For decades, accuracy has been recognized as a key privacy interest in data protection law. The EU General Data Protection Regulation includes accuracy as one of its seven principles, requiring processors to ensure data is kept up to date and erased or rectified if determined to be inaccurate.
The U.S. has also long considered accuracy a foundational concept in data privacy, flowing from the fair information practice principle known as "quality" or "integrity." Nevertheless, until recently, the accuracy of personal information has not often been the focus of privacy enforcement actions.
Set against a policy landscape that is increasingly concerned with data broker practices, the U.S. Federal Trade Commission recently brought several complaints and reached settlements with companies for failing to ensure the accuracy of data they collect and sell. Because data broker reports are used for significant life decisions, such as employment, housing and creditworthiness, inaccurate data can have detrimental consequences for consumers. Whether through the deception prong of the FTC Act or expanded allegations under the Fair Credit Reporting Act, the FTC is demonstrating its commitment to defending the principle of accuracy and holding accountable any company that risks harming consumers by falling short of the required standard.
The FTC recently released a draft settlement with Truthfinder and Instant Checkmate, alleging both companies deceived consumers with false advertising claims by asserting their background reports contained "the most accurate information available to the public." The FTC's stipulated order includes civil money penalties of USD5.8 million, as well as a requirement to implement various compliance programs — consequences that illustrate the growing seriousness with which the FTC is addressing potential harms created by inaccurate data.
Truthfinder and Instant Checkmate are people-search data brokers that collect information on individuals from third parties, create profiles of the individuals and then allow customers to pay to access the profiles. With respect to the FTC Act, the core of the FTC's complaint centers on the companies' deceptive advertisements about the accuracy of their datasets, particularly the claim that their reports contain the "most accurate information available to civilians." The complaint alleges that because the companies do not collect the information in their reports themselves and use third parties instead, they fail to verify the accuracy of the information they sell. The complaint also asserts the third-party sources of the information — often other data brokers — have disclaimers about the accuracy of the data. By marketing their information as the "most accurate," Truthfinder and Instant Checkmate allegedly deceived consumers — usually business customers — who rely on the accuracy of the information in the reports.
Relying on false claims of accuracy by data brokers can also result in detrimental outcomes for the consumers whose information is collected and sold. For instance, a report alleging its subject has a criminal history could be a critical factor in a potential employer's decision to hire that subject. If the subject does not have a criminal history, or if the information was inaccurate as to the offenses committed or the penalties paid, the employer might not hire them based on false information. This could cause the individual unjustified costs from lack of employment and an extended job search. These genuine consequences likely explain the seriousness with which the FTC has begun to regulate exaggerated claims of accuracy as false advertising.
The right to correct means more than a decoy button
In addition to allegations of deceptive advertising, the FTC complaint against Truthfinder and Instant Checkmate also asserts the companies deceived customers with privacy dark patterns on their websites. The companies' websites both had two ostensibly clickable buttons: a "Remove" button and a "Flag as Inaccurate" button. One button was supposed to remove information from a background report, while the other button was intended to start an investigative process to correct inaccurate information.
However, the complaint alleges neither of the buttons worked at all. They were instead decoys. If a customer clicked the "Remove" button, the information would be removed from the customer's screen but would still be maintained as part of their report. Essentially the button just hides the information from the view of the consumer attempting to remove it. Similarly, the "Flag as Inaccurate" button had little effect. Thousands of users flagged information as inaccurate, but the inaccuracies were allegedly never investigated or fixed. For both buttons, the FTC alleged using decoys was a deceptive act or practice.
From a basic business perspective, decoy buttons are not advisable because they foster mistrust in a company's consumer base. In this context, decoy buttons have important privacy implications as well. Failing to investigate or remove information that is flagged as false creates a doubly deceptive situation. Not only were individual consumers allegedly unable to correct and delete misinformation about themselves, but also customers who purchased their files could use inaccurate data to make decisions impacting their lives.
The FTC's charge highlights the importance of accuracy as a privacy interest. The right to correct personal information is a widely recognized privacy principle. If consumer reports are used to inform important decisions, like employment, housing and creditworthiness, then the subjects of the reports have a strong interest in ensuring the information is as accurate as possible. Half measures toward upholding this interest will not be taken lightly by regulators.
Accuracy under the FCRA
The complaint against Truthfinder and Instant Checkmate includes allegations that each company also violated provisions of the Fair Credit Reporting Act. The FCRA imposes several obligations on consumer reporting agencies to ensure the accuracy and confidentiality of the consumer data assembled. These include requirements to take reasonable procedures to ensure the accuracy of the information collected in reports and to reasonably investigate claims of inaccuracy.
Truthfinder and Instant Checkmate attempted to avoid coverage under the FCRA by including disclaimers at the bottom of their websites stating that they were not consumer reporting agencies because customers were not allowed to use the profiles for decisions in tenant screening, creditworthiness or employment. However, according to the FTC's complaint, both companies are regulated under the FCRA. Because their business models include assembling information and sharing reports about individuals that are then purchased by third parties, the FTC determined the companies qualify as consumer reporting agencies and the disclaimers were ineffective to evade enforcement under the FCRA. This determination enables the FTC to enforce FCRA violations as de facto violations of Section 5 of the FTC Act.
The FTC asserts that the companies are liable under the FCRA for the same practices the FTC Act deems deceptive: failing to verify the accuracy of the information they received and compiled and failing to investigate or correct claims of erroneous consumer information. Specifically, the alleged decoy "Flag as Inaccurate" button directly violated the FCRA requirement for consumer reporting agencies to reasonably investigate consumer claims of inaccuracy, while laxity with fact checking third party sources directly offended the FCRA's obligation to take reasonable procedures to verify the accuracy of consumer reports.
Violations of the FCRA carry the possibility of fines, so the double-whammy approach to the misconduct in these cases amplifies the possible penalties that similarly situated companies can face.
Accuracy matters for housing and other major life outcomes
A similar case illustrates how federal enforcers will not hesitate to impose significant fines on data brokers whose reports contain inaccurate, outdated or incomplete information that cause consumers genuine harm. In early October, the FTC and the Consumer Financial Protection Bureau reached a settlement with Trans Union and its subsidiary, requiring the credit reporting company to pay USD15 million to resolve allegations that its inaccurate tenant-screening reports and eviction records prevented consumers from obtaining housing. This is the largest financial settlement recovered by the FTC in a tenant-screening matter.
The subsidiary at issue, TransUnion Rental Screening Solutions, assembles background screening reports about thousands of consumers for tenant and employee selection. These reports are then sold to various clients, including rental property owners, property management companies, employers and other background screening companies, to assist in housing and employment decisions. In the initial complaint, the FTC and CFPB alleged Trans Union violated the FCRA by failing to follow reasonable procedures to assure the maximum possible accuracy of the information in tenant-screening reports and failing to accurately disclose to consumers sources of the information in the reports. These practices resulted in numerous consumers being unjustly denied housing.
As for the initial charge, Trans Union allegedly misrepresented consumer eviction proceeding records in its tenant-screening reports in multiple ways. These included duplicate entries for the same eviction case, erroneously reporting the disposition of eviction proceedings — often incorrectly in favor of landlords — and inaccurately labeling data fields in the eviction proceeding reports, such as "Judgment Amount" fields based only on the amount sought by landlords. Notably, many consumer reports even included eviction proceeding records that had been sealed. Trans Union sources consumer eviction information from LexisNexis, which allows consumers to retroactively delete records that have been restricted from public view. However, Trans Union had no procedures in place to guarantee its tenant-screening reports were updated once consumers had their eviction records deleted from LexisNexis.
The FTC found each of these practices constituted a violation of the FCRA for failing to ensure the accuracy of consumer information.
Misleading or inaccurate eviction records can have grave consequences for consumers applying for a lease or attempting to obtain housing. Landlords and property managers are much less likely to approve applications by people who have previously been evicted. Eviction proceeding records provide context to these situations and can prevent someone from being denied housing if it turns out that the proceeding was dismissed, resulted in the tenant's favor or was settled for an insignificant amount. Thus, inaccurate records increase the chances a person will be denied housing based on false information. Situations like these partially explain why the FCRA codifies a requirement for consumer reporting agencies to ensure the accuracy of their reports and to investigate claims of inaccuracy. Because housing is critical to a fair economy, the FTC is sending a message to data brokers that inaccurate, access-threatening record keeping will not be taken lightly.
If you sell personal data, you may be a consumer reporting agency
The renewed focus on accurate consumer data is taking place alongside the CFPB's efforts to expand the scope of the FCRA's requirements. In August, CFPB Director Rohit Chopra previewed a forthcoming rulemaking that could broaden FCRA coverage to include certain data broker practices. The proposed rules would first expand the scope of the term "consumer reporting agency" to encompass anyone selling various types consumer data, such as income, payment history or criminal records. Additionally, the new rules would determine the extent to which "credit header data" — or identifying information typically at the top of a consumer file such as name, Social Security number and date of birth — qualify as consumer reports.
The CFPB's efforts to broaden the FCRA's reach stem from growing concerns over increasing harms in the data broker ecosystem. If these rules are eventually adopted, anyone who handles consumer information in the ordinary course of business should be aware such activities may qualify their company as a "consumer reporting agency" subject to FCRA requirements, including accuracy.
More to come as data brokers remain in the crosshairs
The FTC has been concerned about the multibillion-dollar data broker ecosystem for years, given its genuine impact on consumers' lives. Consumer profiles that detail a person's life and influence important aspects of it must be accurate and complete to prevent harm, whether or not they qualify as "consumer reports" under current rules.
At best, inaccuracies in consumer profiles cost people time and money by prolonging employment or housing searches, requiring consumers to pay additional application fees, and forcing people to expend efforts to correct errors in background reports. At worst, inaccurate reports can propel consumers on the financial brink into instability and contribute to systemic economic issues.
The FTC has recognized consumers' strong privacy interest in ensuring their data is accurate and has begun to safeguard this interest through detailed complaints and record-breaking settlements. These cases serve as a reminder to any company that sells or shares data to take extra steps to consider the ethical and compliance risks in the current regulatory environment and to be sure they uphold the principle of accuracy.
