In March of this year, I had an opportunity to meet with representatives of the Federal Trade Commission (FTC) to get the pulse on their current enforcement focus, hear about their new privacy report , and to discuss trends in consumer background checks. Social media sites and mobile applications were at the top of their agenda.
At the meeting we raised an interesting question—would the FTC consider social media “aggregator” sites and “metasearch’ engines, like Dogpile and Spokeo, consumer reporting agencies (CRAs) as defined by the Fair Credit Reporting Act (FCRA)? After all, when those sites are used by employers to look up potential applicants, the search engines are compiling reports for employment purposes, right? And they market their sites to businesses for this very purpose, right? On the other hand, you could look at the site as just a pass-through— software through which information passes. As we debated the issue, one of the FTC attorneys in our meeting commented that, taken to the extreme, one could argue that Google is a CRA. And we wouldn’t want that, would we?
The online search site Spokeo was faced with this very question in 2010, when it was hit with a double whammy–the Center for Democracy & Technology filed a complaint against the company with the FTC, and Virginia resident Thomas Robins filed suit against the company for allegedly violating the FCRA. In the FTC complaint, the watchdog group claimed “Despite offering credit ratings and promoting the use of its services for employment decisions, Spokeo does not offer consumers any of the protections encoded in the Fair Credit Reporting Act as required by law.” Meanwhile, Robins alleged that Spokeo was acting as a CRA, reporting inaccurate information that was hindering his job search, and that he had no recourse or means to dispute the inaccurate information. CRAs are required to provide consumer protections like procedures to assure accuracy and dispute processes for consumers who find inaccuracies.
Spokeo countered that Robins had no proof of damages and that it is not a CRA, but merely a search engine. Last September, the judge dismissed the case, finding that “(t)he alleged harm to Plaintiff’s employment prospects is speculative, attenuated and implausible.”
Now Robins is back. Earlier this week, Media Post reported that he has asked the 9th Circuit Court of Appeals to revive his case, arguing he does not need to prove damages under the FCRA since it provides for statutory damages, and that he can prove anxiety and stress.
And the FTC is still circling. The agency has not taken any public action against Spokeo, but they have asked Congress to consider new legislation to address so-called “data broker” web sites. While sites like Spokeo typically say in their terms of service that users are not allowed to use the information for FCRA purposes like employment or credit, the FTC has repeatedly warned that attempts to avoid liability through the use of disclaimers won’t fly. In their Privacy Report issued earlier this year, the FTC calls for legislation that would give individuals more control over the information held by “brokers” making it easier to erase it or modify it.
As the FTC seems to be defining data brokers, the term applies to a very broad spectrum of businesses on the Internet. Data brokers, the FTC report said, “Buy, compile and sell a wealth of highly personal information about consumers but never interact directly with them.”
Stu Ingis, a partner with Venable who represents the Digital Advertising Alliance recently had this to say: “The FTC created a term that sounds nefarious. It’s fear-mongering. I’m not sure what they’re talking about. Data is the engine of the economy; it’s not a secret the online world is replicating [in] the offline data world.”
So what is a site like Spokeo? A CRA? A data broker? Neither? And what is a data broker anyway? Tell me what you think.