At the request of Sen. Jay Rockefeller (D-WV) and other members of Congress, the Government Accountability Office (GAO) released a report that examines concerns about the collection and use of consumers’ personal information by information resellers. The report found that no overarching federal privacy law governs the collection and sale of personal information among private sector companies, including information resellers. Instead, a variety of laws tailored to specific purposes, situations, or entities governs the use, sharing, and protection of personal information. These include the Fair Credit Report Act, the Gramm-Leach-Bliley Act, and the Health Insurance Portability and Accountability Act, to name a few.
According to GAO, privacy protections provided under federal law for consumer data used for marketing purposes are limited. Current federal privacy laws generally do not provide individuals the universal right to access, control, or correct personal information that resellers and private sector companies use for marketing purposes. As examples, GAO notes that no federal statute provides consumers the right to learn what information is held about them and who holds it. Consumers have limited legal rights to control what and how personal information is collected, maintained, used, and shared. And no federal law provides correction rights for information used for marketing or look-up purposes.
“There are differing views on whether there is a need for more legal privacy protections or whether better enforcement of current laws and self-regulation of the industry can suffice,” said Alicia Puente Cackley, GAO’s director of financial markets and community investment, during a Nov. 15 audio interview with GAO staff. “So many believe consumers have a right to expect the companies will collect, use, and disclose their information in ways that are consistent with the context in which the information was provided. Industry representatives have argued that repurposing of consumer information generally is not inappropriate or harmful.”
The GAO report recommends that Congress should consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the increased market for consumer information. This includes addressing:
- The adequacy of consumers’ ability to access, correct, and control their personal information in circumstances beyond those currently accorded under FCRA
- Whether there should be additional controls on the types of personal or sensitive information that may or may not be collected and shared
- Changes needed, if any, in the permitted sources and methods for data collection
- Privacy controls related to new technologies, such as web tracking and mobile devices
To view the full report, click HERE.