This practice note is intended to give privacy practitioners a framework for thinking about the legal issues surrounding Big Data, such as those relating to privacy, data security, and anti-discrimination, and for evaluating potential legal risks, including those related to compliance and consumer protection issues. This practice note approaches Big Data from a U.S. perspective. Increasingly, Big Data will encompass consumer data relating to individuals outside of the United States, in which case other countries' privacy laws will need to be considered for potential applicability, as will any laws governing the transfer of personal data from another country into the United States.

Big Data—What Is It?

Big Data analytics is the collection and analysis of large and varied data sets (both structured and unstructured) to discover or infer patterns, trends, correlations, and preferences and can be used to make more accurate decisions. Big Data analytics is made possible by the collection of vast amounts of data from a variety of sources, the decreasing cost of obtaining this data, and new technologies and methodologies to analyze data to draw connections and make inferences and predictions.

Big Data analytics is driving innovation across all industries, and there are many benefits to be gained from its analysis. However, there are significant and very real concerns about the risks posed by the use of Big Data. These include the potential for consumer harm, including by perpetuating existing disparities or excluding consumers from receiving the benefits of Big Data. As noted by the Federal Trade Commission (FTC) in its 2016 Report "Big Data: A Tool for Inclusion or Exclusion?," the challenge for organizations is not whether they should use Big Data, but "how organizations can use Big Data in a way that benefits them and society, by minimizing legal and ethical risks.

As described below, the legal landscape surrounding Big Data analytics is uncertain. There is no comprehensive federal privacy law in the United States governing its use, and therefore practitioners must consider an array of different privacy laws and guidance and their potential application to a particular use of Big Data.

Benefits of Big Data

Big Data offers a number of benefits across different industries and practice areas. For example:

  • Healthcare outcomes. Big Data analytics can be used to predict critical healthcare-related information, develop treatments in areas without specialty providers, and detect and diagnose disease.
  • Business efficiency. Real-time Big Data analytics can help organizations identify and react to problems in near realtime and be used to analyze sales (and returns) to make better decisions about new products and services, feature enhancements, discontinuations, and other changes.
  • Consumer preferences and personalization. Big Data allows businesses to provide better services to customers based on their individual needs and changing preferences.
  • Security/fraud. Big Data can help avoid security threats and fraud by allowing organizations to detect anomalies in their data or on their networks.

Risks of Big Data

Big Data also opens individuals and organizations to significant risks.

Privacy

Privacy is a key concern for Big Data analytics. Many Big Data sets include consumer data and traditional methods used to protect privacy rights, like de-identification or exclusion, may limit the accuracy or usefulness of the analysis. In addition, technologies that rely upon Big Data, such as Internet of Things (IoT) devices, have invaded areas that were historically private and also generate a large amount of sensitive information. For example, smart home devices capture large amounts of information about our day-to-day activities in our most private spaces. For more information regarding IoT, see Internet of Things Key Legal Issues. Some services may use Big Data to personalize offerings in ways that are neither disclosed to nor approved by the user. There is also the risk of large-scale data breaches when data used for analysis is subject to unauthorized access or exfiltration and is used for malicious purposes.

Transparency

Transparency is also a significant challenge in the use of Big Data. Consumers may want to know what data has been collected about them and how it will be used. Many federal and state laws that regulate privacy focus on the need for user consent, notification, and opportunities to opt-out of data collection or use (e.g., Federal Trade Commission Act of 1914 (15 U.S.C. §§ 41–58, as amended) (the FTC Act or the Act) and the California Consumer Privacy Act). Fraudulent or misrepresented use of personal information and consumer data is the basis for a significant portion of FTC enforcement actions related to privacy.

Discrimination and Fraud

The rising use of Big Data analytics can also result in discriminatory hiring and lending practices, among other insidious forms of bias. Big Data analytics can be used to predict individuals' personal, sensitive characteristics, including religion, ethnicity, sexual orientation, and political affiliation, that could be used, in turn, to make decisions that violate consumer protection and equal opportunity laws. This information is often inferred from more traditional, less sensitive, data points (such as addresses, birthdays, and home ownership information). The conclusions derived may also be used by businesses to make dubious and misleading offers or otherwise promote scams to vulnerable individuals, including senior citizens. Incorrect predictions from Big Data can preclude otherwise deserving consumers from credit offers, educational opportunities, and other things, which can have the effect of perpetuating existing disparities.

Errors

Big Data analysis is not error-free and as such, important decisions might be based on false or misleading data points. When poor quality data enters the complex system of Big Data analytics, there can be significant inaccuracies that result in revenue loss, major process inefficiencies, bias or discriminatory effects, and the failure to comply with applicable industry and government laws and regulations.

Data Protection/Security

There is also the risk of unauthorized access or acquisition of large data sets that contain vast amounts of personal information. Attorneys working in Big Data need to understand how to implement reasonable security practices to protect the information, and how to evaluate legal and contractual obligations if there is a data breach.

To view the full article, click here.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.