THE CONCEPT OF giving consumers “access” to their personal data-allowing them to see, and if necessary correct, information marketers possess about them-seems reasonable enough. But the closer you look at it, the more complicated it gets. Just what information should be available? And just what is access?
The issue is becoming more of a priority because the data out there is so much more robust than 20-odd years ago, when fair information practices were first discussed. In a July 1998 draft paper, the U.S. Commerce Department said access should be part of any self-regulation scheme. Access is also in the Online Privacy Alliance’s guidelines.
Will the goal of true one-to-one marketing also mean true one-to-one access? Marketers protest that allowing consumers to see and correct the data would be nearly impossible and cost millions of dollars. For one thing, in a multi-office company, data about an individual is spread all over the place, usually in computers that don’t talk to one another. Attorney Charles Prescott, the Direct Marketing Association’s new vice president of international business development and government affairs, adds that in litigious America, companies fear that even if they unintentionally don’t fully comply with such requests by mistake they may expose themselves to lawsuits.
Even more fundamentally, unlike credit databases, marketing databases are not set up for access and correction. They’re set up to make searches not based on a name but on criteria that will create lists of individuals who are most likely to buy that CD-ROM or popcorn maker. “There’s a misconception that companies are sitting there with dossiers on individuals,” explains Jill Lesser, America Online’s director of law and public policy.
And it is also likely that a consumer’s correction would be overwritten by new, possibly incorrect information from another source.
To complicate matters, “data” used to mean only transactional information. Now many buyer files are combined with overlays from a Polk or an Experian with likely income from ZIP+4, car type and psychodemographic information. Does access include this?
“The companies are extremely nervous about having to let somebody see the imputed data they have about them,” says Alan Westin, publisher of Privacy & American Business. “The business concern collides with the right to access.”
And if seeing means actual, online access to the database (rather than, say, a hard copy mailed to the house), what about security concerns? Must marketers show outsiders their proprietary information?
Marty Abrams, Experian’s vice president of information policy and privacy, says that direct marketers would have a very hard time going along with this. Experian’s position, he says, is that “if the government believes access is a public good, it won’t be achieved from self-regulation because we can’t afford to have a different cost structure than our competition.”
Says AOL’s Lesser: “The access principle is difficult for a number of companies, including America Online, because we’re concerned about the integrity of our systems. Letting people have access to our database does potentially threaten the integrity of our database. Even if you try to limit the data a consumer has access to, there’s always a threat that they can get access beyond what you intended.”
Lesser says that currently AOL does not provide access to its database, but members can correct name, address, phone number and credit card information.
Privacy advocates are unsympathetic to marketers’ contention that providing the information would present them with a huge burden. Privacy Times’ Evan Hendricks says marketers want to collect and profit from this information “yet when the consumer wants to find out what the marketer has, the marketer says they can’t do it because they’re not geared for it. Well, the price of doing business is that you have to be geared for it.”
Privacy Journal’s Robert Ellis Smith says that consumers should have access to “any information in the mainstream of an organization that would have any consequences for an individual, including generating calls or mail to them. If the information is retrievable by name or an identifying number then the consumer should be entitled to see it.”
The DMA’s position is that the type of access given should depend on what kind of information is involved. Medical and financial information is obviously much more important than marketing information.
But National Consumers League vice president for public policy Susan Grant says marketing data is not benign, because it gets combined with other information and is used for reasons far removed from the original marketing purpose. Privacy advocates stress that allowing consumers to see and correct their information will help marketers keep their files accurate. Westin cites another benefit of access: Consumers will want to correct misinformation that they feel is preventing them from receiving offers from marketers.
While access is a complex issue, there is a place to which American marketers can turn their gaze for some enlightenment: across the pond to Europe. The laws of several European countries (United Kingdom, France and Sweden) have long allowed access, and the European Union’s data protection directive requires that companies at least divulge what type of information they keep.
There are no studies on how many Europeans have clamored to see what data marketers have about them (compared with American marketers, European companies hold almost nothing). Anecdotal evidence suggests there’s not much. The head of computer security for a large European bank recently told the DMA’s Prescott that since 1984 the bank has had only 96 requests. But, Prescott says, when Hong Kong initiated a similar directive in 1996 many people made requests out of curiosity.
Even on this question there is disagreement. Privacy advocate Hendricks believes consumers will not be stampeding to see this information. But Experian’s Abrams says that American consumers may do so because they are used to asking to see their credit reports.
They may also do so out of pure curiosity.
Network
