吃瓜大本营

Yesterday, we published a piece on cashless stores and how they are bad for low-income communities, undocumented people, and many merchants 鈥� and for privacy. In this post, we take a closer look at the privacy problems with electronic payment systems such as credit cards.

Simply put, cash is good for keeping people from prying into our lives, and credit cards are not. That starts with the stores and restaurants where we use them. When we use a credit card to buy something, the seller can learn our first and last name, which, combined with a zip code (either requested at the register or guessed at, since most transactions take place near where people live), can be used to learn a lot more about us. Using 鈥溾�� services, the merchant may then be able to acquire our email and postal addresses and our telephone number. That, in turn, permits a merchant to tap into the databases of the giant industry and learn anything from demographic information to our employment, marital, and homeownership status to our interests and hobbies and even our medical conditions. A retailer may also add our personal data, including purchases, into a 鈥渄ata cooperative鈥� where it will become available to all the other participating companies as well.

It is true that there are other ways for merchants to track people and their purchases, including those made with cash 鈥� from loyalty programs to Bluetooth tracking to face recognition. It is also theoretically possible that cash could be tracked using serial number readers, but we know of no existing infrastructure for doing that. Cash is not a guarantee of privacy, but it is still far more privacy-protective than credit cards.

A big reason that electronic payment systems threaten privacy is that they introduce a middleman. When a middleman becomes part of the process, that company often gets to learn about the transaction 鈥� and under our weak privacy laws has a lot of leeway to use that information as it sees fit.

The primary middlemen in most non-cash transactions today are the oligopolistic credit card companies (Visa has around 60% of the credit and debit card market, MasterCard has 25%, American Express 13%, and Discover 2%). Mobile apps such as Apple Pay, Venmo, and Square are also gaining a foothold.

But, regardless of who plays that role, Congress has bent to the will of the financial industry and refused to enact adequate privacy protections. In 1999, Congress passed the Gramm-Leach-Bliley Act (GLB). Although it has often been described as a 鈥渇inancial privacy law,鈥� Gramm-Leach created nothing more than . The real effect of the law, which manages to be both extremely and weak, has been to ratify the abandonment of customer privacy by an industry (banking) that, once upon a time, prided itself on discretion:

• Under GLB, companies can sell their customers鈥� financial data to anyone they choose, including credit card information such as the date, amount, and recipient of charges, and the personal details consumers provide when they fill out applications. Consumers have no privacy under unless they affirmatively take steps to 鈥渙pt out鈥� of this sharing, repeating the process for each and every financial service provider who may have data about them. (Personally, I鈥檝e found that opting out with a credit card issuer, which should be made easy, is like pulling teeth.) That means these companies could be collecting a vast amount of detail about our lives: how much we spend on travel, restaurants, political or religious donations, liquor stores, sex shops, and on and on. And of course, that kind of information is more powerful and revealing when combined with other data.
• Even this opt-out option is not available for consumers to stop credit card companies and issuing banks from sharing this data with their financial affiliates and financial 鈥渏oint marketers,鈥� a vaguely defined term that provides a giant loophole in privacy protections.
• Nor do consumers get the transparency they should as to how their information is being shared. Companies are required to provide 鈥減rivacy notices,鈥� but they don鈥檛 have to reveal the specific information that they share with third parties, or the names of those parties 鈥� only the categories of information they share and the categories of organizations shared with. When the journalist Kashmir Hill tried to find out what was being done with her Amazon/Chase credit card data, both companies basically . The impossible number of click-through contracts we鈥檙e swamped by online makes these notices just part of a wave of fine print and even less meaningful.

In 2002, citizens in states around the country began to rebel against this rule by passing their own, tougher 鈥渙pt-in鈥� financial privacy rules requiring people鈥檚 affirmative permission before their information could be shared. In North Dakota, for example, the battle over a proposed ballot measure to require opt in for the sharing of financial data was a true David and Goliath story. On one side were wealthy and powerful financial interests including big, national banks and insurance companies, which ran a sophisticated media campaign opposing the measure, and outspent the pro-privacy forces by a factor of at least 6-to-1. On the other side was a group of citizen-volunteers led by Charlene Nelson, a homemaker and mother of three working out of her home. Until a last-minute $25,000 contribution by the ACLU for radio ads, the grassroots effort had reported donations of just $2,450.

Yet despite this lopsided battle, the ballot measure won with of the vote.

Unfortunately, in the face of this rebellion by North Dakota, and another in , as well as similar 鈥渙pt-in鈥� laws in some other states, financial interests ran to Congress and were able to use their sway to thwart states鈥� ability to pass stronger standards than GLB. In many crucial areas, GLB was made the ceiling rather than the floor for privacy protection. (A similar preemption battle is shaping up consumer internet privacy legislation.)

The result is that we now have a situation in which consumers鈥� credit card and other financial information is bought, sold, traded, and accumulated by the private sector at an ever-faster pace 鈥� and made all the more convenient and available for access by the government.

For example:

• The major credit card companies have quietly turned their access to consumer transactions into a new revenue stream, according to . And not just the networks like MasterCard and American Express, but also issuing banks. 鈥淩epresentatives from the four top credit card issuers 鈥� Bank of America, Citi, Chase and Wells Fargo 鈥� declined to discuss details of how they use purchasing data internally,鈥� a credit card analyst in 2009, adding that 鈥渁 spokeswoman from a banking industry trade group acknowledged that the practice is common.鈥�
• Google has made with credit card companies and, according to the , now has access to 70% of the nation鈥檚 credit and debit card transactions. Google, which refused to explain how its new system works, uses it to track the success of its online ads, which already rely on access to highly personal data about consumers鈥� search, browsing, and location histories. Although advertisers regularly protest that ad data is based on information, that system could only work if Google connects people鈥檚 online clicks to their real offline identities.
• 鈥淏ehavioral scoring鈥� by credit card companies can be used in unfair ways. One man who had paid his credit card off in full every month received a notice that his credit limit was being lowered. When he asked why, , he was told it was because other shoppers at certain stores he patronized had proven to have poor credit records. It鈥檚 very easy to see how that kind of analytics, especially when done in secret, could have strong, even if unintentional, discriminatory consequences.

The current ecosystem of privacy invasion needs to stop, and is one more reminder why Congress needs to enact strong, comprehensive privacy legislation 鈥� and why we need to preserve cash as a widely-available option for making purchases in our society.