Last week, the Federal Trade Commission, Equifax Information Services LLC and a company and its affiliates that purchased and resold customer lists of consumers who were late on their mortgage payments, settled charges that the customer lists were bought and resold in violation of the FTC Act and Fair Credit Reporting Act (FCRA). The FTC described the two settlements as part of the Commission's ongoing efforts to protect both consumers in financial distress and consumer privacy.
According to the charges, Equifax sold lists of people who met selected criteria (also called "prescreened lists"), including "sensitive information such as credit scores and whether they were 30, 60 or 90 days late on their mortgage payments." See FTC Press Release (10/10/2012), available at http://www.ftc.gov/opa/2012/10/equifaxdirect.shtm. The purchasers allegedly included Direct Lending Source, Inc., a Florida corporation, and its affiliates, Bailey & Associates Advertising, Inc. and Virtual Lending Source.
According to the FTC, Direct Lending and its affiliates did not have a legally permissible purpose to obtain the prescreened lists. The FTC claimed that Direct Lending and its affiliates purchased more than 17,000 prescreened lists from January 2008 through early 2010, and sold the lists to third parties, including entities that targeted consumers in financial distress for loan modification, debt relief and foreclosure services. The FTC also claimed that Direct Lending and its affiliates sold prescreened lists to entities that had been the subject of actions or warnings by law enforcement in California and Maryland. The FTC alleged that, in other instances, prescreened lists were sold to list brokers and others, and then resold to unidentified downstream entities. Under the FCRA, prescreened lists may be obtained only to make "firm offers of credit or insurance," which are offers that will be honored if consumers meet pre-selected criteria. There is no other permissible purpose: using prescreened lists for general marketing is not allowed.
The FTC alleged that Direct Lending and its affiliates obtained consumer reports without a "permissible purpose" in violation of FCRA § 604 (15 U.S.C. § 1681b(f)); resold the reports and failed to disclose to the identity of the end-user of the consumer report in violation of FCRA § 607(e)(1) (15 U.S.C. § 1681e(e)(1)); failed to comply with reasonable procedures designed to ensure that the consumer reports were resold only for a permissible purpose in violation of FCRA § 607(e)(2) (15 U.S.C. § 1681e(e)(2)) and FTC Act §5(a) (15 U.S.C. § 45(a)); to the extent firm offers of credit were made, failed to maintain on file the criteria used to select the consumer to receive the firm offer of credit for three years in violation of FCRA § 615(d) (3) (15 U.S.C. § 1681m(d)(3)); and failed to employ reasonable and appropriate measures to control access to the sensitive consumer financial information they sold, which constitutes an unfair act or practice in violation of FTC Act § 5 (15 U.S.C. §§ 45(a) and 45(n)). As part of its settlement with the FTC, Direct Lending will pay a $1.2 million civil penalty and will be barred from using or selling prescreened lists without a permissible purpose, or in connection with solicitations for debt relief or mortgage assistance relief products or services. See Proposed Stipulated Final Judgment, available at http://www.ftc.gov/os/caselist/1023000/121010directlendingstip.pdf.
The FTC made similar allegations against Equifax, together with claims that Equifax "failed to properly investigate when it learned Direct Lending was violating Equifax's internal policies on prescreening" and continued selling prescreened lists when it knew or should have known that Direct Lending resold the lists without telling Equifax who would end up using the information. See Press Release (10/10/2012), available at http://www.ftc.gov/opa/2012/10/equifaxdirect.shtm. As part of its settlement with the FTC, Equifax will pay $393,000, and will be prohibited from providing prescreened lists to anyone that it does not have reason to believe has a permissible purpose to receive them; must maintain reasonable procedures to limit prescreened lists to those with a permissible purpose to use them; and may not sell prescreened lists in connection with offers for debt relief products or services and mortgage assistance relief products and services when advance fees are charged.
The settlement is subject to public comment for 30 days; thereafter, the Commission will decide whether to finalize the proposed consent order.
* * * * * * * * * *
The FTC's action and resulting settlement with Equifax and Direct Lending is a good reminder that entities that sell consumer reports with consumer financial information such as credit scores, and the entities who purchase and use those reports, must make reasonable efforts to verify that the information will be used for a permissible purpose under the FCRA. As outlined in the FTC's allegations, reasonable efforts for entities that provide consumer reports include identifying each end user, certifying each purpose for which the consumer reports would be used or certifying that the consumer reports would be used only for a permissible purpose, namely, to make "firm offers of credit or insurance." Further, entities that obtain consumer reports must use them for a permissible purpose and must establish and comply with reasonable procedures designed to ensure that a report is resold only for a purpose for which it has been furnished.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.