If you deal in data

If information is your stock in trade, FTC settlements with consumer reporting giant Equifax Information Services and San Diego-based Direct Lending Source merit your attention.  The cases are a timely reminder to businesses that when buying and selling data, it’s important to build legal compliance into your day-to-day operations.

Here’s what the FTC says happened.  For about a two-year period, Equifax sold Direct Lending and its affiliates lists of people who met selected criteria — prescreened lists. The criterion that got millions of people on those lists?  Being 30, 60, or 90 days late on their mortgage payments. The lists included other sensitive data, like people’s credit scores.  According to the complaint, Direct Lending turned around and sold the information to outfits that were peddling products and services targeting consumers struggling to stay afloat. The FTC says that some of those companies have been the subject of law enforcement actions centering on allegedly deceptive practices.

Is it illegal for consumer reporting agencies to sell prescreened lists and for other businesses to buy them?  No.  The Fair Credit Reporting Act allows companies like Equifax to furnish reports to those who have a “permissible purpose.” But under the law, the only permissible purpose for getting a prescreened list is to make a “firm offer of credit or insurance.” What about using prescreened lists to send marketing solicitations to people in financial distress? That’s not a permissible purpose.  The FCRA doesn’t allow prescreened lists to be sold for pure marketing purposes because there is no firm offer of credit and that’s why the FTC says both Equifax and Direct Lending violated the FCRA.

Among other allegations, the FTC’s complaint charges that Direct Lending — along with its affiliates and principals — violated the FCRA and the FTC Act by getting prescreened lists when it didn’t have a permissible purpose, by reselling reports without telling Equifax who was going to wind up with the info, by failing to maintain reasonable procedures to make sure the people they were selling to had a permissible purpose, and by failing to use appropriate measures to control access to sensitive consumer financial information.

What about Equifax’s involvement? In addition to charging that Equifax provided lists to companies that didn’t have a permissible purpose, the complaint alleges that it didn’t have appropriate procedures in place to prevent that from happening.  For example, according to the FTC, Equifax didn’t properly investigate when it found out that Direct Lending was violating Equifax’s own policies on prescreening.  The FTC also says that Equifax knew or should have known that Direct Lending was reselling the data without telling Equifax who was going to wind up with it — and yet Equifax continued selling prescreened lists to Direct Lending.  The complaint charges that Equifax’s failure to employ appropriate measures to control access to sensitive consumer information was an unfair practice, in violation of Section 5 of the FTC Act.

The settlement with Direct Lending, filed in federal court in California, imposes a $1.2 million civil penalty and puts provisions in place to protect consumers in the future.  Also named in that case are Bailey & Associates Advertising, Inc., Virtual Lending Source, LLC, Robert Bailey, and Linda Giordano.

The proposed administrative settlement with Equifax, which the FTC has published for public comment, includes a $393,000 payment.  Under the proposed order, Equifax will have to tighten up its procedures and make sure that before providing prescreened lists, the company has good reason to believe the people buying them have a “permissible purpose.”

The message to marketers? The Fair Credit Reporting Act puts limits on how companies can traffic in consumer information.  Consumer reporting agencies that want to keep their operations within the law understand the importance of keeping a close watch on who’s getting prescreened lists, what they’re doing with the data, and how it’s being handled downstream.

Looking for more about the FCRA?  Bookmark the BCP Business Center's Credit Reporting page.