Are They Actually Any Different? Comparing Thousands of Financial Institutions Privacy Practices

Transcription

1 Are They Actually Any Different? Comparing Thousands of Financial Institutions Privacy Practices Lorrie Faith Cranor Kelly Idouchi Pedro Giovanni Leon Manya Sleeper Blase Ur

2 Background Gramm-Leach-Bliley Act (1999) Annual privacy disclosures 2

3 Background Gramm-Leach-Bliley Act (1999) Annual privacy disclosures Notices have been formatted in various ways and as a result have been difficult to compare, even among financial institutions with identical practices 3

4 Comparing Policies 4

5 Comparing Policies 5

6 Standardized Notice Eight federal agencies jointly released a model privacy form (2009) Two pages Optional, but widely adopted Safe harbor 6

7 Model Privacy Form 7

8 Data Collection FDIC directory of 7,072 institutions Download top 10 results for Google query: Restrict to institution s web domain 8

9 Data Extraction Convert HTML or PDF to text Regular expressions (pattern matching) Structure of document Manual verification: 90%+ accurate per section on a random sample of 50 policies 9

10 We compared 3,422 financial institutions privacy and data-sharing practices 10

11 We compared 3,422 financial institutions privacy and data-sharing practices Creative commons: Jeff Adair, 11

12 With Whom is Information Shared? 12

13 With Whom is Information Shared? 13

14 With Whom is Information Shared? 14

15 For What Reasons? 15

16 For What Reasons? 16

17 For What Reasons? 17

18 For What Reasons? 18

19 For What Reasons? 19

20 For What Reasons? 20

21 Comparing Competitors Creative commons: Jeff Adair, and Edo, 21

22 Comparing Competitors Creative commons: Jeff Adair, and Edo, 22

23 Comparing Competitors 23

24 Comparing Competitors Forbes list of the 100 largest banks J.D. Power credit card satisfaction survey 24

25 Comparing Competitors Forbes list of the 100 largest banks J.D. Power credit card satisfaction survey We again found differences in practices Opportunity for consumer privacy choice 25

26 For What Reasons? 26

27 For What Reasons? (Largest) 27

28 Comparing Credit Cards Institution Capital One, Chase, Discover, HSBC Bank of America, Citi Our everyday Our marketing Joint marketing Affiliates- Trans. Affiliates- Credit. Affiliates' Marketing Nonaffiliates' marketing Am. Ex. Barclays GE Capital U.S. Bank Wells Fargo 28

29 Logistic Regressions Dependent variable: {Share, Do not share} Independent variables: assets, state, specialization, regulator, etc. 29

30 Logistic Regressions Dependent variable: {Share, Do not share} Independent variables: assets, state, specialization, regulator, etc. Significant factors included: OCC district (geographic location) Number of offices Member or not of a bank holding company 30

31 Opt-Out Mechanisms , phone, postal mail, website 69.1% of institutions did not offer a computer-based opt-out 32.6% offered only a phone opt-out 31

32 What Info is Collected, and How What: 24 options, SSN + choose exactly 5 How: 34 options, choose exactly 5 32

33 What Info is Collected, and How What: 24 options, SSN + choose exactly 5 How: 34 options, choose exactly 5 The most commonly used terms were the examples listed in the model 33

34 Curiosities Encountered Self-contradictory statements (15) 34

35 Curiosities Encountered Self-contradictory statements (15) 35

36 Curiosities Encountered Self-contradictory statements (15) 24 institutions appear to be violating the Fair Credit Reporting Act (FCRA) Not providing required opt-outs 36

37 Conclusions and Future Work Institutions are actually different Largest institutions have the worst practices Opportunity for consumer privacy choice Plan to build a web database and make annotated consumer lists Model privacy form prohibits companies from making complete disclosures 37

38 Are They Actually Any Different? Comparing Thousands of Financial Institutions Privacy Practices Lorrie Faith Cranor Kelly Idouchi Pedro Giovanni Leon Manya Sleeper Blase Ur