Data-matching: what happens when firms join the dots about you?

You may not have heard of data matching, but I guarantee you’ve heard of the companies that do it. Data matching is where a company simply takes internally held data, matches it with publicly available data, analyses it and then uses it for the purpose of raising money, targeting people, or whatever the business goals are.

Recently, Uber was caught out for using a program it called Greyball to dodge law-enforcement officials in cities where the service was being rolled out. Essentially Greyball carried out a data-matching process to figure out whether users were government officials or not.

The New York Times explains in more detail about how it did this. Uber employees cross-matched usernames with social media profiles, employed “geofencing” around government offices to identify potential officers, and assessed whether credit card information was tied to an institution. And apparently it worked quite effectively, since they managed to evade law enforcement in several US cities.

Even charities have been caught red-handed using data matching to further their fundraising goals. Late last year the UK’s data protection authority, the Information Commissioner’s Office (ICO), fined the RSPCA and the British Heart Foundation for breaching the Data Protection Act. The ICO found they did this by targeting new donors by data matching, by trading personal data with other charities, and by screening donors using their data without their consent.

Most importantly, perhaps, is the question of using data matching to further political aims. I have written about the limitations of Cambridge Analytica – which has been credited with winning Donald Trump the White House and helping Leave.eu win the UK’s referendum on leaving the European Union – and its approach to Facebook data, but never touched on the potentials for data matching.

Outside of using Facebook’s tools, there are of course many ways in which the data can be extracted and matched to data that’s held elsewhere. And it doesn’t require a stretch of imagination to think that Cambridge would have access to donor lists or voter lists, whose data could be extrapolated to create an extended pool of potential supporters.

It’s extremely tricky to legislate for this sort of behaviour and even harder to enforce it. After all, if people leave breadcrumbs of their identity around the internet and these pieces of data can be matched together, what’s the harm? Most of the data is freely available and not obtained by nefarious means.

The problem is volume – there is so much personal data spread about online that matching them can give companies insights into your life that you never really expected they would have. And what’s more, generally these users haven’t explicitly consented to using data-matching methods to mine the internet for more information.

Data matching is limited in some ways because most of us don’t have unique names and there tend to be at least a handful of other people around. But what happens if someone is trying to match my details to public data and instead they get another Sophie Warnes who might have a different social media presence to me or have a different job?

This happened to a friend of mine in a PR stunt gone wrong – she was sent a “dossier” on herself, which detailed where she lived, and assumed the person living with her was her partner. Only… it was another woman in the same city with the same name. It’s a bit… Orwellian.