European Consumer Commissioner
Roundtable on Online Data Collection, Targeting and Profiling
Brussels, 31 March 2009
I would like to thank all of you for accepting our invitation to be here today. We are here to talk about one of the most important and most controversial issues in the fast evolving world of digital communications: the explosion in the volume of collected personal data and its use for commercial purposes.
I feel there is a much needed discussion on the new generation of practices and business models built on the ability to profile consumers and then use their profile to target them for commercial purposes.
The current work on privacy has concentrated on eliminating personally identifiable information such as name or IP addresses from the public domain. Consumer policy needs to go beyond that and address the fact that users have a profile and can be commercially targeted based on that profile, even if no one knows their actual name.
Let me be very clear from the start, I believe that the internet and the new generation of digital communications and digital platforms offer immense possibilities to consumers. In terms of choice, access and opportunity, they are some of the most empowering tools consumers have ever had. I am convinced that new information and communication technologies will bring enormous benefits to consumers.
It is precisely because we want these new opportunities to grow and evolve, that we need to promote the trust and confidence that will encourage people to participate. Internet is an advertisement supported service and the development of marketing based on profiling and personal data is what makes it go round. Personal data is the new oil of the internet and the new currency of the digital world.
We accept this reality because it is one chosen by users. Internet users have massively opted for free services offered in exchange for acceptance of advertisement. Today, advertisement online is individually targeted and increasingly based on the user's profile and behaviour.
Tools must now be developed that balance the interests of business with that of the consumers. This means two things: the respect of users' right to control their public exposure; and the obligation to protect them against abusive and risky practices targeted at them.
We have already well established consumer policy principles, articulated in regulations and tools that bring confidence in the traditional world of goods and services. These are principles of transparency, clear information, choice, fair commercial communications and fair contract terms. We do not need to reinvent the wheel. What we need now is a debate on how we apply these tested principles in digital world, in particular in the activity of collecting consumers' personal data for the purpose of commercially targeting them.
I believe a constructive dialogue on this issue will lead to a common understanding of the rules of the game and a better market environment for all.
A new generation of consumers is emerging, empowered by technology and the knowledge to use it. This new generation has developed astonishing tools of networking and social participation. It has developed a culture of transmission, shared interests and user-generated content.
And business and advertisers feel they have no choice but to engage with these networks of users, to work with communities to promote their products and to fully exploit new technologies to reach their target audience. This is new territory for them and it is new territory for us regulators as well.
Why do we need action? Because from the point of view of commercial communications the World Wide Web is turning out to be the world "wild west". And this could be very damaging.
Our research shows that young people between the ages of 15-25, the most confident of internet users, use the internet in spite of the fact that they generally don’t trust it. Using internet under these conditions is like drinking your water while thinking it might be slightly toxic. We would not allow such a situation to exist in the market for water, or cosmetics or toys. We do not tolerate this lack of confidence in any consumer commercial setting because in the long run lack of confidence damages markets. In our toxic water example, you will drink the toxic water but you will drink just enough and no more. And the water market will not thrive.
There are three particular strands of actions we must address: privacy policies, commercial communications and commercial discrimination.
Let me tackle now the issue of privacy policies. There is a clear need to reassert users’ trust by being more transparent about data collection activities. We need to generate awareness amongst consumers that their data is being traded, and establish certain possibilities for user control.
More than 4 out of 5 young internet users believe that their personal information is somehow used without their knowledge and shared with third parties without their agreement. They are right.
The status quo is not an option. Currently, consumers have little awareness of what data is being collected, how and when it is being collected and what it is used for. And they are also not able to control this process. The current opt-out systems are partial, sometimes nowhere to be found, they are difficult or cumbersome and most of all, they are unstable. Avoiding tracking is currently technically difficult if not impossible.
A social network recently included without warning a clause in their terms and conditions that amounted to users rescinding ownership of all their content in their favour. This is a social network site taking ownership of your personal photo albums. Although regulators did not react people obviously thought the clause was not fair and the uproar of users and the threat of legal action has led the platform to rethink this clause.
It will not be a secret to this audience that people do not normally read contract terms of online services. In fact, in this case, it took 175 million users for one of them to notice the change. Are we willing to delegate onto consumers the full task of monitoring the internet for abuses in the existing myriad of incomprehensible policies?
We must establish the principles of transparency, clear language, opt-in or opt-out options that are meaningful and easy to use. I am talking about the right to have a stable contract and the right to withdraw. And I am also talking about fair clauses and the right to participate in economic activity without selling your whole self indiscriminately as commercial fodder to the entire world.
My second area of concern is commercial communications.
The data collected online contains information about the websites we visit, the things we buy, whether we actually liked it, the people we befriend and the commercial content we respond to. It can also contain large amounts of very personal information. This information is combined to build a profile of who we are.
No one in the digital space really cares about our actual names or exact physical addresses. What traders want is a description of who we are and a way to reach us. They want to know that the person behind the number 1234 is young, sporty, drives fast cars and travels frequently and that as a trader you can show up on his screen at your convenience. This is fine. But what about the person behind number 456, unemployed, in debt and about to lose his home? He is a target for predatory loans and fraudulent financial and yes, personal, advice.
Advertisement is useful to consumers and better advertisement will no doubt greatly benefit consumers. We must do nothing to discourage progress in the relevance of the advertisement people receive. Advertisers want to be useful and appealing and we should let them get better at this.
But we must ensure that commercial communications comply with the law. This means they cannot deceive, mislead or amount to excessive pressure. What is the implication of these principles in a world of personal information?
For example, can the knowledge of some of your personal circumstances, say your financial status or your health condition, ever translate into 'pressure'? Assume for a second you receive an unsolicited message that your cholesterol is up alongside a recommended treatment. Is this help or pressure? What if the message is about your weight? Is it enough to signal the commercial nature of the message?
This actually brings us the really tricky matter of the blurring of commercial and non commercial communications. A recent experiment in neuroscience suggests that individuals might abdicate their own valuation of risks when given individual advice by an expert and just follow the expert's advice.  This only reinforces the need to enforce the principle of identifying commercially sponsored messages and, even more importantly, the principle of identifying commercially sponsored messengers.
The situation becomes even trickier in the world of social sites and viral marketing. Young people and even children are being particularly targeted as conduits for advertisement. If a toy company incites a little girl to share with her friends she got a brand new doll, is the message she sends an advertisement? Does receiving a sponsored message that your best friend got a doll amount to pressure selling if you are 7 years old?
Our current legislation forbids advertisements that ask children to pester their parents but we say nothing of the ones that ask them to pester their friends.
We must find guiding principles to help us address the rapid evolution of very targeted commercial messages and viral marketing. What are the personal circumstances that could make a commercial message too aggressive? What are the criteria for a commercial message not to mislead by passing as personal advice?
The questions are many and the issues are difficult. I have left for the end probably the most difficult issue of all because it is also the newest. The issues of commercial discrimination.
The explosion of personal information available to traders is resulting in people having increased access to customized services. If done in the interest of the consumer, this is very efficient and beneficial. Good examples of customisation are books or music sites that recommend and introduce new music to their customers; travel agencies that propose hotels and destination packages in accordance to the consumer's tastes. And I am sure there will be new ways to better serve consumers that we have not yet think of.
But personal and behavioural information can also reveal how much you are actually willing to pay for a service. It can reveal the risks you are likely to incur, be it in late payments, illnesses, or even the likelihood you will return the goods you buy.
If this personal information is used to extract the maximum price possible from you or to block your access to some services altogether, then commercial discrimination can damage the confidence in digital trade and services. People may resent a world where they would have to systematically pay for who they are or the risks they personally incur.
Excessive targeting in the form of price or commercial discrimination can also inhibit the ability of users to predict and compare prices which seriously harms competitiveness in a market.
We have some way to go to understand the full consequences of this commercial practice but we must start thinking about the parameters for legitimate discrimination. What type of commercial discrimination, if any, is damaging to consumer trust and market efficiency?
I know that many industry participants are going at great lengths to address the issue of trust in data collection and targeting. We will hear today of the different approaches adopted by some of the industry giants. Industry must rise to the challenge as they are now best placed to define the rules of the game. More than anyone, they need the trust of their users.
I invite industry to develop a framework that applies consumer policy principles and that will establish the principles of acceptable behaviour along the lines of what is being discussed today.
But as the new US Federal Trade Commission Chairman, Jon Leibowitz said recently, any reliance on industry to improve the situation does not amount to regulatory retreat but rather to a last chance given to business to improve the situation
The regulatory protection we have in Europe is extensive and far-reaching. There is a huge task ahead of us in terms of enforcement of the rules that already exist both regarding privacy and consumer protection. Some progress has been made but it is not nearly enough.
In much the same way that the internet is borderless, the questions pertaining to online data collection are also global. We have participants here from the US who, I hope, will not only be able to contribute with their experience to the discussion, but hopefully will return home encouraged and with ideas on how we can cooperate on this important subject. If we want to be effective, we also need to consider the international dimension of this issue
Behavioural targeting on the internet will become increasingly pervasive and consumers understandably feel uncomfortable.
Today I want to send one very clear message to those involved in all aspects of the digital world - Consumer rights must adapt to technology, not be crushed by it. The current situation with regard to privacy, profiling and targeting is not satisfactory.
The central issue is to transpose the principles of consumer policy to this new technological reality so that we maintain our traditional boundaries of what is right and what is not, what damages people and markets and what favours and nurtures them.
This will involve consumers, business and regulators. But it is regulators that bear the ultimate responsibility of ensuring markets work well and develop their greatest potential with the interest of citizens at heart. I want to send a warning signal today that we cannot afford foot dragging in this area. If we fail to see an adequate response to consumers concerns on the issue of data collection and profiling, as a regulator, we will not shy away from our duties nor wait for a cataclysm to wake us up.
Without further ado, I would like to wish you a fruitful and productive discussion and thank you once again for being here today.
 Engelmann JB, Capra CM, Noussair C, Berns GS (2009) Expert Financial Advice Neurobiologically “Offloads” Financial Decision-Making under Risk. PLoS ONE 4(3): e4957. doi:10.1371/journal.pone.0004957