Big data: We need to know what's known

That much is clear from a recent White House report on big data. The analysis articulates the prospects and the perils, and it suggests a few policies. But the path is still mostly unmapped.

Your thermostat can adjust your energy use to limit overconsumption — and indicate where you are in your home. GPS devices can track your workouts — and tell app makers, or anyone who buys the information, where you've been. Secondhand data brokers get their hands on all sorts of information generated on phones, in Internet stores and in other contexts, creating sometimes-extensive profiles of individuals. Advertisers, lenders and employers can buy those profiles to find the right consumers for their product or the right employees to hire. Or to discriminate against people.

Government is in on the game, too: The Centers for Medicare and Medicaid Services can root out improper payments from massive stores of payment information — but that can put personal health records under scrutiny.

Previously, the difficulty of sorting through mostly paper records made this sort of information-gathering impossible. Now it is commonplace, but privacy protections have not kept up.

The report suggests some broad principles. People should know what's being collected about them, where it's stored, that it's being stored securely and what it's used for. Data brokers, for example, ought to offer information to those they profile on a unified website, like credit ratings agencies must do now. But given the rapid advance of technology and increasingly numerous sources of information, the report says, policy may have to adjust the old approach to privacy protection: Rather than putting the emphasis only on when information can be collected, government and industry might focus on when certain sorts of information can be used and by whom. Congress should take up the discussion.