How the US Can Stop Data Brokers’ Worst Practices—Right Now

The letter also points to databases maintained by the British multinational RELX and the Canadian conglomerate Thomson Reuters, which, according to CUNY law professor Sarah Lamdan, author of Data Cartels: The Companies That Control and Monopolize Our Information, contain dossiers on roughly two-thirds of the US population, tracing their whereabouts and mapping social and familial relationships. 

In 2020 alone, data brokers bled out some $29 million while vying to undermine legislative efforts to rein in their industry, according to lobbying disclosures unearthed by The Markup. 

While many major data collectors acknowledge falling under the jurisdiction of the FCRA, others have evaded regulatory scrutiny by relying on what the lawyers petitioning Chopra deem erroneous legal analysis. Other firms partition their products and the surveillant data they gather to exempt from compliance what the credit reporting industry calls “header information,” traditionally consisting of people’s names, birth dates, and Social Security numbers, in addition to phone and residential histories. This, even when that data is derived from sources clearly subject to the law. 

“Data brokers are packaging the same personal data points about us into different products for sale and then claiming that certain products are beyond the reach of key legal protections,” says Laura Rivera, an attorney with Just Futures Law. “It’s dishonest, exploitative, and leads to real harm to consumers of all backgrounds, but especially low-income communities of color, including immigrants.”

“In advocating for coverage of data brokers, we’re simply asking the CFPB to restore the scope of the Act as Congress originally intended,” adds Chi Chi Wu, a staff attorney at the National Consumer Law Center who identified a series of constricting court rulings over the years that watered the FCRA down. 

Historically disadvantaged communities face the brunt of the harm, Wu says, pointing to the sale of information on some of America’s poorest communities to predatory “payday” lenders. In fact, data brokers derive significant profit from businesses whose whole purpose is identifying consumers who face financial instability. A 2013 US Senate report noted, for example, that these purchases were often made by companies that “sell high-cost loans and other financially risky products”—unscrupulous businesses making bread and butter out of the economically vulnerable, including widows. 

Companies playing fast and loose with personal data have drawn the ire of consumer protectionists and Capitol Hill privacy hawks for years, leading to meager gains for consumers. In 2021, a slew of utility companies that had long pilfered cable, phone, and energy customers of sensitive data for their own profit agreed to end the practice of selling it to Thomas Reuters, which had, in turn, supplied it to government agencies and police, including US Immigration and Customs Enforcement. 

“Selling personal information that people provide to sign up for power, water, and other necessities of life, and giving them no choice in the matter, is an egregious abuse of consumers’ privacy,” said US Senator Ron Wyden, a Democrat of Oregon and leading government-surveillance critic, in a letter to Chopra at the time. 

The US Defense Intelligence Agency, Defense Counterintelligence and Security Agency, and Customs and Border Protection (CBP) are among a wide range of federal agencies known to purchase Americans’ private data, including that which law enforcement agencies would normally require probable cause to obtain. The US Supreme Court ruled in 2018 that police and intelligence agencies had no right to compel businesses to turn over location data derived from cellphones and other devices without a legal warrant. 

The decision did little to stop the government from sidestepping the courts. The Justice Department, the Office of the Director of National Intelligence, the Pentagon, and hundreds if not thousands of state and local police agencies have interpreted the ruling as having placed no restrictions on their ability to simply buy location data instead.