April 03, 2013, 6:49 PM — Ready for a good news/bad news joke? Here goes.
Legislators in California have introduced a "Right to Know Act” that would compel companies operating in the state to disclose any data they have collected about you, as well as the names of any other organizations to whom they’ve disclosed that information over the past year. Organizations would have 30 days to respond with the names and contact info for any business that has your data.
It’s actually an amendment to existing California privacy law that extends the law to any company that retains information, not simply the original collector of it. The new law defines “personal information” as not merely name or email, but also “age, gender, race, income, health concerns, and recent purchases.” And it gives private citizens and law makers the right to sue for damages if the law is ignored.
Sounds reasonable, right? That’s the good news.
Now for the bad: Most of the companies that retain information about us have no direct business relationship with us. They have no idea who we are, and most of us have no idea who they are. In fact, the vast majority of the 1300-odd companies that track users across the Internet wouldn’t be able to respond to a request for data under this statute, even if they wanted to, because the data was collected anonymously. And that makes most of this moot. According to the new language being proposed:
A business is not obligated to provide information to the customer pursuant to subdivision (a) if the business cannot reasonably verify that the individual making the request is the customer.
Let’s take the site you’re now reading as an example. The Ghostery browser plugin identified 18 trackers on ITworld.com alone, ranging from a company called Adhere to one known as ValueClick Mediaplex. Not exactly household names to anyone outside the Internet advertising community.
But ValueClick describes itself as “one of the largest and most trusted display advertising networks in the world,” reaching nearly 600 million unique visitors per month. It operates as both an online behavioral advertising (OBA) company that collects demographic information anonymously, and a lead generation firm that collects very identifiable information. I don’t know which of those is at work here. Maybe both.