Senator Richard Bryan
Ranking Member
Subcommittee on Financial Institution and
Regulatory Relief
U. S. Senate
364 Russell Senate Office Building
Washington, DC 20510-2804
Dear Senator Bryan:
This responds to your September 20, 1996, letter requesting the Commission's
views concerning reports about a database service provider that allows searches
to be performed by entering a consumer's social security number which enables
them to retrieve a name and address.
The Federal Trade Commission has received numerous complaints and Congressional
inquiries concerning recently-introduced, widely-available commercial services
that provide, for a fee, identifying information on individuals. According
to press reports, at least one tracking service currently furnishes an individual's
name, maiden name, aliases, address, prior address, telephone number and
birth month and year. To access this information, the service will search
for the data by any elements just listed, or by social security numbers.
Apparently, social security numbers are no longer displayed, but the search
for all other identifying information can be made on social security number
alone.
The ready availability of this information through the tracking service
may facilitate identity fraud, credit fraud and other illegal activities.
These concerns may outweigh the limited legitimate uses of this information
for locating individuals. On August 20 of this year, Commission staff met
with representatives of credit bureaus, creditors, law enforcement agencies,
consumer groups, and a number of additional interested parties. The staff
learned how, using the kind of information available on this service, fraud
artists could open credit lines in innocent consumers names and run up unpaid
charges, thereby ruining the consumers credit histories.
The interest of the Commission in the potential misuse of this information
stems in part from its responsibilities in enforcing the Fair Credit Reporting
Act, ("FCRA or ACT"), 15 U.S.C. § 1681 et seq The FCRA,
which was enacted in 1970, is intended, among other things, to promote accurate
consumer reporting and to protect the privacy of consumer report information
compiled by consumer reporting and to protect the privacy of consumer report
information compiled by consumer reporting agencies (also known as credit
bureaus) by restricting access to such information.
Reportedly, this tracking service obtains the consumer information from
a consumer reporting agency that maintains the identifying and other information
in its extensive computer files of data used in the preparing and furnishing
of consumer reports.1
Section 603(d) of the FCRA defines a consumer report2, and Section
604 prohibits consumer reporting agencies from furnishing a consumer report
to anyone who does not have a "permissible purpose" to obtain
the report. If the information provided by the consumer reporting agency
does not meet the definition of a consumer report, however, the FCRA does
not apply and the recipient does not need a permissible purpose to obtain
the information. No provision of the FCRA specifically prohibits the release
of non-credit related consumer identifying information.3
Nonetheless, the Commission believes that in light of the information it
has recently obtained about credit identity fraud, it may be appropriate
to reexamine the elements of information that consumer reporting agencies
can legally provide to recipients who do not have a statutorily defined
permissible purpose to obtain the information. Because many otherwise neutral
consumer identifiers are now recognized to be, either individually or in
combination, critical elements in systems of fraud prevention and security,
the Commission believes that these identifiers may warrant the same protections
afforded to other consumer information specified in the FCRA.
Accordingly, Congress may wish to consider amending the Fair Credit Reporting
Act to provide confidentiality protections to the following elements of
consumer identification: social security number, mother's maiden name, prior
addresses and date of birth. In order to accomplish this we suggest addition
of the following language as Section 603(k), 15 U.S.C. 1681a(k)
The term "consumer report" also includes any communication by a consumer reporting agency of any identifying information other than the consumers name, generational designation, current address and telephone number.Congress may also wish to consider amending Section 602 of the Act, which sets out the findings and purpose of Congress in enacting the FCRA, as follows:
§ 602. Findings and purposeIf you have any questions or wish to discuss this response further, please feel free to contact David Medine, Associate Director for Credit Practices, at (202) 326-3025.
(a) the Congress makes the following findings:
***(b) It is the purpose of this title to require that consumer reporting agencies adopt reasonable procedures for meeting the needs of commerce for consumer credit, personal, insurance, and other information in a manner which is fair and equitable to the consumer, with regard to the confidentiality, accuracy, relevancy and proper utilization of such information, including indentifying information, in accordance with the requirements of this title.
(4) There is a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, concern for the confidentiality of consumer information, and a respect for the consumer's right to privacy.
1 Certain of this information may be available from other sources not subject to the FCRA.
2 Section 603(d) defines "consumer report " as "information... bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living which is used or expected to be used or collected in whole or in part for the purpose of serving as a factor in establishing the consumer's eligibility for (1) credit or insurance... (2) employment...or (3) other purposes authorized under section 604."
3 In early 1993, the Federal Trade Commission entered into an
agreed order amending its 1991 consent order against TRW Inc. (FTC v TRW
Inc., 784 F Supp. 361 (N.D. Tex 1991)), restricting TRW's ability to engage
in target marketing, the practice of using information from consumer reports
to develop and sell direct marketing lists. The amended order provides
that TRW may, in the sale or distribution of lists of consumers, use the
following identifying information from its consumer reporting database:
name, telephone number, mother's maiden name address, zip code, year of
birth, age, any generational designation, social security number, or substantially
similar identifiers or any combination thereof.
Posted on September 25, 1996 || Transcribed from hard copy