IV.	FTC Correspondence Systems of Records

FTC-IV-1

SYSTEM NAME:

Consumer Information System–FTC.

SECURITY CLASSIFICATION:

Not applicable.

SYSTEM LOCATION:

Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580. This system is operated off-site by a contractor. See Appendix III.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

(1) Individual consumers who submit complaints to the FTC about identity theft, or the business practices of a company or individual, as well as consumers who request information or assistance.

(2) Individuals who submit their complaints about identity theft or the business practices of a company or individual to another organization that has agreed to provide its consumer complaint information to the FTC.

(3) Individuals acting on behalf of another consumer to submit the other consumer's complaint about identity theft, or the business practices of a company or individual, or to request information or assistance on behalf of another individual.

(4) Individuals who are the subjects of complaints about identity theft or about the business practices of a company or individual.

(5) FTC or contractor staff assigned to process or respond to such communications.

(6) Other system users outside the FTC (e.g., law enforcement agencies authorized to have access to the system under confidentiality agreements).

CATEGORIES OF RECORDS IN THE SYSTEM:

(1) Personally identifying information about the individual who submits a complaint or requests information or assistance, including, for example, the individual's name, address, telephone number, fax number, date of birth, Social Security or credit card numbers, e-mail address and other personal information extracted or summarized from the individual's complaint.

(2) Personally identifying information about the individual who submits a complaint or requests information or assistance on behalf of someone else, including, for example, the submitting individual's name, address, phone or fax number and e-mail address.

(3) The name, address, telephone number or other information about an individual who is the subject of a complaint, or is allegedly associated with the subject of a complaint. (Information in the system about companies or other non-individuals is not covered by the Privacy Act.)

(4) The name and reference number of FTC or contractor staff person who entered or updated the complaint information in the database.

(5) Name, organization, and contact data for system users outside the FTC (e.g., staff of other authorized law enforcement agencies).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Federal Trade Commission Act, 15 U.S.C. 41 et seq.; section 5 of the Identity Theft and Assumption Deterrence Act of 1998 (ITADA), 18 U.S.C. 1028 note.

PURPOSE(S):

To maintain records of complaints and inquiries from individual consumers; to track and respond to such communications (e.g., providing information to consumers over the phone or fulfilling requests by consumers to be mailed copies of FTC publications); identify consumer problems and issues that may lead to law enforcement investigations, litigation, or other proceedings; to be used in and made part of the records of such proceedings, or to be referred to other person, entities, or authorities, where appropriate, covered by other Privacy Act system of records notices; and to provide statistical data on the number and types of complaints or other communications received by the FTC. Also, to satisfy the requirement of the ITADA that the FTC compile and refer ID theft complaints to "appropriate entities," and to provide useful information that may contribute to regulation and oversight of institutions and systems that play a role in or are affected by fraudulent business practices or identity theft.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

(1) Consumer complaints can be disclosed to the subject of the complaint for purposes of attempting to resolve the complaint;

(2) ID theft complaints also can be disclosed to the three major national credit reporting agencies and other appropriate entities to fulfill the requirements of section 5 of the ITADA; and

(3) Contact data for non-FTC users of this system (e.g., staff of authorized law enforcement agencies) can be shared among such users or with others within or outside the FTC to enable them to communicate with one another.

See Appendix I for other ways that the Privacy Act allows the FTC to use or disclose system records outside the agency.

DISCLOSURE TO CONSUMER REPORTING AGENCIES:

Identity theft complaints may be referred to consumer reporting agencies, as authorized by the ITADA. Disclosure of system records is also authorized under 5 U.S.C. 552a(b)(12) when trying to collect a claim of the Government. See Appendix I.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Communications are received from consumers in a variety of paper and electronic formats (e.g., by letter, e-mail, Web-based form, facsimile, telephone, TTY). The FTC maintains a Consumer Response Center, which can be reached through a toll-free telephone numbers, for the collection of complaints from consumers. Communications referred to the FTC from other sources (e.g., other law enforcement agencies, private consumer protection organizations) may also be provided to the FTC in paper or electronic format (e.g., by letter, e-mail, CD-ROM, disk drive). Data from such communications are entered into a structured electronic database maintained by a contractor on the agency's behalf, and accessible by Web-based interface to FTC staff, contractors, and other authorized users (e.g., law enforcement partners) subject to strict access and security controls (see "Safeguards" below).

RETRIEVABILITY:

Records may be retrieved and indexed by any category of data that is submitted by consumers or otherwise compiled in association with such records (e.g., name, subject of the complaint).

SAFEGUARDS:

The system can currently be accessed by FTC staff, contractors, and other system users, such as authorized law enforcement agency personnel. This access occurs via a Web-based interface and is authorized only on a need-to-know basis to those individuals and organizations requiring access. Contractors and other non-FTC users must sign confidentiality and nondisclosure agreements, and, in some cases, are required to undergo additional security clearance procedures. Letters or other system records in paper format are maintained in lockable rooms and cabinets. Access to the electronic database requires users to have the correct "user ID" and password combination, individual security token code, and Internet protocol ("IP") address for the user's law enforcement agency. The system database is maintained on secure servers, protected by firewalls, access and usage logs, and other security controls. Servers are maintained in a secure physical environment, including building locks, security guards, and cameras.

RETENTION AND DISPOSAL:

Records are retained and destroyed in accordance with schedules and procedures issued or approved by the National Archives and Records Administration.

SYSTEM MANAGER(S) AND ADDRESS:

Assistant Director, Division of Planning and Information, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580.

NOTIFICATION PROCEDURE; RECORD ACCESS PROCEDURES; AND CONTESTING RECORD PROCEDURES:

See Appendix II. Individuals who call the FTC's Consumer Response Center can also use their FTC reference number to identify complaints they have previously submitted in order to update them.

RECORD SOURCE CATEGORIES:

Consumers and entities who communicate with the FTC; FTC staff and contractors; other law enforcement agencies and non-FTC organizations.

EXEMPTIONS CLAIMED FOR THE SYSTEM:

None.