Insurance Companies May Be Data Mining Your Facebook Page

August 6, 2012

Jeffrey N. Rosenthal

The Legal Intelligencer

By now it should go without saying: Be careful what you post on social networking sites. But here is yet another reason to be conscious of your online presence: Insurance companies are beginning to check social media sites like Facebook and Twitter to determine if you are a coverage risk. You may even have a "social media score" to prove it.

And, just like your credit score, your social media score can impact what you qualify for and affect how much you pay for coverage. Yet, unlike a credit score, it is hard to say exactly what goes into a social media score — or if existing federal laws provide sufficient oversight.

When it comes to mining data, insurance companies are learning that personal information on social media sites is as good as gold.

Companies are always interested in who their customers are. British Airways tries to surprise its passengers with greetings and personal touches based on Googled information; high-end restaurants commonly search out their bookings online to see who is coming in.

But it may come as a surprise to learn that insurance companies surf social media sites like Facebook and Twitter to get the scoop on their customers.

Such efforts used to take significant energy. Not anymore.

Now, vendors are building online programs to automate this process using sophisticated data-mining tools. In its simplest form, data mining is the process by which new patterns are discovered in large data sets. Data-mining software allows users to crunch unwieldy amounts of data to recognize hidden relationships among seemingly unrelated information.

And according to a recent report by Novarica Market Navigator, a leading provider of market research and trend analysis, personal information insurers formerly had to devote considerable resources to gathering is now readily available on-demand from commercial sources — and at a lower cost.

"Our electronic trails have been digitized, formatted, standardized, analyzed and modeled — and are up for sale," said Novarica on its blog. And insurance companies are ready to buy.

So what exactly goes into a social media score? The answer may surprise you.

Generally made up of what you "like" and the types of activities you engage in, this score can also be based on what you do and say on social media sites; it can even include pictures from photo-sharing sites like Flickr and Instagram.

Participating in dangerous activities, like skydiving or extreme sports, could affect your score. So could smoking cigarettes — especially if you claimed to be a nonsmoker in an insurance application. Traveling to war-torn countries could equally have an impact on your score, regardless of whether you were only there as a volunteer.

Even your favorite foods could make the list — the thought being that someone who "likes" Oreo-brand cookies and fried chicken may not be living as healthy a lifestyle as someone whose Facebook page has them going to the gym every week. It all paints the picture of who you (really) are.

At least one Canadian insurance company, Manulife Financial, has confirmed that it uses Facebook to investigate clients.

A notable example involved a Quebec woman on long-term leave who had her benefits cut after her employer's insurance company, Manulife, found potentially contradictory photos posted on Facebook, according to a November 2009 article by the Canadian Broadcasting Corp. titled "Depressed Woman Loses Benefits Over Facebook Photos."

Nathalie Blanchard, 29, had been on leave suffering from major depression for a year when her sick-leave benefits were discontinued. When called for an explanation, her insurance agent described several pictures she posted on Facebook — including ones showing her having a good time at a Chippendales bar, at her birthday party and at the beach.

In response, Blanchard told CBC News that, on her doctor's advice, she had been trying to have fun as a way to forget her problems. Blanchard later initiated legal action to reinstate her benefits.

Although it would not comment on the suit, Manulife said in a written statement to CBC News that: "We would not deny or terminate a valid claim solely based on information published on websites such as Facebook."

Blanchard also said she did not understand how Manulife accessed her photos, because her Facebook profile is locked and only approved people can see her posts.

Legislators have gone to great lengths to promote transparency in the handling of credit scores (and to protect consumers from abuses thereof). But unlike credit scores — which are heavily regulated — there is no federal law limiting the potential uses of an online profile.

The experience of a start-up data mining company called Social Intelligence provides insight as to how the federal government — via the Federal Trade Commission — is addressing the use of social media.

In June 2011, FTC staff evaluated Social Intelligence's practice of selling background reports that included social media information to determine if it was complying with the Fair Credit Reporting Act (FCRA). The FCRA preserves uniform national standards for the content of consumer reports and access to such information. It also combats identity theft, protects privacy and improves consumer access to and overall accuracy of consumer reports.

In response to industry concerns, the FCRA was substantially amended by the Fair and Accurate Credit Transactions (FACT) Act in 2003 to strengthen existing protections. For instance, the FACT Act allows consumers to request and obtain a free credit report once every 12 months from each of the three nationwide consumer credit-reporting companies. Notably, these free reports do not contain actual credit scores from any of the three agencies; such scores must be purchased directly from the credit-reporting agencies.

Importantly, the FTC staff's letter to the company emphasized that when background reports include social media content, the same rules apply.

For example, companies selling such reports must take "reasonable steps" to ensure the maximum possible accuracy of what is reported, and that the report relates to the correct person. They also have to comply with other FCRA sections — like providing copies of such reports and having a process to dispute what is said. Additionally, data companies must give employers that use the reports information about their responsibilities under the FCRA —like their obligation to give applicants advance notice of any adverse action taken on the basis of said reports. Lastly, employers must certify that the report will not be used in a way that would violate equal employment opportunity laws or regulations.

In May 2011, the FTC suspended its investigation of Social Intelligence, allowing the company to continue to operate.

Implications for the increasingly widespread use of social media in the insurance context fall into three main categories: (1) the rating, classifying and underwriting of policyholders; (2) fraud prevention; and (3) transparency and consumer access.

First, the fact that insurers regularly review social media sites in issuing coverage and setting premiums has both pros and cons for policyholders. On the plus side, awareness of this practice allows insureds to, as one commentator puts it, "brag on themselves" when it comes to portraying a healthy lifestyle. If you truly are the picture of health you claim to be in your insurance application, let the world (and your insurer) know it.

But be forewarned: There is also the potential for companies to deny coverage when your online presence does not match your responses to pointed insurance questionnaires. Take, for example, the nonsmoker shown smoking in various online photos. Or, like the Blanchard example, seemingly benign pictures can potentially be taken out of context.

When confronted, most social media users cite privacy filters — which are always an option. But what about pictures of you uploaded to a friend's Facebook page? Or comments you made on someone else's message board? Chances are there is a loose end somewhere. And as for online privacy concerns, it is likely the Stored Communications Act— which protects most online content — will not apply to bar the usage of this otherwise public information.

This leads to the second implication: fraud prevention. As many commentators (including this author) have observed, courts generally refuse to find a reasonable expectation of privacy in content uploaded to social media sites.

"Mining social media for clues is one of the fastest-growing areas of insurance-fraud investigations," said James Quiggle in a February 2012 newsletter by the Association of Certified Fraud Examiners — the world's largest antifraud organization.

The classic example is the injured person seen riding a jet ski a week after submitting a disability claim. According to Social Intelligence, the continued monitoring of social media sites post-coverage has the additional effect of reducing overall loss costs by detecting fraud before payments are made — which, in turn, results in lower premiums for the rest of us. It is widely believed that insurance fraud adds 10 percent to the cost of the average policy.

But just because insurance companies are mining for data does not mean they are digging for dirt.

According to Social Intelligence's COO, Geoffrey Andrews, in an interview with Forbes in June 2011, only about 5 to 20 percent of job applicants had something negative in their online profile. And most of the extreme examples that affected employment decisions were related to fraudulent or criminal activity, involvement in racist online organizations or drug abuse.

Lastly, the issue of transparency and consumer protection is probably the murkiest.

According to the FTC, Social Intelligence's existing work with social media in background checks is already subject to the requirements of the FCRA. So there is at least some basis to believe social media scores would be subject to the same parameters — i.e., a requirement to provide consumers with copies of said reports and a process by which to dispute the contents. But it is unclear whether consumers would be allowed to view their actual scores (like credit reports), or if they would have to buy them directly from the online providers.

The law has yet to catch up with this recent phenomenon. But a few issues will likely arise, such as: How can one check a social media score? Is the score public? Who would be sent this score? Can you challenge the items in the report? How detailed will it be? Will actual content appear? Who gets to look at it, for how long and for what purposes?

For now, these questions remain unanswered. But as the prevalence of social media grows (which all signs suggest it will) these issues will have to be addressed by the legislature and the courts.

The people writing insurance policies have always been interested in your lifestyle. Now they have a convenient, easy-to-use tool to quickly size you up. In our age of data superabundance, the data mining of social media sites is only going to increase. So be mindful of any data nuggets that might just be waiting to be unearthed. •

Reprinted with permission from the August 6, 2012 edition of The Legal Intelligencer © 2012 ALM Media Properties, LLC. All rights reserved. Further duplication without permission is prohibited. For information, contact 877-257-3382, or visit