UNITED STATES DffiTIUCTCOURT 

NORTHERN DISTRlCT OF GEORGIA 

ATLANTA DMSION 

UNITED STATES OF A1v!ERlCA, ) 

) 

) 

) 

) 

) 

) 

) 

) 

) 

Plaintiff, Civil Action No. 1 :06~cv"()198-JTC 

v. 

CHOICEPOINT, INC., a corporation, 

Defendant. 

SUPPLEMENTAL STIPULATED JUDGMENT AND ORDER FOR 

PERMANENT INJUNCTION AND MONETARY RELIEF 

Plaintiff, the United States of America, acting upon notification and authorization to the 

Attorney General by the Federal Trade Conunission r'FTC" or "Commissi.on',). and Defendant 

ChoicePoint, Inc. ("Defendanf,) jointly stipulate to this Supplemental Stipulated Judgment and 

Order for Permanent Injunction and Monetmy Relief("Supplemental Order"), which resolves 

the Plainti.frs alJegation that Defendant violated the Stipulated Final Judgment and Order r'Final 

Order'') entered by this Court on February 15,2006. 

NOW THEREFORE IT IS HEREBY ORDERED AS FOLLOWS: 

FINDINGS OF FACT AND CONCLUSIONS OF LAW 

A. This Court has jwisdiction over the subject matter of this case and over Defendant. 

B. Venue in this district is proper under 28 U.s.C. § 1391(b) and (c), and 15 U.S.C. § 53(b). 

C. The acts and practices of Defendant are in or affecting commerce, as "commerce" is 

dermed in Section 4 of the FTC Act, 15 U.S.C. § 44. 
D. The Court finds that entry of this Supp]emental Order is in the pub1ic interest. 

E. All provisions of the Final Order remain in full force and effect except as otherwise 

stated in this Supplemental Order. 

F. The Final Order, inter alia, requires Defendant to estabHsh and implement. and thereafter 

maintain. a comprehensive infonnation security program that is reasonably designed to 

protect the security. confidentiality, and integrity of personal infonnation col1ected from 

or about consumers. (paragraph m.) Tile Final Order further requires Defendant to 

conduct regular testing or monitoring of the effectiveness of the safeguards I key controls, 

systems, and procedures. (paragraph m.A.3.) 

O. Defendant experienced a one-month period of unauthorized access to personal 

information, that the FTC alleges Defendant should have detected, during which an 

unknown person began using the account of one of Defendant's subscribers to obtain 

personal infonnation about consumers. This unauthorized access compromised the 

personal infonnation of approximately] 3,750 consumers. The FTC aUeges that 

Defendant's failure to detect the unauthorized access resu1ted from Defendant's failure to 

establish and maintain procedures to insure that a key electronic monitoring application 

was operating for a four-month period. This electronic monitoring application was used 

to monitor customer access to, and use of, the database that was breached. The FTC 

further alleges that this reveals that Defendant had failed. for a four-month period, "to 

establish and implement, and thereafter maintain. a comprehensive information security 

program that is reasonably designed to protect the security, confidentiality, and integrity 

ofpersonaJ infonnation collected from or about consumers." The FTC alleges that 

Defendant failed, for that same four-month period, to conduct regular monitoring of the 

-2· 
effectiveness of one of the safeguards' key controls, systems, and procedures, as required 

by Part m.A.3 of the Final Order, thereby violating the Final Order. 

H. Defendant voluntarily reported the unauthorized access to the FTC, however, Defendant 

makes no admissions to, and denies, the Commission's aUegations other than the 

jurisdictional facts. 

I. Defendant waives: (a) all rights to seek appellate review or otherwise challenge or 

contest the validity of this Supplemental Order; (b) any claim Defendant may have 

against the Commission, its employees, representatives, or agents that relate to the matter 

stated herein; (c) al1 claims under the Equal Access to Justice Act, 28 U.S.C. § 24] 2, as 

amended by Pub. L. 104·12], no Stat. 847, 863-64 (J996); and (d) any rights to 

attorney's fees that may arise under said provision of law. 

I. MONETARY RELIEF 

IT IS HEREBY ORDERED that Defendant pay TWO HUNDRED AND SEVENTY. 

FNE THOUSAND DOLLARS ($275,ooo.00) to the Commission, within five (5) days of entry 

of this Supplemental Order, pursuant to payment instructions provided by the Commission. 

A. AU funds paid pursuant to this Paragraph sha)] be deposited into a fund administered by 

the Commission or its agent to be used for equitable reHef, including, but not limited to, 

consumer redress and any attendant expenses for the adIl1inistration of any redress fund. 

In the event that direct redress to consumers is wholly or partially impracticable or funds 

remain after redress is completed, the Commission may apply any remaining funds for 

sucb other equitable relief (inc]uding consumer infonnation remedies) as it dete.nnines to 

be reasonably related to Defendant's violations of the Final Order. kay funds not used 

fur such equitable relief shall be deposited to the United States Treasury as equitable 

-3-
disgorgement. Defendant shaH have no right to challenge the Commission's choice of 

remedies or the manner of distribution. 

B. Defendant relinquishes all dominion, control. and title to the funds paid to the fullest 

extent permitted by law. Defendant shall make no cJaim to or demand for retum of the 

funds, directly or indirectly, through counselor otherwise. 

IL BmNNlAL ASSESSMENT REQUIREMENTS 

(Supersedes Paragraph IV in the Final Order) 

IT IS FURTHER ORDERED that Defendant shall obtain bieonialassessments and 

reports ("Assessments") from a qualified, objective, independent third~party professional who 

uses procedW"eS and standards generally accepted in the profession. 'The reporting period for the 

Assessments shall cover each two (2) year period after the period covered by the initial 

Assessment (i.e., after August 15,2006) for twenty (20) years after the date of entry of the Final 

Order. Provtded, however, that the Commission, at its sole discretion, may require Defendant to 

obtain up to two additional biennial Assessments covering the two two-year periods foJlowing 

the final biennial Assessment if the FfC provides the Defendant with written notice, between 

August 15.2024 and February 15, 2026, stating that the first such additional Assessment will be 

required, and/or written notice, between August 15, 2026 and February 1 5, 2028, stating that the 

second additional Assessment will be required. 

Each Assessment shall: 

A. Set forth the specific administrative, technical, and physical safeguards that Defendant 

has implemented and maintained during the reporting period to comply with Paragraph 

m of the Final Order; 

B. Explain how such safeguards are appropriate to Defendant's size and complexity, the 

-4-
nature and scope of Defendant's activities, and the sensitivity of the personal information 

collected from or about consumers; 

C. Explain how the safeguards that have been implemented meet or exceed the protections 

required by Paragraph m of the Final Order; and 

D. Certify that Defendant's security program is operating with sufficient effectiVeness to 

provide reasonable assuranee that the security, confidentiality, and integrity of personal 

infonnation is protected, and has so operated tlrroughout the reporting period. 

Each Assessment shall be prepared and completed within sixty (60) days after the end of 

the reporting period to which the Assessment applies by a person qualified as a Certified 

Information System Security Professional (CISSP) or as a Certified Infonnation Systems 

Auditor (CISA); a person hoJding GJoballnfonnation Assurance Certification (GJAC) from the 

SysAdmin, Audit, Network, Security (SANS) Institute; or a similarly qualified person or 

organization approved by the Associate Director for Enforcement, Bureau of Consumer 

Protection, Federal Trade Commission. 

Within fifteen (15) days after each biennial Assessment is prepared and completed, 

Defendant shall notify the Commission that the Assessment has been prepared and completed 

and provide: (1) the name, address, phone number, and credentials of the third-party 

professional who conducted the Assessment; (2) an overview of the administrative, technical, 

and physical safeguard8 the third~partyprofessional evaluated for the Assessment; and (3) proof 

of certification from the third.party professional as required under Paragraph n.D of this 

Supplemental Order. Defendant shall deliver all notifications to the Commission pursuant to 

Paragraph N.D of this Supplemental Order. 

All biennial Assessments shall be retained by Defendant until three (3) years after 

~s~ 
completion of the final Assessment and provided to the Associate Director for Enforcement upon 

request within ten (10) business days after Defendant receives such request 

III. COMPLIANCE MONITORING 

(Supersedes Paragraph VI in the Final Order) 

IT IS FURTHER ORDERED that, for the purpose of monitoring and investigating 

compliance with any provision of the Final Order or of this Supplemental Order. 

A. Within thirty (30) days of receipt of written notice from a representative of the 

Commission, Defendant shall submit additional written reports. which are true and 

accurate and swom to under penalty of peIjury; produce documents for inspection and 

copying; appear for deposition; and provide entry during normal business hours to any 

business location in Defendant's possession or direct or indirect control to inspect the 

business operation; 

B. In addition, the Commission is authorized to use all other lawful means, including, but 

not limited to: 

1. Obtai ning discovery from any person, without further leave of court. using the 

procedures prescribed byPed. R. Civ, P. 30. 31,33,34,36, and 45; 

2. Posing as consumers and suppliers to Defendant. Defendant's employees, or any 

other entity managed or controlled in whole OT in part by Defendant, without the 

necessi ty of identification or prior notice; and 

C. Defendant shall permit representatives ofthe Commission to interview any consultant, 

independent contractor. representative, agent, or employee who has agreed to such an 

interview, relating in any way to any conduct subject to the Final Order or to this 

Supplemental Order. The person interviewed may bave counsel present. 

-6. 
Pruvlded, however, that nothing in the Final Order or in this Sllpplemental Order shall 

limit the Commission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the 

FTC Act, 15 U.S. C. §§ 49, 57b·l, to obtain any documentary material, tangible things. 

testimony, or information relevant to unfair or deceptive acts or practices in or affecting 

commerce (within the meaning of 15 U.S.C. § 4S(a)(l»). 

IV. COMPLIANCE REPOR.TING 

(Supersedes Paragraph vn in the Final Order) 

IT IS FURTHER. ORDERED that, in order that compliance with the provisions of the 

Final Order and of this Supplemental Order may be monitored: 

A. For a period of twenty (20) years from the date of entry of this Supplemental Order, 

Defendant shall notifY the Commission of any changes in corporate structure that may 

affect compliance obligations arising under the Final Order or this Supplemental Order, 

including, but not limited to: a dissolution. assignment, sale, merger, or other action that 

would result in the emergence of a successor entity; the creation or dissollltion of a 

subsidiary. parent, or affiJiate that engages in any acts or practices that are subject to the 

Final Order or to this Supplemental Order. or a change in the corporate name or address, 

at least thirty (30) days prim: to such change, provided that, with respect to any proposed 

change in the coIporation about which Defendant learns Jess than thirty (30) days prior to 

the date such action is to take place, Defendant shall notifY the Commission as soon as 

practicable after obtaining such knowledge. 

B. For the PllIposes of monitoring compliance with Paragraphs ill.A.2 - 4 of the Final 

Order, Defendant, for a period of two (2) years from the entry date ofthls Supplemental 

Order, shan submit reports identifYing. for the preceding two (2) months ("reporting 

»7-
period"): 

1. Each policy and procedure implemented or maintained during the 

reporting period to detect or prevent unauthorized disclosure, misuse, or 

other compromise of personal infonnation accessible by subscribers 

through Defendant's non-FCRA regulated products (hereinafter 

"unauthorized access''), including, but not limited to, practices that verify 

that automated systems are operating effectively; and any and aU practices 

that deviated from any such policy or procedure; 

2. Each material risk identified during the reporting period, including, but 

not limited to, each material instance of unauthorized access; and each 

material action taken during the reporting period to identify, address, or 

remedy any such material risk, including, but not limited to, each material 

instance of unauthorized access; and 

3. To the extent that Defendant has identified instances of unauthorized 

access that Defendant has detennined do not constitute material risks, 

Defendant shaH describe such accesses generally by type and indicate the 

reasons Defendant has determined that such types of unauthorized accesses 

are not material. 

Defendant shan provide the first report within ten (10) days following the end of the two 

(2) month reporti~g period that starts on tbe date of entry of this Supplemental Order, and 

shall provide an subsequent reports within ten (10) days after the end ofthe reporting 

period to which the report applies. 

C. Defendant shall notify the Commission of the filing ofa bankruptcy petition by such 

-8-
Defendant within fifteen (1S) days of filing. 

D. For the purposes of this Supplemental Order, Defendant shall, unless otherwise directed 

by the Commission's authorized representatives, send by overnight courier all reports and 

notifications to the Commission, to the following address: 

Associate Director for Enforcement 

Bureau of Consumer Protection 

Federal Trade Conunission 

600 Pennsylvania Avenue, N.W., Room NJ·2122 

Washington, D.C. 20580 

Re: United States v. ChoicePoint, Inc. 

Provided that, in lieu of overnight courier, Defendant may send such reports or 

notific~ions by first-class mail, but only if Defendant contemporaneously sends an 

electronic version of such report or notification to the Commission at: DEBrief@ftc.gov. 

E. For purposes of the compliance reporting and monitoring required by this Supplemental 

Order, the Commission is authorized to communicate directly with Defendant. 

V. RECORD KEEPING 

(Supersedes Paragraph vm in the Final Order) 

JT [S FURTHER ORDERED that: 

A. For a period of six (6) years from the date of entry of this Supplemental Order, Defendant 

and its agents, employees, officers, corporations, successors, and assigns, and those 

persons in active concert or participation with them who receive actual notice oftbis 

Supplemental Order by personal service or otherwise, are hereby restrained and enjoined 

from failing to create and retain the following records: 

I . Subscriber files containing the names, addresses, telephone numbers, all 

certifications made by the subscriber pursuant to Section 607(a) of the Fair Credit 
Reporting Act ("FCRA',. 15 U.S.C. §§ 1681~1681x. and Paragraph II.Bl(a)-(b) of 

the Final Order, and all materials considered by Defendant in connection with its 

verification of the identity of the subscriber and verification of the certifications 

made under Section 607(a), as required by Section 607(a) of the FCRA and 

Paragraph II.B.1 (c) ofthe Final Order; 

2. Consumer complaints (whether received in written or electronic form, directly. 

indirectly. or through any third party), and any responses to those complaints, 

whether in written or electronic form. that relate to Defendant's activities as 

alleged in the Complaint and Defendant's compliance with the provisions of the 

Final Order~ 

3. Copies of all training materials that relate to Defendant I s activities as alleged in 

the Complaint and DefendWlt's compliance with the provisions ofthe Final Order; 

4. Copies of all subpoenas and other communications with law enforcement entities 

or personnel, whether in written or electronic fonn, if such documents bear in any 

respect on Defendant's collection, maintenance, or ftrmishing of consumer reports 

or other personal information of consumel'B; and 

5. All records and documents necessary to demonstrate fulJ compliance with each 

provision of the Final Order or of this Supplemental Order, including, but not 

limited to, copies of acknowledgments of receipt of the Final Order required by 

Paragraph IX.B of the Final Order or of receipt of.the Final Order and 

Supplemental Order required by Paragraph VI.B of this Supplemental Order, and 

an reports submitted to the FfC pursuant to Paragraph VII of the Final Order or 

Paragraph IV of this Supplemental Order. 

·10· 
B. For a period of three (3) years after the date of preparation of each biennial Assessment 

required under Paragraph IV of the Final Order or Paragraph II of this Supplemental 

Order: all plans, reports, studies, reviews, audits, audit trails, policies, training materials, 

work papers, and Assessments, whether prepared by or on behalf of Defendant, relating to 

Defendant's compliance with Paragraph m of the Final Order for tbe compliance period 

covered by such biennial Assessment. 

VI. DISTRIBUTION OF FINAL AND SUPPLEMENTAL ORDERS BY DEFENDANt 

(Supersedes Paragraph IX in the Final Order) 

IT rs FURTHER ORDERED that, for a period of five (5) years .from the date of entry of 

this Supplemental Order: 

A, Defendant shall deliver copies of the FinaJ Order and of this Supplemental Order to all of 

its principals, officers and directors, and to all managers who have responsibility directly 

o~ indirectly for any matters covered by the Final Order or this Supplemental Order. 

unless such persons have previously received such copies. Defendant also shall deliver an 

accurate summary of the Final Order and a notice of the revised time periods for 

Defendant's obligations under this Supplemental Order to aU of its employees who verify 

the identity of prospective users of conswner reports, those employees who verify the uses 

certified to Defendant by prospective users of consumer reports, and those employees Who 

monitor or audit the continued compliance by Defendant's subscribers with their 

certification of permissible pwposes, unless such persons have previously received such 

summaries and notices. Defendant also shall deliver accurate summaries of the Final 

Order and of this Supplemental Order to all of its employees who are engaged in conduct 

related to Defendant's activitiee that are the subject of Paragraphs m and IV of the Final 

·11· 
Order or Paragraph IT of this Supplemental Order. including, but not limited to, those 

employees designated as jnformation security program coordinators, unless such persons 

have previously received such summaries. Defendant also shall deliver copies of the Final 

Order and of this Supplemental Order to any business entity resulting from any change in 

structure of Defendant or any business entity that Defendant directly or indirectly controls, 

or has an ownership interest in, that may affect Defendant's compliance obligations 

arising under the Final Order or this Supplemental Order, including, but not limited to: 

incorporation or other organization; a dissolution, assigmnent, sale, merger, or other 

action; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any 

acts or pzactices subject to the Final Order or this SuppJemental Order; or a change in the 

business name or address, tmless such business entities have previously received such 

copies. 

B. For current personnel, delivery shall occur within five (5) days of the date of entry. of this 

Supplemental Order. For new personnel, delivery shall occur no later than their assuming 

their responsibilities. For any business entity to which distribution is required pursuant to 

this Paragraph, delivery shall be at least ten (10) days prior to the change in structure. 

C. Defendant must secure a signed and dated statement acknowledging reoeipt of the Final 

Order and SuppJementaJ Order, within thirty (30} days of delivery, :from all persons 

receiving a copy of the Final Order and Supplemental Order pursuant to this Paragraph. 

VII. ACKNOWLEDGMENT OF RECEIPT OF SUPPLEMENTAL ORDER 

IT IS FURTHER ORDERED that Defendant, within five (5) business days ofreoeipt of 

this Supplemcmtal Order as entered by the Court, must submit to the Commission a truthful sworn 

statement acknowledging receipt of this Supplemental Order. 

-12-
VIII. RETENTION OF JURISDICTION 

IT IS FURTHER ORDERED that this Court shaH retain jurisdiction of this 

matteI fOI pwposes of construction, modification, and enforcement of this Supplementa1 Order. 

IX. COSTS AND ATTORNEY'S FEES 

IT IS FURTHER ORDERED that each party shall bear its own costs and attorney's fees 

incurred in connection with this action. 

X. NOTICE OF ENTRY OF SUPPLEMENTAL ORDER 

IT IS FURTHER ORDERED that entry in the docket of this Supplemental Order by the 

C1erk of Court shall constitute notice to Defendant of the terms and conditions of this 

Supplemental Older, and that Defendant waives all rights to contest in any future proceeding 

whether Defendant was properly served with this Supplemental Older. 

IT IS SO ORDERED: 

Dated this J.J!!...day of cYcro13 ElL ,2009. 

II 

II 

II 

II 

II 

H~J~ a..,.- United States District Judge 

-13-
FOR THE FEDERAL TRADE COMMISSION: 

JAMES A. KOHM 

Associate Director for Enforcement 

ROBERT KAYE 

Assistant Director for Enforcement 

Elizabeth 

£~ Tucci, Attorney 

Robin Rosen Spector, Attorney 

Jock Chung. Attorney 

Federal Trade Commission 

Division of Enforcement 

600 Pennsylvania Avenue. NW 

Suite NJ-2122 

Washington, D.C. 20580 

(202) 326-2402 (Tucci) 

(202) 326-3740 (Spector) 

(202) 326-2558 (fax) 

DAVID SHONKA 

Acting General Counsel 

II 

II 

/I 

II 

/I 

-14-

FOR THE DEFENDANT: 

Robert. . , Bsq 

Kevin L. Coy. Esq. 

Oldaker, Belair, & Wittie L.L.P. 

81S Connecticut Avenue, N.W. 

Suite 1100 

Washington, D.C. 20006 

Counsel for Defendant 

Hogan 

~j)~ & Hartson LLP I / 

Columbia Square 

555 Thirteenth Street N.W. 

Washington, D.C. 20004 

Counsel for Defendant 
FOR THE PLAINTIFF, THE UNITED STATES OF AMERICA: 

SALL Y QUILLIAN YATES 

Acting United States Attorney 

DANIEL A. CALDWELL 

Assistant United States Attorney 

Georgia Bar No. 102510 

600 Richard B. Russell Building 

75 Spring Street, SW 

Atlanta, Georgia 30303 

Telephone: (404) 581-6224 

Facsimile: (404) 581-6181 

E-mail: Dan.Caldwel1@usdoj.gov 

EUGENE M. TIllROLF 

Director 

Office of Consumer Litigation 

KENNETH L. JOST 

Deputy Director 

Office of Cons 

- .. -r~~~~----~--------

Tri Attorney 

Oil I of Consumer Litigation 

PO Box 386 

Washington, D.C. 20044 

Telephone: (202) 307-6154 

Facsimile: (202) 514-8742 

E-mail: Alan.Phelps@usdoj.gov 

Attorneys for Plaintiff 

United States of America 

-15-