Thus, Census data cannot be used to provide a reliable count  FTC has called on the information reseller industry to improve the  transparency of its practices, and in December 2012 issued orders  requiring nine information resellers to provide FTC with information about  how they collect and use data about consumers.about the nature and sources of the consumer information that  information resellers collect; how they use, maintain, and disseminate the  information; and the extent to which the companies allow consumers to  access and correct their information or opt out of having their personal  information sold. The Fair Information Practice Principles (FIPPs) are a set of  internationally recognized principles for protecting the privacy and  security of personal information. In the United States, the FIPPs served  as the basis for the Privacy Act—which governs the collection,  maintenance, use, and dissemination of personal information by federal  agencies—and as the basis for many of the privacy recommendations of  agencies such as FTC and Commerce. In the United States, the federal privacy framework for private-sector  companies comprises a set of more narrowly tailored laws that govern the  use and protection of personal information—that is, the laws apply for  specific purposes, in certain situations, to certain sectors, or to certain  types of entities. The primary federal laws with regard to consumer  privacy include the following:  Fair Credit Reporting Act (FCRA). Enacted in 1970, FCRA protects the  security and confidentiality of personal information collected or used to  help make decisions about individuals’ eligibility for such products as  credit or for insurance or employment. Existing Privacy Laws Have Limited Scope over Personal Data Used for Marketing

For consumer data used for marketing purposes, the privacy protections  provided under federal law have been limited. Although the FIPPs call for  restraint in the collection and use of personal information, the scope of  protections provided under current law has been narrow in relation to (1)  individuals’ ability to access, control, and correct their personal data; (2)  collection methods and sources and types of consumer information  collected; and (3) new technologies, such as tracking of web activity and  the use of mobile devices. In relation to data used for marketing purposes, no federal statute  provides consumers the right to learn what information is held about them  and who holds it. As noted earlier, FCRA provides individuals with rights  to access information from consumer reports used for eligibility  determinations, but does not apply to personal information used for  marketing (other than prescreened marketing offers). Current Law Does Not Directly Address Some Privacy Issues Raised by New Technology

The current privacy framework does not fully address new technologies. Mobile applications. For example, they have noted that the FTC Act grants  In contrast, privacy advocates and others have stated that the current  privacy scheme left significant gaps. Industry and privacy advocates also have disagreed on the need for more  legislation or regulation and the efficacy of self-regulatory approaches to  protect privacy. Potential Disadvantages of Comprehensive Privacy Legislation

Industry stakeholders have argued a comprehensive privacy law would  amount to a one-size-fits-all approach to regulation, which could be overly  burdensome because no single law can be tailored to fit the practices of  each individual company and industry. Changes in the marketplace for consumer data include a vast increase in  recent years in the number and types of companies that collect and share  such data with third parties. Views on the Potential Impact of New Regulation on Consumers and Commerce

			Benefits of Information Sharing for Consumers

Representatives of the marketing and reseller industries have argued that  regulatory restrictions on the use of consumer data unintentionally could  reduce the benefits consumers reap from the use and sharing of personal  information. The challenge will be providing appropriate privacy protections without  unduly inhibiting the benefits to consumers, commerce, and innovation  that data sharing can accord. Matter for Congressional Consideration

Congress should consider strengthening the current consumer privacy  framework to reflect the effects of changes in technology and the  marketplace—particularly in relation to consumer data used for marketing  purposes—while also ensuring that any limitations on data collection and  sharing do not unduly inhibit the economic and other benefits to industry  and consumers that data sharing can accord. In written  comments, which are reprinted in appendix III, Commerce agreed that  evolving technology and business practices are changing the ways that  consumers’ personal information is collected and used, and that  strengthened privacy protections could better protect consumers and  support innovation. Appendix I: Objectives, Scope, and Methodology

This report examines (1) existing federal laws relating to the privacy of  consumer information held by information resellers, (2) any gaps that may  exist in this legal framework, and (3) views on approaches for improving  consumer data privacy.
Why GAO Did This Study

In recent years, information resellers--companies that collect and resell information on individuals--dramatically increased the collection and sharing of personal data for marketing purposes, raising privacy concerns among some in Congress. Recent growth in the use of social media, mobile applications, and other technologies intensified these concerns. GAO was asked to examine privacy issues and information resellers. This report addresses (1) privacy laws applicable to consumer information held by resellers, (2) gaps in the law that may exist, and (3) views on approaches for improving consumer data privacy.
To address these objectives, GAO analyzed laws, studies, and other documents, and interviewed representatives of federal agencies, the reseller and marketing industries, consumer and privacy groups, and others. GAO focused primarily on consumer information used for marketing purposes.

What GAO Found

No overarching federal privacy law governs the collection and sale of personal information among private-sector companies, including information resellers. Instead, a variety of laws tailored to specific purposes, situations, or entities governs the use, sharing, and protection of personal information. For example, the Fair Credit Reporting Act limits the use and distribution of personal information collected or used to help determine eligibility for such things as credit or employment, but does not apply to information used for marketing. Other laws apply specifically to health care providers, financial institutions, videotape service providers, or to the online collection of information about children.
The current statutory framework for consumer privacy does not fully address new technologies--such as the tracking of online behavior or mobile devices--and the vastly increased marketplace for personal information, including the proliferation of information sharing among third parties. With regard to data used for marketing, no federal statute provides consumers the right to learn what information is held about them and who holds it. In many circumstances, consumers also do not have the legal right to control the collection or sharing with third parties of sensitive personal information (such as their shopping habits and health interests) for marketing purposes. As a result, although some industry participants have stated that current privacy laws are adequate--particularly in light of self-regulatory measures under way--GAO found that gaps exist in the current statutory framework for privacy. And that the framework does not fully reflect the Fair Information Practice Principles, widely accepted principles for protecting the privacy and security of personal information that have served as a basis for many of the privacy recommendations federal agencies have made.
Views differ on the approach that any new privacy legislation or regulation should take. Some privacy advocates generally have argued that a comprehensive overarching privacy law would provide greater consistency and address gaps in law left by the current sector-specific approach. Other stakeholders have stated that a comprehensive, one-size-fits-all approach to privacy would be burdensome and inflexible. In addition, some privacy advocates have cited the need for legislation that would provide consumers with greater ability to access, control the use of, and correct information about them, particularly with respect to data used for purposes other than those for which they originally were provided. At the same time, industry representatives have asserted that restrictions on the collection and use of personal data would impose compliance costs, inhibit innovation and efficiency, and reduce consumer benefits, such as more relevant advertising and beneficial products and services. Nonetheless, the rapid increase in the amount and type of personal information that is collected and resold warrants reconsideration of how well the current privacy framework protects personal information. The challenge will be providing appropriate privacy protections without unduly inhibiting the benefits to consumers, commerce, and innovation that data sharing can accord.

What GAO Recommends

Congress should consider strengthening the consumer privacy framework to reflect the effects of changes in technology and the increased market for consumer information. Any changes should seek to provide consumers with appropriate privacy protections without unduly inhibiting commerce and innovation. The Department of Commerce agreed that strengthened privacy protections could better protect consumers and support innovation.