Letter to FTC re: Equifax sales of consumer info to predatory lenders

November 8, 2012

Federal Trade Commission
Office of the Secretary
Room H-113 (Annex D)
600 Pennsylvania Avenue, NW
Washington DC 20580

Re: Proposed Consent Agreement In the Matter of In the Matter of Equifax Information Services LLC, FTC File No. 102 3252;

Thank you for the opportunity to comment on the proposed consent decree, In the Matter of Equifax Information Services LLC. The consent decree appeared in the Federal Register at 77 Federal Register 63833 (October 17, 2012), http://www.ftc.gov/os/fedreg/2012/10/121017equifaxagreefrn.pdf.

The WPF is a non-profit public interest research group that focuses on privacy issues, including technology, finance, health, and other privacy topics. Our materials can be found at www.worldprivacyforum.org.

The consent decree and complaint against Equifax is one of two that the Commission filed relating to this matter. The other consent decree was against Direct Lending Source, Inc. and others. Taken together, the consent decrees describe significant and egregious violations of the Fair Credit Reporting Act by Equifax and Direct Lending LLC that in the Commission’s own words, substantially harmed consumers.

The documents in these cases show that for a period of two years, Equifax sold the names of consumers who were late on their mortgages to businesses that used that information to market financially damaging and in some cases outright fraudulent products and services to these consumers. [1] These lists of consumers that Equifax sold then made their way through an underbelly of shady data brokers as the lists were sold and resold, often to companies under investigation by law enforcement. [2] According to the Commission, more than 17,000 lists containing information about millions of consumers were sold. The complaints state that some consumers lost their homes due to the sales of the Equifax lists, and that more than 1,500 consumers were charged up-front fees of $1,000 to $5,000 in debt-relief scam operations, also resulting from the list sales. [3]

According to Commission documents, Equifax had reason to know that the sales of the lists were not going to be used in compliance with the law.

The FTC documents do not describe a one-time, stray, accidental violation by just one or two employees. The complaints describe a violation that went on for two years. The complaint against Equifax notes this when it states, “Given Direct Lending’s failures, Equifax had reason to believe that the entities to whom its prescreened lists were being sold did not have a permissible purpose for obtaining the lists. Nonetheless, Equifax continued to sell prescreened lists to Direct Lending.”

The scope of the consent decree does not match the nature of the harm to consumers in this case. This case affords the Commission a notch on its gun, but it does not do much to help aggrieved consumers who lost their homes and paid thousands of dollars to scam operations.

The FTC complaint explains that the thousands of lists that were improperly sold are now largely untraceable because they had presumably been spread too far and wide. The Commission’s complaint against Direct Lending states, “In some cases, Defendants sold the prescreened lists at issue to list brokers and others, which in turn resold the lists to unidentified downstream entities. In these instances, Defendants cannot identify the entity or individual that ultimately obtained the list. Defendants did not identify to Equifax the end-user of these consumer reports.” The picture painted here is one of significant mishandling of consumer data.

WPF is especially concerned about continuing practices and consumer harms in this case. The deleterious consumer impacts of the improper “mortgage lates” list sales by Equifax the FTC described may not have run its course, as it is probable that the old lists are still being circulated downstream. Other new sales may still be continuing. To check on the status of the Equifax lists, we searched for Equifax lists of 30, 60, and 90-day mortgage “lates.” We note for the record that Equifax lists of 30, 60, and 90+ day mortgage “lates” are still for sale online today. [4] With relative ease, we found a Nextmark Equifax “lates” list for sale. The data card for the list states options to modify their mortgage or stop foreclosures, and that, in some instances, homeowners realized they had been scammed too late to avoid the loss of their home.” (p.6) that it turns around the data in 24 to 48 hours, which is a very rapid turnaround, as noted on the card. The data card for the list we found is attached at the end of this letter. We request that the data card attached to this letter be entered into the public record along with this letter.

We respectfully request the answers to the following specific questions in relationship to this consent decree:

• Does the Commission have a copy of the original Equifax data card? Can it be put in the public record?
• Have the consumers whose names were on the lists been offered one year of free Equifax credit monitoring to mitigate the negative impacts of the list sales?
• Has Equifax taken affirmative steps to remove all of the old data cards and lists from rotation?
• What is being done to contact the consumers on the list and repair the harm? We know from press reports that Equifax has contacted customers regarding this matter, [6] but what has the company done to specifically repair the damage to consumers, especially those who lost their homes?
• How many consumers were known to be adversely affected by the improper sale of lists? “Millions” is an insufficient and non-specific fact.
• How much did consumers lose as a result of the improper sale of lists?
• Does the $392,803 fine represent the amount of revenue that Equifax collected from thesale of or just the profit from the sale of lists?
• How precisely was the $392,803 figure determined? It would be most helpful if the Commission would show the calculation that achieved that result.
• Did the Commission include or exclude any elements of company overhead in its calculation? How many lists did Equifax sell improperly? Is the figure of more than 17,000 – which is noted in the press release and in the Direct Lending complaint — accurate? If so, can it be placed in the official Equifax documents filed with the court on the public record and not just included in a press release?

We recognize that some information in a case may legitimately be confidential business information. Nothing prevents the Commission, however, from explaining the number of lists that a company sold illegally, the number of consumers impacted, or the revenues earned illegally. Those figures are not proprietary.

We request that the Commission revise this consent decree to include more facts and to explain with more specificity how the amount of the payment was determined, how many consumers were impacted, and what Equifax is specifically doing to affirmatively mitigate the harm it caused by its actions, including consumer redress and retraction of the lists in question. We reiterate that we have substantial concerns that consumer lists detailing late mortgage payments are still being sold, and we reiterate our question that these lists will be genuinely used for firm offers of credit. There are many of unanswered questions here and many unaddressed concerns. What hangs in the balance is the potential for additional serious consumer harm from predatory lending offers and sketchy debt relief marketing efforts.

Respectfully submitted,

Pam Dixon
Executive Director,
World Privacy Forum

________________________________________________

Endnotes:

[2] The FTC complaint against Equifax states: “Equifax’s failure to employ reasonable and appropriate measures to control access to the sensitive consumer financial information it maintains and sells for prescreening services resulted in prescreened lists being sold to a number of entities that were ultimately the subject of actions or warnings by law enforcement. Equifax’s lack of reasonable procedures caused or is likely to cause substantial consumer injury that is not reasonably avoidable by consumers and is not outweighed by benefits to consumers or competition.” <http://www.ftc.gov/os/caselist/1023252/index.shtm>.

[3] Ibid.

[4] See http://lists nextmark.com/market?page=order/online/datacard&id=244684, a screen copy of the page as seen Oct. 31, 2012 is available at the end of this letter.

[5] The Commission’s press release of October 10, 2010, FTC Settlements Require Equifax to Forfeit Money Made by Allegedly Improperly Selling Information about Millions of Consumers Who Were Late on Their Mortgages http://www ftc.gov/opa/2012/10/equifaxdirect.shtm. From this we learn that the number of impacted consumers numbers in the millions, although we do not have a specific number. The press release also implies that the amount that Equifax will pay is the money made from the improper sale of lists.

[6] A spokesperson from Equifax was quoted as saying “We discontinued all business activities with Direct Lending and any of its affiliates the summer of 2011. We also formally notified all of our customers at the time that we had ceased doing business with them and any of their affiliates, and that was formal notification by direct mail as well as email.” Human Resources Journal, http://www.humanresourcesjournal.com/2012/10/equifax-accused-of-fail…-to- safeguard-sensitive-consumer-data-settle-complaints-for-393000/.