FCRA: FTC Settles First Case Involving Sale of Internet and Social Media Data
On June 12, 2012, the Federal Trade Commission (FTC) announced an $800,000 settlement of Fair Credit Reporting Act (FCRA) charges against a data broker, Spokeo, Inc. (See Settlement Order and Press Release.) The company, through its website Spokeo.com, aggregates personal information collected from hundreds of online sources, including social media. It then produces consumer profiles including someone’s name, address, age range, and e-mail address. They also may include information regarding hobbies, ethnicity, religion, participation on social networking sites, and photographs.
According to the Commission, Spokeo allegedly marketed the profiles to companies in the human resources, background screening, and recruiting industries without taking steps to protect consumers. These actions were claimed to have violated three key requirements of the FCRA: (1) to maintain reasonable procedures to verify who its users are and that the consumer report information would be used for a permissible purpose; (2) to ensure accuracy of consumer reports; and (3) to provide a user notice to any person that purchased its consumer reports and took an adverse action against the person. In addition to paying the FTC $800,000, Spokeo must not misrepresent its data, must give users a chance to correct information, and must disclose its sources.
The FTC’s determinations hinged on its finding that Spokeo was a “consumer reporting agency” (CRA) governed by the FCRA’s regulations and restrictions. As an Internet data broker, Spokeo argued that it had never been their intention to act as a CRA – they denied any allegations that they created their own content, stored or accessed private financial information, or disseminated consumer reports.
Practical Lesson
Ultimately, this settlement marks the FTC’s first significant FCRA action against Internet data brokers, a new area of enforcement that may leave some companies scrambling to reassess their internal procedures and compliance mechanisms. Companies dealing in information about consumers may need to ask whether their business is regulated by the FCRA, particularly given that this action stands as a warning sign of the FTC’s broad FCRA interpretations and intention to carve new avenues for regulation of private information.
About Financial Services Litigation
Troutman Sanders is an accomplished and experienced leader in providing litigation and regulatory advice to a broad spectrum of financial services institutions. The firm’s Financial Services Litigation team is comprised of a dedicated group of trial and regulatory lawyers who regularly focus on resolving the array of issues that confront financial institutions.