ChoicePoint Releases Consumer Data
ChoicePoint, Inc.’s failure to protect consumers’ private data will cost it $15 million in fines and consumer redress under a settlement reached with the Federal Trade Commission (FTC).
In 2005, ChoicePoint notified over 163,000 consumers that their private data, including social security numbers and date of birth, had been released by the company due to inadequate security and screening measures. At lease 800 cases of identity theft has been linked to the wrongful disclosures. Under the settlement agreement, ChoicePoint will pay $10 million in civil penalties to the FTC and $5 million in consume redress.
ChoicePoint collects consumer data without ,making any contact with consumers whose information it sells and consumers cannot remove their information from ChoicePoint’s databases.
The FTC alleged in its complaint that the data was sold to bogus ChoicePoint subscribers. ChoicePoint failed to check out the credentials of the subscribers or to authenticate their identities. For example, some of the bogus subscribers used commercial mail drops, submitted articles of incorporation that reflected that the business was suspended or inactive, contained inconsistent information such as including an apartment number as the applicant’s business address or a cellular telephone number as the business’ sole telephone number and continued to furnish consumer reports after the subscriber’s telephone had been disconnected, the business address was found to be incorrect and the credit card used to pay for the information was in another name.
The FTC charged ChoicePoint with violating the Fair Credit Reporting Act by furnishing consumer reports to subscribers who did not have a permissible purposes to obtain them and by failing to maintain reasonable procedures to verify both their identities and how they intended to use the information.
The agreement bars ChoicePoint from furnishing consumer reports to people who do not have a permissible purpose to receive them. The company is also required to verify the identity of businesses that apply to receive consumer reports, including making site visits to certain business premises and auditing subscribers’ use of consumer reports.