Consumer Law & Policy Blog

Uncle Sam: Dangerously Careless With Our SSNs

Ed Mierzwinski over at U.S. PIRG's consumer blog has this informative piece about recent U.S. government disclosures of our social security numbers.  Ed links to stories in today's New York Times and Washington Post describing these disclosures in detail.  Worth a look.

More on Whether the Federal Government is a "Consumer Reporting Agency" Under the FCRA

by Jeff Sovern

On Wednesday I blogged about whether lenders who trolled for potential borrowers through a federal database containing the financial records of millions of student aid applicants might have violated the Fair Credit Reporting Act.  The answer depends in part on whether a government agency qualifies as a consumer reporting agency within the meaning of the FCRA.  Notwithstanding the statutory language which I referred to on Wednesday, some authority states that it does not.  In Ollestad v. Kelley, 573 F.2d 1109, 1110 (9th Cir. 1978), the Court wrote:

The district court concluded that the FCRA does not apply to records held by federal agencies and granted defendants' motion for summary judgment. That conclusion was proper in light of the plain language of the statute, the absence of evidence of Congressional intent to include federal agencies within the statutory definition of “consumer reporting agency,” and the Federal Trade Commission's interpretation of the statute.

But the case is easily distinguishable and the statements appear to be overbroad dicta.  The plaintiff in Ollestad had sought an injunction under the FCRA to obtain corrections in his FBI records.  After quoting the definition of a consumer reporting agency, the court wrote: "It cannot be contended seriously that agencies such as the F.B.I. compile information on persons, particularly on former employees as is the appellant, for the purpose of furnishing consumer reports to third parties."  In addition, in commenting on the legislative history, the Court explained that "Although the FCRA's legislative history is less than explicit, the tenor of remarks of members of Congress indicates that the statute is concerned with regulating practices in the credit reporting industry rather than with regulating the record-keeping functions of federal agencies."  The student loan database, by contrast, has to do with the credit industry.

Are Lenders Trolling a Federal Student Loan Database to Solicit Borrowers Violating the FCRA?

by Jeff Sovern

The Washington Post had a story on Sunday about fears that lenders are trolling for potential borrowers through a federal database that contains the financial records of millions of student aid applicants.  Today's New York Times reports that because of the concerns, the Education Department has temporarily cut off outside access to the database.  Federal rules reportedly prevent the use of the database for that purpose and the Department of Education has in the past revoked some IDs that grant access to the database.  I'm not familiar with the federal rules in question and I hadn't even heard of the database until these reports surfaced, but I can't help wondering if this practice would give rise to a claim under the Fair Credit Reporting Act. 

The FCRA limits access to consumer reports to certain permissible purposes as stated in 15 U.S.C. § 1681b.  Lenders are permitted to send solicitations if they comply with the prescreening rules but if those rules were not complied with, the lenders may have a problem.  It's hard to believe that the FCRA applies to a database maintained by the government, but on a quick look I can't find anything that says it doesn't.  The FCRA applies to "consumer reports" assembled by "consumer reporting agencies," as defined in § 1681a. The database reportedly was maintained at least in part to determine student eligibility for financial aid, which would seem to qualify its reports as consumer reports ("any written . . . or other communication of any information by a consumer reporting agency bearing on a consumer's credit worthiness, credit standing, credit capacity . . . .").  "Consumer reporting agency" is defined in part as "any person which for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information . . .."  It seems likely that that describes the federal database.  The word "person" is specifically defined as including any "government or governmental subdivision or agency, or other entity." 

Does anybody out there see something I'm missing?  Incidentally, obtaining information from a consumer reporting agency under false pretenses is a federal crime under § 1681q; gives rise to a private claim by consumers with $1,000 in statutory damages under § 1681n; and gives rise to a claim by the credit reporting agency.

Consumer Law Publications

We recently obtained permission to reprint on the Blog abstracts of and links to articles published on the Social Science Research Network (SSRN).  As many of our readers will know, numerous writers on legal and other subjects post articles to SSRN when (or even before) they are submitted to law reviews, enabling the articles to be read long before they are available in print.  Consequently, SSRN has become perhaps the most important and certainly the most timely place to find current legal scholarship.  Seven recent abstracts on pieces relevant to consumer law , together with links, are pasted in below:

FTC Goes After Corporate Privacy Violaters: Is It Enough?

    U.S. PIRG's Consumer blog has this interesting short post on the FTC's and state AGs' efforts to fine corporations that violate your privacy rights - - for instance, by selling information about you to identity thieves.  Be sure to read the linked article from forbes.com that discusses these enforcement efforts in some detail.  My question:  Are the regulators hitting hard enough and often enough to deter?

Interagency Proposal for Model Privacy Forms under the Gramm-Leach-Bliley Act

by Jeff Sovern

I have previously blogged here about the 2006 amendment to the Gramm-Leach-Bliley Act, which added a new subsection (e) to 15 U.S.C. § 6803, directing federal regulators to develop a model disclosure form for financial institutions to send customers explaining their privacy rights, including the right to opt out of the sharing of customer information.  Now eight government agencies have banded together to propose model forms and solicit comments on them.  The model forms, together with explanatory material, appear here.  The proposed model forms seem to be a substantial improvement over the disclosure forms I've seen up to now; it will be interesting to see the extent to which financial institutions use them and how consumers react to them.  One ironic commentary on the price of simplicity: the proposal, request for comments, and supporting materials (as distinct from the forms themselves) run 149 pages.

Google Makes Privacy Improvements, But Is It Enough?

by Greg Beck

Google announced last week a new policy designed to help protect the privacy of its users.  Google will continue to store usage history, but it will "anonymize" its server logs after 18-24 months so that particular data can no longer be linked to individual users.

Google could have gone a lot further.  Keeping the data for 18-24 months seems like a long time when something like 30 days or less may be sufficient.  Moreover, Google has argued that keeping personally identifying information helps it provide services to its users, but those users who value privacy over the additional services should have a way to opt out of the data collection. 

Still, criticism of Google's decision conceals the fact that it has gone a lot further than other Internet companies.  Yahoo!'s privacy policy, for example, states that the company will save your IP address and the pages that you view without promising to delete or anonymize this information at any time in the future.  Amazon.com says it stores your IP address and other information, including which books you looked at on the site.  There is no reason why Amazon needs to keep databases with the books you looked at years ago.

Google's first step may be tentative, but hopefully it will spur other companies to examine their privacy policies as well and ask themselves whether they really need to keep all that private data.

Retailers Demanding Thumbprints: A New Trend?

BoingBoing has the story of a car dealership that refused to sell a car without first taking the buyer's thumbprint.  The story also links to a Consumerist post about banks with the same policy.  One of the banks apparently cited the Patriot Act for its requirement of demanding a customer's thumbprint before cashing a check.

Is this a new privacy problem in the making?

Dee Pridgen's Report on the ABA Antitrust Section Consumer Protection Conference

My co-author, Dee Pridgen, Associate Dean and Professor of Law at Wyoming and author of the treatises Consumer Protection and the Law and Consumer Credit and the Law, attended the recent ABA Antitrust Section Consumer Protection Conference and kindly provided the following illuminating report:

I attended what was called the “inaugural stand-alone consumer protection conference” put on by the ABA Antitrust Section at Georgetown Law Center on January 29-30, 2007.  The focus was on FTC consumer protection enforcement and industry self regulation, with a smattering of state consumer protection enforcement thrown in. There was little or no discussion of private suits.  All five sitting FTC Commissioners, as well as the current and four former Bureau of Consumer Protection directors made appearances.  There was also good representation from the private sector, including firms and in-house counsel.  Two speakers from state attorneys general offices and two academics also spoke.  Thus, this conference was a good complement to the NCLC annual conference and the Teaching Consumer Law conference held biennially in Houston.

What I gleaned from the various speakers was that the FTC appears to be revitalized in the consumer protection area, with an emphasis on consumer privacy (including data security), consumer technology (spyware and adware), health and obesity issues, and international and criminal enforcement.  Several FTC speakers mentioned the recently passed US SAFE WEB Act [which we blogged about earlier here] as a major step forward in assisting the FTC in its overseas law enforcement efforts.

New York AG Settles Adware Charges

by Greg Beck

New York’s Attorney General announced a settlement yesterday with three big companies, Priceline.com, Travelocity.com, and Cingular Wireless, accused of using software called Direct Revenue to deliver unwanted ads to computer users. In a 2006 lawsuit, the Attorney General alleged that Direct Revenue installed its software onto millions of computers without adequate notice or consent. Once installed on a user’s computer, the software monitored Internet usage, collected data typed into web forms, and delivered a steady stream of unwanted advertising. To make matters worse, once installed, the software was difficult to remove.

The settlement marks the first time that advertisers, instead of just the adware maker itself, have been held responsible for this abusive sort of advertising. That seems like a smart strategy. In this case, Priceline, Travelocity, and Cingular had spent hundreds of thousands of dollars advertising their services through Direct Revenue. Targeting the advertisers could help dry up the source of funding that keeps adware companies in business. Although the financial settlement was relatively small, a total of $100,000 between the three companies, the companies also agreed to use only adware programs that provide notice and consent to users and make it easy for users to uninstall. Of course, few computer users, if fully informed, will willingly choose to install adware on their computers.