The UK government is seeking expert insight into the data brokerage industry and the potential security risks it could bring to the foray as new data protection laws move through parliament.

Data brokers – companies that collect personal data and sell these datasets to other firms that can then use them for targeted marketing and or sales – have seen themselves in the spotlight more and more as the public becomes evermore conscious that their everyday interactions with the world wide web are a sought-after commodity.

“The UK government is seeking views to understand more about organizations that take part in data broking and the wider industry,” the Department for Science, Innovation, and Technology said. “In particular, the government would like to understand the operations, security practices, and customers of data brokers, to support policy development.”

Any and all organisations involved in the process of data brokerage – those that use the services, supply the data, as well as brokerages themselves, have been invited to give evidence to DSIT about the practice and any security concerns that may arise from it.

Those outside of its direct realm, including academics and public advocacy groups, are also able to share their views.

DSIT’s concerns seem reasonable, considering the amount of data these brokers hold make them a tantalising target for cyber-criminals.

Their often lacklustre approach to security has also led to a number of leaks – National Public Data, based in Florida, faced a data leak last year that affected 1.3 million people. Another US-based data broker, Gravy Analytics, which often sells location-based data, faced a breach this year, with cyber-criminals claiming to have stolen 17TB of data.

With the UK’s Data (Use and Access) Bill (DUAB) going through the legislative process, it makes sense that the UK is taking note of the data brokerage’s potential as a data security liability

The new bill posits itself as a more business friendly alternative to previous data protection legislation, though it maintains to uphold the same level of data protection and security as GDPR.

Recommended reading

• ICO Publishes Draft Guidance on Biometric Data Use in the UK
• UK Gov Introduces New Data Use and Access Bill
• Police Could Use Driving License Data for Facial Recognition in New Bill

In trying to tow this fine line, the new bill is proposing the creation of data intermediaries which would enable the sharing of data via smart data schemes, acting as a third party between involved organisations.

DSIT has explained that data intermediaries differ from data brokers in a key way, as data intermediaries facilitate the sharing of data that a subject would like to share, whereas a data broker does not “rely on the agreement of the individual (the data subject) and act in their interest” in the same way a data intermediary should.

The current inquiry therefore mainly focuses on possible security concerns arising in the data brokerage industry, and how this may affect national security

Interested parties may share their insights with DSIT until 12 May.