Source – theguardian.com

Equifax, one of the largest credit reporting agencies, revealed on Thursday that it was hacked back in May, exposing the personal data of up to 143 million people. The data accessed by hackers contains extremely sensitive information like social security numbers, birth data, consumer’s names, driver’s license numbers and credit card numbers.

This breach is a monumental failure of cybersecurity, which raises many pressing privacy concerns. However, beyond those issues, it also illustrates a fundamental problem of the data economy as a whole: databanks like Equifax are too big.

Consumer credit agencies like Equifax are part of the multi-billion dollar data broker industry, which is based on collecting, analyzing, and selling thousands of data points about individual people. They paint a detailed picture of a person’s life and that profile is used to make decisions with direct impacts on, as I have written elsewhere, “many facets of our lives, from obtaining a loan to finding a job to renting a home.” As a company adds to its hoard of data, the value grows exponentially; so, the imperative for data brokers is to continuously accumulateas much data as possible.

As epic as Equifax’s hack was, things can get a lot worse. The credit reporting agencies Experian and TransUnion are data giants on par with Equifax and there are thousands of other data brokers that also possess large databanks. Data breaches like this one are not bugs, but rather features of a system that centralizes immense amounts of valuable personal data in one place.

The vaults of these databanks are impossible to secure, in large part, because the wealth of information they hold is a beacon for hackers. Even the most impenetrable cybersecurity will eventually fail under the pressure of dogged hackers probing for weaknesses to exploit. Better cybersecurity is important, but it is not a solution. It only postpones catastrophic failure.

Indeed, after the hack of infidelity website Ashley Madison in 2015, security experts warned of an event exactly like the Equifax hack – one that would make Ashley Madison “look like a footnote by comparison”. Rather than focus on cybersecurity, we need to ask critical questions about the very structure and operation of the data economy.

No longer can these companies be allowed to exist in the shadows quietly sucking up alarming amounts of data about people. Data is often called the “new oil” and a new “kind of capital” because it generates huge profits for a fast-growing industry. Rather than simply laugh off these metaphors, we should take a cue from them and treat Big Data with the same wariness we direct toward Big Oil and Big Finance.

In terms of power and wealth, the data capitalists are already usurping the oil barons and hedge fund managers, as Olivia Solon and Sabrina Siddiqui report. “It used to be banks, but now it is tech giants that dominate the US lobbying industry.”

It is time we treat Big Data with the skepticism, vigilance, and oversight it deserves. In 2014, the Federal Trade Commission released a report calling for more transparency and accountability in the data broker industry. If anything, the Equifax hack shows that this tepid approach does not go far enough. It is hard to see how transparency and accountability would have prevented the hackers’ heist.

The problem is that companies like Equifax are able to accumulate – essentially, without limit – as much sensitive, personal data as they can get their hands on. There is an urgent need for strict regulations on what types of data companies can collect and how much data a company can possess, both in aggregate and about individuals.

At the very least, this will lessen the severity and size of (inevitable) data breaches. It could also go a long way towards preventing the invasive and discriminatory uses of data – like “digital redlining” – that endemic in the data broker industry.

Without putting hard limits on the data capitalists who extract and exploit our personal information, they will continue to reap the benefit while we bear the risks.