By Destiny Ginn
Under a proposed stipulated order dated September 11, 2023, background check providers, Instant Checkmate, TruthFinder, The Control Group media company, IntelicareDirect, and PubRec, will be required to pay $5.8 million for alleged violations of the Fair Credit Reporting Act (FCRA) for activities as consumer reporting agencies (CRA) and of the Federal Trade Commission Act (FTC Act) for deceptive activities.
Instant Checkmate, TruthFinder, and the three related companies are owned by the same holding company. In the complaint, the FTC stated that the companies take information about consumers that they get from other data brokers and assemble background reports based on the information. Subscribers have unlimited access to such reports by buying a monthly subscription to the websites. Reports about consumers could contain information like phone numbers, email addresses, addresses, relatives, criminal records, social media profiles and more.
The companies marketed their reports to potential subscribers of their service using keywords related to employment, tenant, or credit screening. The FTC claimed such marketing made the companies consumer reporting agencies subject to the requirements of FCRA. The FTC also claimed numerous counts of deceptiveness relating to the accuracy of the product, controls provided to subscribers, and for incentivized endorsements of its service.
Instant Checkmate, TruthFinder, and the three related companies were charged with:
Violations of FCRA
Failure to obtain certifications from users.
Under FCRA, when selling consumer reports, CRAs are required to receive certification from users that they plan to limit use of such reports for a permissible purpose outlined in FCRA. Such permissible purposes include, for example, credit transactions, employment purposes, or legitimate business in connection with a consumer-initiated transaction (e.g., tenant screening). A CRA must also obtain certification from users that they have provided consumers with notices containing a summary of their rights, obtained written consent of consumers to obtain reports, and, prior to taking adverse actions, provided the consumer with a copy of the report. The FTC claimed that the defendants failed to obtain the required certification from users of its reports.
Failure to provide summary of consumer rights.
Under FCRA, in addition to obtaining certification from users that they have provided consumers with notice about their FCRA rights, CRAs are required to provide users a notice informing users of their legal obligations under FCRA. The FTC claimed that defendants failed to provide such notices to users purchasing the background reports.
Failure to follow reasonable procedures to assure accuracy of consumer report information.
Under FCRA, companies are required to follow reasonable procedures to assure maximum accuracy in consumer reports and to respond to disputes of accuracy from consumers about their information. The FTC alleged that the defendants claimed their reports were “the most accurate information available to the public.” However, the FTC asserted that all the information contained in the background checks were obtained from third parties who disclaim the accuracy of the information.
Failure to investigate consumer disputes regarding accuracy of information.
If a consumer disputes the completeness or accuracy of any item of information contained in their report, FCRA requires that the CRA conduct a reasonable reinvestigation (free of charge) of the disputed information make appropriate corrections or deletions. The FTC claimed that the defendants took no extra measures to reinvestigate the accuracy of information after receiving notices of disputes.
Deceptiveness under the FTC Act
Deceptive accuracy claims.
The FTC claimed the defendants falsely represented to consumers in its marketing that reports were highly accurate - “the MOST ACCURATE information available to the public” (emphasis in original) or “the Most Accurate Data Available to Civilians Online.” The FTC alleged that because the defendants in fact never checked for accuracy, that these statements were deceptive.
Deceptive criminal or arrest records claims.
The FTC claimed the defendants falsely represented in their promotions and messages that searched-for individuals may have or have criminal and arrest records when searched-for individuals may have had no record or simply a traffic violation. FTC said the defendants’ representation was false and misleading.
Deceptive controls for removing and flagging inaccurate information.
The FTC claimed the defendants represented that subscribers could correct or remove inaccurate information from background reports by presenting buttons labeled “Remove” and “Flag As Inaccurate.” The FTC alleged that after subscribers would flag information as inaccurate, defendants took no extra measures to investigate the dispute or remove the information from their systems. The FTC also claimed defendants failed to report to its other related companies and to other users that such information has been flagged by subscribers.
Disclosures regarding incentived endorsements.
The FTC in its Endorsement Guides requires disclosure for connections between endorsers and sellers of products materially affecting the weight or credibility of endorsements such as incentives for endorsements. The FTC claimed the defendants compensated customers for reviews with report credits but did not require customers to disclose such compensation.
Under the proposed order, in addition to the fine, Instant Checkmate, TruthFinder, and the three related companies will be required to:
Establish and implement a comprehensive monitoring program to regularly review, assess, and determine the extent to which the company is operating in whole or part as a CRA;
Permanently discontinue failing to comply with the FCRA when operating as a CRA;
Permanently discontinue misrepresenting the accuracy of their reports or making similar misrepresentation outlined in the complaint; and
Ensure that reviewers disclose any material connection and to monitor any reviewer who have a material connection to the company.
We note that this is the second action against Instant Checkmate. The FTC brought actions against the company for FCRA violations in 2014. The company agreed to a settlement with the FTC and paid a $525,000 civil penalty.
Take Aways
First, have a process to review marketing and other claims you make about products and services to make sure they are correct and accurate.
Second, determine if your business is a consumer reporting agency and subject to FCRA. Consumer reporting agencies are businesses that sell or provide background checks for employment, housing, credit, or any other purpose that uses the report to determine a consumer’s creditworthiness, character, or mode of living.
If your business provides background reports for any of the purposes above, review the requirements under FCRA and follow the FTC’s FCRA guidelines to ensure you are compliant.
Establish reasonable procedures to assure data accuracy,
Have clients certify that they are only using the report for the specific permissible purpose,
Provide clients with notices for consumers with information about FCRA rights, and
Honor the rights of consumers, including rights to receive reports and correct or delete inaccurate information.
If your business does not wish to sell background reports for purposes subject to FCRA:
Take reasonable efforts to prevent the use of sold information from being used to determine the consumer’s housing, employment, insurance, or credit eligibility, and other FCRA-covered purposes including requiring customers to agree that they will not use information you provide for these purposes.
Review marketing or advertising practices, include key words for targeted advertising, to ensure you are not marketing products for purposes covered by the FCRA.
Destiny Ginn is an associate (pending bar admission) at Hintze Law. Destiny was a Summer Associate with Hintze Law in 2022 and in 2021 as a Legal Intern at Intuit where she gained experience on a wide range of privacy and cybersecurity issues. During law school, Destiny served as Justice of the Langston Chapter of Phi Alpha Delta and worked as a Student Attorney at the Howard University Fair Housing Clinic.
Hintze Law PLLC is a Chambers-ranked and Legal 500-recognized boutique privacy firm that provides counseling exclusively on global data protection. Its attorneys and privacy analysts support technology, ecommerce, advertising, media, retail, healthcare, and mobile companies, organizations, and industry associations in all aspects of privacy and data security.