FTC Settles Charges Related to Sale and Use of Consumer Mortgage Payment Data

FTC FCRA Consumer Reporting Privacy/Cyber Risk & Data Security

On October 10, the FTC announced that a major consumer reporting agency (CRA) agreed to settle charges that it improperly sold lists of consumers who were late on their mortgage payments. The CRA will pay $393,000 to resolve allegations that it violated the FTC Act by failing to implement procedures to prevent the sale of lists of consumer information to firms that should not have received them. In a separate but related case, which the DOJ pursued under a referral from the FTC, a data reseller and its affiliates settled charges that the companies violated the FTC Act and FCRA by (i) obtaining prescreened lists without having a permissible purpose, (ii) reselling the reports without disclosing to the consumer reporting agency that provided them who the end users would be, (iii) failing to maintain reasonable procedures to ensure that prospective users had a permissible purpose to get them, (iv) to the extent that firm offers of credit were made, failing to maintain a record of the criteria used to select consumers for these offers, and (v) failing to control access to sensitive consumer financial information. The resellers agreed to pay a $1.2 million civil penalty and will be barred from using or selling prescreened lists without a permissible purpose, or in connection with solicitations for debt relief or mortgage assistance relief products or services.