You have probably never heard of Acxiom, Experian, or Quantium. But if you have ever opened a bank account, used a credit card, applied for insurance, visited an airport, bought a car, signed up for a subscription, made a purchase online, made a purchase in a store or even just browsed the internet, they have almost certainly heard of you.
These are just three among an entire industry of companies known as ‘data brokers’, which base their business models on analysing the moment-to-moment behaviour, choices and locations of millions of people. Where the current Cambridge Analytica scandal used data from Facebook, these companies also work with banks, insurance agencies, retail companies, healthcare providers and a range of other partners to pull in information about you as an individual consumer. They may know where you live, where you work, how much your home is worth, what kind of car you drive, how old your kids are, what you do on the weekends, what news you read, how much money you spend at the pub and much, much more. Step by step, they piece together these little breadcrumbs of data about you to build up a comprehensive profile of you which they can use to analyse and try to predict your future behaviour. And it’s all up for sale.
Consumers in Australia currently do not have a legal right to see what information a company holds about them.
The Cambridge Analytica scandal which has dominated headlines in recent weeks involved the data of 87 million Facebook users. That may sound like a lot, but in the data world it is small potatoes. Acxiom, one of the world’s largest data brokers, claims to have data on
Using ",” Acxiom proudly promotes what it calls “people-based marketing” – by which it means the ability to target specific individuals across multiple “touchpoints” regardless of whether they are online, offline, using multiple devices, using different identifying details or even different names. The infographic below of ‘Lisa’s Customer Journey’ illustrates this.
Acxiom offers the ability to target individuals and households based on factors such as demographics, location, financial behaviours, net worth, spending habits, interests and hobbies, political affiliation, home ownership, media consumption or what kind of car they drive.
Infographic of online and offline customer touchpoints from Acxiom marketing material. Source: Acxiom
This allows Acxiom’s clients to identify their targets to a degree of specificity which sits somewhere on the border between ridiculous and creepy. For example, the following filters can be used in a targeted advertising campaign: Men aged between 40-45 who own a home in a particular postcode, have children under 10, have a dog but not a cat, are interested in antique collecting, are fans of a particular soccer team, drive a BMW, are moderately unlikely to eat at McDonalds and have recently bought a kitchen appliance. To top it off, those individuals will likely never know exactly how or why their data was shared and for what purpose.
“The data industry is incredibly problematic,” says Dr Monique Mann, the Vice Chancellor's Research Fellow in Technology and Regulation at the Queensland University of Technology and board member of the Australian Privacy Foundation. “It is founded on a business model of surveillance capitalism that profits from the exploitation of personal information. It is imperative that there is greater transparency and regulation in this area.”
A teenager in Vietnam had been paying $15,000 a month for access to people’s personal information on the Experian database and then on-selling this information to identity thieves via the dark web.
Lack of transparency and regulation were identified as significant problems in a . Consumers in Australia currently do not have a legal right even to see what information a company holds about them. The Commission recommended developing a centralised model for data governance in Australia, which would include more rights for consumers to access their own data held by government agencies and private organisations. The government has created a to respond to the report, including the proposal for a new Data Sharing and Release Act which the Productivity Commission recommended should be passed by the end of 2018.
Advertisers are the main clients for data brokers, but they are far from the only group interested in getting to know you, whether you want them to or not.
Financial institutions are regular clients of data brokers, including using them for credit screening, fraud prevention and debt collection. In Australia, . Experian also offers a range of debt collection and “skip tracing” tools to identify and track down people owing money.
"The outsourcing of data analysis, tracking and brokering is incredibly worrying, as it fails to take into account the onus of responsibility to protect individual’s privacy. There is always the very real threat of false positives, invasion of privacy via scraping of social media profiles and inaccuracies in automated algorithms,” says Tim Singleton-Norton, Chair of Digital Rights Watch Australia.
Another risk is that this kind of data could potentially be used to target and exploit particularly vulnerable individuals. A has expressed concern about the targeting of financially insecure consumers for predatory lending. For example, in 2012 the .
The US Federal Trade Commission fined credit broker Equifax for selling the data of 17,000 customers in financial distress to payday lenders.
Australian data broker Quantium (, as well as data-sharing agreements with other major institutions such as NAB) help to "engage their customers as unique individuals at scale: predicting the cover they need, when and how they need it and the price they are willing to pay."
When asked about how many Australians Quantium holds data on, however, a spokesperson for the company claimed that Quantium does not use identifying data on individuals. "Quantium's services business uses de-identified data, so it does not collect or use personal information about identifiable individuals," says the spokesperson.
This was not an answer to the question (which was about how many Australians Quantium has access to data on rather than asking about the type of data they hold) but it raises the significant issue of what should be considered as identifying data. Identifying data is usually thought of as details like names, addresses and phone numbers. But if Quantium has enough personal data to predict the kind of insurance you need, when you need it and how much you can pay for it, is just taking your name off it enough to call that data “de-identified”?
"The outsourcing of data analysis, tracking and brokering is incredibly worrying, as it fails to take into account the onus of responsibility to protect individuals’ privacy. There is always the very real threat of false positives, invasion of privacy via scraping of social media profiles and inaccuracies in automated algorithms,” says Tim Singleton-Norton, Chair of Digital Rights Watch Australia.
Facebook has worked closely with data brokers through its Partner Categories program, which combined all of the information held by Facebook about an individual user with all of the information data brokers held from other sources about that same person. This allowed advertisers to “ people take outside of Facebook, such as owning a home, being in the market for a new truck or being a loyal purchaser of a specific brand or product.” If you’ve ever been served ads on Facebook which seem to be targeting you based on something which (you think) Facebook could not possibly know, there is a good chance that this is what was going on there.
Given these companies hold huge amounts of potentially sensitive personal data, data security is a very real concern. The massive Equifax hack in 2017 exposed the data of 147.9 million Americans, including full names, addresses, Social Security numbers, tax identification numbers, driver’s licenses and passport numbers, leaving up to 45% of the US population potentially at risk of identity fraud.
It isn’t even always necessary for criminals to hack in to get access to the data – sometimes they just buy it like everyone else. In 2015, Experian (yes, the same company which will now be reviewing NAB customers’ financial history) admitted that a teenager in Vietnam had been paying $15,000 a month for access to people’s personal information on the Experian database and then on-selling this information to identity thieves via the dark web. , which estimates that up to 30 million consumers could have been affected.
Advertisers should remember that they are the real decision makers.
One of the changes Facebook has announced in the wake of the Cambridge Analytica scandal is that . To say the news came as a shock is putting it mildly – literally the day before, .
The announcement knocked millions off projected profits for data brokers and sent their stock prices tumbling, but they’re not giving up without a fight. , Acxiom’s CEO Scott Howe claims to have seen signs that Facebook is already softening its stance, and calls for advertisers to put pressure on the social media company to change its decision. “Money is powerful, and advertisers should remember that they are the real decision makers,” he writes.
Money is powerful, but so is public pressure. The question at the heart of this issue is who should own the data you create, and who has the right to profit from it. Up until now, according to Acxiom, advertisers have been in the driver’s seat, but the combination of growing consumer awareness and increased regulatory pressure from governments could signal a shift in the balance of power. The time may be coming when increasingly informed, empowered consumers begin to demand control over who has access to their data – or broker it themselves. Perhaps then we will find out who the “real decision makers” are.
Acxiom did not provide responses to questions or a statement by the time of publishing. Multiple phone calls to Experian’s Sydney and Melbourne offices went unanswered.
