`Data mining' privacy threat
More firms using new marketing technique
by Valerie Lawton

Ontario's privacy watchdog wants businesses to offer their customers a bigger say in how information about them is "mined" from computer data bases.

Data mining - a powerful high-tech technique that can be used to sift through personal information to look for spending patterns and relationships - has become one of the hottest trends in marketing.

Provincial privacy commissioner Ann Cavoukian argues it raises potential problems.

"Data mining represents a major challenge to privacy because the companies who practice data mining cannot predict what uses the resulting information will have", she said.

"Informational privacy hinges on companies telling their customers how their personal information will or may be used, but data mining offers few certainties in this area."

Her concerns were outlined in a report released yesterday.

The collection of vast amounts of information makes data mining possible - and attractive to business.

Virtually everything you do - withdrawing cash from a bank machine, paying with a debit card, renting a video, buying a plane ticket, filing an insurance claim - gets added to a data base.

By one estimate, the amount of information in the world doubles every 20 months. The size and number of data bases are increasing even faster.

Data mining allows businesses with the proper computer software to pull together seemingly unrelated pieces of information from different data bases to unearth spending patterns that can help make them better marketers.

But putting bits of information together like a puzzle can also reveal a great deal about individuals.

Businesses can use data mining to create profiles of the type of person most likely to buy a product. Scanning various data bases can then create a list of people who match the profile.

Data mining showed U.S. marketers, for example, that fathers who buy diapers often pick up beer at the same time. The link prompted some stores to stock the seemingly unrelated items on the same aisle so even more dads would reach for a six-pack.

Cavoukian's report gives other examples:

    Home Depot adds other customer information - postal codes and the customer's sex and approximate age - to its sales transaction data base with an eye to boosting sales.

    MasterCard International plans to sell its data warehouse of card-holder transactions to business partners. 

Cavoukian sees some data-mining connections with adverse consequences. She imagines the following - admittedly somewhat farfetched - scenario: One data base shows that a man who usually buys diapers and family staples like milk and carrots has suddenly purchased wine, oysters and caviar. Another data base shows that, at the same time, his wife has purchased an airline ticket for a business trip.

Putting the two bits of information together might suggest infidelity, Cavoukian said.

"The point isn't that anyone is really going to be doing detective work on an individual. But it's that this type of information could reveal more information about you than you may be aware, or that you would be willing to share."

"It's the disclosure of information about you, about larger portions of your life that may be gleaned from relatively innocent, simple information that on the face of it is of no value or interesting to anyone."

She'd like to see companies allow customers to say yes or no to the use of their information for data mining.

John Gustavson of the Canadian Direct Marketing Association doesn't think that would be helpful - most people don't know what data mining is.

"There's no question that businesses have to act responsibly and adopt a code of fair information practices when dealing with personal information", Gustavson said. "That extends to and includes data mining."

Gustavson agreed with Cavoukian about the thorny privacy issue data mining creates for business: How do you ask for permission to use information in a certain way when you haven't yet thought of how it will be used?

Cavoukian suggests consumers could be given various choices - not having their data mined at all, only having it mined in-house, or having it mined by other companies.

She advises consumers to ask how their personal information will be used and ask to see a business's privacy policy.