A 40-year old organization that provides consumer information has settled Federal Trade Commision (FTC) charges that it failed to properly screen potential customers, leading to the sale of at least 318 credit reports to identity thieves.
The defendents, Rental Research Services, Inc. (RRS) and Lee Mikkelson (vice president and managing officer of RRS), based in Eden Prairie, Minn., provide tenant screening reports, which contain personal data culled from credit reporting agencies, such as Equifax and Fair Isaac Corporation, to individuals and business clients, such as landlords seeking credit reports on potential tenants.
The complaint, filed in United States District Court for the District of Minnesota, stated that the tenant screening reports “contain the personal information of consumers, including names, Social Security numbers, dates of birth, bank and credit card account numbers, and credit histories, much of which is sensitive and not publicly available.”
In at least 318 instances, the FTC complaint stated, the defendants furnished consumer reports “to persons that did not have a permissible purpose to obtain a consumer report,” a violation of The Fair and Accurate Credit Transactions Act.
The FTC charged that RRS failed to maintain “reasonable procedures to prevent such impermissible disclosures and to verify their customers' identities and how they intended to use the information.”
The settlement prescribes that RRS cease providing information to anyone lacking legitimate claim to it. It was also ordered to enlist a security procedure to protect data and to submit to a third-party audit every other year for 20 years. A $500,000 judgment was suspended based on the defendants' inability to pay, though this may be rescinded if the company is found to have misrepresented its finances, the FTC said in a statement.
The FTC will also be monitoring RRS to make sure the company complies with the FTC stipulations.
"We expect companies in the business of selling personal information to take reasonable steps to protect it," Molly Crawford, an attorney with the FTC division of privacy and identity protection, told SCMagazineUS.com Friday.
Asked to comment, Lee Mikkelson of RRS told SCMagazineUS.com Thursday, "We are going to prepare a statement and will release that soon." [UPDATE: his comments are below]
Crawford said the charges against RRS were somewhat similar, though not in scale, to those the FTC brought against ChoicePoint, another instance where a company that sells consumer reports failed to have reasonable procedures in place to protect that data in violation of the Fair Credit Reporting Act.
The FTC provides education to inform consumers and businesses how to better protect personal information, Crawford added.
The defendents, Rental Research Services, Inc. (RRS) and Lee Mikkelson (vice president and managing officer of RRS), based in Eden Prairie, Minn., provide tenant screening reports, which contain personal data culled from credit reporting agencies, such as Equifax and Fair Isaac Corporation, to individuals and business clients, such as landlords seeking credit reports on potential tenants.
The complaint, filed in United States District Court for the District of Minnesota, stated that the tenant screening reports “contain the personal information of consumers, including names, Social Security numbers, dates of birth, bank and credit card account numbers, and credit histories, much of which is sensitive and not publicly available.”
In at least 318 instances, the FTC complaint stated, the defendants furnished consumer reports “to persons that did not have a permissible purpose to obtain a consumer report,” a violation of The Fair and Accurate Credit Transactions Act.
The FTC charged that RRS failed to maintain “reasonable procedures to prevent such impermissible disclosures and to verify their customers' identities and how they intended to use the information.”
The settlement prescribes that RRS cease providing information to anyone lacking legitimate claim to it. It was also ordered to enlist a security procedure to protect data and to submit to a third-party audit every other year for 20 years. A $500,000 judgment was suspended based on the defendants' inability to pay, though this may be rescinded if the company is found to have misrepresented its finances, the FTC said in a statement.
The FTC will also be monitoring RRS to make sure the company complies with the FTC stipulations.
"We expect companies in the business of selling personal information to take reasonable steps to protect it," Molly Crawford, an attorney with the FTC division of privacy and identity protection, told SCMagazineUS.com Friday.
Asked to comment, Lee Mikkelson of RRS told SCMagazineUS.com Thursday, "We are going to prepare a statement and will release that soon." [UPDATE: his comments are below]
Crawford said the charges against RRS were somewhat similar, though not in scale, to those the FTC brought against ChoicePoint, another instance where a company that sells consumer reports failed to have reasonable procedures in place to protect that data in violation of the Fair Credit Reporting Act.
The FTC provides education to inform consumers and businesses how to better protect personal information, Crawford added.
