In early May, Theodore Moss, the CEO of online background-check provider Crimcheck.com, received a letter from the Federal Trade Commission (FTC) notifying him that “recent test-shopping contacts” had indicated that his company was possibly selling consumer information unlawfully.¹ Crimcheck.com provides background-check services to businesses conducting employment screenings for potential job candidates.² Such companies, often referred to as “data brokers,” collect and compile information on individual consumers, drawing from public sources such as court databases and consumer credit records to piece together profiles of individuals’ financial, retail, recreational, and criminal behaviors.³ But it is precisely that assembling of detailed information on individuals—even information compiled from public sources—that can trigger provisions of the Fair Credit Reporting Act, prompting the FTC to take a closer look at how these companies collect and use consumer information.

The Fair Credit Reporting Act

Under the Fair Credit Reporting Act (FCRA), consumer information used for employment, insurance, or credit purposes is subject to certain safeguards.⁴ Enacted in 1970, the FCRA was designed “to ensure fair and accurate credit reporting, promote efficiency in the banking system, and protect consumer privacy.”⁵ Section 1681a(f) defines a “consumer reporting agency” (CRA) as “any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties . . .”⁶ The term “consumer report” is further defined to include virtually any information used for extension of personal credit, insurance, or employment purposes.⁷ Read together, these two provisions indicate that an entity that collects consumer information later used for credit, insurance, or employment determinations is a CRA for purposes of the FCRA.

Qualifying as a CRA is consequential because it triggers a number of consumer protection measures. Among other steps, CRAs must do the following:

• Use reasonable measures to ensure that information contained in their reports is as accurate and up-to-date as possible⁸
• Ensure that the information will only be used for a permissible purpose under the statute⁹ (Section 1681b lists the exclusive set of permissible purposes)
• Obtain certification that consumer reports for employment purposes will be used in compliance with equal opportunity laws and that the potential employee authorized the report and has an opportunity to challenge any contents that result in adverse action¹⁰
• Ensure that consumer reports for credit evaluations be used only for firm offers of credit¹¹
• Inform data buyers of their own FCRA obligations¹²

Clearly, an entity’s designation as a “consumer reporting agency” under the FCRA carries some substantial obligations.

FTC Enforcement Efforts

In recent years, the FTC has renewed its efforts to enforce the FCRA to protect consumer privacy. In December 2012, the FTC launched a study of the “data broker” industry, ordering nine different companies to disclose information concerning their collection and use of consumer data.¹³ Those orders followed on the heels of several earlier settlements with data brokers, with one, Teletrack, settling for $1.8 million after the FTC alleged that it unlawfully sold consumer report information without a permissible purpose.¹⁴ Another case, in which the FTC alleged that data broker Spokeo unlawfully marketed its consumer information to companies for use in hiring or recruiting, settled for $800,000.¹⁵

In May, the FTC conducted a sting operation to identify companies that provide or were willing to provide consumer information to buyers without complying with FCRA safeguards. FTC staffers targeted 45 data brokers, posing as company representatives or individuals seeking to purchase consumer information for use in screening consumer creditworthiness, insurance eligibility, or employment suitability.¹⁶ While a company may promote its products exclusively for marketing purposes, in the FTC’s view, “[e]ven if a company is not compiling and sharing data for the specific purpose of making employment, credit, or insurance eligibility decisions, if the company has reason to believe the data will be used for such purposes, it would still be covered by the FCRA.”¹⁷ According to the FTC, employees at ten companies were unaware of the necessary FCRA safeguards when selling consumer information for such purposes.¹⁸ Among the ten, six—Crimcheck.com, 4Nannies, Case Breakers, People Search Now, USA People Search, and U.S. Information Search—seemed willing to sell data for employment determination purposes; two—Brokers Data and US Data Corporation—seemed willing to sell data for insurance decisions; and two—ConsumerBase and ResponseMakers—seemed willing to sell pre-screened lists for credit offers.¹⁹ The FTC subsequently sent these ten companies warning letters, recommending that the companies review their products, internal policies and procedures, and employee training programs for compliance with the FCRA.²⁰

The FTC noted that it was warning the recipients but that the letters were not formal complaints since it had not “evaluated” the companies’ practices for FCRA compliance.²¹ However, the FTC specifically pointed to the Teletrack settlement as an example of the penalties it could seek, as well as to another recent settlement in which a data broker was enjoined from certain practices and required to adopt FCRA compliance procedures for a period of 20 years.²²

A Global Push

Internationally, the FTC’s efforts were complemented by similar actions by other member nations in the Global Privacy Enforcement Network (GPEN).²³ According to its mission statement, GPEN aims to “connect[] privacy enforcement authorities from around the world to promote and support cooperation in cross-border enforcement of laws protecting privacy.”²⁴ For 2013, GPEN member states are focusing on privacy practice transparency.²⁵ Other member countries, including Canada, the UK, Australia, Germany, and Hong Kong, participated in their own compliance efforts in early May.²⁶ In Canada, for instance, authorities conducted a “sweep” of numerous popular websites to check for privacy policies and contact information.²⁷

Continuing Efforts

The FTC’s sting operation, coupled with the actions of its international peers, is further evidence that regulatory authorities are keeping their eyes on privacy. As for the recipients of the FTC’s warning letters, there have been some mixed reactions, both to the commission’s interpretation of the FCRA and to its test-shopping operation. Even while the FTC has taken the position that CRAs, as defined by Section 1681a(f), encompass more than traditional credit bureaus,²⁸ a few of the companies dispute whether they acted unlawfully or are CRAs to begin with. Mr. Moss, for his part, acknowledged that Crimcheck.com is a CRA, though he insisted that his company was in compliance with the FCRA.²⁹ In contrast, Eric Kaminsky, CEO of US Data Corporation, disputed the FTC’s characterization of his business as a CRA, while at the same time praising the commission’s efforts to “catch people who are bad guys.”³⁰

Even if the recipients agree that the FTC is right to go after the “bad guys,” the enforcement efforts are instead most likely to impact the unaware. Indeed, one goal of the FTC is to raise awareness about consumer privacy issues and to encourage businesses that unknowingly or unintentionally may be in violation of the FCRA to revisit their practices.³¹ Whether or not consumer information is sourced from public records or gathered only for marketing or sales purposes, it still may be subject to the FCRA’s many safeguards, depending on the information buyer’s purpose or intentions. Companies would be well advised to ensure their FCRA compliance, to avoid ending up on the FTC’s warning-letter mailing list.