As we interact online, we leave a breadcrumb trail of data – both personally identifiable and anonymized. This information can be pulled straight from data shared – name, age, or address – or can be extracted from browsing habits and usage patterns. So what restraints are put in place to stop unchecked collection and use of this data?
One touchstone used by authorities in determining data-related policies and definitions is the concept of “unfairness.” This term is used prominently in the FTC Act and is part of the fabric of consumer protection in the United States. In addition, unfairness is being used in policymaking and enforcement efforts to determine what types of data collection, storage or use may be impermissible because conducted or structured in such a way that do not adequately protect consumers from harm.
The key points for unfairness analysis (whether in connection with data or beyond) are: (1) is an activity causing substantial injury to consumers?; (2) could consumers reasonably have avoided that injury? and; (3) is the injury outweighed by benefits?
How have these factors been applied in the context of data? For one – in the past, “injury” has often meant monetary harm (though aggregating small costs to many consumers could support “substantiality” of such harm); but when the FTC turns to data and privacy, it has been known to find injury that may not be direct monetary consumer losses, such as the harm of “unauthorized revelation of [user] affiliations.”
Additionally, the FTC has found all three factors generally satisfied where a company failed to employ reasonable and appropriate measures to protect personal information against unauthorized access. As the FTC takes an increasingly active role in relation to data usage – with respect to which it currently sees itself as a “lifeguard” keeping an eye out for consumers – we will surely see further application of unfairness, both on a holistic and a factor-by-factor approach. As a result, it is in a company’s best interest to keep the unfairness principle in mind when developing its data practices.