with a court order.

Now, one step further. You should also approve who collects this information. I don't care if the bank has my bank records on file (including debit card purchases). I do care if some private company is collecting all my info so it can turn a profit selling it (even with my approval).

I know all the arguments about how centralizing the info allows improved credit ratings and such. They're all bullshit. The number of bankruptcies show that.

We allowed it to happen with "Credit Bureaus"

[erroneus]

The industry of collecting personal information was truly created when this started to happen. The laws regulating the business were established in response, but they only served to legalize their action rather than to stop their abuse. I fear that if people start to complain more, the response will be the same -- that they legalize it and the abuse will persist in a more 'controlled and regulated way.' Controlled and regulated abuse is still abuse.

Not only should we ban such data collection, we should ban the 'credit' industry as it exists today. It openly abuses the Social Security system in a way that is definitely unlawful and has become so entrenched in daily business practices that now virtually every business tracking individuals relies on our personal serial numbers.

I'm completely against the abuse of the social security number and I am mildly amused at the possibility that "social security" could go away in the future... what number could they use to track people if they do away with the system? Fascinating isn't it? I hope more attention is paid to this issue [SSN abuse and personal information selling] and that people will take a lesson from what has happened already and work to see that the practice is outlawed, not 'regulated.'

in Capitalist America

[ne0n]

It's OK to sell anything these days.
Personally, I'm a whole lot more offended that people like Rumsfeld & the Bush family get rich on oil wars and manufacturing hype about avian flus.
Put into perspective, why is selling information any more wrong than killing thousands of innocent people for a few bucks?
Go ahead and mod me down, but at least think about it first.

The way to the Darkside...

[Karma_fucker_sucker]

If Government starts doing the collecting that will the intial steps towards monitoring of its citizens. And, unlike the private sector, there's really no accountability. Just look at what happens to people who are mistakenly put on the "No-Fly" list. They're fucked unless they have political connections. And even then it can be a real hassle - Ted Kennedy anyone? At least with a corp., you can bring a civil case and maybe a criminal. Government, years of hassles - even if you get permission to sue.

No sir, I'll take corporate over government anyday.

Re:The way to the Darkside...

[Karma_fucker_sucker]

And you'd have to try pretty hard to get less accountability than you get with the private sector.

Not to start a flame war here, please tell me exactly how government is accountable? for example

Who actually gets fired over this? Who compensates this poor bastard?

Or here's another name: Richard Jewel. The FBI fucks this guy over, the press falls in line, he wins a liability suit with the press (a million or so), the FBI gets away with fucking up this guys life. And they're still doing it. Look at what to this guy. If the FBI were a corp they'd be out of business right now or at least have paid out billions in settlements.

No sir, I still hold to my original oppinion

Re:The way to the Darkside...

[Anonymous Coward]

Abuses of power are a reality of government. I'm not saying I support them, or like them, but until we figure out "something else", it's what we are stuck with. Governments are there to "protect" society, if it thinks your a threat to society you're fucked. Personal rights truely don't matter on an individual level, just on a societal level.

What does this have to do with anything? Simple, corps aren't here to protect society, unless by society you mean their majority shareholders. All they care about, ever, is money, it's their blood. Every time they do something "nice" it's with an eye on the bottom line, tax breaks, good PR, etc. The truth is they have to, because they have to protect their shareholders.

Sure government sucks, but frankly corps suck more. One will screw the invididual, the other will screw everyone as long as it helps their shareholders.

I would like to mention, that I REALLY hope we can find that "something else" soon.

Re:The way to the Darkside...

[CosmeticLobotamy]

Not to start a flame war here, please tell me exactly how government is accountable?

It's not. But I didn't say it was going to be more accountable, just that corporations aren't in any significant way, either. There are, of course, cases where both were held accountable for something, but they're both few and far between.

The two situations are pretty much the same. I'm just more comfortable having 1/150,000,000 of a say in what happens with that data than the 0 say I get with a corporation.

Re:The way to the Darkside...

[gordonb]

And, unlike the private sector, there's really no accountability.

Actually, just the opposite. You have no ability to make a corporation remove or correct your information besides threat of a lawsuit. With governmental data, not only are lawsuits possible but there is a legal and regulatory framework. That is, in the US, you almost always have a means, specified in regulations, to make corrections or opt in/out of the system.

Now, whether these work ideally is another question. And, by the way, there is a third way to get satisfaction - political connections. Do not underestimate what a call to your Senator or Representative can accomplish. This route is more effective if you are politically active or a donor. That may strike some as "pay for play" but, after all, we all should be active. It's cheaper than a lawyer and lawsuit, in any case.

Re:The way to the Darkside...

[Darby]

If the FBI were a corp they'd be out of business right now or at least have paid out billions in settlements.

I agree with your point up to this point.

You have far more faith in our justice system than I do.
If they had billions to pay in settlements, then they would simply buy their way out of trouble.
Sure, you can point to a few examples where the justice system worked recently, but those where it doesn't far outweigh them and it's only going to get worse.
For those who doubt that, I challenge you to come up with a sane, rational, mechanism which has even a feeble possibility of working by which it could get better.

The FBI and various other federal agencies have long, sordid histories of being used against the American public and their abilities to do this are getting better all the time.

We're already well on the road past 1984.

There is a feeble chance that the next election could be a pivotal point which could bring some sanity back, but it's over with 100% certainty if another Republican gets elected.
It's equally 100% certain if another Democrat gets elected.

The only possible thing that could save this country and the world from complete totalitarianism is if a person with actual integrity gets elected president and appeals to the people to immediately yank all of their congresspeople (with the possible exception of Russ Feingold) and replace them with honest citizens with no ties to either party and further take all of this big brother bullshit they've been pushing and mandate that it all only be used against the members of congress.
"With great power comes great responsibility."

Of course, who watches the watchers.

We are well and truly fucked at this point.

Baby Steps to Totalitarianism

[umbrellasd]

If Government starts doing the collecting that will the intial steps towards monitoring of its citizens.

What country do you live in again? Is it the one with the Patriot Act? Or the one with federally mandated agencies that are granted sweeping privileges to protect the state with social, economic, and racial profiling?

Is there another choice?

[JimJinkins]

In a small town information brokering is not a feasible business, but personal information is shared. Examples:

"He pays his bills on time."

"He pays his bills, but usually late."

He is a good plumber, but he will not answer a call during deer season."

"He is a good guy and a lousy electrician."

In an urban society, reputations established by gossip is not available. But reputation is still necessary for people to do business with each other.

Whether information is collected and sold by a business or collected by a government and sold for money or taxes is another issue. The information has to come from someone.

Whoever provides the information will screw it up at least part of the time.

Note: There are also disadvantages to the small town model. Consider prejudice and spite.

Credit reporting == lower prices, more services

[G4from128k]

someone has to collect and distribute this stuff for things like background checks. are we suggesting the govt should do it instead of the private sector?

Very insightful comment and I'm glad it got upmodded.

As a consumer I'm really of two minds on this issue. On the one hand, I hate that all this data is sitting out there. But on the otherhand, i realize its the price one pays to get a reasonable mortgage rate, credit cards on favorable terms, low insurance premiums, and a wide range of services at acceptable prices. Without accurate credit reporting, all businesses would need to increase prices to factor in the risk of loss and the added costs of extracting late payments.

As long as people expect businesses to take risks on them (lending money, providing service without up-front payment, entering into long-term service contracts, etc.), those businesses will want to collect information on the riskiness of those consumers. And if a consumer doesn't have an established relationship with a given business, then it makes sense that that business will need to ask other business that have done business with that consumer. And rather than have each business pester every other business with questions, it makes sense that other businesses would form to collect and sell consumer payment/risk data. Thus we get to the question of who should do this?

I fear that the government would be utterly incompetent at creating such a system, even if consumers did decide that all their purchase/payment history data should go to the government. The government would have little incentive to create accurate risk models. Because there is no a priori obvious way to estimate a given consumer's risk of non-payment, it's sensible to have multiple credit risk analysis companies each with their own scoring system. The final question is how should they do this?

What we need are better laws to ensure that the data is properly secured, properly vetted, fairly computed, and that consumers have some due process rights to contest erroneous data.

Re:Credit reporting == lower prices, more services

[SilverspurG]

As long as people expect businesses to take risks on them those businesses will want to collect information on the riskiness of those consumers

Perfectly understandable.

it makes sense that other businesses would form to collect and sell consumer payment/risk data

This is the part under debate. I, and many others, do not feel that the sale of consumer information should be a business model at all. If some business wants to track information for business purposes let them do it internally and hold them accountable for every bit of information they collect.

They should treat consumer information databases the same way they treat stalking.

In America....

[Larry_Dillon]

Why can a business collect and sell your personal information for profit?

Because America is first and formost PRO BUSINESS.

A Democracy? A "Christian Nation?" The Land of the Free(TM)? ...when it's convenient. But always pro business.

People have *always* sold information

[SalesEngineer]

The news, colleges, Google, spies, gurus on the mountain top, private investigators, documentary film makers, political advisors, Number 2 in The Village, the head of the "popular group" in high school, the hacker who knows all the backdoors, the creepy old guy in every horror film that knows all about the serial killer ...

How is this information any different? More personal, sure, but it is no different than any other paid information source. Information is easier to catalog than before, so it's just a bit easier to be intrusive.

The ChoicePoint scandal illustrated to the world how information gathering, and how that information can be exploited in the name of fraud, has changed over time. That type of data is a necessary evil in the world of credit cards & on-line shopping ... your payment history is the new collateral.

It's information about transactions not people

[Shannon Love]

Most the information under discussion is not information about people per se but rather information about transactions. Since a transaction takes two at least two entities it is an open question as to who owns the information about the transaction.

If I sell you something, do I have rights to the information that I sold you something? Why should either side of the transaction have to "forget" that the transaction ever took place? If the information about the transaction is itself valuable, why shouldn't either side be able to sell it?

I think the presumption that all information that includes data about a individual is the property of the individual is highly simplistic.

Yet we still have lots of bankruptcies.

[khasim]

I'd agree with you if this information could be seen as resulting in fewer bankruptcies (organizations giving credit to bad risk cases). But I don't see that as being the case.

The problem is that there is very little risk to the collecting agency but a big risk to the individuals. The agencies don't really care if bad information gets on your report and you end up paying more for a loan than you really need to.

Now, if they had to go to your bank for the info on your account status and the credit card companies for info on how often you paid your bills, that would be different. If I didn't like the info the bank gave out, I could switch banks. The bank risks losing a customer. If my account is a good account, that's important to them. If it's a bad account, it's not that important to them.

And the bank should be checking with me before releasing any information.

difference?

[loraksus]

How does the information gathered and sold by data brokers differ from the information collected and sold by a private investigator

Well, first off, data collected by a PI is more correct, given that someone actually spent the time to research it (I realize this is sort of idealistic, since a lot of PI's just search on the net, but let's be idealistic for a bit. I'll be a bitter sarcastic prick in the latter half of my post)

Choicepoint, and Lexsis (and to a certain extent, the credit bureaus), etc are just data aggregator which basically means they run a couple searches on the net, throw it all in one place and throw marketing pixie dust all over it. They don't care if the information they sell is wrong because they have essentially been granted the ability to slander someone and not face any liability because of it.
As a result, accuracy is dismally bad, especially given the fact that these companies are pushed by their customers to provide "negative data" i.e. an excuse as to why you shouldn't hire Bob Jones, or lend money to Jill Smith (or perhaps what interest rate to give on a home loan) or, while we are at it, to deny someone the ability to fly. Most of the time even basic checking (like "was the person in this record alive when something happened")

Ultimately, it doesn't matter if their data is correct - a company investigating a potential employee is not going to investigate to see whether a black mark in a Lexis report is actually true, nor is the Federal government going to verify before throwing someone on the no or "latex glove" fly list.
I don't think we even have to go into the fact that it is virtually impossible to correct data in their databases either.

As for ethics, these shitbags who engage in slander on a grand scale have none. They will continue to send out incorrect information even after being notified and will throw up layers of bureaucracy in order to prevent you from changing the data.
Nor do the credit bureaus, car dealerships, et al, who will knowingly use bad data and will inflate the cost of a loan on a home or a car). Of course, they bribe politicians - especially politicians whose constituents are ignorant morons - so nothing will change and we will continue getting screwed until something changes.

As for the worries of identity theft - you should be far more worried about companies who you knowingly give your data to - i.e. any tax preparation company.

I've mentioned this before, but as a $9/hour tech support monkey working for TaxCut a couple of years ago, I had access to every single return filed by EVERY SINGLE PERSON WHO HAD FILED A TAX RETURN WITH H&R BLOCK SINCE 1998. I was able to see your income, your address, phone, names of your kids, the amount you paid on your mortgage, the names and addresses of your employers, etc, etc, etc.
A single person, assuming they were properly motivated, could of have created the largest breach of customer data in history - or made millions if they played it right and used some data in a credit card fraud scheme .

Tech support is one of the easiest fields to get a job in and normally requires no background check or even a drug screen. In fact, the reason that we haven't heard of many such breaches is because most of the people who work in there are stoned or drunk.
If anyone is interested, I believe that Stream in Beaverton, Oregon will be hiring for the TaxCut "team" for the 2005 tax year in the next couple of weeks. This would be an excellent opportunity for any organized crime groups to make some money, or for some anarchist group to cause some chaos if, say, 50 million tax returns were thrown onto a binaries newsgroup or onto bittorrent trackers in a foreign country. I'm afraid that only such a breach - and the resulting fraud - would convince the morons who live in this country that something needs to change.

Re:difference?

[SilverspurG]

<i>I'm afraid that only such a breach - and the resulting fraud - would convince the morons who live in this country that something needs to change.

There would be a witch hunt. Some people (actually involved or not) would be apprehended. Several would be charged. After a lengthy and costly court battle complete with media pomp and display one or two would be convicted and never heard from again. Politicians would shuffle and propose a thousand new mandates. Five or ten would attract the interest of special interest lobbying groups who represent businesses who see how they could manipulate those new proposals for profit.

In general the citizens lose more money, gain more bureaucracy, and everything gets worse no matter how it goes.

The Ethics of Data Brokers?

[AthenianGadfly]

The Ethics of Data Brokers

The submitter poses an interesting question, but forgot to include a link where the answer can be found. Here it is.

Re:I *am* original... the facts about me define me

[cpt kangarooski]

Please explain to me how "all facts related to me" as a compilation is not original.

A compilation that includes everything does not possess originality with regards to selection. The selection was unthinking and all-inclusive. It is not a creative work of authorship, as is constitutionally required for copyright protection to attach. Simply, there has to be a creative choice to include some facts and to not include other ones.

From the Feist case:

[O]riginality is not a stringent standard; it does not require that facts be presented in an innovative or surprising way. It is equally true, however, that the selection and arrangement of facts cannot be so mechanical or routine as to require no creativity whatsoever. The standard of originality is low, but it does exist. ...

The selection, coordination, and arrangement of Rural's white pages do not satisfy the minimum constitutional standards for copyright protection. As mentioned at the outset, Rural's white pages are entirely typical. Persons desiring telephone service in Rural's service area fill out an application and Rural issues them a telephone number. In preparing its white pages, Rural simply takes the data provided by its subscribers and lists it alphabetically by surname. The end product is a garden-variety white pages directory, devoid of even the slightest trace of creativity.

Rural's selection of listings could not be more obvious: it publishes the most basic information -- name, town, and telephone number -- about each person who applies to it for telephone service. This is "selection" of a sort, but it lacks the modicum of creativity necessary to transform mere selection into copyrightable expression. Rural expended sufficient effort to make the white pages directory useful, but insufficient creativity to make it original.

While the white pages phone book in the Feist case was uncopyrightable, other kinds of phone books have been found to be copyrightable. For example, in the Key Publications case, a phone book that only contained listings that the author thought would be useful for the local Chinese community was copyrightable as a compilation, since the author had creatively chosen some listings to include and others to exclude.

Given that, do you agree that I should be able to copyright my data as a compilation?

Absolutely not.

First, the facts are uncopyrightable. Second, a compilation of all facts about you is uncopyrightable. Third, even if a compilation were copyrightable, the people who you do not want using your data are not copying the facts from the compilation, they are obtaining facts through observation of you, and copyright cannot be used to prevent them from finding out the same facts you compiled from other sources. Fourth, even when compiled in a copyrightable compilation, the facts themselves are uncopyrightable, and free for others to copy from your compilation itself. Fifth, the act of living and thereby producing facts (e.g. eating a hotdog produces the fact that you ate a hotdog at a particular time, date, and place, in a particular manner, etc.) is not an act of authorship resulting in a fixed original work of authorship, and so merely living does not produce a compilation of facts, nor any other copyrightable work.

This is a really stupid, pointless line of discussion, because there is no way that the brain-dead notion of copyrighting the facts of one's life so as to ensure privacy will ever, ever, ever work.

Justice, not ethics

[quentin_quayle]

"Ethics" is not the word. It is a category mistake to speak of a corporation having principles, acting ethically, or caring about anything other than profit or shareholder value. It is a case of attributing human qualities to an inanimate thing. Considered as a person, a corporation is a perfect sociopath. Speaking of what it "ought" to do is nonsensical. Like a shark, all that anyone can expect it to do is pursue its sole interest without regard for the consequences for anyone else or any other considerations.

What we want here is justice, not ethics. We want protection of the moral rights of citizens to appropriate control of information about themselves.

There is a freedom-of-speech aspect. It should remain legal to transmit truthful information. However, businesses should be prevented from using the customers' information for anything beyond the immediate transaction in which it is collected, unless the customer gives separate permission.

Legality of Information Brokers

[blankgm]

It comes down to this. There is aboslutely nothing illegal with, and there never will be anything illegal with, the gathering and selling of information about an individual..........until we as the 'consumers' start buying information about our Congressmen and Senators - then and only then will we see a quick and absolute death to such practices.

Re:I *am* original... the facts about me define me

[UncleFluffy]

First, the facts are uncopyrightable.

Ah, but what if I created a non-factual piece of data about myself and it got entered into their system ... I think I have a plan!

Re:I *am* original... the facts about me define me

[UnapprovedThought]

Thank you. Very informative (except for the comment about this being a stupid line of discussion. Not true unless you think people need to be kept in the dark about it).

Well, your argument didn't convince me that consumers' rights are being fully considered. You said:

Simply, there has to be a creative choice to include some facts and to not include other ones.

OK. Once upon a time, I selectively decided to purchase one specific hot dog product instead of another. Instead of using one credit card to pay for it, I artistically whipped out another and rendered my digitized signature with a unique flourish. This was recorded.

Then I traveled to another location and creatively decided to pay for an electronics part in cash. That was not recorded. Thus I decided what to leave on my credit record "storyline" and what to leave out.

The next day, to add to the biography, I creatively considered several areas to move to, and which address, and moved to one of them, crossing storied mountains and rivers. I chose from among many numbers and streets, for instance I may have moved to a #80 address or a #404 -- my choice. How often do I make payments and on what day? That could also be a choice. All of these things put together can read like a storyline, similar to how a book author chooses the names of characters, events, streets and towns. Those who observe me must write down the actions as I have performed them. It is as if I am dictating to them a message and they are writing it down.

A non-fiction story is a compilation of facts. A fictional story is a compilation of some mixture of fact and imagination. Both are subject to copyright. People can take excerpts, but (correct me if I'm wrong) they cannot obtain the entire work. If giving out one number allows someone to obtain the entire work, would that not be considered a violation of copyright? (Even if you disagree, that's OK, read on.)

Your credit record is a document you are writing either by action or inaction. There is no end to those credit-repair agencies which claim they are able to help generate a fictitious or semi-fictitious storyline to make your "online character" look more creditworthy. They are spinning a tale for someone else to read, which you would otherwise be the author of. Book authors can also allow "ghost writers" to handle part of the work for that purpose, yet the author can still own the copyright.

Copyright aside, someone has already been issued a provisional patent on a storyline as in this recent story. (So even if copyrights are out of the picture there are plenty of other precedents being set.)

OTOH, to argue the reverse, if the results of my decisions are mere facts and not part of a biographical storyline that I am writing, then I could also conclude that:

• a movie is merely a very large integer and as such, the number contains no creativity inside it whatsoever
• A song is just a smaller integer, similarly consisting of bytes placed end to end.
• A book is a yet smaller integer, and to prove it I could reduce it down to its factors, just like any other number.
• etc....

A movie, song, or book is reducible to a fact, then. The creative part of the movie is what they performed while in the course of their business (e.g. shooting it in their studios). They did so under constraints of time and money, just as I have constraints of time and money in producing my storyline. That very long integer they produced as a result, well, that's just a "fact," just like the data I produce through my decisions is merely a "fact." I may choose to view a factual report of their activities through my viewer of choice, but I will probably be obliged to pay them for that privilege even though copyr

I hope somebody reads this...

[cr0sh]

I am not going to argue the "ethics" and "responsibility" of whether the data about us as individuals should or should not be ours. Personally, I think it should be, and I think we should have complete control of it, etc. However, this sentence from the submitter caught my eye:

The general public seems to think not, while our elected officials seem to think it's just fine.

I have seen this sentence in a variety of forms, but ultimately, it boils down to the perception by seemingly every member of the public that there is an US and a THEM. When and why did this mentality start?

Arguably, it could be said it has always been this way, for as long as there was a government and the governed. However, here in the United States of America, what has happened to cause us, the citizens, to view our government this way? Ignorance? Apathy?

We don't have "elected officials" - our government is supposed to be a representative democracy. All of the members of our government are elected as representatives of the people. The key word is "represent"! They are supposed to be elected to represent our interests, to represent in a analogous fashion who we are as individuals.

These people we elect are not meant to be our kings or queens. They are not the "ruling elite", and they should not be viewed, thought, or spoken of as so. To do so grants them more power and status than they deserve. We are not vassels under a lordship. We are free citizens of the United States of America in a representative democracy.

The way the submitter speaks in his writing (and it isn't just him - it is spoken this way of our representative on a wide ranging number of issues affecting the lives of you and I), seems to indicated that the ChoicePoint (or similar) issue didn't (and never can) affect the lives of our elected representatives. Why not? Why shouldn't it? Why do our elected representatives think (or know?) that it can't? If it can't affect our representatives, why should they care how it affects those who they represent?

If they don't, if they truly think this way, then we are nothing better than serfs fated to live out our lives in mediocrity. This isn't the United States I was brought up to know and love.

A famous quote by Thomas Jefferson, one of our country's founding fathers, reads:

The tree of liberty must be refreshed from time to time with the blood of patriots and tyrants

I dare to wonder if the time is nigh that we need to exercise our second ammendment rights, march on Washington, and water that tree a little. It is "We the People" and not "Us" versus "Them". The sooner the citizens and our representatives realize this again, the better off we and our country will be.