Apparently, ChoicePoint has decided not to fully investigate what data may have been sold to their bogus customers. Furthermore, it strongly appears that their internal auditing systems and customer records can’t tell them exactly what data they did sell and to whom. It also seems that they are not willing to investigate what data may have been sold to these unauthorized customers prior to July 1, 2003, because the law did not go into effect until that date, and there is no legal requirement for them to do so. I’ve included the relevant quote from their 8K SEC filing.
“These numbers were determined by conducting searches of our databases that matched searches conducted by customers who we believe may have had unauthorized access to our information products on or after July 1, 2003, the effective date of the California notification law. Because our databases are constantly updated, our search results will never be identical to the search results of these customers.”
It also appears ChoicePoint’s database is riddled with inaccuracies, and ChoicePoint doesn’t care that the information they may be selling about you may be inaccurate. They currently don’t have a reasonable policy for correcting bad data in your file. MSNBC has a good story about this here.
“Rosen was told she had to talk with each furnisher of the information individually — to the private firm where she rented the P.O. box, for example — and convince each one to update their information and then send it back to ChoicePoint. Rosen figures there might be 100 different sources of information in her report, so fixing the errors would be just about impossible.”
It would seem to me, that if ChoicePoint were to submit data to a customer—say a company you were interviewing with for a job—as part of a background check, and the data they sent the company was erroneous, you might not get the position in question.
At least in the United States, libel law states that information published or broadcast which is false and defamatory and damages the reputation of an individual is considered libel. So wouldn’t ChoicePoint be guilty of libel and defamation? The standard for civil penalties in libel law is if the individual or corporation making the statement had a reckless disregard for the truth.
It would seem that ChoicePoint, by not having any mechanism for making corrections, and understanding that their data is not perfect, does have such a reckless disregard for the truth. In the MSNBC story, one individual’s ChoicePoint file contained the following inaccuracies:
“…his wife had a child three years before they were married, that he had been married previously to another woman, and most absurd, that he had died in 1976.”
Federal legislation is needed to protect the individuals from unauthorized or unethical use and distribution of the information gathered by the large data aggregators. The laws should also require companies, which collect such information, to notify any individual of possible security breaches of their information. The law should also hold the companies liable for any damages arising out of such a breach. From what has been published, recovering from a stolen identity is fairly expensive and traumatic.
The new laws should also allow the consumer free access to their data, and require a mechanism for correcting the data collected. The government has started to do something similar to this with the credit bureaus, but new legislation covering a wider and broader range of data needs to be enacted.
New privacy laws should also be enacted which give consumers a chance to opt out of such data aggregation, or to restrict the commercial use by permission only. This is not to say that the data couldn’t be collected, but to consumers should be able to restrict whether the company can sell the data regarding them to non-law-enforcement entities.
Currently, the Fair Credit Reporting Act has some restrictions on the use of credit information, but these restrictions appear to be insufficient to the modern information age. The laws governing credit information need to be made more restrictive as well.