EFF, Privacy Rights Clearinghouse Seek Probe Into Unregistered Data Brokers
The Electronic Frontier Foundation (EFF) and Privacy Rights Clearinghouse on Tuesday sent letters to the attorneys general of California, Texas, Oregon and Vermont, asking that they investigate data brokers that have failed to register with state consumer protection agencies as required by law.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
"Hundreds of data brokers have not registered with state consumer protection agencies," said an EFF blog Tuesday. "These findings come as more states are passing data broker transparency laws that require brokers to provide information about their business and, in some cases, give consumers an easy way to opt out."
The letters come after a Privacy Rights Clearinghouse and EFF analysis that found many instances where data brokers registered in one state but not in another. The groups noted that "more investigation is needed" to determine the reason behind these discrepancies.
"New data broker transparency laws are an essential first step to reining in the data broker industry," the EFF bloggers said. "This is an ecosystem in which your personal data taken from apps and other web services can be bought and sold largely without your knowledge," including sensitive information like location data.
Each letter contains the number of data brokers not registered in the state, key findings and methodology of the analysis and a reminder of the state's enforcement abilities.
"States should investigate compliance with data broker registration requirements, enforce their laws, and plug any loopholes," said EFF. "Ultimately, consumers deserve protections regardless of where they reside, and Congress should also work to pass baseline federal data broker legislation that minimizes collection and includes strict use and disclosure limits, transparency obligations, and consumer rights."