May 6, 2013
Previously published on May 2, 2013
In recent enforcement actions, the Federal Trade Commission (FTC) continues to show its regulatory teeth in the FCRA arena. On April 30, 2013, the FTC settled charges against two criminal record vendors, Filiquarian Publishing LLC and Choice Level LLC, as well as their CEO Joshua Linsk, for various Fair Credit Reporting Act (FCRA) violations in the operation of consumer reporting agencies. Filiquarian’s business involved the sale of mobile apps to consumers that allowed searchable access to hundreds of thousands of criminal records. Customers could download the app via iTunes or the Google Android store and perform an unlimited number of criminal-record searches in a particular state or county. The raw data was provided to Filiquarian by Choice Level - then accessed by consumers through the mobile app. The FTC’s administrative complaint charged the companies with failing to ensure that the information that they sold was accurate and would be used only for legally permissible purposes. The companies also failed to inform report users of their FCRA obligations, including the requirement under FCRA § 1681k to notify consumers if an adverse action was taken against them based on a report. The FTC noted in the complaint that both Filiquarian and Choice Level provided disclaimers to customers stating that their businesses and services were not FCRA compliant and should not be considered for insurance, employment, or credit screening. According to the FTC, a company does not comply with the FCRA by relying on a blanket, published prohibition that its users not use such information for purposes regulated by the FCRA where the company does no active monitoring or auditing. This was particularly problematic given the companies’ clear advertisements and expectations that the reports could be used for employments purposes, an area regulated by the FCRA. The consent order provides only for injunctive relief. It bars Filiquarian and Choice Level from furnishing a consumer report to anyone without a permissible purpose and requires them to take reasonable steps to maximize possible accuracy of the information they furnish. It also mandates that they provide users of their reports with information about their obligations under the FCRA. Violations of the settlement order - which will stay in effect for twenty years - may be subject to civil penalties of up to $16,000 per violation. Practical Impact The Filiquarian settlement teaches that companies outside the purview of the Consumer Financial Protection Bureau (CFPB) that think they are immune from federal oversight are dead wrong. While some of its powers have been usurped by the CFPB, the FTC remains focused on consumer protection and the FCRA in particular. The Filiquarian case indicates that, in line with the CFPB’s recent trend, the FTC may be looking to become a more aggressive and systematic regulator in the FCRA space. Additionally, recent enforcement actions by the CFPB and FTC make clear that all companies that obtain or use personal information about consumers should be aware of the FCRA. This case highlights the need for companies to acutely understand and recognize the difference between FCRA and non-FCRA information, as the FCRA has an extensive body of complex regulations and potential civil and regulatory liabilities.
|