<story><title>I Got Access to My Secret Consumer Score</title><url>https://www.nytimes.com/2019/11/04/business/secret-consumer-score-access.html</url></story><parent_chain><item><author>Cieplak</author><text>I’m curious what sort of due diligence these companies must do to authenticate you as a person prior to satisfying an information retrieval request.  Given that the exchange is entirely digital, it seems plausible that there are bad actors who would pose as someone else to gain access to their personal information. What sort of liability does one of these data controllers bear when they fail to properly authenticate a person prior to handing over all their data? Is it limited to tort liability, in which there needs to be proof that the transgression ultimately led to some particular damage?  Given that this data is being traded on the free market, what’s to stop abusive employers, ex-spouses and criminals from exploiting this information?</text></item></parent_chain><comment><author>Frost1x</author><text>I suspect we as a society need new legislation to deal with these sort of issues. Before, much of this was incredibly difficult to impossible so legislation and regulation was entirely avoidable and relatively rare occurence could be dealt with on a case-by-case basis.&lt;p&gt;At this point, technology has enabled this sort of behavior at mass scale, now revealing far more personal and useful information about individuals.&lt;p&gt;A feasible model to work from may be go look at the healthcare industry and HIPPA requirements&amp;#x2F;liabilities and adapt as needed. Certainly not perfect but it&amp;#x27;s a good starting point for widespread data laws.&lt;p&gt;The question is, will our representatives actually give teeth to real data protection legislation  (not a facade with no teeth only enacted by name) in the US or are they too deeply in bed with industry that they&amp;#x27;ll protect business rights over real people who suffer real direct damages.</text></comment>
<story><title>I Got Access to My Secret Consumer Score</title><url>https://www.nytimes.com/2019/11/04/business/secret-consumer-score-access.html</url></story><parent_chain><item><author>Cieplak</author><text>I’m curious what sort of due diligence these companies must do to authenticate you as a person prior to satisfying an information retrieval request.  Given that the exchange is entirely digital, it seems plausible that there are bad actors who would pose as someone else to gain access to their personal information. What sort of liability does one of these data controllers bear when they fail to properly authenticate a person prior to handing over all their data? Is it limited to tort liability, in which there needs to be proof that the transgression ultimately led to some particular damage?  Given that this data is being traded on the free market, what’s to stop abusive employers, ex-spouses and criminals from exploiting this information?</text></item></parent_chain><comment><author>astura</author><text>This is already a big (and largely unaddressed) problem with the big 3 credit CRAs, if you know enough about a person you can very easily request their credit report and get the keys to the kingdom (so-to-speak) - everything you didn&amp;#x27;t already know.&lt;p&gt;I mean, I already request credit reports for my husband without issue, for example (with his permission! - he finds it much easier to just ask me to do those things for him rather than doing them himself).&lt;p&gt;In this case, since email address is part of the report they could only send the report to the email address on file for &amp;quot;security,&amp;quot; which would be a big improvement over what the big three CRAs are doing with annualcreditreport.com.</text></comment>