FTC Supports Legislation To Protect Consumer Credit Privacy

The Federal Trade Commission today told the House Committee on Banking and Financial Services that it favors legislation that would impose civil penalties on information brokers who obtain sensitive financial information about individuals under false pretenses. Speaking on behalf of the agency, Commissioner Mozelle W. Thompson told the Committee that while the agency could likely bring law enforcement actions against such brokers under its current authority," ... civil penalty authority would make the Commission's enforcement actions even more effective and would substantially increase the deterrent effect of such actions."

The testimony notes that "pretexting" is a term of art coined by the private investigation industry to describe the practice of getting personal information about others under false pretenses. For example, an investigator who obtains a bank account balance by posing as the account holder would be engaged in pretexting. "This tactic ... appears to be gaining in popularity -- especially in the burgeoning Internet marketplace. Now, increasing numbers of high-tech private eyes, also known as 'information brokers,' are touting their ability to obtain surprisingly sensitive information without the subject ever knowing. The Web sites of certain companies also imply that they can retrieve such information by simply keying a few search terms into one of their many databases, and that the services are perfectly legal. Despite such claims, it appears that the companies can get this information only one way ... through plain, old-fashioned lies," the testimony says.

The Commission has been actively engaged in identifying and addressing consumer protection and consumer privacy issues that result from the increasing availability of personal identifying information in the electronic marketplace, the testimony says. For example, following an FTC study of database services that supply personal identifying information used to locate and identify people, known as "look up services" or "individual reference services," the individual reference service (IRSG) industry developed a self-regulatory program that will go into effect December 31, 1998. The testimony notes that the IRSG Principles should prevent pretexting by the participants and limit third party access to identifying information, thereby making it more difficult for others to engage in pretexting. However, the Commission testimony says, the IRSG Principles will not prevent all pretexting, which the Commission will challenge through law enforcement. "Indeed, although the Commission encourages industry self-regulation, the Commission is first and foremost a civil law enforcement agency, whose mandate is to combat unfair and deceptive practices. And the practice of obtaining confidential information for resale under false pretenses appears to be just that -- unfair and deceptive," the testimony says.

Thompson said that the Commission supports legislation to clarify for the courts and information brokers that pretexting violates the FTC Act and to authorize civil and criminal penalties to deter information brokers from pretexting. "The Act would add an important tool to the Commission's arsenal..." the testimony says. "It has been the Commission's experience that sanctions that go beyond merely ordering future compliance with the law, such as civil penalties, provide stronger incentives for compliance. "

"The imposition of civil penalties would be particularly appropriate against pretexters, given the invasive and deliberate nature of their practices. Further, because a civil penalty could easily exceed the amount a pretexter would have to pay for disgorgement or consumer redress, it could more effectively deter the practices at issue. Indeed, deterring the practices from occurring in the first place is especially important here, where the real consumer injury -- the serious privacy invasion to individuals being investigated -- may be difficult to quantify and therefore to redress."

"Pretexting is a troubling, and apparently growing problem facing consumers. The disclosure of a consumer's sensitive bank account or other sensitive information is a significant privacy invasion, with potentially serious financial consequences. While the Commission is able to stop many of these practices ... civil penalty authority would make the Commission's enforcement actions even more effective and would substantially increase the deterrent effect of such actions," the testimony says.

The Commission vote to approve the testimony was 4-0.

Copies of the the Commission testimony and the IRSG principles are available from the FTC's web site at http://www.ftc.gov and also from the FTC's Consumer Response Center, Room 130, 6th Street and Pennsylvania Avenue, N.W., Washington, D.C. 20580; 202-FTC-HELP (202-382-4357); TDD for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC NewsPhone recording at 202-326-2710.