How the Fair Credit Reporting Act Regulates Big Data

Abstract

This short essay, prepared for Future of Privacy Forum's Big Data and Privacy: Making Ends Meet event in September 2013, makes two observations concerning First, big is not new. Consumer reporting, a field where information about individuals is aggregated and used to assess credit, tenancy, and employment risks, achieved status of big in 1960s. Second, Fair Credit Reporting Act of 1970 (FCRA) provides rich lessons concerning possible regulatory approaches for big data. Some say that data requires policymakers to rethink very nature of privacy laws. They urge policymakers to shift to an approach where governance focuses upon the usage of rather than itself. Consumer reporting shows us that while use-based regulations of big provided more transparency and due process, they did not create adequate accountability. Indeed, despite interventions of FCRA, consumer reporting agencies (CRAs) remain notoriously unresponsive and unaccountable bureaucracies. Like today's big firms, CRAs lacked a direct relationship with consumer, and this led to a set of predictable pathologies and externalities. CRAs have used messy and fuzzy logic in ways that produce error costly to consumers. CRAs play a central role in both preventing and causing identity fraud, and have turned this problem into a business opportunity in form of credit monitoring. Despite legislative bargain created by FCRA, which insulated CRAs from defamation suits, CRAs have argued that use restrictions are unconstitutional. Big is said to represent a powerful set of technologies. Yet, proposals for its regulation are weaker than FCRA. Calls for a pure use-based regulatory regime, especially for companies lacking discipline imposed by a consumer relationship, should be viewed with skepticism.