While this debate has been factual and I'm happy to let it continue,
let's not forget the positive, socially beneficial services provided by
credit reporting and the free flow of information. I wrote last year's
cover story for Reason magazine on this:
http://www.reason.com/0406/fe.dm.database.shtml
-Declan
-------- Original Message --------
Subject: Re: [Politech] An insider says EPIC hasn't done homework on
credit agencies [priv]
Date: Thu, 13 Jan 2005 23:01:46 -0500
From: Joel Reidenberg <reidenberg@private>
Reply-To: reidenberg@private
Organization: Fordham Law School
To: Declan McCullagh <declan@private>
CC: politech@private
References: <41E60142.7030902@private>
Declan,
I have followed the various exchanges about the EPIC/Choice Point
letters on your list. As you may know, I was one of the FCRA experts
who testified in the FTC v. Trans Union proceeding that resulted in the
landmark ruling holding that Trans Union’s use of consumer reporting
information for marketing purposes was illegal. FTC v. Trans Union, 245
F.3d 809 (D.C. Cir., 2001) cert. denied 536 U.S. 915 (2002). I am
concerned that your readers will be misinformed about the FCRA because
of significant errors that were stated in a recent post by Bill Fason.
Mr. Fason’s assertion that the FCRA does not apply to public record
information is simply wrong. The FCRA applies to any information that
is collected for a consumer reporting purpose. The statute and the
courts have been quite clear: “Under the FCRA whether a credit report is
a consumer report does not depend solely upon the ultimate use to which
the information contained therein is put, but instead, it is governed by
the purpose for which the information was originally collected in whole
or in part by the consumer reporting agency.” Bakker v. McKinnon, 52
F.3d 1007 (8th Cir., 1998). Whether the data comes from a public
record or a private record is legally irrelevant to the applicability of
the FCRA. Once any data is collected for a consumer reporting purpose
as defined by the statute, then uses of that data, in whole or in part,
that are not expressly authorized by the FCRA are illegal. FTC v.
Trans Union, 245 F.3d 809 (D.C. Cir., 2001) cert. denied 536 U.S. 915
(2002).
Mr. Fason suggests that the distinctions in the data reported in a
traditional credit report as compared to an AutoTrackXP report are
legally significant. This too is completely wrong. Under the FCRA and
the Trans Union decision, the distinctions he describes do not matter.
The relevant legal issue is whether the data used to generate an
AutoTrackXP report was originally collected for consumer reporting
purposes. If so, his description of an AutoTrackXP report would still
be subject to the FCRA. Ironically, Mr. Frason’s post raises important
questions about the legality of AutoTrackXP that can only be answered
through an FTC investigation or private law suit. Mr. Fason
acknowledges that he has hands-on experience with AutoTrackXP reports
along with credit reports as a private investigator and debt
collector. While he does not specifically say that he used AutoTrackXP
to find witnesses, defendants or assets in connection with debt
collection, any of these practices would unarguably be subject to the
FCRA under Section 604. If this is how he and others use AutoTrackXP,
then they and ChoicePoint have a substantial liability issue under the
FCRA. If the the AutoTrack reports are not used in connection with
debt collection, the issue of co-mingled data between permissible and
non-permissible uses still remains. Mr. Fason does not, and most likely
cannot, say anything about ChoicePoint’s data collection and storage
practices, and specifically whether ChoicePoint processes data collected
for consumer reporting purposes in its AutoTrackXP algorithms. As the
Trans Union case clearly demonstrated, the only way to actually find out
how these products are really used, why a company collected particular
information in the first place and how a company’s systems process that
data is through a legal investigation of the company’s information
practices.
Regards,
Joel
Of possible interest:
/Privacy Wrongs in Search of Remedies
<http://reidenberg.home.sprynet.com/PrivacyWrongs.pdf> ,/ 54 HASTINGS L.
J. 877 (2003)
********************************************
Joel R. Reidenberg
Professor of Law
Fordham University School of Law
140 West 62nd Street
New York, NY 10023
Tel: 212-636-6843
Fax: 212-636-6899
Email: <reidenberg@private>
Web page: <http://reidenberg.home.sprynet.com>
********************************************
-------- Original Message --------
Subject: EPIC ChoicePoint Letter
Date: Thu, 13 Jan 2005 17:03:08 +0000
From: djsolove@private
To: declan@private
Dear Declan,
A lot has been written on your list about the letter Chris Hoofnagle
(EPIC) and I wrote to the FTC regarding the activities of database
companies such as ChoicePoint. I think that your readers might be
interested in reading the original letter, so they have a more complete
picture of the claims Hoofnagle and I made. I attach the text below.
I also take issue with the claim in the letter from the "insider" that
EPIC hasn't done its "homework." Check out EPIC's ChoicePoint page,
which has over a thousand pages of FOIA material:
http://www.epic.org/privacy/choicepoint as well as Hoofnagle's article,
"Big Brother's Little Helpers: How ChoicePoint and Other Commercial Data
Brokers Collect and Package Your Data for Law Enforcement," 29 N.C. J.
Int'l L. & Com. Reg. 595 (2004).
Regards,
Daniel J. Solove
Associate Professor of Law
George Washington University Law School
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* * * *
December 16, 2004
Federal Trade Commission
600 Pennsylvania Ave., NW
Washington, DC 20580
Re: Request for investigation into data broker products for compliance
with the Fair Credit Reporting Act
Dear Commissioners,
In recent years, there has been an explosion in the creation and use of
dossiers of personal information to evaluate individuals. Some of these
dossiers, known as "data products," in the information brokerage
industry, are designed to be sold so that they avoid triggering the
provisions of Fair Credit Reporting Act of 1970 (FCRA), a landmark law
that ensures that compilations of personal information used for many
different purposes are accurate, correctable, fairly collected.
Additionally, the FCRA mandates that information collectors be
accountable for their practices.
Commercial data broker ChoicePoint, for instance, is selling data
products that are used by law enforcement, government, and the private
sector to make important decisions about people. ChoicePoint,[1] one of
the largest data aggregation companies, became independent from Equifax,
a leading U.S. credit rating agency, in 1997.[2] ChoicePoint has bought
more than 40 companies and competitors, and obtains 40,000 new public
records daily for its database of more than 19 billion records.[3]
Choicepoint contracts with about 35 federal agencies to supply
data.[4]The company's slogan is "Smarter Decisions. Safer World."
However, decisions cannot be smarter, and we cannot be safer, if these
new data products are not subject to the basic fairness requirements
incorporated in the FCRA.
In 1970, Congress passed the FCRA in response to a litany of problems
and complaints about credit reporting agencies.[5] The opening of the
FCRA states:
The Congress makes the following findings:
(1) The banking system is dependent upon fair and accurate credit
reporting. Inaccurate credit reports directly impair the efficiency of
the banking system, and unfair credit reporting methods undermine the
public confidence which is essential to the continued functioning of the
banking system.
(2) An elaborate mechanism has been developed for investigating and
evaluating the credit worthiness, credit standing, credit capacity,
character, and general reputation of consumers.
(3) Consumer reporting agencies have assumed a vital role in assembling
and evaluating consumer credit and other information on consumers.
(4) There is a need to insure that consumer reporting agencies exercise
their grave responsibilities with fairness, impartiality, and a respect
for the consumer's right to privacy.
15 U.S.C. § 1681(a) (1970).
Americans face a return to the pre-FCRA era if companies like
ChoicePoint can amass dossiers on Americans without compliance with any
regime of Fair Information Practices. That era was marked by
unaccountable data companies that reported inaccurate, falsified, and
irrelevant information on Americans, sometimes deliberately to drive up
the prices of insurance or credit.[6] To some extent, this pre-FCRA area
has returned. For instance, erroneous ChoicePoint data sold without the
FCRA's protections were relied upon in Florida to cleanse voting
registration rolls of felons prior to the 2000 election, resulting in
the disenfranchisement of thousands of eligible voters.[7]
In an
<_http://www.epic.org/privacy/choicepoint/fcraltr12.16.04.html#appendix_
<http://www.epic.org/privacy/choicepoint/fcraltr12.16.04.html>>appendix
to this letter, we explain ChoicePoint's business activities.[8]
ChoicePoint sells a number of FCRA products in the employment screening,
tenant screening, and criminal background check fields. But the company
also sells two products, "AutoTrackXP" and "Customer Identification
Programs" outside of the FCRA's protections. AutoTrackXP is a database
of 17 billion records that includes Social Security Number, addresses,
property and vehicle information, and other information.[9] The
company's anti-fraud "Customer Identification Programs" are a suite of
data products that have been created in order to verify the identity and
perform background checks on individuals who open new financial services
accounts. [10] From its description, Customer Identificat! ion Programs
appears to be an AutoTrackXP report with additional identity
verification services.
These two products are sold to financial institutions, members of the
public (private investigators, law firms, etc.) and to law enforcement
agencies. These are the same institutions which rely on credit reports
and investigative consumer reports, but these new products are sold
outside the protections of the FCRA, yet are often used for related (and
sometimes identical) purposes.
It is difficult to determine what sources ChoicePoint used to create
AutoTrackXP and Customer Identification Programs. However, both of these
non-FCRA products have similar data elements and descriptions as
ChoicePoint's FCRA products. The similarities between the information in
an AutoTrackXP report and the company's FCRA products is striking; it
suggests that AutoTrackXP was generated from FCRA sources.[11]
Under a well-developed line of cases, courts interpreting the FCRA have
held that if a data product originates from a consumer report database,
the product remains protected by the FCRA. For instance, the D.C.
Circuit held in Trans Union v. FTC that marketing lists drawn from a
credit reporting agency's master databases were "credit reports" for
purposes of the FCRA.[12]
If ChoicePoint had created AutoTrackXP or its Customer Identification
Programs from FCRA sources, the products should be considered "consumer
reports" for purposes of the FCRA. Consumers could exercise a series of
important rights with respect to their ChoicePoint reports that are not
currently available. Only the FTC can determine the "information flows"
or sources of data used by ChoicePoint, and whether the company has
leaked data from the FCRA products to AutoTrackXP and Customer
Identification Programs. We urge the Commission to engage in this inquiry.
Even if these products are not consumer reports for purposes of the
FCRA, it is incumbent on the FTC to analyze them and make
recommendations to Congress concerning possible expansion of the FCRA.
If these products are found not to be within the FCRA, the FTC should
recommend to Congress to expand the scope of the Act.
Many of the public policy purposes underlying the FCRA are being
circumvented by data brokers who have artfully constructed databases to
avoid the Act's provisions. For instance, the use of data products for
voter registration list cleansing implicates the most important right in
a democracyaccess to the polls. If such a use is not covered by the
FCRA, this creates an absurd consequence. Someone denied access to a
credit card would enjoy access, correction, and other FCRA rights, while
another person denied access to the voting polls would have no federal
information privacy rights.
Other absurd consequences emerge from this end-run around the
protections of the FCRA. Although the FCRA regulates law enforcement
access to consumer report information,[13] the FBI has concluded that
information it buys from ChoicePoint is not subject to the FCRA.[14] In
effect, the FBI has circumvented the FCRA by purchasing data from
AutoTrackXP -- data that is often identical to what appears in a credit
report from one of the "big three" agencies. Why would law enforcement
agencies continue to comply with fair procedures in the FCRA for access
to consumer data when they can get unaccountable, open-door access to
the same information at ChoicePoint?
The use of these data products by law enforcement officials, government
agencies, private investigators, and others raise the same concerns that
prompted Congress to pass the FCRA. Errors in reports provided by
ChoicePoint and similar companies can find their way into other
databases, resulting in the potential for improper arrest and even
imprisonment. People have been wrongly arrested and jailed due to errors
in law enforcement databases.[15] Since information often circulates
between law enforcement records and commercial databases, erroneous
information in a database such as AutoTrackXP can make its way into a
series of other databases, with profoundly harmful effects on people’s
lives. For example, consider the following incident:
[A] Maryland woman wrongly arrested for a burglary was not cleared from
the state’s criminal databases. Her name and SSN also migrated to a
Baltimore County database relating to child protective services cases.
She was fired from her job as a substitute teacher, and only after she
could establish that the information was in error was she rehired. When
she later left that job to run a day care center for the U.S. military,
she was subject to questioning about the erroneous arrest. Later on,
when employed at as a child care director at a YMCA, she was terminated
when her arrest record surfaced in a background clearance check. Since
she could not have the error expunged in sufficient time, the job was
given to another person. Only after several years was the error finally
cleared from the public records.[16]
Finally, we note that under the self-regulatory scheme erected by the
now defunct Individual Reference Services Group, commercial data brokers
choose who is eligible to buy personal information. This is a subtle but
important deviation from the Fair Credit Reporting Act's approach, which
tends to approve record disclosure based on the use of the information,
rather than the identity of the purchaser. The importance of this
difference becomes clear when it is understood that private
investigators, major buyers of personal information, are not licensed in
all fifty states, and in some states that require licensure, it is a pro
forma process.[17] As a result, ChoicePoint and other information
brokers can create ties with marginal businesses or private
investigators with dubious backgrounds. Based on their status of being a
private investigator, a paralegal, or a law enforcement agent,
ChoicePoint's customers can pull information on almost anyone without
having to declare the! ir legal justification or entitlement to the data.
We encourage the Commission to examine access to commercial data broker
information in light of the Amy Boyer case, where a Florida information
broker sold data to the man who stalked and killed Amy Boyer.[18] If the
sale of Ms. Boyer's Social Security Number and other information to a
complete stranger were conditioned upon one of the FCRA's permissible
uses of data, perhaps she would be alive today. The FCRA's reasonable
limitations on the use of data, if applied to this sector of data
brokers, could protect individuals from unwarranted access to and sale
of personal information.
Again, we urge the Commission to engage in a serious inquiry on the
status of data brokers' products. We believe that some of these products
may be "consumer reports" for purposes of the FCRA, thus subjecting both
the seller and the buyer to regulation under the Act. We also think it
incumbent upon the Commission to analyze whether the sale of these new
data products circumvents the FCRA, giving businesses, private
investigators, and law enforcement access to data that previously had
been subjected to Fair Information Practices.
We look forward to hearing from you on this matter, and please contact
us if we can provide more information.
Sincerely,
Chris Jay Hoofnagle, Associate Director, Electronic Privacy Information
Center
Daniel J. Solove* Associate Professor, George Washington University Law
School
*Title and affiliation listed for identification purposes only.
[1] See EPIC ChoicePoint Page, available at
_http://www.epic.org/privacy/choicepoint/_. For more information about
ChoicePoint, see Robert O'Harrow, No Place to Hide: Behind the Scenes of
Our Emerging Surveillance Society (Free Press Jan. 2005).
[2] Duane D. Stanford, All our lives are on file for sale, Atlanta J.
Const., Mar. 21, 2004 at 1A.
[3] Id.
[4] Daniel J. Solove, The Digital Person, Technology and Privacy in the
Information Age 169 (NYU 2004).
[5] Robert Ellis Smith, Ben Franklin's Web Site, Privacy and Security
from Plymouth Rock to the Internet 316-318 (Privacy Journal 2000).
[6] Id.
[7]Solove, Digital Person, 170.
[8] See also, Chris Jay Hoofnagle, Big Brother's Little Helpers: How
ChoicePoint and Other Commercial Data Brokers Collect and Package Your
Data for Law Enforcement, 29 N.C.J. Int'l L. & Com. Reg. 595 (Summer 2004).
[9] ChoicePoint, AutoTrackXP and ChoicePoint Online,
_http://www.choicepoint.com/industry/retail/public_cbi_1.html_.
[10] ChoicePoint, Customer Identification Programs,
_http://www.choicepoint.com/business/financial/patriotact.html_.
[11] See Appendix.
[12] 245 F.3d 809 (D.C. Cir. 2001), cert. denied, 536 U.S. 915 (2002);
Bakker v. McKinnon, 152 F.3d 1007, 1012 (8th Cir. 1998) ("even if report
is used or expected to be used for non-consumer purpose, it may still
fall within definition of consumer report if it contains information
that was originally collected by consumer reporting agency with
expectation that it would be used for consumer purpose"); Ippolito v.
WNS, Inc., 864 F.2d 440, 453 (7th Cir. 1988) ("even if a report is used
or expected to be used for a non-consumer purpose, it may still fall
within the definition of a consumer report if it contains information
that was originally collected by a consumer reporting agency with the
expectation that it would be used for a consumer purpose"); Rice v
Montgomery Ward & Co., 450 F. Supp. 668 (M.D.N.C. 1978).
[13] Law enforcement access to "credit headers" or information from a
full report is subject to substantive and procedural protections. See,
e.g., 15 U.S.C. § 1681b(a)(1).
[14] Memorandum from Office of the General Counsel, National Security
Law Unit, FBI, to National Security, FBI (Sept. 17, 2001) (document
obtained from the FBI), available at
_http://epic.org/privacy/choicepoint/cpfbia.pdf_.
[15] Solove, Digital Person, 109-110.
[16]Solove, Digital Person, supra, at 46-47 (citing Eugene L. Meyer,
"Md. Woman Caught in Wrong Net; Data Errors Link Her to Probes, Cost 3
Jobs," Wash. Post, Dec. 15, 1997, at C1). Another example includes the
case of Scott Lewis, an innocent person who was labeled a criminal
because of an administrative error. After he was able to fix the error,
information brokers continued to circulate erroneous conviction
information. Beth Givens, Identity Theft: The Growing Problem of
Wrongful Criminal Records, Jun. 1, 2000,
_http://www.privacyrights.org/ar/wcr.htm_.
[17] "Some States have few requirements [for private investigator
licensure], and 6 StatesAlabama, Alaska, Colorado, Idaho, Mississippi,
and South Dakotahave no statewide licensing requirements while others
have stringent regulations." U.S. Department of Labor, Bureau of Justice
Statistics, Private Detectives and Investigators, Mar. 21, 2004,
available at _http://www.bls.gov/oco/ocos157.htm_.
[18] Remsburg v. Docusearch, Inc. 149 N.H. 148 (N.H. 2003). More
information about the Amy Boyer case is online at
_http://epic.org/privacy/boyer/_.
----------
Appendix
I. ChoicePoint
ChoicePoint,[1] one of the largest data aggregation companies, became
independent from Equifax, a leading U.S. credit rating agency, in
1997.[2] ChoicePoint has bought more than 40 companies and competitors,
and obtains 40,000 new public records daily to insert into its database
of more than 19 billion records.[3] Its business and government services
division offers through its
<_http://www.epic.org/privacy/choicepoint/fcraltr/AutoTrackXP.pdf_>AutoTrackXP
product identity verification, property records, bankruptcy records,
licenses, liens, judgments, and other records to local, state and
federal law enforcement,[4] including the Drug Enforcement
Administration and the Federal Bureau of Investigation.[5] It also
advertises the AutoTrackXP product as a solution for financial services
anti-fraud and anti-money laundering compliance.[6! ]
ChoicePoint's roots are in information services to the insurance sector.
The company stated in its initial Securities and Exchange Commission
filing that: ChoicePoint's operations have historically consisted of
database information and inspection and investigative services supplied
primarily to the insurance industry. ChoicePoint believes it can enhance
future growth and profitability by offering a broader range of risk
assessment services, fraud management information and technology
solutions to clients outside of the insurance industry. Although Equifax
believes that significant growth opportunities exist for ChoicePoint's
products and services, it anticipates that marketing and promotion of
these services will be necessary. The public perceives, however, that
credit reporting services and the more privacy sensitive services
offered by ChoicePoint should not be available from a single provider.[7]
Since its spinoff from Equifax, ChoicePoint has acquired a number of
information collection and processing companies.[8] As a provider of
personal information to the insurance sector, from its inception,
ChoicePoint's activities have been subject to the FCRA.[9]
II. ChoicePoint's FCRA Business Activities
ChoicePoint sells a number of information products in the employment
screening, tenant screening, and personal insurance areas. Many of these
information products are FCRA databases and require both ChoicePoint and
the company's clients to comply with the Act. This section summarizes
ChoicePoint's FCRA employment screening, tenant screening, and personal
insurance products. The next section turns to AutoTrackXP and "Customer
Identification Programs," ChoicePoint's non-FCRA data products that are
similar to the company's FCRA employment, tenant, and insurance
screening products.
A. ChoicePoint's "CP Online" Product
On its website, ChoicePoint markets a pre-employment screening service
named "CP Online." The company claims that that product is FCRA-compliant:
ChoicePoint Online is a comprehensive Web-based screening interface
designed to help employers meet their pre-employment screening needs
regarding background verification and drug testing administration.
ChoicePoint Online is FCRA-compliant and offers easy-to-use data entry
screens, duplicate request notification and alerts for possible criminal
records. Using ChoicePoint Online's interactive ordering system,
flexible reporting options, process monitoring and online billing, users
can gain valuable information to help make better decisions and employ
more efficient hiring practices.[10]
…* FCRA Summary of Consumer Rights attached to all decisional reports
ChoicePoint lists the following databases as being available for
pre-employment search through the CPOnline product:
Stanton® Assessments
State Law Reference Library
National Criminal File
Driver Qualification File
Criminal Background Checks
Identity Verification
MVRs
Credit History
Employment Verification
Education Verification
Military History
Worker's Compensation
License, Credentials and Certification Verification
Business or Personal Reference Verification[11]
B. ChoicePoint's "National Criminal File" Product
On its website, ChoicePoint markets a pre-employment screening service
named
"<_http://www.epic.org/privacy/choicepoint/fcraltr/NCrF.pdf_>National
Criminal File." The company claims that that product is FCRA-compliant:
ChoicePoint National Criminal File is a comprehensive search of multiple
criminal record sources, including fugitive file, state and county
criminal record repositories, ChoicePoint proprietary criminal record
information, prison, parole and release files from state Department of
Corrections, Administrative Office of Courts and other state agencies.
Key Features & Benefits
* Access to more than 100 million criminal conviction records across all
50 states
* National reach at an economically feasible price
* FCRA Compliant…[12]
C. ChoicePoint's "Resident Data" Screening Product
On its website, ChoicePoint markets a tenant screening service named
"Resident Data." The company claims that that product is FCRA-compliant:
Resident Data is an industry leader in apartment resident screening and
debt collections. Our mission is to maximize customer profitability by
managing resident profile risk, collecting maximum payments from
residents who default, and creating an environment of resident
accountability.
Our integrated screening, skip watch and collections solutions enable
apartment owners and managers to better direct their properties by
providing flexible solutions that adapt to the individual needs of the
community.
Resident Data helps reduce liability by improving compliance with FCRA
and Fair Housing requirements.[13]
ChoicePoint lists the following data elements as being available for
tenant screening through the "Resident Data" product:
Access to Criminal, Registered Sex Offender and Eviction Databases.
[…]
* Online access to more than 77 million criminal records, State and
county criminal record repositories.
* 39 States of Registered Sex Offender Records.
* FBI Terrorism Watch List - Including FBI Most Wanted list and FBI
Terrorist database list.
* Proprietary records from ChoicePoint's other screening business results.
* Offender and offense descriptions.
[…]
National Eviction Search
ChoicePoint has more than 10 million current records from 45 states. The
data includes initial filings, dispossessory warrants and property
actions. Resident Data searches every state where the applicant has a
prior address as part of its search, not just the state where the
applicant is applying.
[…]
Unit Application Analysis
For roommates or multiple applicants, the Resident Data system evaluates
all applicants on a per-unit basis and presents a recommendation for the
group. Individual screening outcomes are also noted on the report.
[…]
Occupant Processing
Resident Data also offers occupant screening to protect your property
from potential problem residents who are not financially responsible for
a lease. We can provide legally compliant screening services on
potential occupants without initiating a credit check.
[…]
Maximum Evaluation of the Credit Report
The Resident Data review of the credit report includes fraud alerts,
SafeScan warnings for possible Social Security Number problems, landlord
or utility debt, address matching and full review of payment
performance.[14]
D. ChoicePoint's CLUE Personal Auto Product
On its website, ChoicePoint markets a personal insurance screening
service named
"<_http://www.epic.org/privacy/choicepoint/fcraltr/CLUEAutoUnderwriter.pdf_>CLUE
Personal Auto:"
C.L.U.E. (Comprehensive Loss Underwriting Exchange) is a claim history
information exchange that enables insurance companies to access prior
claim information in the underwriting and rating process. C.L.U.E.
Personal Auto reports contain up to five years of personal automobile
claims matching the search criteria submitted by the inquiring insurance
company. Data provided in C.L.U.E. reports includes policy information
such as name, date of birth and policy number; claim information such as
date of loss, type of loss and amounts paid; and vehicle information.
More than 95 percent of insurers writing automobile coverage provide
claims data to the C.L.U.E. Personal Auto database. By providing
immediate interactive information, C.L.U.E. Personal Auto helps insurers
and agents make immediate business decisions.[15]
The data elements in the CLUE Personal Auto report include: names of
other drivers possible associated with the person applying for
insurance, claims information, vehicle descriptions, and vehicle
ownership.[16]
E. ChoicePoint's "Motor Vehicle Records" Product
On its website, ChoicePoint markets a personal insurance screening
service named
"<_http://www.epic.org/privacy/choicepoint/fcraltr/mvrhowtoread.pdf_>Motor
Vehicle Records:"
ChoicePoint provides driving records, including standard violation
codes, from all 50 states and three Canadian provinces in an
easy-to-read standardized format. Online access to driving records is
available for 40 states and two provinces, and ChoicePoint continues to
add to the list of states with online access.[17]
The data elements in the Motor Vehicle Records report include: contact
information, driver license number, physical descriptions of drivers,
and additional drivers that may be associated with the data subject.[18]
F. ChoicePoint's "National Credit File" Product
On its website, ChoicePoint markets a product named
"<_http://www.epic.org/privacy/choicepoint/fcraltr/NCF.pdf_>National
Credit File:"
ChoicePoint's National Credit File provides insurance carriers with
online consumer credit reports obtained from the three major credit
bureaus. Carriers then consider the financial history of the applicant
and assess the applicant's risk for quoting, underwriting and renewal
purposes.[19]
The data elements in the National Credit File report include: contact
information, bankruptcies, public records, liens, collection items,
employment information, and tradelines.[20]
III. ChoicePoint's Apparent Non-FCRA Products
In addition to the FCRA products described above, ChoicePoint markets
two additional, popular data products to law enforcement, financial
services companies, private investigators, law firms, and other
businesses. These products are known as "AutoTrackXP" and "Customer
Identification Programs."
A. ChoicePoint's "AutoTrackXP" Product
On its website, ChoicePoint markets "AutoTrackXP", which is described as:
AutoTrackXP and ChoicePoint Online provide Internet access to more than
17 billion current and historical records on individuals and businesses,
and allow users to browse through those records instantly. With as
little information as a name or Social Security number, both products
cross-reference public and proprietary records including identity
verification information, relatives and associates, corporate
information, real property records and deed transfers. In addition,
access is available to a staff of field researches who perform county,
state and federal courthouse searches.[21]
The advertised data elements in AutoTrackXP include:
Discovery PLUS!™ - through ChoicePoint Online
* Compiles a comprehensive report on an individual including current and
previous addresses, relatives, assets, corporate involvement and
derogatory information.
* Returns list where no matches were found.
* Also available Discovery PLUS! with Vehicle Identification Number.
Info:PROBE™ - through ChoicePoint Online
* Checks millions of records simultaneously and provides a "shopping
list" of databases, which contains records that match the search
criteria. A client can then choose which databases to view.
[…]
<_http://www.epic.org/privacy/choicepoint/fcraltr/nationalcomprehensive.pdf_>National
Comprehensive Report – through AutoTrackXP
* Searches national and state databases for a summary of assets, driver
licenses, professional licenses, real property, vehicles, and more.
* Each report offers the ability to add associates to the report, which
include relatives, others linked to the same addresses as the subject
and neighbors.[22]
A sample AutoTrackXP report on the ChoicePoint web site shows that it
contains Social Security Numbers; driver license numbers; address
history; phone numbers; property ownership and transfer records;
vehicle, boat, and plane registrations; UCC filings; financial
information such as bankruptcies, liens, and judgments; professional
licenses; business affiliations; "other people who have used the same
address of the subject," "possible licensed drivers at the subject's
address," and information about the data subject's relatives and
neighbors.[23] The AutoTrackXP report is very similar in content to a
standard credit report issued by one of the "big three" credit reporting
agencies.
However, there is no indication that AutoTrackXP is sold within the
FCRA's procedural and substantive safeguards. ChoicePoint seems to have
treated the data product outside the FCRA and subject only to the
now-defunct Individual Reference Service Group self-regulatory
principles. This means that anyone with a ChoicePoint account can buy an
AutoTrackXP account.
It appears that both ChoicePoint and federal law enforcement share the
view that AutoTrackXP is outside the FCRA's protections. In a document
obtained by EPIC under the Freedom of Information Act from the Federal
Bureau of Investigation, the agency concluded that ChoicePoint's
products are not covered by the FCRA: "In this instance, none of the
information which the FBI would seek to review has been collected by
ChoicePoint for any of the [FCRA] purposes."[24]
B. ChoicePoint's Customer Identification Programs
On its website, ChoicePoint offers "Customer Identification Programs,"
described as a PATRIOT Act compliance mechanism with many data elements
similar to AutoTrackXP:
Identification Solutions
Basic identification solutions ensure that name, address, date of birth
and Social Security numbers match. This includes a check against
required government sanctions lists. Enhanced due diligence solutions
include telephone numbers, historical information, criminal records, key
relationships, international information and comprehensive individual
and business reports.
[…]
You’ll benefit from our unique offerings, including:
* Access to more than 17 billion public records and three major credit
bureaus.
* An extensive proprietary identity database.
* National real property information.
* Nationwide corporate and business information.
* A vast database of drivers’ license data and motor vehicle records.
* National criminal history database.
* Access to the Office of Foreign Asset Control and other government
sanctions and enforcement actions, including international information.[25]
[1] See EPIC ChoicePoint Page, available at
_http://www.epic.org/privacy/choicepoint/_. For more information about
ChoicePoint, see Robert O'Harrow, No Place to Hide: Behind the Scenes of
Our Emerging Surveillance Society (Free Press Jan. 2005).
[2] Duane D. Stanford, All our lives are on file for sale, Atlanta J.
Const., Mar. 21, 2004 at 1A.
[3] Id.
[4]ChoicePoint, AutoTrackXP and ChoicePoint Online,
_http://www.choicepoint.com/industry/government/_ public_le_1.html
(accessed Oct. 25, 2004).
[5] Chris Jay Hoofnagle, Big Brother's Little Helpers: How ChoicePoint
and Other Commercial Data Brokers Collect and Package Your Data for Law
Enforcement, 29 N.C.J. Int'l L. & Com. Reg. 595 (Summer 2004).
[6]ChoicePoint, All Financial Solutions,
_http://www.choicepoint.com/business/financial/allfinan.html_ (accessed
Oct. 25, 2004).
[7] ChoicePoint Corporation, SEC Registration of securities [Section
12(b)], Jun. 9, 1997.
[8] These include: National Data Retrieval, Inc., a provider of public
records information; List Source, Inc., d/b/a Kramer Lead Marketing
Group, a marketing company in the life and health insurance and
financial services markets; Mortgage Asset Research Institute, Inc., a
mortgage fraud monitoring company; Identico Systems, LLC, a customer
identity verification company; Templar Corporation; insuranceDecisions,
Inc., an insurance industry claims administration company; Bridger
Systems, Inc., a USA PATRIOT Act compliance company; CITI NETWORK, Inc.
d/b/a Applicant Screening and Processing, a tenant screening company;
TML Information Services, Inc., a provider of motor vehicle reports.
ChoicePoint Corporation, SEC Form 10-K, Mar. 5, 2004. With respect to
TML Information Service, ChoicePoint purchased "certain assets" of the
company. Drug Free, Inc., a drug testing company; National Drug Testing,
Inc., a drug testing company; Application Profiles, Inc., a background
check co! mpany; Informus Corporation; a company enabling ChoicePoint to
offer products online; Tyler-McLennon, Inc., a background screening
company; ChoicePoint Direct Inc., formerly known as Customer Development
Corporation, a database marketing company; EquiSearch Services, Inc.;
DATEQ Information Network, Inc., an insurance underwriting services
company; Washington Document Service, Inc., a court record retrieval
service; DataTracks Technology, Inc., a public record information
company; DataMart, Inc., a database software company; Statewide Data
Services, Inc; NSA Resources, Inc., a drug testing company; DBT Online,
Inc., a public record services provider; RRS Police Records Management,
Inc., a provider of police reports and related services; VIS’N Service
Corporation; Cat Data Group, LLC; Drug Free Consortium, a drug testing
company; BTi Employee Screening Services, Inc., an employee
pre-screening services company; ABI Consulting Inc., a drug screening
company; Insurity Solution! s, Inc., an insurance rating company;
National Medical Review Offices, Inc.; Bode Technology Group, Inc., a
DNA identification company; Marketing Information & Technology, Inc., a
direct marketing company; Pinkerton’s, Inc., a preemployment screening
company; Total eData Corporation, an e-mail database company; L&S Report
Service, Inc., a provider of police records; Resident Data, Inc., a
residential screening services provider; Vital Chek Network, Inc., a
provider of vital records; Accident Report Services, Inc., a provider of
police records. ChoicePoint Corporation, SEC Form 10-K, Mar. 26, 2003.
Programming Resources Company, insurance software company; Professional
Test Administrators, Inc., a drug testing company; CDB Infotek, a seller
of public records; Medical Information Network, LLC, an online physician
verification service. ChoicePoint Corporation, SEC Form 10-K, Feb. 16,
2001. Rapsheets.com, an online provider of criminal records data.
ChoicePoint acquired Rapsheets, a provider of online criminal records
data, Information Tod! ay, Inc., Sept. 1, 2004.
[9] "Certain data and services provided by ChoicePoint are subject to
regulation by the Federal Trade Commission under the Federal Fair Credit
Reporting Act, and to a lesser extent, by various other federal, state
and local regulatory authorities. Compliance with existing federal,
state and local laws and regulations has not had, and is not anticipated
to have, a material adverse effect on the results of operations or
financial condition of ChoicePoint. Nonetheless, federal, state and
local regulations in the United States designed to protect the public
from the misutilization of personal information in the marketplace may
increasingly affect the operations of ChoicePoint, which could result in
substantial regulatory compliance and litigation expense, adverse
publicity and a loss of revenue. Id.
[10]ChoicePoint, CP Online,
_http://www.choicepoint.com/business/pre_employ/pre_employ_2.html_.
[11] Id. ChoicePoint offers similar information for employment purposes
under the product names "ScreenNow," "Screening Network," and "Secure
Point."
[12]ChoicePoint, National Criminal File,
_http://www.choicepoint.com/business/pre_employ/pre_employ_4_1.html_. In
November 2001, ChoicePoint introduced the National Criminal File
database, one that then contained, "more than 20 million conviction
records from jurisdictions around the country." David J. Cook, then
ChoicePoint vice president, was quoted saying that the National Criminal
File was created for employment screening purposes: "We have two large
clients who want to run a large national criminal search on every one of
their employees." Lisa Guernsey, What Did You DO Before the War?, New
York Times, Nov. 22, 2001.
[13] ChoicePoint, Resident Data,
_http://www.choicepoint.com/business/public/cbi_5.html_.
[14] ChoicePoint, Screening Unique Services and Features,
_http://www.residentdata.com/services/screening_features.asp_.
[15] ChoicePoint, CLUE Personal Auto,
_http://www.choicepoint.com/business/pc_ins/us_1.html_. ChoicePoint
markets a similar product for other property as
"<_http://www.epic.org/privacy/choicepoint/fcraltr/CLUEPropertyUnderwriter.pdf_>CLUE
Personal Property."
[16] ChoicePoint, CLUE Personal Auto Report,
_http://www.choicepoint.com/sample_rpts/CLUEAutoUnderwriter.pdf_.
[17] ChoicePoint, Motor Vehicle Records,
_http://www.choicepoint.com/business/pc_ins/us_5.html_.
[18] ChoicePoint, Motor Vehicle Records Report,
_http://www.choicepoint.com/sample_rpts/mvrhowtoread.pdf_.
[19] ChoicePoint, National Credit File,
_http://www.choicepoint.com/business/pc_ins/us_9.html_.
[20] ChoicePoint, National Credit File Report,
_http://www.choicepoint.com/sample_rpts/NCF.pdf_.
[21] ChoicePoint, AutoTrackXP and ChoicePoint Online,
_http://www.choicepoint.com/industry/retail/public_cbi_1.html_.
[22] Id.
[23] ChoicePoint, AutoTrackXP Report,
_http://www.choicepoint.com/sample_rpts/AutoTrackXP.pdf_.
[24] Memorandum from Office of the General Counsel, National Security
Law Unit, FBI, to National Security, FBI (Sept. 17, 2001) (document
obtained from the FBI), available at
_http://epic.org/privacy/choicepoint/cpfbia.pdf_
[25] ChoicePoint, Customer Identification Programs,
_http://www.choicepoint.com/business/financial/patriotact.html_.
<_http://www.epic.org/privacy/_>EPIC Privacy Page |
<_http://www.epic.org/_>EPIC Home Page
Last Updated: December 16, 2004
Page URL: _http://www.epic.org/privacy/choicepoint/fcraltr12.16.04.html_
_______________________________________________
Politech mailing list
Archived at http://www.politechbot.com/
Moderated by Declan McCullagh (http://www.mccullagh.org/)
This archive was generated by hypermail 2.1.3 : Thu Jan 13 2005 - 22:52:31 PST