Big Data—Big Obligations: FTC Clarifies Understanding & Future Enforcement of Big Data
The Federal Trade Commission’s (“FTC”) new report on big data, signifies its intent to continue regulating the commercial use of consumer information through the enforcement of existing discrimination laws. It also clarifies the FTC’s interpretations of these laws and provides a set of recommendations for companies to consider as they design and implement their big data practices.
The Fair Credit Reporting Act (“FCRA”)
According to the report, the FCRA applies to predictive analytics used for eligibility determinations whether they are based on traditional credit characteristics—such as debt payment history—or non-traditional characteristics—such as a consumer’s zip code, social media use, or shopping history. For example, if a company considers the fact that a customer shopped at Dollar Tree or liked Bob’s Pay Day Loans on Facebook to generate an analysis of a group that exhibited similar behaviors and then uses that analysis to make an eligibility determination about the consumer, “the Commission would likely regard the analysis to be a consumer report, and FCRA requirements and protections would likely apply.”
The report also reverses the FTC’s previous position—asserted in its 2011 FCRA Report—that “[i]nformation that does not identify a specific consumer does not constitute a consumer report even if the communication is used in part to determine eligibility.” Rather, the FTC now stresses that if a report is created with reference to a particular consumer or set of particular consumers, and is used for eligibility purposes, the FCRA applies, even if all customer identifying information is stripped. This change could significantly expand the practices and potentially the types of companies covered by the FCRA.
Equal Opportunity Laws
The FTC also identified a number of equal opportunity laws that could be used to regulate big data. These laws include the Equal Credit Opportunity Act (“ECOA”), Title VII of the Civil Rights Act of 1964, the Americans with Disabilities Act, the Age Discrimination in Employment Act, the Fair Housing Act, and the Genetic Information Nondiscrimination Act. The report makes clear that these laws regulate both disparate treatment and disparate impact. A company risks enforcement for disparate treatment, such as offering an unmarried person less favorable terms on a loan than a married person because analytics show that unmarried persons are less likely to repay debts. A company also risks violating these laws for practices that have disproportionate adverse effects on a protected class even if the underlying analysis is facially neutral or based upon non-protected characteristics. For example, companies risk enforcement for utilizing big data analytics to screen job applicants in a way that has a disparate impact on the disabled, even if disabled status is not considered directly. Similarly, these laws prohibit a company from basing credit decisions on a consumer’s zip code, if doing so will have a disproportionate impact on a particular ethnic group. If a company’s actions cause a disparate impact, it will likely face enforcement unless it can show that the decision is justified by a legitimate business need and that there is a no less discriminatory alternative.
The report also announces that the ECOA, which prohibits credit discrimination on the basis of a variety of protected characteristics, could apply to companies’ advertising choices. Although offers open to all individuals are unlikely to violate the ECOA, the FTC advises companies to “proceed with caution.” Because the ECOA prohibits creditors from advertising to applicants or prospective applicants in a way that would unlawfully discourage a reasonable person from pursuing an application, the FTC warns against marketing practices that could impact a creditor’s subsequent lending patterns and the terms of its offers.
Section 5 of the Federal Trade Commission Act (“Section 5”)
The report also recommends four actions for companies to take in the pursuit of their big data practices to decrease the likelihood of violating Section 5, which prohibits unfair or deceptive acts or practices. First, companies must uphold all material promises made to consumers, whether related to third party data sharing, consumer choice, or the safeguarding of personal information. Second, companies must implement measures to secure their data, employing procedures commensurate to the amount and sensitivity of the data. Third, companies must disclose all material information to consumers in order to ensure that their omissions do not rise to the level of misrepresentations. Fourth, companies must refrain from selling big data analytics products to clients if they know or have reason to know that they will use them for fraudulent or discriminatory purposes.
In summary, while the FTC acknowledges the potential benefits of big data and recognizes the ever-increasing role it will play in the future, the Commission appears quite concerned with the potential for bias, inaccuracy, and misuse of big data.