It appears that Congress has finally taken note of the problems caused by the consumer data companies, and their apparent inability to properly protect the data they profit from. The recent ChoicePoint and Bank of America problems have brought the issue to Congress’s attention. Wired magazine has the article.
One has to wonder if Congress would be taking action at all, if some of the data lost—mainly that lost by Bank of America—didn’t affect them directly. The Bank of America data consisted of approximately 1.2 million credit card records, mostly of government employees and officials. The lost backup tapes were part of a record set for the GSA’s SmartPay program. It would not be a surprise to find that a least a few congressmen and other politicians were among this group, as the SmartPay program is one used extensively to handle travel arrangements.
Wired magazine also has an article about how inaccurate background data, provided by the data collection companies, can have serious adverse affects on people. It also starts to discuss how laws need to be passed, that will allow consumers the ability to find out and correct what is in their background check data. Currently, there are no federal laws, that allow a person to obtain a copy of the background report, which may be used by a company to decide if they will be hired.
There are also no requirements or standards for the accuracy of the data provided by the data collection companies. There is also no requirement for obtaining permission before executing a background check on an individual. The only current requirement is if a credit report is requested, the individual must give permission. The data collection companies are willing to sell the data in various forms that don’t include the credit report, and do not require any permission or notification of the individual.
The United States needs to have much more restrictive, and protective, legislation on data privacy. The Privacy Act of 1974 seems to be written to only cover government use of information and data collection. Broader and more stringent regulations should be enacted—with particular attention paid to commercial entities which profit from the collection and sale of consumer data.
Considering that these companies profit from the collection and sale of consumer data—don’t they have a responsibility to both their customer, their shareholders, and to the general public, to ensure the data they collect is both accurate and well-protected. If information was a physical resource—like gold—it can be certain that the companies would protect the data as zealously as possible. It would also be certain that the customers, who purchased the data, would have stringent requirements about the purity and quality of the data.
Because modern information, in the form of computer data, is not a physical, tangible resource— and that the “theft” of data doesn’t generally deprive the collectors and sellers of data of the ability to sell the “stolen” data—as it would in the case of a physical resource, like gold—there is no real “business” incentive for the companies to protect the data. Likewise, since data is not a physical resource—there is no incentive for the company to maintain any standards of quality and purity of the product. If data were a physical resource, like gold, there would be de facto, if not legal, standards for accuracy and reliability, as there are for gold’s purity.
If the federal government is willing to pass laws which infringe on consumers’ rights, like the Digital Millenium Copyright Act, in order to protect data sold by corporations for profit—shouldn’t the government put even more restrictive laws on consumer data which can have a greater impact on the lives of the general public.