Fair Financial Services & The 88th Legislative Session - Data Privacy

Advances in digital technologies have allowed consumer behavior to be incessantly monitored through the mass collection, sharing, and selling of our personal information. Texas has several data privacy laws that provide some degree of accountability for data collection and use, but there is no comprehensive law that protects the right to privacy. In 2019, The Privacy Protection Advisory Council was created to advise the state legislature on current privacy laws. In the Council’s 2020 report, one of its recommendations to the state legislature was for policymakers to consider ways to strengthen Texans’ “right to know how their personal information is being used.” To date, that recommendation has yet to be fulfilled. The Council’s recommendation was a step forward in considering privacy concerns but also left clear gaps in providing a full assessment of key consumer-facing privacy issues that need to be addressed.

As it stands, current Texas law lacks the data privacy rights necessary to safeguard the personal and online data of its citizens. The current state of the law enables and facilitates harmful actions by abusers, fraudsters, and scammers who can easily glean information from the Internet and use it to perpetuate abuse and fraud. Every day, mass amounts of data are collected from us using a range of methods, including online cookies, registered loyalty cards, public social media platforms, device or browser identifiers, and more. Data brokers are major players in collecting and selling our personal data.

What Are Data Brokers?

Data brokers are businesses that have no direct relationship with an individual, yet they collect and sell personal information to third parties. Data brokers collect our data gleaned from tracking internet searches and from other parties with whom we do business. They then sell our data to interested parties, such as companies looking to advertise their products or businesses, as well as to any person who may be looking for information about us and willing to pay for it. Data brokers collect expansive lists of data about individuals. Some examples of this are:

• Full names,
• Home addresses (both current and previous),
• Telephone numbers and email addresses, and
• Social security numbers.

Data brokers then add a vast trove of digital information to the personal data they have collected, including web browser identification, web history, profile data, location information from mobile apps, and purchase history. As our data gets passed around among countless third parties, there are more possibilities for our data to be leaked or breached in a way that causes real harm. In recent years, we have seen major data breaches from T-Mobile, Equifax, Robinhood, and Edfinancial, which put millions of consumers' personal, private financial data at risk, and have brought about growing data privacy concerns from consumers. Texas has the ability to protect individual privacy by enacting consumer data privacy laws and protections that give Texans the right to control their own data.

Survivors of Domestic Violence and Human Trafficking

Rapidly growing technology can bring risks to the well-being and security of survivors of domestic violence, victims of human trafficking, youth, and vulnerable older adults. The current use and abuse of personal data has significant ramifications for individual safety and protection. The digital age has enabled ingenious ways for abusers, fraudsters, and scammers to gain access to personal identifying information. As a result, we see significant impacts on financial stability and physical safety. Through economic exploitation, abusers can use the vast array of data available to continue to harass and harm survivors of domestic violence and human trafficking both when they are in the abusive relationship and long after they have escaped. A specific form of economic exploitation called coerced debt can burden the survivor with bad credit caused by the abuser. Coerced debt, defined as non-consensual, credit-related transactions occurring in an abusive intimate relationship, is a form of identity theft where an abuser obtains credit using the survivor’s identifying information through threats, fraud, and/or coercion. Abusers can continue to perpetrate acts of violence by financially exploiting their victim by taking out coerced debts through purchasing data on their victim from data brokers. Data show that economic exploitation is prevalent in abusive relationships and this type of abuse is enabled by the ease of accessing and using the data of survivors. A 2019 report by the National Domestic Violence Hotline found that nearly one in three Texans who called the hotline disclosed experiencing economic/financial abuse, and 19% disclosed experiencing digital abuse, which was defined as abuse through “the use of technologies such as texting and social networking to bully, harass, stalk, or intimidate a partner.”

Vulnerable Older Adults

A myriad of social and economic issues face the more than 3 million people over the age of 65 living in Texas today, including elder abuse through exploitation and fraud. A common form of elder fraud is the “grandparent scam,” which takes advantage of a grandparent’s love and concern for their grandchildren to scam them out of money. Scammers now have access to an abundance of personal information about their targets, thus bolstering their impersonations by making them more believable. As it currently stands, Texas is a leader in terms of elder fraud perpetrated against people aged 60 and older, with losses reaching more than $100 million.

Policy Recommendations

Texas Appleseed supports enacting policies that enhance Texans’ right to privacy for survivors of domestic violence and human trafficking; vulnerable youth and older adults; and all Texans. A comprehensive data privacy law should include the following tools for Texans to have better control over their data:

• Allow consumers to access, correct, delete, or transfer their data in an easy-to-navigate and user-friendly way;
• Require strong data minimization requirements for businesses;
• Implement a global “opt-in” mechanism;
• Enable consumers to avoid all targeted advertising and profiling;
• Provide consumers with the ability to opt out of third parties (like data brokers) collecting, sharing, and selling their data;
• Prohibit businesses from discriminating against consumers that choose to exercise their data privacy rights; and
• Require strong enforcement efforts for privacy violations.

Texans should be able to freely and safely participate in this increasingly expanding digital society without fear that their personal data will be abused. It is crucial for companies to be held accountable for invasive and unnecessary data collection and sharing practices that lead to detrimental safety and financial outcomes for consumers. Data privacy is an issue that affects us all. Texas has the ability to prioritize data privacy protections and put control back in the hands of survivors, vulnerable groups, and all Texas consumers.