ChoicePoint Inc., the data broker that set off a national debate after disclosing a data breach early in 2005, will pay US$15 million in fines and other penalties for lax security standards, the U.S. Federal Trade Commission (FTC) announced Thursday.
ChoicePoint’s $10 million fine is the largest civil fine in the FTC’s history, the FTC said. Under a settlement with the FTC, the Georgia company will also set up a $5 million fund to aid victims of identity theft that resulted from the data breach, and the company has agreed to implement new security measures and have an independent auditor review its security every other year until 2026, said FTC Chairwoman Deborah Platt Majoras.
“This is an important victory for consumers and an equally important opportunity for ChoicePoint to get data security right,” Majoras said. “Companies like ChoicePoint are realizing now that it is a bad business practice to ignore the security of customer data.”
Last February, ChoicePoint announced that scammers had set up bogus businesses and contracted with the company to gain access to the personal information of 145,000 U.S. residents. The company, which found out about the breach in September 2004, later said the number of affected people was 163,000.
ChoicePoint was notified by law enforcement officials of potentially fraudulent activity as early as 2001, the FTC said. “This breach occurred because ChoicePoint failed to implement reasonable and appropriate procedures for approving new customers and for monitoring existing ones,” Majoras said. “ChoicePoint failed to monitor or otherwise identify fraudulent customer activity even after repeated subpoenas from law enforcement.”
ChoicePoint holds billions of personal records, including credit histories, Social Security numbers and employment histories. The company provides background checks for more than 50,000 businesses and government agencies, and in most cases, the company does not notify the people whose records it sells. About 800 people have so far been identified as victims of ID theft-related crimes in connection with the ChoicePoint breaches, Majoras said.
ChoicePoint, in a press release, said it has taken several steps to improve security since the data breach was announced, including the hiring of an independent credentialing, compliance and privacy officer. The company has also stopped selling products containing sensitive personal information in some markets, it said.
“The events of early 2005 provided critical lessons from which ChoicePoint and, indeed the entire industry, has learned a great deal,” Derek V. Smith, ChoicePoint chairman and chief executive officer, said in a statement. “The men and women of this company take nothing more seriously than their responsibility to safeguard consumer information and, as a direct result of those lessons learned, we have, for the past several months, been in the process of implementing nearly all of the changes reflected in today’s settlement.
“I firmly believe that the changes we’ve implemented in the past year were not only the right thing for this company to do, but are equally important for the entire industry to consider,” Smith added.
The FTC alleged that ChoicePoint turned over sensitive personal information to subscribers whose applications raised obvious “red flags.” ChoicePoint approved contracts with customers who used commercial mail drops as business addresses and reportedly used fax machines at public commercial locations to send multiple applications for purportedly separate companies, the FTC said.
The FTC charged that ChoicePoint violated the U.S. Fair Credit Reporting Act (FCRA) by giving credit histories to subscribers who did not have a permissible purpose to obtain them, and by failing to maintain reasonable procedures to verify subscriber identities.
The agency said that ChoicePoint also violated the U.S. FTC Act outlawing unfair and deceptive business practices by making false and misleading statements about its privacy policies. Among the company’s past privacy statements: “ChoicePoint allows access to your consumer reports only by those authorized under the FCRA” and “Every ChoicePoint customer must successfully complete a rigorous credentialing process.
ChoicePoint does not distribute information to the general public and monitors the use of its public record information to ensure appropriate use.”
ChoicePoint’s data breach announcement in February, spurred by a 2003 California breach notification law, was the first of dozens of such announcements in 2005. More than 20 states have since passed breach notification laws, and the U.S. Congress is considering a national law.
