Removing Your Personal Information From LexisNexis: A Cybersecurity Expert‘s Perspective

As our lives have become increasingly digitized, a massive industry has emerged to collect, analyze and sell our personal data. Among the major players in this space is LexisNexis Risk Solutions, a data broker that generates billions of dollars in annual revenue by compiling extensive dossiers on millions of individuals.

While LexisNexis provides data services for essential uses like identity verification and fraud prevention, it has also faced criticism over its handling of sensitive personal information. With rising concerns over data privacy, many consumers are seeking to opt-out of LexisNexis and other data brokers. But what does this process entail, and is it an effective way to protect your digital privacy?

The Scale of Data Collection

To appreciate the implications of removing your data from LexisNexis, it‘s important to understand the sheer breadth and depth of the information the company collects.

According to LexisNexis‘ own documentation, their databases contain over 283 million US consumer identities and 84 million unique business contacts. For each individual, the company aggregates thousands of attributes from a wide range of public and proprietary sources, including:

• Government records (property, court, professional licensing, voter files, etc.)
• Financial data (credit headers, loan applications, bankruptcy filings, etc.)
• Demographic information (age, gender, marital status, education level, etc.)
• Vehicle and asset ownership records
• Social media and online activity
• Location data from mobile devices

By connecting these disparate data points, LexisNexis is able to construct highly detailed profiles that provide insights into our identities, finances, behaviors, and social connections. While some of this information is obtained through public records, the company also purchases data from other commercial sources like website operators, data aggregators, and retailers.

The data broker industry is relatively opaque, but recent estimates peg its total annual revenue around $200 billion. While thousands of companies engage in some form of data collection and resale, the market is dominated by a handful of major players like LexisNexis, Acxiom, Experian, and Epsilon.

Risks of Exposed Personal Data

For businesses and government agencies, data brokers offer a powerful tool to verify identities, investigate fraud, and assess consumer risk. However, the mass aggregation of personal data also introduces significant privacy threats for individuals.

Some key concerns include:

• Unwanted Profiling – Data brokers analyze consumer information to segment individuals into marketing categories or risk profiles that may be discriminatory or embarrassing.
• Government Surveillance – LexisNexis and other data brokers have controversially sold consumer data to law enforcement and government agencies like ICE, which raises civil liberties issues.
• Identity Theft & Phishing – Exposed personal data enables criminals to commit identity fraud or launch highly targeted phishing campaigns.
• Physical Security Risks – Location information and personal details may be misused to stalk or harm individuals.
• Reputational Damage – Incorrect or outdated information on data broker sites may negatively impact employment, housing and financial opportunities.
• Unwanted Marketing – Profiles are sold to enable hyper-targeted advertising that may feel invasive.

Compounding these risks, major data brokers have suffered data breaches in recent years exposing consumer records. In 2013, a LexisNexis databases containing millions of SSNs was compromised by identity thieves. More recently in 2020, 10.6 million customer records were leaked from LexisNexis‘ legal research portals.

Your Data Privacy Rights

Given these myriad concerns, it‘s understandable that many individuals want more control over how their personal information is collected and shared by data brokers. Fortunately, consumers have won some important privacy rights on this front in recent years.

In the European Union, the General Data Protection Regulation (GDPR) implemented in 2018 provides residents with the right to access their personal data, correct inaccuracies, object to processing, and request data deletion from companies that collect their information. It also requires companies to obtain affirmative consent before collecting sensitive data.

In the US, the California Consumer Privacy Act (CCPA) grants similar rights to the state‘s residents, including the ability to opt-out of having their personal information sold by companies like LexisNexis. Businesses are also required to disclose details on the types of data they collect and how it is used.

While these regulations are a step in the right direction, the reality is that opting-out of data brokers is still a complex and incomplete process. LexisNexis and its peers benefit from a web of interconnected databases and partnerships that make it exceedingly difficult for individuals to identify and control every instance of their personal data.

The LexisNexis Opt-Out Process

To its credit, LexisNexis does offer consumers multiple options to access their data and request that it be suppressed from the company‘s products. However, the process is not exactly straightforward.

First, individuals can request a free copy of their LexisNexis Consumer Disclosure Report once every 12 months via an online form or by phone/mail. The report is delivered within 15 days and contains all data points LexisNexis has collected about you along with their sources. Reviewing this report is an essential step to identify any inaccurate or sensitive information.

To opt-out of LexisNexis databases, you must complete a separate online request form that requires you to select a specific reason:

1. You are a victim of identity theft (requires police report)
2. You are at risk of physical harm (requires court protective order)
3. You are a law enforcement officer, public official or judicial officer (requires proof of occupation)
4. General privacy concerns

Only the first three "higher risk" categories result in a complete suppression of your data from all LexisNexis products. General opt-out requests simply remove you from the company‘s more widely available public records datasets. Some sensitive data may still be shared on a limited basis.

LexisNexis also offers the option to place a security freeze on your Consumer Disclosure Report, which blocks any third party from accessing it until you lift the freeze. This provides similar protection to an opt-out without requiring you to demonstrate a higher risk scenario, and it can be toggled on and off anytime for free.

It‘s worth noting that even a successful opt-out only removes your data from LexisNexis‘ own databases. The company may still obtain some of your updated personal information in the future from partners and public sources. To more completely minimize your data footprint, you would need to repeat the opt-out process with each major data broker – a daunting and time-consuming undertaking.

Data Removal Services

One way that consumers are simplifying the data broker opt-out process is by using third-party data removal services. For an annual fee, these companies work on your behalf to submit opt-out requests and monitor your information across dozens of databases.

Leading data removal providers include:

• DeleteMe – Removes data from over 50 brokers with a full-service digital security app
• Incogni – Removes data from over 180 brokers and posts regular privacy monitoring reports
• Privacy Bee – Removes data from over 220 brokers and includes free identity theft recovery support

Using a data removal service can greatly reduce the time and effort required to manage your data across the vast ecosystem of people search sites and data brokers. However, even these solutions have their limitations.

Data removal services are generally not able to purge 100% of your personal information online, as some data brokers prohibit third-party opt-out requests. There‘s also the reality that much of your data exists in public government records that can never be fully deleted. And of course, engaging a data removal service requires sharing your personal information with yet another company.

Balancing Privacy and Utility

As you consider whether to opt-out of LexisNexis and other data brokers, it‘s important to weigh the privacy benefits against potential drawbacks. Just as locking down your credit report can sometimes backfire when applying for new credit, suppressing your personal data may complicate access to certain services.

For example, if a company is unable to electronically verify your identity via LexisNexis, you may need to provide additional documentation or jump through other hoops to prove you are who you claim to be. In higher risk transactions like applying for insurance, a mortgage, or employment, the lack of data could even be held against you.

On the flip side, proactively opting out of data brokers significantly reduces your risk of falling victim to identity theft, financial fraud, and other crimes that leverage exposed personal information. It‘s a key element of good digital hygiene in an age of rampant data breaches and online scams.

At the very least, I would recommend that anyone with heightened physical safety or cybersecurity concerns (e.g. domestic violence survivors, stalking victims, law enforcement officials, executives, public figures, etc.) strongly consider a complete opt-out of LexisNexis and other data brokers. For the average consumer, implementing a security freeze offers a good balance of protection and flexibility.

Beyond opting out, adopting privacy-focused habits like using virtual credit card numbers, secure email providers, and VPNs can help to stem the flow of personal data that ends up in broker databases. Regularly monitoring your credit report, financial statements, and online accounts for suspicious activity is also critical to catch identity theft early.

The Bottom Line

The decision to remove your personal information from LexisNexis is a highly individual one that requires carefully considering your unique privacy risks and preferences. While the opt-out process is far from perfect, it remains one of the best tools we have to maintain some level of control over our data.

As cybersecurity and privacy professionals, it‘s our role to educate consumers on these complex issues and advocate for their rights in a world where personal data has become an immensely valuable commodity. With stronger regulations and greater transparency from data brokers, we can hopefully strike a better balance between the benefits of data-driven services and the imperative to protect individual privacy.