U.S. Supreme Court To Hear Arguments About Spokeo Lawsuit

While the country focuses on the U.S. Supreme Court as it considers arguments about whether the U.S. Constitution contains rights for gay and lesbian adults to enter into marriage contracts, there is another case before the Court that is arguably of equal, if not more, importance.

The current case is Spokeo v. Robins, U.S. Supreme Court, No. 13-1339. The U.S. Chamber of Commerce, Facebook, and Google have filed friend-of-the-court briefs to support Spokeo.com's position. Maybe you've heard about Spokeo.com, the people-finder website, or have even used it. This blog first reported about Spokeo.com back in 2010.

This is a Court case you'll want to follow. Why? Basically, the lawsuit is about who controls consumers' personal property: specifically, the profile information about consumers in various databases compiled by data brokers. Do individual consumers each control their profile data, or do the data brokers? You might say, the case is about whether we want accurate "bigdata" or not.

The plaintiff, Thomas Robbins a Virginia resident, originally filed a lawsuit in 2010 in California alleging the data collected and sold about him by Spokeo.com was incorrect, prevented him from finding a job, and as a result violated the Fair Credit Reporting Act (FCRA). The FCRA requires that consumers receive notice about their profile information and have the rights to view and correct their information collected by credit reporting agencies. Also, consumers have the right to lock down or prevent their credit reports from being sold by the three major credit reporting agencies: Experian, TransUnion, and Equifaz. Of course, in this case Spokeo.com claimed that it is not a credit reporting agency.

Robbins' suit was dismissed in 2011 by a lower court for lack of standing; that he hadn't proved harm. An Appeals Court reversed the lower court's decision in 2014. The U.S. Supreme Court will hear the case, and its decision will hopefully settle the matter.

University of Washington School of Law professor Anita Ramasastry analyzed the case:

"Spokeo attempts to immunize itself from FCRA violations by stating that it is not providing data for use in credit reporting. But as a recent lawsuit illustrates, Spokeo’s data is being used for such purposes, because the company may not have sufficient safety precautions... Robins’s lawsuit is not the first time that Spokeo has gotten into hot water. While it claims to be a site selling personal data for other uses (e.g., cultivating new clients, finding old friends, and evaluating prospects for business deals) it is skating on thin ice, as its data is also useful to landlords, employers, and even lenders, who may subscribe to the service as a way of doing additional background checks on people. These new types of data brokers are either unregulated, or claim that certain laws do not apply to them..."

Spokeo paid $800,000 in 2012 to settle charges by the U.S. Federal Trade Commission (FTC) that it allegedly violated the Fair Credit Reporting Act by operating as a credit reporting agency and by marketing consumers' profiles to companies in several industries without implementing methods to protect consumers as required by the FCRA. The complaint (Adobe PDF) filed by the FTC, in June 2012 in the Central District Court in California, read in part:

"Spokeo assembles consumer information from 'hundreds of online and offline sources,' such as social networking sites, data brokers, and other sources to create consumer... In its marketing and advertising, [Spokeo] has promoted the use of its profiles as a factor in deciding whether to interview a job candidate or whether to hire a candidate after a job interview. Spokeo purchased thousands of online advertising keywords including terms targeting employment background checks, applicant screening, and recruiting. Spokeo ran online advertisements with taglines to attract recruiters and encourage HR professionals to use Spokeo to obtain information about job candidates' online activities. Spokeo has affirmatively targeted companies operating in the human resources, background screening, and recruiting industries... Spokeo profiles are consumer reports because they bear on a consumer's character, general reputation, personal characteristics, or mode of living and/or other attributes listed in section 603( d), and are "used or expected to be used... in whole or in part" as a factor in determining the consumer's eligibility for employment or other purposes specified in section 604."

A 2012 survey found that most consumers are unaware about how data brokers operate. In her analysis, professor Ramasastry explained:

"[Spokeo] obtains information from dozens of sources including public records, marketing surveys, online maps, and social networks, the company says on its website. What is unclear from the company’s site is how it merges and melds data together to create a unique profile—so that data that may not be yours, or data that has an error in it, will not get wrongly compiled into your unique individual profile. In one of its blog posts, the company tells the public that “Spokeo is not a private investigator, but an information aggregator. This means that our machines do not have the human intelligence to decide which information is right, and which is wrong." This may be its assertion, but many people rely on Spokeo to serve as a sort of online detective and make decisions based on what they find in its records. Spokeo says in its Terms of Use that using the site to determine eligibility for employment, credit or other use under the FCRA is “explicitly prohibited.” "

Plus, consumers must pay to view their full profile at Spokeo.com. Professor Ramasastry concluded that the lawsuit (bold emphasis added):

"... illustrates the gray zone in which Spokeo has been operating. It is collecting data that is not traditionally the type of data that has been used for credit-reporting purposes. Employers, banks, insurers, and landlords have typically relied on financial history: how much debt a person has, whether he or she has paid their bills on time, whether he or she has a criminal record, etc. But Spokeo and other companies are compiling even more robust data sets, with new types of profiles that creditors and others will also find useful when making decisions, so Spokeo has a product that creditors want... And the underlying issue is this: when the information is used for a major life decision, such as whether someone might be hired or not, the person affected has no recourse, or ability to correct the errors."

It's not just Spokeo.com. Other data brokers operate in the same "gray zone." One example is the mugshot industry, where its data seems similarly error-filled. Mugshots from arrest records published don't seem to be updated based upon the results of court cases when charges are dropped or when defendants are found not guilty by a court. And, there are some print mugshot publications. Plus, the mugshot industry operates in an ethically questionable manner when it charges consumers with large take-down fees to have their mugshots removed (only to reappear in another site).

What can consumers conclude about all of this? Four things:

1. The data compiled by many data brokers has errors, whether they admit it or not. Consumers don't know how accurate (or inaccurate) the data compilation processes are. This can affect you. That data brokers' databases have errors should not be a surprise since errors by credit reporting agencies are well documented. the two perform similar functions.
2. What consumers share online in social networking sites can affect whether or not you get a job, or even get an interview. In the rush to make money and create new revenue streams, social networking sites will sell your information to data brokers, and your profile data will find its way into sites like Spokeo.com.
3. What gets decided in this case probably will have ripple impacts upon the whole Internet of things (ioT) industry, as the Internet-connected devices installed in "smart homes" collect even more information about consumers' habits, movements, purchases, utilities, and product usage.
4. There are rarely-discussed ethical issues. Is it right for data brokers to sell information about consumers they know isn't correct, and pretend that it is? Is it right for data brokers to charge consumers a fee to see their own profile data? After all, without consumers data brokers like Spokeo wouldn't have anything to sell. Is it right for creditors and employers to sue data brokers' sites with incorrect information?

My opinion: if it walks like a duck, quacks like a duck, and smells like a duck, then it probably is a duck. Spokeo claims it's not a credit reporting agency, but it surely operates like one. The FTC case highlighted the company's operations with procedures that may not prevent creditors from performing FCRA applications. Think of it this way: to find somebody online, you can simply search Facebook, one of the major search engines, or a white-page telephone site. So, the data compiled by Spokeo seems intended for more advanced purposes beyond finding people. Spokeo can't and shouldn't have it both ways: enjoy the benefits and revenues without complying with the FCRA requirements.

At some point, one has to hold companies accountable for selling error-filled information. If not, then you have chaos. What are your opinions?

Comments

[Ellen Gordon]

This whole situation stinks to high heaven. Thanks for covering it!

[Chanson de Roland]

In Spokeo v. Robins, U.S. Supreme Court, No. 13-1339, I hope that the U.S. Supreme Court (Court) holds that Spokeo, at least to the extent that its compilations of our personal data are used for FCRA purposes, is a credit reporting agency and must, therefore, comply with the provisions of the FCRA. However, there is a more profound question, one which was tacitly decided at the dawn of the Internet: It has been at least tacitly decided that our personal information, the information that we author with the acts of lives, isn't our personal property even when it has been reduced to and expressed in a tangible medium, such as computer memory, paper, etc. So how did that happen? How has it come to be the case that we don't have at least a common-law copyright in the personal information that Spokeo, Google, Facebook, et al. collect about us? How has it come to be that we don't have property rights, specifically a copyright, in our personal information?

Our personal information is just like writing a novel; it is our novel. We author our personal information by using products, placing photos and other information on Facebook, doing searches on Google and other search engines, etc., and that personal information is set into tangible form and, thus, subject to copyright, once it is stored in computer memory, and that original copy and all subsequent copies of our personal information in any tangible medium would also be, or I think should also be, an expression of which we are the authors and which should enjoy the protection of copyright. But this argument has never been seriously considered by the courts. It is viewed as legally absurd to say that our personal data is our copyrighted personal property. But why is that?

The only reason that I can discover for refusing to acknowledge that our personal data is our personal property is that it means all of the data collectors and aggregators, the Sopkeoes, Facebooks and other social networks, Google and the other search engines, and every other website, ISP, and other sources that collects our personal data in computer memory would then have to negotiate with each of us to get our license to use our personal information as set forth and restricted in our license and in exchange for the consideration that each of negotiates according to the terms of our license.

Now would acknowledging our copyright in our personal data wreak havoc upon the primary revenue model of the Internet, i.e., providing services and goods often without charge in exchange for our valuable personal data? No, it would not. First, most of us don't seem to give a hoot about our privacy, as long as we can expose ourselves and otherwise communicate on Facebook; do searches without charge on Google and Bing, though DuckDuckGo provides good searches without collecting one's personal data; buy cheap stuff at Amazon, etc. We readily exchange our personal information for these benefits without a thought. So Google, Sopkeo, and their ilk need only offer a form license on take it or leave it terms, and the vast majority of their current customer would assent to that license without even a first thought, much less a second thought. But at least those, who don't consider the benefits of Google and its ilk worth the bargain, could say no and could proceeded under copyright law against anyone who, without their freely and fairly negotiated license, collects their personal data in violation of their copyright in their personal data.

Certainly, this line of reasoning has merit, because, as Mr. Jenkins notes, supra, without our personal data Spokeo, Google, Faceboo, and their ilk would have nothing to sell. So surely then, our personal data can't be their personal property, if without our authoring acts they have nothing. It can't be that their property, our personal data, requires us to create it, just as I don't require someone else's words to create my own novel or to create even these words. So our personal data isn't theirs, because they don't author it. Each of us authors his personal data, which, at best, Google, Spokeo, and their ilk set into computer memory without our individual permissions, without our individual licenses. That we must author our personal data for their to be any personal data at all, for their to be any expression of our personal data stored in computer memory, implies that we, each of us, authors his personal information and are, therefore, the owners of our personal data. So we author our personal data by making an expression, and Google and its ilk set that expression in computer memory and/or other tangible medium. That is enough for copyright: an original, authored expression that is set forth in a tangible medium.

When is the last time that Google, Spokeo, or any of their ilk requested your license for your personal data, your permission to store it in computer memory and use it and trade it, on terms that you assented to? It, notwithstanding the agreements that you assent to to use Facebook, Google, etc. are not licenses. They are not an acknowledgment that your personal data is yours. That fundamental question of who owns our personal data is not presented in Spokeo v. Robins, U.S. Supreme Court, No. 13-1339, so the Court won't decide the question of who owns are personal data when it is stored in a computer's memory or other tangible medium, but it is a question that some court should address, and when and if it finally does address that question, it will have been long overdue.