Page 35 - FIGI - Big data, machine learning, consumer protection and privacy

Little of this provides reassurance to the individu- and consumer protection. This new law regulates
160
al subject of the data. It also raises questions about businesses that collect, sell or license to third par-
the responsibility of entities that acquire data down- ties’ personal information of Vermont residents with
stream, including in relation to the levels of due dili- whom the business does not have a direct relation-
gence they should perform. The difficulty of tracking ship. It requires data brokers to register as such with
data processing and transfer operations adds com- the authorities, disclose information about their data
plexity to the problem of attributing responsibility collection activities, and maintain security measures
for the unauthorised use of personal data. to protect the data. Failure to do so is a violation
Data brokers are, therefore, coming under increas- of Vermont’s consumer protection laws, which may
ing scrutiny, including providing consumers direct lead to enforcement by the Attorney General or by
rights. For instance, the US FTC singled out data a private citizen. California’s new Consumer Privacy
brokers in its Privacy Report to allow consumers to Act 2018 also imposes restrictions on transfers of
access their data through an easy-to-find, easy-to- data to brokers.
161
use common portal, and supported legislation that The development of laws governing data brokers
would allow consumers to access, and a right to dis- promises to open up a new area of consumer rights
pute or suppress, data held by brokers. to access data held on them, rectify incorrect data,
159
In May 2018, the small US State of Vermont was and obtain redress for violations of their rights.
the first to enact An Act relating to data brokers

5 THE POST-ENGAGEMENT PHASE: ACCOUNTABILITY TO CONSUMERS FOR PROBLEMS AFTER
THE FACT

When complex automated decision-making systems This section then considers the consumer’s posi-
operate without human involvement, there is a need tion after personal data about them has been used
to ensure that creators, designers, manufacturers, in big data and machine learning in a way that
operators, maintainers, and users of the algorithms affects them, such as a decision with legal or sim-
and systems are accountable for their respective ilar consequences. It considers difficulties big data
elements in the process. Achieving this requires and machine learning pose to traditional approach-
transparency or traceability, whereby the automated es to transparency and accountability in section 7.2,
decision maker can explain the decision and its ratio- including the problem of a right to obtain an expla-
nale for rejecting other possible decisions in favour of nation of inferences and decisions based on them.
the one chosen. This requires documentation of each Section 7.3 then reviews the consumer’s rights to
decision made about the data selected, its treatment contest decisions that have been made about them
and the design of algorithms. Lastly, the creators, using big data and machine learning processes. Last-
designers, manufacturers, operators, maintainers, ly, the question of showing that harm has actually
and users of the algorithms and systems must bear been suffered is discussed in section 7.4. Account-
economic responsibility for their decisions, where ability cannot work without liability on the backend.
appropriate in the form of legal liability.
This section considers consumers’ rights where 5�1 Consumer rights of access, rectification and
something has gone wrong after they have shared erasure
data or after personal data about them (shared by A key safeguard for consumers in data protection
them or by others) has otherwise been used to their and privacy laws is the right to access data held by
disadvantage or harm. It begins in section 7.1 by an organization about the individual and to rectify
reviewing consumer rights to address problems with errors in it, or complete it if it is incomplete.
162
data that could be used in decisions affecting them. For instance, the recently enacted California Con-
This includes rights to rectify incorrect data held sumer Privacy Act of 2018 requires businesses that
about them and to have certain data erased. This collect personal information of California residents, if
is discussed here in this post-engagement section a consumer requests, to disclose (without charging)
because it arises after a firm has obtained an indi- the types of personal information it has collected
vidual’s personal data, but it may of course merely about that consumer over the previous year. This
be a prelude to another engagement when the data includes the specific pieces of information collected
will be used. and categories of third parties with which the infor-

Big data, machine learning, consumer protection and privacy 33