The Federal Trade Commission (“FTC”) announced on February 18 that it has reached settlements with three affiliated companies accused of selling the financial and other personal information of “hundreds of thousands” of consumers to illegitimate buyers. The settlements include a judgment against the defendants totaling $5.7 million and a prohibition on their selling consumers’ financial information in the future. Significantly, the FTC noted that while in some industries the effect of sharing customer information may be less harmful, “if your stock-in-trade is personal information…, what’s reasonable under the circumstances may be different.”
In December 2014, the FTC filed its complaint against the three data brokers. The complaint alleged that the defendants obtained hundreds of thousands of applications for payday loans from websites that collected information (including Social Security numbers and bank account information) directly from consumers. The websites provided the applications to data brokers, including the defendants, for the purpose of connecting the consumers with willing buyers for the applications. Instead, the defendants sold only approximately 5% of the applications to lenders, but sold 95% of the applications to non-lender third parties that had no legitimate need for the financial information. According to the complaint, these third parties included “fraudsters, spammers, and telemarketers.” At least one such buyer used the consumers’ information to debit their bank accounts for $4.1 million worth of purported financial products that were never purchased. The FTC complaint alleged that the defendants continued to sell the consumer information to these buyers even after becoming aware of their fraudulent purposes.
The defendants agreed to judgments totaling $5.7 million, which are suspended based on financial condition. In addition, the court entered an unsuspended $4.1 million default judgment against one of the defendants. All of the defendants must destroy all consumer data in their possession within 30 days and are prohibited from selling or transferring consumers’ sensitive financial information to third parties in the future. The settlements and order can be accessed here.
The FTC’s comments in announcing the settlements suggest its willingness to closely scrutinize data brokers and other intermediaries. By noting that “what’s reasonable under the circumstances may be different” in the context of data brokers, and by titling its post: “Dealing in personal data? Seller beware,” the FTC is warning data brokers that they may be held responsible not only for the data in their possession, but also the bad actions of those to whom they knowingly sell data.
Reporter, Tom Randall, Washington, D.C., +1 202 626 5586, trandall@kslaw.com.
