1ihHZ6h

More documents

Recommendations

Info

Legal Implications of Big Data: A Primer | David Navetta tions. The challenges include capture, curation, storage, search, sharing, analysis, and visualization. 5 While the Wikipedia definition highlights the challenges associated with large data sets and understanding the data contained in those sets, a definition by the TechAmerican Foundation also captures the opportunities associated with Big Data: Big Data is a term that describes large volumes of high velocity, complex, and variable data that require advanced techniques and technologies to enable the capture, storage, distribution, management, and analysis of the information. 6 The Foundation stresses Big Data solutions as part of its attempt to define the term: Big Data Solutions: advanced techniques and technologies to enable the capture, storage, distribution, management and analysis of information. According to the TechAmerican Foundation, Big Data is characterized by three factors: volume, velocity, and variety: 7 CHARACTERISTIC Volume Velocity Variety DESCRIPTION The sheer amount of data generated or data intensity that must be ingested, analyzed, and managed to make decisions based on complete data analysis How fast data is being produced and changed and the speed with which data must be received, understood, and processed The rise of information coming from new sources both inside and outside the walls of the enterprise or organization creates integration, management, governance, and architectural pressures on IT While these definitions and attributes of Big Data may be helpful, they are still rather abstract. Perhaps the better question to ask is “what does Big Data mean to companies or other organizations” Using this filter, Big Data and its use can be viewed as a business process or a supplement to existing business processes. Big Data in the business context means or encompasses the following: • The ability of the organization to (or could have) access unimaginable amounts of structured and unstructured data (much more of it likely in the unstructured category) both internally and through external resources (e.g., data brokers, affiliates, or partners). • A realization (or hope) that by capturing, structuring, and analyzing these huge volumes of data, and understanding the relationships within and between data, the company may gain valuable insights (often precise and nonobvious) that may significantly improve how the company does business. • The need to leverage specialized tools and specialized employees (e.g., data scientists) to enable the capture, cura- 5 See http://en.wikipedia.org/wiki/Big_data. 6 See Demystifying Big Data, http://www.techamerica.org/Docs/fileManager. cfmf=techamerica-bigdatareport-final.pdf. 7 Ibid. tion, storage, search, sharing, and analysis of the data in a way that is valuable to the organization. • Analyzing and addressing the potential limitations and legal, security, and privacy risks and issues associated the collection, analysis, and use of Big Data (and the insights derived from it). While the specific applications of Big Data analysis will vary depending on the industry, the availability of data and the goals of a particular organization (and some of those practical applications are summarized above), many organizations will use Big Data to better understand and market to their customers (both individuals and corporate). Big Data and privacy When it comes to consumer marketing, the potential for Big Data is enormous (and some would argue that the confluence of online marketing and Big Data represents the “Holy Grail” of marketing). Big Data can allow marketers to target customers precisely and efficiently by providing advertising and product and services offers that are specifically tailored to a particular individual, based on his or her attributes. Big data combined with the use of mobile devices can result in offers to individuals that are highly relevant, delivered at the right time, and (with mobile and geo-location tracking) at the right place. However, one of the most significant legal challenges associated with Big Data, especially on the consumer marketing side, is privacy. Big Data and notice/consent In the United States, pursuant to the Fair Information Practice Principles, 8 the foundation of privacy protection includes the concepts of notice/awareness and choice/consent. To satisfy the principle of notice and awareness, the data subject from whom data will be collected must be made aware of the uses to which his or her personal information will be put, and to whom such personal information will be disclosed. 9 The notice is intended to allow the data subject to make an informed choice as to the collection and use of the subject’s personal information, and to consent (or not) to that collection and use. In a Big Data world, some contend that the goals of notice/ consent may be circumvented due to the complexity of the Big Data ecosystem and practical limitations related to the use of written privacy policies. For example, privacy advocates believe that in some cases, a person that reads a privacy policy and agrees that his or her personal information can be collected, used, and disclosed for “marketing purposes” may not understand that such personal information may end up residing in the database of a data broker and combined and disclosed in ways not apparent in or contemplated by the privacy policy. For example, if an ecommerce vendor disclosed to a marketer that an individual customer purchased a deep fryer, such information could be combined into a profile about the individual in a database owned by a data broker. If the data 8 http://www.ftc.gov/reports/privacy3/fairinfo.shtm. 9 Ibid. ©2013 ISSA • www.issa.org • editor@issa.org • All rights reserved. March 2013 | ISSA Journal – 15
Legal Implications of Big Data: A Primer | David Navetta In a Big Data world…data subjects have even less awareness and ability to provide meaningful consent. broker later sells access to the database to a health insurance company, whose algorithms put people who purchase deep fryers into a high risk category, in the world of Big Data the initial, relatively innocuous data disclosure (that was consented to) could suddenly serve as the basis to deny a person health care (or result in higher health care rates). The problem here is twofold. First, the consumer may not understand where his or her personal information may end up, and that it could be combined with other existing profile data in a manner that reveals more about the person than contemplated at the time of disclosure. Further onward transfer and combining with yet more databases could reveal even more. Second, the data subject lacks an understanding of the interpretations, inferences, and/or deductions that may be draw from his combined data using Big Data mining techniques and analytics. As such, in a Big Data world some would argue that data subjects have even less awareness and ability to provide meaningful consent. 10 Big Data and access/participation Another area of privacy concern related to Big Data deals with the principle of “access/participation.” 11 This principle deals with a data subject’s ability to access his or her personal data in order to ascertain whether it is accurate and complete. This principle is necessary to allow individuals to correct inaccurate information about them. This principle has been incorporated into the Fair Credit Reporting Act 12 (FCRA), which requires credit reporting agencies to provide consumers with access to their credit reports so they can have inaccuracies corrected. In the Big Data context satisfying the access/participation principle poses significant challenges. Except for the established and highly visible players, the general public does not know what entities may be collecting information about them and creating profiles. While data subjects may be able to identify companies to whom they have provided personal information, and may have a direct relationship with such companies, the same is not true in the case of data brokers. In most cases data subjects do not have a direct relationship with them and these brokers typically do not receive information directly from the data subjects. Even if a consumer can identify a data broker that holds his or her profile, without a contract the consumer may have no legal recourse that would require the broker to provide access to his or her personal information. 10 Notice and Consent in a World of Big Data, http://www.techpolicy.com/ NoticeConsent-inWorldBigData.aspx. 11 Fair Information Practice Principles, http://www.ftc.gov/reports/privacy3/fairinfo. shtm. 12 Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681, et. seq. While some data brokers may be acting as “credit reporting agencies” and therefore subject to the FCRA, many take steps to avoid that status. Based on concerns over access and transparency, the Federal Trade Commission (FTC) has indicated a desire to consider additional regulatory scrutiny over data brokers: To address the invisibility of, and consumers’ lack of control over, data brokers’ collection and use of consumer information, the Commission supports targeted legislation – similar to that contained in several of the data security bills introduced in the 112th Congress – that would provide consumers with access to information about them held by a data broker. To further increase transparency, the Commission calls on data brokers that compile data for marketing purposes to explore creating a centralized website where data brokers could (1) identify themselves to consumers and describe how they collect and use consumer data, and (2) detail the access rights and other choices they provide with respect to the consumer data they maintain. 13 More recently, in December 2012, the FTC launched an investigation to study the data broker industry’s collection and use of consumer information. 14 Moreover, much of the privacy-related legislation proposed in Congress has included provisions related to the regulation and oversight of data brokers (although none has passed to date). 15 Overall, this is an area that is ripe for an increased regulatory response and potentially federal and/or state legislation. Big Data and Do Not Target/Do Not Collect Another privacy-related area impacted by Big Data is the do not track (DNT) debate. 16 For many in the advertising industry do not track refers to the use of consumer data for purposes of targeted advertising. In contrast, the FTC and privacy advocates believe the concept of DNT encompasses not only targeting of individuals, but also collection of personal information from individuals (do not collect). Recent regulatory emphasis on do not collect stems in part from concerns surrounding Big Data. With the pervasive and constant collection of information about individuals from multiple sources, many data brokers are able to pinpoint a user’s identity and specific preferences without having any information traditionally considered personally identifiable information. As discussed further below, common methods for de-identifying personal information may not be effective, if the unique identifier of the computer or mobile device used to access a website, when combined with specific behavioral and other data, can supply enough information to identify a person individually. This may lead to heightened regulatory scrutiny 13 See Protecting Consumer Privacy in an Era of Rapid Change, http://ftc.gov/ os/2012/03/120326privacyreport.pdf. 14 See http://www.ftc.gov/opa/2012/12/databrokers.shtm. 15 See e.g., http://www.infolawgroup.com/2010/08/articles/breach-notice/yet-anotherproposed-federal-data-security-and-breach-notification-bill-senators-rockefellerand-pryor-jump-into-the-fray/. 16 See http://www.infolawgroup.com/2012/03/articles/data-privacy-law-or-regulation/ ftc-looks-to-link-donottrack-big-data-privacy-concerns-seeks-solutions/. 16 – ISSA Journal | March 2013 ©2013 ISSA • www.issa.org • editor@issa.org • All rights reserved.
Page 1: ISSA DEVELOPING AND CONNECTING CYBE
Page 5 and 6: Legal Implications of Big Data: A P

1ihHZ6h

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?