Social sorting

The lucid 90 page The Scoring of America: How secret consumer scores threaten your privacy and your future  [PDF] by Pam Dixon and Robert Gellman for the World Privacy Forum comments

To score is human. Ranking individuals by grades and other performance numbers is as old as human society. Consumer scores — numbers given to individuals to describe or predict their characteristics, habits, or predilections — are a modern day numeric shorthand that ranks, separates, sifts, and otherwise categorizes individuals and also predicts their potential future actions.

Consumer scores abound today. Credit scores based on credit files receive much public attention, but many more types of consumer scores exist. They are used widely to predict behaviors like, spending, health, fraud, profitability, and much more. These scores rely on petabytes of information coming from newly available data streams. The information can be derived from many data sources and can contain financial, demographic, ethnic, racial, health, social, and other data.

The Consumer Profitability Score, Individual Health Risk Score, Summarized Credit Statistics that score a neighborhood for financial risk, fraud scores, and many others seek to predict how consumers will behave based on their past behavior and characteristics. Predictive scores bring varying benefits and drawbacks. Scores can be correct, or they can be wrong or misleading. Consumer scores – created by either the government or the private sector – threaten privacy, fairness, and due process because scores, particularly opaque scores with unknown ingredients or factors, can too easily evade the rules established to protect consumers.

The most salient feature of modern consumer scores is the scores are typically secret in some way. The existence of the score itself, its uses, the underlying factors, data sources, or even the score range may be hidden. Consumer scores with secret factors, secret sources, and secret algorithms can be obnoxious, unaccountable, untrustworthy, and unauditable. Secret scores can be wrong, but no one may be able to find out that they are wrong or what the truth is. Secret scores can hide discrimination, unfairness, and bias. Trade secrets have a place, but secrecy that hides racism, denies due process, undermines privacy rights, or prevents justice does not belong anywhere.

Broader transparency for consumer scores with limited secrecy may offer a middle ground. Knowing the elements but not necessarily the weights of a scoring system provides a partial degree of openness and reassurance. Knowing that there is a scoring system and how and when it is used helps. Knowing the source and reliability of the information used to make a score helps. Being able to challenge a score and correct the data on which it is based helps. Knowing that some types of information will not be used for scoring helps. Knowing that data collected for one purpose will not be used for another or in violation of law helps. Knowing that the person running the scoring system is accountable in a meaningful way helps.

The history of the credit score provides a useful model for the new batch of predictive consumer scores. Developed in the 1950s, the credit score became part of consumer credit granting. The credit score was largely secret to the consumers that it scored and affected until 2000, when a long and well-documented history of unfair uses and abuses finally culminated in the credit score being made available to consumers. Eventually, public pressure caused the credit score’s use and even its underlying factors to become public. The use of factors such as race, gender, and religion were prohibited and this was spelled out in detail in law.

No similar protections exist for most consumer scores today. Consumer scores are today where credit scores were in the 1950s. Data brokers, merchants, government entities, and others can create or use a consumer score without notice to consumers. For various reasons laws governing credit scores do not typically extend protection to the new consumer scores. We need rules that will make consumer scores fair, accountable, accurate, transparent, and non-discriminatory.

This report discusses and explores consumer scores, what goes into them and how they are made, how they are used, the regulations in place that control some but not most new consumer scores, and how scores affect broader privacy and fairness issues. The discussion of findings and recommendations points toward solutions and reforms that are needed.

The report is structured as follows

Part I: Summary and Background

As the numbers of predictive consumer scores increase and their usage expands, Americans face a future that may be shaped in significant ways by consumer scores. By itself, consumer scoring is not necessarily good or bad. Scoring orders consumers along a mathematically defined scale. However, scoring has the prospect of being used to affect individuals in significant ways that may not always be fair or even legal. If a predictive score unknown to a consumer determines how that consumer is treated, the results may not be acceptable to the American public. The quality and relevance of the data used, the transparency of the methodology of how the score was created, plus the reasonableness of the application of the consumer score are the major factors that determine the fairness of any scoring activity. These issues should be the central focus of any policy debate about consumer scoring. These issues also suggest the elements of best practices that should apply to consumer scoring.

What is a Consumer Score?

With this report, the World Privacy Forum introduces a term: consumer scores. Consumer scores – the ones we discuss in this report – are built using predictive modeling. Predictive modeling uses copious amounts of information fed through analytical methods to predict the future, based on past information. Predictive consumer scores are important because they affect the lives, privacy, and wellbeing of individuals. Many people know about credit scores, but few know about the broader range of new consumer scores. Consumer scores are already abundant and are in active use. Consumer scores are not just an online phenomenon. Consumer scores are found in a wide array of “offline” arenas, including businesses, health care providers, financial institutions, law enforcement, retail stores, federal and state government, and many other locations. Some social consumer scores may have online applications, but mostly, consumer scores are not solely focused on just online activities. And unlike credit scores, consumer scores remain largely secret and unregulated.

The World Privacy Forum defines a consumer score as follows: A consumer score that describes an individual or sometimes a group of individuals (like a household), and predicts a consumer’s behavior, habit, or predilection. Consumer scores use information about consumer characteristics, past behaviors, and other attributes in statistical models that produce a numeric score, a range of scores, or a yes/no. Consumer scores rate, rank, or segment consumers. Businesses and governments use scores to make decisions about individual consumers and groups of consumers. The consequences can range from innocuous to important. Businesses and others use consumer scores for everything from predicting fraud to predicting the health care costs of an individual to eligibility decisions to almost anything.

Who has a Score?

Consumer scoring is already more widespread than most people realize. Many hundreds of consumer scores exist, perhaps thousands. How many Americans have them? Almost all do. Minors are less likely to be scored than adults, although they, too can have or influence some consumer scores. For example, household scores often reflect interests and activities of minors.

Among American adults, each individual with a credit or debit card or a bank account is likely to be the subject of one or more scores. Many individuals signed up under the Affordable Care Act have a score. Individuals who buy airline tickets have a score. Individuals who make non-cash purchases at large retail stores likely have a score. Scores such as the medication adherence score, the health risk score, the consumer profitability score, the job security score, collection and recovery scores, frailty scores, energy people meter scores, modeled credit scores, youth delinquency score, fraud scores, casino gaming propensity score, and brand name medicine propensity scores are among the consumer scores that score, rank, describe, and predict the actions of consumers.

In short, almost every American over the age of 18 has at least one score, and most adult Americans have many scores. An individual could easily be the subject of dozens or even hundreds of secret consumer scores. We can safely predict that there will be many more consumer scores in the future. Fed by the masses of consumer data now available, consumer scoring is quickly becoming a form of shorthand to make sense of a sea of information.

Gaps in Consumer Privacy Rights and Protections around Consumer Scoring (And why existing laws don’t always apply)

This report’s analysis is that many new consumer scores exist, and many of these new scores do not appear to fall under the narrow protections offered by the Fair Credit Reporting Act or the Equal Credit Opportunity Act for a variety of reasons. Scores built from factors outside a formal credit bureau file, scores designed to predict the behavior of groups of people instead of individuals, and new scores in emerging and unregulated areas may all fall outside of existing protections.

For example:

• Energy consumption scores, churn scores, and identity scores are not likely to fall under the FCRA and other laws as currently written. This is because those scores do not meet the layers of qualifications that would bring them under the FCRA.

• Scores that identify the approximate credit capacity of neighborhoods instead of individuals also appear to be unregulated. This is because the FCRA applies to individuals, not neighborhoods. Formal credit scores may only be used in certain circumstances, for example, for extending a firm offer of credit or insurance. Credit scores cannot be used for general marketing purposes, but aggregate credit statistics tied to a neighborhood do not appear to be subject to the same restrictions for the reasons mentioned. Lead generation is not the same thing as a formal offer of credit under the FCRA.

• Risk scores -- like health risk scores -- that use broad demographic information and aggregate financial statistics about consumers to assess financial or other risks (credit bureau files are not typically used) also don’t appear to fall under the layers of requirements that would bring them under current regulation.

• The Equal Credit Opportunity Act requires credit scoring systems to not use race, sex, marital status, religion, or national origin as factors comprising the credit score. But this law applies only to what is today a narrowly defined credit scoring system. Other scores which fall outside of the narrow definitions – like identity, fraud, churn, and other predictive scores can incorporate factors that would in other situations be considered prohibited factors to use.

As a result, consumers may have scant rights to find out what their non-FCRA consumer scores are, how the scores apply to them and with what impact, what information goes into a score, or how fair, valid, or accurate the score is. Even if the input to a score is accurate, consumers do not know or have any way to know what information derived from their lifestyle, health status, and/or demographic patterns is used to infer patterns of behavior and make decisions that affect their lives.

Further, consumers can have difficulty exercising basic Fair Information Principles for many if not most new consumer scores. Fair Information Principles form the base for most global privacy law today, including some US privacy laws. However, those who create unregulated scores have no legal obligation to provide Fair Information Practices or due process to consumers.

These significant gaps in consumer protections mean that consumer scores may include or use discriminatory factors in their composition, or uncorrected or otherwise inaccurate information could be included. Scores developed to characterize individuals or predict their behaviors need to provide fairness and due process. The credit score is already subject to some regulation, but that is not to say that consumers would not benefit from better rules for credit scores.

There is a great need to examine the effects and fairness for all consumer scores now in use. Intriguing possibilities exist that a certain stratification of consumer experience based on opportunities offered to each consumer could become commonplace. Victims of identity theft, for example, may consistently receive different and less desirable marketing treatment than individuals with clean credit scores, even if most other demographic factors are similar.

Disparate treatment, even in the area of marketing opportunities granted to consumers, raises many questions, questions that the general field of risk-based pricing has raised. Oddly, direct marketing lists and activities have the potential to strike deeply into the lives of individuals in quirky ways that can have an impact on consumer lifestyle. Much remains to be learned about the impact of consumer scoring in the direct marketing arena, as well as eligibility issues and edge-eligibility issues like scores for identity and authentication.

It identifies a range of issuere regarding gaps in protection and information fairness in scoring -

Key Issue: Score Secrecy

There are good reasons why credit scores are not secret anymore, nor are the foundational factors that comprise the score. By law, consumers have the right to see credit scores now. This report finds that with the exception of the credit score and a handful of other consumer scores, at this time, secrecy is the hallmark of many consumer scores. The factors that go into most scores are usually secret, the models used are usually secret, and in many cases, the score itself is also secret. This report’s analysis is that consumer scores that are risk scores bear many similarities to scores regulated under the FCRA. Yet industry treats these risk scores as falling outside the FCRA so that consumers have none of the rights guaranteed by the FCRA.

Consumers have no formal rights to find out what their non-FCRA consumer scores are, or how these scores affect their lives. Victims of identity theft and other individuals may have errors or omissions affecting their scores, but they do not necessarily have a right to see or correct the scores. Even if information is accurate, consumers do not know or have any way to know how companies use information derived from their lifestyle, health status, and/or demographic patterns to infer patterns of behavior and make decisions that affect their lives. Unseen scores can affect consumers’ marketplace experiences and much more.

Key Issue: Score Accuracy

Because consumers do not have the right to correct or control what personal information goes into a consumer score as an attribute or factor, the accuracy of the scores is suspect. Consumers also do not have the right to see the scoring models used to make the score, nor do they typically have information about the model validity. Because of the lack of transparency, consumers cannot be assured of the reliability, fairness, or legality of scoring models. Inaccurate, incomplete, and illegal factors may be used today to make decisions about consumers without any oversight or redress.

Credit scores offer a useful model here. Credit scores are based on credit reports. Credit report accuracy has been the subject of substantial, meaningful scrutiny over decades. The CFPB, in its 2012 study on credit reports, noted the significant problems with inaccuracy that occur:

Given the volume of data handled, the challenges of matching tradelines to the correct consumer files, and the number and variety of furnishers, inaccuracies in some credit files inevitably occur. Inaccuracies in credit files and credit reports can occur where information that does not belong to a consumer is attached to his or her file, where information belonging to a consumer is omitted from the file, or where there are factual inaccuracies in trade line or other information in the consumer’s file. Some of these inaccuracies can be attributed to matching challenges in assigning a trade line to a consumer’s file. Other causes of inaccuracies include data and data entry errors, NCRA system or process inaccuracies, furnisher system or process inaccuracies, identity fraud, or time lags.

In a ten-year, Congressionally-mandated study published in 2013, the FTC found that overall “one in five consumers had an error on at least one of their three credit reports.” The FTC found that these credit report errors did impact the credit score. The FTC found that, specifically:

• “Slightly more than one in 10 consumers saw a change in their credit score after the CRAs modified errors on their credit report; and;

• Approximately one in 20 consumers had a maximum score change of more than 25 points and only one in 250 consumers had a maximum score change of more than 100 points.”

Errors in credit scores abound, and credit scores are based on credit reports, which also are subject to significant errors. If a transparent score with few factors has these kinds of errors, what about consumer scores? Consumer scoring relies on dozens, hundreds, or thousands of data elements that have no standards for accuracy, timeliness, or completeness. The quality of data matters: errors in data used to make a score create a score that is not predictive. With thousands of factors, error rates and false readings become a big issue.

Key Issue: Identity Theft and Consumer Scoring

Victims of identity theft – both financial and medical forms of the crime -- may have significant and stubbornly ongoing errors or omissions affecting their scores. ID theft victims can be seriously affected by identity scoring because their identity scores and fraud scores may be incorrect as a direct result of criminal activity. This can cause a range of problems from being denied services to being tagged as a potential fraudster. Yet even this vulnerable group has no right to see or correct many consumer scores.

Key Issue: Unfairness and Discrimination

One of the fundamental policy issues regarding scoring activities is the question of what characteristics it is appropriate to use in scoring consumers. In the world of home loans, ECOA has answered that question. But in the world of direct marketing, this area is nearly without boundaries. In a prescient early critique of scoring policy, Columbia University professor Noel Capon wrote in 1982:

Since prediction is the sole criterion for acceptability, any individual characteristic that can be scored, other than obviously illegal characteristics, has potential for inclusion in a credit scoring system.

As a bewildering plethora of new databases of consumer information become available, these databases may be scored in various ways by being run through one or more scoring models. More databases of consumer information fundamentally can mean more potential scores, and more potential characteristics to score.

The Equal Credit Opportunity Act protects consumers from invidious discrimination in formal credit granting situations. Notably, the ECOA requires that credit scoring systems may not use race, sex, marital status, religion, or national origin as factors comprising the score. The law allows creditors to use age, but it requires that seniors be treated equally. But in the modern consumer scores, marital status – a protected factor under ECOA – is commonly used as a consumer score factor. Consumer scores may also contain underlying factors of race, sex, and religion without disclosure to consumers. In some cases, health factors may also be included in scores, for example, if a person smokes, or has a chronic illness. (See the section on Factors below for an example of a score that incorporates smoking and ethnicity).

As discussed in Part II of this report, a single score is often created from the admixture of more than 600 to 1,000 to even 8,000 individual factors or data streams. These factors can include race, religion, age, gender, household income, zip code, presence of medical conditions, zip code + 4, transactional purchase information from retailers, and hundreds more data points about individual consumers. Therefore, one individual score can have the potential to contain hidden factors that range from bland – like mail order buyer of sports goods -- to quite sensitive – like ethnicity.

A score designed to assess or assign consumer value to a business could easily include factors that would be entirely unacceptable or that, in the context of either the Equal Credit Opportunity Act (ECOA) or the Fair Credit Reporting Act, would be flatly illegal. If ECOA factors are present in consumer scores, in most cases it would be difficult or impossible for consumers to find out if the scoring system or its factors were secret. While carefully directed and controlled use of credit scoring and credit automation has reduced some discriminatory practices, new consumer scoring that uses elements that correlate with prohibited factors such as race can reintroduce discrimination and hide the effects behind a secret or proprietary screen that falls entirely outside of current consumer protection regulations. This is not acceptable.

Key Issue: Sensitive Health and Lifestyle Information and Consumer Scoring

Health scores already exist. This category of score deserves special attention and scrutiny. Some health scores are used in the HIPAA context, some are used outside the HIPAA context. The health scores used outside the HIPAA context are of most concern. Actuaries already use some new consumer scores to underwrite risk, for example, the Brand Name Medicine Propensity Score from a health category and the Underbanked Indicator from the financial category. Scores can contain health information as hidden information within the score, and used for health purposes, or used for non-health related purposes such as marketing, or risk scoring. Many consumers with chronic health conditions would object strenuously to having their financial risk be determined by their health status. While health risk may be very predictive in a score, is it fair to use without consumer knowledge?

Just because a score contains information about a consumer’s health status, it does not mean the score will be subject to the federal health privacy rule (HIPAA). In fact, much of health information available for commercial use outside of the healthcare environment falls outside the scope of HIPAA. HIPAA, for example, provides no consumer privacy rights over health data held by list and data brokers. Health information often leaks outside of HIPAA protections when it is revealed by consumers through surveys, website registrations, and other online activities. After a consumer reveals his or her health information to a non-HIPAA third party, that information is considered out of HIPAA’s bounds. It is in this way that consumers’ most sensitive health information can wind up used as fodder for a consumer score, with unknown consequences.

Consumer scores that use health or other sensitive information such as sexual orientation as factors need close examination for fairness, and consumers need rights over whether their health information is used in predictive scores, whether for marketing or any other purpose.

Key Issue: Consent and Use of Consumer Data in Predictive Scores

If a consumer fills out a registration on a health-related web site or a consumer warranty card that accompanied a purchase, the consumer did not give informed consent that the information can be used in downstream consumer scoring in ways that affect the consumer’s marketplace opportunities. A buried statement in an unread privacy policy that “we may share your information for marketing purposes with third parties” is not informed consent to allow unfettered use information for predictive scoring. Does making a purchase with a credit or debit card at a retailer grant consent for use of a consumer’s purchases and other information to be used in a score? Part II of this report contains a detailed discussion of what kinds of information go into consumer scores. Many individuals would be quite surprised to learn just how the details of their lives are fodder for scores they may never see or have access to – and did not knowingly consent to. The issue of consent becomes increasingly important for scores that affect any kind of eligibility, such as jobs, credit, insurance, identity verification, or other significant opportunities.

Scores Then: A Handful of Factors. ……Scores Now: Thousands of Factors

The research for this report found that consumer scores may rely on hundreds or thousands of pieces of consumer information coming from many different data sources. This report identifies a large roster of raw consumer data that includes demographic information like age, race, gender, ethnicity, and home address as well as religion, mobile phone number, online and offline purchase history, health conditions like Alzheimer’s, diabetes, and multiple sclerosis, as well as intimate financial details such as net worth, card holder information, low or high-end credit scores, money market funds, ages of children, and a great deal more.

Statistical scoring methods rely on the increasing availability of large amounts of new source data from social media, the web in general, and elsewhere. The input for consumer scores can include information that is mostly unobjectionable or public. But, as discussed, consumer scores also can incorporate highly sensitive information that in other contexts could be used in a prejudicial, unfair, or unethical way in making decisions about consumers. Some data, such as social media data, can be unobjectionable in one context, but inappropriate as a factor, for example, in credit decisioning models. An example, and a fairly common one, is of a predictive model that a major US health insurer worked with an analytics company to create. The idea was to determine whether or not publicly available consumer data could enhance the quality and effectiveness of their predictive risk models. They tested approximately 1,500 factors at the household level and found that the consumer information that showed the most value in predicting individual level risk included:

• Age of the Individual

• Gender

• Frequency of purchase of general apparel

• Total amount from inpatient claims

• Consumer prominence indicator

• Primetime television usage

• Smoking

• Propensity to buy general merchandise

• Ethnicity

• Geography – district and region

• Mail order buyer - female apparel

• Mail order buyer - sports goods - Those unfamiliar with predictive models can find it surprising to learn that information about purchasing sporting goods can become a part of a predictive score for a health insurer. But the factors used in this example are not surprising factors to find in a modern predictive consumer score model. This is actually a fairly short list compared to some models with thousands of factors.

The raw source material for the factors fed into consumer scores comes from sources such as:

• Retailers and merchants via Cooperative Databases and Transactional data sales & customer lists.

• Financial sector non-credit information (PayDay loan, etc.)

• Commercial data brokers

• MultiChannel direct response

• Survey data, especially online

• Catalog/phone order/Online order

• Warranty card registrations

• Internet sweepstakes

• Kiosks

• Social media interactions

• Loyalty card data (retailers)

• Public record information

• Web site interactions, including specialty or knowledge-based web sites

• Lifestyle information: Fitness, health, wellness centers, etc.

• Non-profit organizations’ member or donor lists

• Subscriptions (online or offline content) (Part II of the report contains a more complete list.)

Traditionally, much of this data came from data brokers or mailing list sellers. That is still the case, but now many new data streams are now available. So-called big data (large data sets) is one source. Other new data, particularly mobile and social data streams, comes via application programming interfaces (API). Data sets that used to be too large for all but the largest of companies to handle computationally can now be replicated and massaged by smaller firms and dedicated analytics teams within companies. Small analytics companies now compete with large data brokers to offer predictive analytics as well as data. One company states they use 300 billion data attributes in compiling their predictive scores, compiled from 8,000 data files. This is no longer an extraordinary feat, it is competitive and to be expected in a world with large data flows.

Analytics tools will continue to come down in price, just as consumer data has become a commodity item. Widespread and inexpensive data and analytics have the potential to allow broader use of predictive analytics. Consumer scores may proliferate, especially in the absence of any need for accuracy, fairness, or transparency. Consumer scoring may expand just because it is cheap and fashionable. Merchants themselves may have little ability to judge the accuracy of consumer scoring.

In short, given abundant data and more data tools, factors used to create consumer scores could continue to increase. With each new unverified factor comes the risk of extra errors or unfairness due to sensitive or prejudicial or irrelevant factors.

Scoring Methods and Models are Opaque

To create a consumer score, the score modeler feeds raw information (factors about consumers) into an algorithm designed to trawl through reams of data to detect consumer behavior patterns and to eventually sift consumers into a ranking by their scores. Each score generally has a name and predictive or descriptive function. Credit scores are the best-known example of this. With credit scores, information culled from a consumer’s credit bureau file becomes the raw input into a formal credit scoring model. Credit scores are built on credit file data. There is a nexus between the score and the data. The data is intrinsic to the score. The Fair Credit Reporting Act lays out, in concert with the Equal Credit Opportunity Act, a variety of responsibilities and restrictions in the uses of credit report data to use in credit scores. It is a balanced approach, and the Fair Credit Reporting Act remains a strong privacy law that enables Fair Information Practices for consumers.

Today, though, scoring models are easily built from data that is extrinsic to the final score. No nexus may exist between the input to a score and the output. In the financial scoring area, companies can now build financial scores from social media, demographic, geographic, retail purchase history, and other non-traditional information that may not be included in the formal credit file. In the health arena, analysts can now build health risk scores from mere wisps of demographic data, without any actual patient records. In this is a new world of scoring, where analysts use factors extrinsic to the purpose of the score to build scores, that a person has red hair can be used as a factor. And the more factors, the better. Instead of using 30 factors, why not 3,000?

The use of credit information for pricing insurance risk is an example of this. Statisticians and actuaries predict the cost of providing car or homeowners insurance using selections of credit report factors about a driver or homeowner. These insurance scores reportedly have a predictive capability. Yet there is no overt reason why credit worthiness correlates with the risk involved with driving safety. There is much controversy about the use of a statistical correlation that does not appear to be causal. Some states restrict the use of credit information for insurance, but the practice remains common.

Many of the consumer scores discussed in Part III are new classes of scores. When scores have hundreds and thousands of factors, it stands to reason that a causal link becomes much more tenuous. The more factors, the less casual the link may be. Risks associated with models are discussed in Part II of the report.

Examples and Numbers of Consumer Scores

Consumer scoring is growing. In 2007, the research for this report uncovered less than 25 scores. In 2014, the research uncovered hundreds of scores, with the strong likelihood that thousands of custom scores exist beyond our ability to confirm them. Here are some examples of consumer scores: Consumer profitability scores predict, identify, and target marketing prospects in households likely to be profitable and pay debt. The Job Security Score claims to predict future income and capacity to pay. Churn scores seek to predict when a customer will move his or her business or account to another merchant (e.g., bank, cell phone, cable TV, etc.) The Affordable Care Act (ACA) health risk score creates a relative measure of predicted health care costs for a particular enrollee. In effect, it is a proxy score for how sick a person is. The Medication Adherence Score predicts if you are likely to take your medication according to your doctor’s orders. Brand Name Medicine Propensity Score – will you be purchasing generics or brand name medications? Fraud Scores indicate that a consumer may be masquerading as another, or that some other mischief is afoot. These scores are used everywhere from the Post Office at point of sale to retailers at point of sale to behind-the-scenes credit card transactions. This is a very widely used score, and a number of companies compete in the fraud score area. Part III of the report discusses these and other specific scores in detail.

Uses of Consumer Scores, Regulation, and Modern Eligibility

After a consumer is scored, ranked, described, or classified, companies, governments, private enterprises, health care entities, and others including law enforcement, can then use the resulting score to make decisions about an individual or group. This is why scores impact consumers every day.

Scores are gaining footholds as part of routine business processes for an expanding number of purposes for everything from marketing to assessing a person’s identity to predicting a person’s likelihood to commit fraud, and more. The consumer score acts as a form of predictive evaluation to measure, predict, and generally facilitate making a decision about things such as an individual’s:

• Credit worthiness, • Popularity, • Reputation, • Wealth, • Propensity to purchase something or default on a loan, • Measure health, • Measure/predict likelihood to commit fraud, • Measure/predict identity • Measure/predict energy consumption • Job success probability • Etc.

In the traditional credit score realm, some have argued that scoring is a foundational activity in the credit market, as well as a wholly positive factor. Others have said that the sub-prime meltdown of the late 2000’s was fueled by overreliance on scoring products. Some of the reasons for using credit scores have the potential to be helpful directly to consumers. Better and faster credit decisions help consumers, for example.

In new consumer scoring, some have argued that the scores are mainly just for marketing and are largely beneficial. There can be potential benefits for consumers, For example, consumer risk scores that prevent fraud are helpful up to a point. But any potential benefits are real only if the scoring models are correct and non-discriminatory, the data is timely, and the scores are something that consumers want. Credit score regulation provides transparency and imposes some limits on use and construction. That offers some assurance to consumers. But when other consumer scores enter the marketplace without transparency or the limits that apply to credit scoring, consumer benefits are much more uncertain, and unfairness is more likely.

There is continuum of concern regarding consumer scores. Some scores are used for straightforward marketing purposes. These scores may be of less concern (however the fairness of factors and secrecy and validity are still a concern). Of greater concern are the consumer scores that are used for what we call “modern eligibility.” This includes identity verification and fraud assessment scores, as well as credit decisioning scores and scores that are used to predict job success or decide between job applicants. These scores are especially worrisome because errors in these scores could lead to significant deleterious consumer impacts.

Whether a consumer receives a coupon for a free soda is not a big deal. In comparison, whether a consumer can complete a transaction is of significant consequence. Any score used for eligibility – like being approved for credit or a job -- becomes important. The most casual social scores meant just to measure social reach have on occasion been used as a criterion for judging applicant hiring qualifications, so all scores need to be explored and assessed.

Some scores –for example, aggregate credit scores not subject to the FCRA – can determine a neighborhood’s general credit score or range. Opportunities for individuals living in that neighborhood will be affected in ways that they cannot anticipate and in ways that bear no relationship to their personal situation. Forms of redlining – the practice of turning someone down for a loan or insurance because they live in an area deemed to be high risk – is a threat in these situations.

By all appearances, consumer scoring has sped beyond the old constraints that were imagined in a largely analog era, and real consumer harms can be the result.

Deja Vu: Why the History of the Credit Score is Important

History is repeating itself with consumer scoring. Before secret predictive consumer score issues, there were secret credit score issues. Credit scores had many of the same problems: secrecy, unfairness, inaccuracy, and opacity. Part IV of the report contains a detailed history of the credit score, including how that score became public and how consumers got important rights regarding credit scores and reports. In brief here, credit scores were unknown to most consumers through the 50s, 60s, 70s, and 80s. Trickles of a score that was not disclosed to consumers but that could be used to deny a person credit began to leak out slowly to some policymakers, particularly around the time ECOA passed. In May 1990, the Federal Trade Commission failed to protect consumers when it wrote commentary indicating that risk scores (credit scores) did not have to be made available to consumers. But when scoring began to be used for mortgage lending in the mid 90s, many consumers finally began hearing about a “credit score,”  many of them for the first time, and mostly when they were being turned down for a loan. A slow roar over the secrecy and opacity of the credit score began to build. By the late 90s, the secrecy of credit scores, the underlying methodology or factors that went into the score, and the scoring range became a full-blown policy issue. Beginning in 2000, a rapid-fire series of events – particularly the passage of legislation in California that required disclosure of credit scores to consumers – eventually ended credit score secrecy. Now, credit scores must be disclosed to consumers, and the context, range, and key factors are now known. This is an example of how brave State privacy legislation serves as a model for state and federal policy makers. In this case, the US “laboratory of democracy” took state legislation and turned it into a federal rule that protects consumers everywhere.

Credit scores are no longer secret anywhere in the United States, and this was and still is the right policy decision. Why are other scores used for important decisions about consumers still secret? Why do score factors and numeric ranges remain secret, when the risk of the data comprising the score of a factor used in modern eligibility practices such as identity verification or fraud identification is very high?

Consumer scores stand today where credit scores stood in the 1950s: in the shadows. While there are some happy exceptions to this, such as most social scores and a few other consumer scores, most consumer scores are not available for consumers to see. As a result, consumers have little to no ability to learn when their lives are affected in a major or minor way by a consumer score that they never heard about. Credit scores are not perfect and still present some issues, but we have learned much from the credit score. What we have learned most of all is that there should be no secret consumer scores and no secret scoring factors. If a score is being used in any meaningful way in a consumer’s life, he or she needs to know about it and have some choices regarding that score.

 Historically, some known consumer issues with the credit score include the following:

• Credit scores reflect inaccuracies in the credit reports they are based on, and credit reports have repeatedly been found to contain errors. • Victims of ID theft can experience changed credit scores. • Consumers who experience major life events such as medical events or divorce can pay a long price in the scoring world. • The FTC has brought cases around “mission creep” in the use of credit score outside of its regulated uses. (Credit scores may only be used for firm offers of credit or insurance, not for general marketing use.)

Findings by the authors are as follows -

Consumer scores are expanding in type, number, and use because of the growth of predictive analytics and the ready access to hundreds and thousands of factors as raw material. Just as credit scores were secret for decades until state and federal legislation mandated that consumers could see their credit scores, today consumer scores are largely secret. While new scores multiply, consumers remain in the dark about many of their consumer scores and about the information included in scores they typically don’t have the rights to see, correct, or opt out of. A primary concern is how these scores affect individuals and meaningful opportunities available to them. Another area of concern is the factors used in new consumer scores, which may include readily commercially available information about race, ethnicity, religion, gender, marital status, and consumer-reported health information.

This report’s other key findings are:

• Unregulated consumer scores – as well as regulated credit scores – are both abundant and increasing in use today.

• The information used in consumer scores comes from a large variety of sources. Some scores use thousands of factors or consumer attributes.

• Many consumer scores, the ranges of the scores, and the factors used in them are secret.

• A consumer score may, without any public notice, rely on an underlying factor or attribute that has discriminatory implications (e.g., race or gender) or that most consumers consider sensitive (e.g., health or financial).

• Consumer scores in use today affect a consumer’s marketplace opportunities. Some of these opportunities are major (e.g., financial, employment, health,), some are minor (e.g., receiving a coupon, spam, or junk mail), and many are in between. Consumers are adversely affected by scores that are kept secret, and consumers are adversely affected when they do not have rights to correct scores.

• Consumer scores are found in a wide array of “offline” arenas, including businesses, health care providers, financial institutions, law enforcement, retail stores, federal and state government, and many other locations. Some of the more social consumer scores may be online, but mostly consumer scores are not solely focused on just online activities.

• Consumers usually have no way to know what the scores predict or how the scores are used.

• Consumers typically have no notice or knowledge about the data sources used in scores predicting their behavior or characterizing them. Consumers typically have no rights over the data about themselves, and consumers usually have little to no ability to control use of the data.

• Consumers typically do not have the right to opt out of being the subject of a consumer score or to prevent use of a consumer score.

• Except where the Fair Credit Reporting Act applies to a consumer score, most consumer scores are not subject to any regulation for privacy, fairness, or due process. A lack of transparency makes it difficult or impossible to determine if creation or use of the scores violates a law that prohibits discrimination.

• Consumers who are victims of identity theft can have their credit or consumer scores affected thereby and may have little recourse even though errors may have major consequences for their ability to function in the economic marketplace can be major. Other consumers can also have their lives affected by the use of consumer scores to determine eligibility for important opportunities in the marketplace. Some consequences may be less significant.

• Consumers have remedies under state and federal law with respect to correcting and seeing their credit reports, but not necessarily with respect to the many records that contribute to consumer scores. Secret consumer scores do not provide consumers with correction rights of underlying information.

 The report offers several Key Recommendations, commenting that

Consumer scoring is not inherently evil. When properly used, consumer scoring offers benefits to users of the scores and, in some cases, to consumers as well. Some uses are neutral with respect to consumers. Consumer scores can also be used in ways that are unfair or discriminatory. The goal of these recommendations is to protect the benefits of consumer scoring, guarantee consumer rights, and prevent consumer harms.

• No secret consumer scores. No secret factors in consumer scores. Anyone who develops or uses a consumer score must make the score name, its purpose, its scale, and the interpretation of the meaning of the scale public. All factors used in a consumer score must also be public, along with the nature and source of all information used in the score.

• The creator of a consumer score should state the purpose, composition, and uses of a consumer in a public way that makes the creator subject to Section 5 of the Federal Trade Commission Act. Section 5 prohibits unfair or deceptive trade practices, and the FTC can take legal action against those who engage in unfair or deceptive activities.

• Any consumer who is the subject of a consumer score should have the right to see his or her score and to ask for a correction of the score and of the information used in the score.

• There are so many consumer scores in existence that consumers should have access to their scores at no cost in the same way that the law mandates credit reports be available at no cost, as mandated by Congress. Otherwise, if a consumer had to pay only one dollar for each meaningful score, a family could easily spend hundreds or thousands of dollars to see the scores of all family members.

• Those who create or use consumer scores must be able to show that the scores are not and cannot be used in a way that supports invidious discrimination prohibited by law.

• Those who create or use scores may only use information collected by fair and lawful means. Information used in consumer scores must be appropriately accurate, complete, and timely for the purpose.

• Anyone using a consumer score in a way that adversely affects an individual’s employment, credit, insurance, or any significant marketplace opportunity must affirmatively inform the individual about the score, how it is used, how to learn more about the score, and how to exercise any rights that the individual has.

• A consumer score creator has a legitimate interest in the confidentiality of some aspects of its methodology. However, that interest does not outweigh requirements to comply with legal standards or with the need to protect consumer privacy and due process interests. All relevant interests must be balanced in ways that are fair to users and subjects of consumer scoring.

• The FTC should continue to examine consumer scores and most especially should collect and make public more facts about consumer scoring. The FTC should establish (or require the scoring industry to establish) a mandatory public registry of consumer scores because secret consumer scoring is inherently an unfair and deceptive trade practice that harms consumers.

• The FTC should investigate the use of health information in consumer scoring and issue a report with appropriate legislative recommendations.

• The FTC should investigate the use of statistical scoring methods and expand public debate on the proprietary and legality of these methods as applied to consumers.

• The Consumer Financial Protection Bureau should examine use of consumer scoring for any eligibility (including identity verification and authentication) purpose or any financial purpose. CFPB should cast a particular eye on risk scoring that evades or appears to evade the restrictions of the FCRA and on the use and misuse of fraud scores. If existing lines allow unfair or discriminatory scoring without effective consumer rights, the CFPB should change the FCRA regulations or propose new legislation.

• The CFPB should investigate the selling of consumer scores to consumers and determine if the scores sold are in actual use, if the representations to consumers are accurate, and if the sales should be regulated so that consumers do not spend money buying worthless scores or scores that they have no opportunity to change in a timely or meaningful way.

• Because good predictions require good data, the CFPB and FTC should examine the quality of data factors used in scores developed for financial decisioning and other decisioning, including fraud and identity scores. In particular, the use of observational social media data as factors in decisioning or predictive products should be specifically examined.

• The use of consumer scores by any level of government, and especially by any agency using scores for a law enforcement purpose, should only occur after complete public disclosure, appropriate hearings, and robust public debate. A government does not have a commercial interest in scoring methodology, and it cannot use any consumer score that is not fully transparent or that does not include a full range of Fair Information Practices. Government should not use any commercial consumer score that is not fully transparent and that does not provide consumers with a full range of Fair Information Practices.

• Victims of identity theft may be at particular risk for harm because of inaccurate consumer scores. This is a deeply under-researched area. The FTC should study this aspect of consumer scoring and try to identify others who may be victimized by inaccurate consumer scoring.