Personal data up for sale for just 5 paise

Personal data up for sale for just 5 paise

Chandrima.Banerjee@timesgroup.com

02.07.2020

Where you live, how much you make, which mail ID you use more often — unknown to you, your personal information is being mined from companies and apps by data brokers. And it’s feeding a growing Covid data industry, which can pass on your health data to advertisers, insurance companies and hospitals.

“It’s a very disturbing trend. Covid has come at a time of increased digital adoption… But premised on the vulnerability of people, data brokers have gathered large amounts of personal data, including healthcare data,” Apar Gupta, executive director of the Internet Freedom Foundation, told TOI.

It’s all legal though. The process starts with a basic database of personal details. When TOI approached a primary data broker, five samples were shared with data about 3,855 individuals. Another data broker came back with a sample sheet of 690. And the full database? “1 lakh data cost you Rs 5k,” the broker wrote back. About 5p per person. But how much of it is legit? TOI called up some of the numbers on the sample lists. The records matched. “Even my residence address is correct,” said one of them, who was alarmed his personal information was up for sale. These datasets, privacy experts said, often come from employees in sectors that have large customer databases — like credit, banking, car dealerships or hospitals — and are largely accurate.

The next step is to track location and purchases. That can be done with SDKs, software development kits, which are small tools that app developers can add to cover a function. But location SDKs can, and are sometimes required to, relay information without adding functionality. VenPath, for instance, pays app developers to use its SDKs in exchange for user data. “We love some location data… The best way to collect it is every minute in the foreground and every 5 minutes in the background… The SDK grabs everything it needs,” VenPath says in its permissions section. For purchase history, there is the Mobile Advertiser ID, assigned to every device by operating systems. It creates a buyer profile by tracking purchases, searches and movement. So if someone stops at a pharmacy and later searches for “Covid symptoms”, data gatherers know where things are headed before their doctor does.

But the data from multiple points needs to be put together and processed. This is where Covid data brokers come in. One Covid data broker, for instance, offers something called a “Covid Graph” and says it can “acquire” the device ID of a person who tests positive (without saying how it will know who tested positive) and track them. Another offers to analyse the impact of Covid-19 on spending patterns. “Medical data can lead to a form of profiling that can be very invasive. It can be commercially utilised without their consent by insurance companies, for instance, which opaquely price premiums, or by hospitals,” Gupta said. “One cannot estimate the amount of money which is flowing through it.”

Covid data brokers are passing on health data to advertisers, insurance companies & hospitals