For Sale: Your Personal Data--Cheap, Easy, Online

Looking for the names and home telephone numbers of affluent elderly women who are unmarried and live in Leisure World?

How about a list of Brentwood bachelors under age 40 who have owned their homes for at least 10 years?

Or perhaps you’d like to know if any of your neighbors dabble in gambling, are big spenders or have recently made investments?

Such personal information, once accessible only at a hefty price through specialty marketers or brokers, is increasingly available on the Internet to virtually anyone with a mouse and credit card.

In recent months, some of the world’s largest gatherers of consumer marketing and demographic information, including Experian and InfoUSA, have quietly started selling lists of names, addresses and phone numbers of as many as 120 million U.S. households. The data include such personal information as estimated income, marital status, buying habits and hobbies.

It’s what privacy advocates have feared for years: financial and lifestyle information about consumers, compiled from dozens of scattered public and private sources, merged into giant databases and plopped onto the Internet where it can be downloaded quickly, easily and cheaply.

That list of ladies at Leisure World with annual incomes above $75,000 cost just $11.75 at Experian’s List OnLine Web site. At InfoUSA’s https://www.listbazaar.com, $19 buys the names, estimated incomes and hobbies of 26 Beverly Hills residents who enjoy travel and live in homes worth more than $600,000.

After a simple registration, ClickAction Inc.’s https://www.myprospects.com gives customers list selections from 26 defined “behavior screens,” including people who are saving for retirement, single parents or those considered to be “quiet homebodies.”

Although none of these Web sites allows users to simply plug in a name and obtain a detailed profile of that individual, privacy advocates worry that these online list services and others like them could put sensitive personal information into the hands of scam artists, stalkers or identity thieves. Boiler rooms, for example, have long used marketing lists to prey on affluent or vulnerable people.

“By putting these databases on the Internet, it opens the information to people with dishonest intentions or to just casual snooping,” said Beth Givens, executive director of the Privacy Rights Clearinghouse, a consumer group in San Diego. “It’s an invitation to abuse.”

Some Question Ability to Control Data Sales

Information companies insist they have put consumer safeguards in place. But the increase in online marketing databases is almost certain to intensify the debate over the sale and availability of personal information on the Internet.

Although marketing lists have been actively peddled for years, buying them was burdensome and generally costly. List brokers kept a low profile, operated chiefly by mail or telephone and often sold names in bulk by the thousand, for hundreds or thousands of dollars.

With the Internet, access has never been cheaper or easier. By permitting users to conduct self-service searches online, companies have been able to fill orders that previously were too small to be profitable. And that makes privacy advocates very nervous.

“When you make information available online, it’s available to people under anonymous circumstances,” said Robert Ellis Smith, editor of Privacy Journal in Rhode Island. He added that the Internet makes it more difficult to verify the identity of Web site users or to ensure that the information is being used properly. “It is really beyond the control of the company,” Smith said.

Not so, says Experian, which launched its List OnLine last fall. Experian requires users to provide a name and matching Social Security number before it will open up its database. Experian will not sell any lists of fewer than 50 names. And lists can be bought only with a credit card, another method of identifying the purchaser.

Officials at Experian, which owns one of the nation’s top three credit bureaus, also say that none of the information on the lists is derived from consumer credit reports. Those reports include such details as a person’s credit card balances and how faithfully outstanding bills are paid.

“The security of the data is the most important issue to us,” said Marty Abrams, the in-house privacy expert at Orange-based Experian, which claims its consumer information database includes 95% of all U.S. households.

Credit reports are legally protected and may be accessed only by legitimate creditors, potential creditors or other qualified users. But regulators and privacy experts worry that some information companies--eager to improve the accuracy of their marketing databases and boost their sales--might be tempted to dip into protected credit files.

U.S. Has Limited Enforcement Powers

In one widely watched case, the Federal Trade Commission is suing Trans Union Corp., alleging that the Chicago-based credit bureau crossed the line in selling certain data from its credit files to marketers. Trans Union, which does not sell marketing lists online, is fighting back, denying that the information it released was protected.

Government regulators say they have limited enforcement powers over the sale of marketing lists online.

“Unless companies are using consumer credit reports, we don’t have express authority,” said Peggy Twohig, assistant director for financial practices at the FTC.

Marketing lists, which include details ranging from consumers’ ethnicity to their preference in toothpaste, are compiled largely from government records, census data, real estate deeds, marketing surveys and warranty cards.

“Most of this is public information,” said Rakesh Gupta, who heads the e-commerce division of InfoUSA, an Omaha-based database giant that sells information on 200 million Americans and 12 million businesses. “A lot of the information is self-reported by the consumers themselves.”

Atlanta-based Equifax, another of the big three credit bureaus, says it does not currently sell marketing lists online, though Myprospects.com relies on the database of Polk Consumer Information Services, which Equifax acquired this year.

Acxiom Corp., another major consumer information company, sold lists online until last month, when the company brought down its Web site, citing technical problems.

By allowing online access to their databases, information vendors say they are simply offering a new way for clients to buy the same customer-prospect lists they have sold for years.

Still, privacy proponents have long complained that most consumers do not realize that the information they write down on a product registration card will end up in one of the large online databases. What’s more, the information in those demographic files has become just as sensitive as credit reports because they combine data from various sources to create an intimate portrait of a consumer, said Jason Catlett, president of JunkBusters, a New Jersey-based advocacy group.

When Personal Data Get in Wrong Hands

As an example of the kind of harm such marketing databases can cause, Catlett pointed to the high-profile case of Beverly Dennis, an Ohio woman who sued information database supplier Metromail Corp. in the mid-1990s. Metromail had been using prison labor to type warranty cards and consumer surveys into its database. One convicted rapist used details gleaned from Dennis’ file to send her a sexually explicit and threatening letter, containing such intimate details as what kind of bath soap she used.

Dennis’ suit was settled and Metromail was acquired in 1998 by Experian. The company no longer uses prisoners for data entry.

Experian, InfoUSA and ClickAction all include legal language on their Web sites requiring users to check a box agreeing that they will not misuse the data or violate any laws. But critics say these online promises do little to dissuade potential con artists.

InfoUSA, which started in March, does not verify that users have supplied their real names, although the company restricts access to certain types of “sensitive data,” including marital status, credit card information, gender and ethnicity. Such information can be bought online only after speaking with an InfoUSA customer representative and providing a sample of the proposed direct-mail piece, officials said.

Database companies also say their online list services may not be used to build a profile on a particular individual by name. Rather, the Web sites allow users to create lists based on a variety of criteria, including ZIP Codes, estimated income, home values or lifestyle interests.

At InfoUSA, however, the list can be as short as one name.

For example, by narrowing a search, it was possible to buy this wealth of data about a certain individual in Redondo Beach: 33 years of age; earns between $70,000 and $75,000 a year; owns a duplex worth $275,000; has lived there for seven years; likes pets; doesn’t give much to charity; is interested in health and fitness; and buys things by mail, including electronic goods.

The cost for all that information: one dollar.

“You shouldn’t be able to buy a list of one,” the Privacy Rights Clearinghouse’s Givens said. “Why would any legitimate marketer want a list with just one name?”

Officials at the Direct Marketing Assn., a trade group representing Experian, InfoUSA and other information and marketing companies, say they are reviewing the trend toward making marketing databases available online. But so far, the group has not developed any guidelines regarding access or security, according to spokesman Stephen Altobelli.

In the meantime, information vendors say that consumers who wish to have their names and personal information removed from marketing lists can do so by contacting each company directly or by writing to the Direct Marketing Assn.

According to the trade group, about 15% of U.S. consumers have done so, a percentage that privacy experts say reflects the public’s unawareness of how to opt out of such lists.

(BEGIN TEXT OF INFOBOX / INFOGRAPHIC)

Regaining Your Privacy

* Mail: Consumers cannot remove their names and personal information from marketing databases, but they can limit the release of such information by contacting the Direct Marketing Assn. To be removed from most direct-mail lists, send your name, home address and signature in a letter or on a postcard to Mail Preference Service, Direct Marketing Assn., P.O. Box 9008, Farmingdale, NY 11735-9008.

* Phone calls: To opt out of receiving telemarketing calls, register with the group’s do-not-call list by sending your name, home address, home telephone number (including area code) and signature in a letter or on a postcard to Telephone Preference Service, Direct Marketing Assn., P.O. Box 9014, Farmingdale, NY 11735-9014.