A new Federal Trade Commission (FTC) report, "Big Data: A Tool for Inclusion or Exclusion? Understanding the Issues," warns that certain uses of big data consisting of consumer information may implicate various federal consumer protection laws. The report, which is intended "to educate businesses on important laws and research that are relevant to big data analytics and provide suggestions aimed at maximizing the benefits and minimizing its risks," focuses on big data's impact on low-income and underserved populations and protected groups. The FTC puts companies on notice that it intends "to monitor areas where big data practices could violate existing laws" and "bring enforcement actions where appropriate."

The report discusses the potential applicability of the Fair Credit Reporting Act (FCRA), the Equal Credit Opportunity Act (ECOA), and the FTC Act to big data practices and provides a list of "questions for legal compliance" for companies to consider in light of these laws. Highlights of the FTC's discussion include the following:

• FCRA. The FCRA imposes various obligations on consumer reporting agencies (CRAs) that compile and sell reports containing "consumer information that is used or expected to be used for credit, employment, insurance, housing or similar decisions about consumers' eligibility for certain benefits and transactions" and users of consumer reports. The report identifies "a growing trend in big data, in which companies may be purchasing predictive analytics products for eligibility determinations." For example, instead of using a traditional credit scoring variable such as a consumer's payment history, "these products may use non-traditional characteristics—such as a consumer's ZIP code, social media usage, or shopping history—to create a report about the creditworthiness of consumers that share those non-traditional characteristics," which a company can then use to make creditworthiness decisions. The report cautions that, in an enforcement action, the FTC applies the same standards to determine the FCRA's applicability to such use of non-traditional characteristics as it applies to the use of more traditional characteristics.

The report includes examples of FTC enforcement actions against data brokers that compiled data and provided it to companies to use for FCRA-covered eligibility decisions, as well as against companies that used big data for eligibility decisions without making FCRA-required disclosures. Such examples include the FTC's 2012 action against online data broker Spokeo which, according to the FTC's complaint, allegedly assembled and merged personal information from hundreds of data sources, including social networks, to create detailed personal profiles that included hobbies, ethnicity, and religion, and marketed those profiles for use by human resources departments in making hiring decisions. Based on its allegation that Spokeo marketed the profiles specifically for employment purposes, the FTC determined that Spokeo was subject to, but had not complied with, the FCRA. The FTC's message is that companies whose practices involve big data analytics, such as an analysis of online behavioral data, should be mindful of the scope of the FCRA's CRA definition and the compliance obligations that the FCRA imposes upon CRAs, and that users of reports provided by such companies should also be mindful of their FCRA compliance obligations.

• ECOA. The report cautions companies using big data to consider the impact of the ECOA and other federal equal opportunity laws, including the Fair Housing Act, Title VII of the Civil Rights Act of 1964, the Age Discrimination in Employment Act, the Americans with Disabilities Act, and the Genetic Information Nondiscrimination Act. With regard to the ECOA, which prohibits discrimination on a prohibited basis in connection with any aspect of a credit transaction, the report advises companies to "proceed with caution" in the area of credit advertisements. In particular, the report observes that ECOA/Regulation B compliance considerations may arise with respect to the prohibition against discouraging credit applications on a prohibited basis and record retention requirements relating to prescreened solicitations. It also warns that "[a]dvertising and marketing practices could impact a creditor's subsequent lending patterns and the terms and conditions of the credit received by borrowers, even if credit offers are open to all who apply." The ECOA takeaway is that "companies should proceed with caution when their practices could result in disparate treatment or have a demonstrable disparate impact based on protected characteristics."
• FTC Act. Uses of big data may run afoul of Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices. An act or practice is deceptive if it involves a misrepresentation or omission that is likely to mislead a consumer acting reasonably under the circumstances. As an example, the FTC cites its 2008 enforcement action against CompuCredit alleging that the company violated Section 5 by failing to disclose that consumers' credit lines would be reduced if they used their credit cards for cash advances or for certain types of transactions, including marriage counseling, or at bars and nightclubs. Observing that a failure to reasonably secure consumers' data can be a potentially unfair practice where the failure is likely to cause substantial injury, the FTC cautions "[c]ompanies that maintain big data on consumers [to] take care to reasonably secure that data commensurate with the amount and sensitivity of the data at issue, the size and complexity of the company's operations, and the cost of available security measures."

We note that a 2014 Northeastern University study confirmed that many companies are already using big data to engage in price steering and price discrimination. This study reported that consumer characteristics, such as a consumer's browser or device type or a consumer's purchase or viewing history, would lead to "personalization" of prices.

The report also includes a discussion of special policy considerations raised by big data research, some of which has focused on how big data analytics could negatively affect low-income and underserved populations. The FTC observes that "[n]umerous researchers and commenters discuss how big data could be used in the future to the disadvantage of low-income and underserved communities and adversely affect consumers on the basis of legally protected characteristics in hiring, housing, lending, and other processes." To "maximize the benefits [of big data] and limit the harms," the FTC advises a company to consider the following questions raised by the research: whether the company's data set is sufficiently representative of different populations; data model accounts for biases, predictions based on big data are accurate; and reliance on big data raises ethical or fairness concerns.

Given the FTC's plans to monitor big data practices and bring enforcement actions where appropriate, companies are well-advised to consult with legal counsel to ensure that their big data practices are compliant with consumer protection laws.