-1-

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF MINNESOTA

 

)

)

UNITED STATES OF AMERICA, )

Plaintiff, )

)

v. )

)

RENTAL RESEARCH SERVICES, INC. ) Civil Action No.

a corporation, and )

)

LEE MIKKELSON, ) 

individually and as an )

officer of the corporation, )

Defendants. )

)

)

 )

COMPLAINT FOR CIVIL PENALTIES,

INJUNCTIVE AND OTHER EQUITABLE RELIEF

Plaintiff, the United States of America, acting upon notification and authorization to the

Attorney General by the Federal Trade Commission (“FTC” or “Commission”), for its

Complaint alleges that:

1. Plaintiff brings this action under Sections 5(a), 13(b), and 16(a) of the Federal

Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 45(a), 53(b), and 56(a), and Section 621(a) of

the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. 1681s(a), to obtain monetary civil penalties,

and injunctive and other equitable relief from Defendants for engaging in acts or practices

violating Section 5(a) of the FTC Act, 15 U.S.C. § 45(a) and the FCRA, 15 U.S.C. §§ 1681-

1681x.
-2-

JURISDICTION AND VENUE

2. This Court has jurisdiction over this matter under 28 U.S.C. §§ 1331, 1337(a),

1345, and 1355 and under 15 U.S.C. §§ 45(a), 53(b) 56(a), and 1681s.

3. Venue in the District of Minnesota is proper under 15 U.S.C. § 53(b) and under

28 U.S.C. §§ 1391(b)-(c) and 1395(a).

DEFENDANTS

4. Defendant Rental Research Services, Inc. (“RRS”), is a Minnesota corporation,

with its principal place of business at 7525 Mitchell Road, Eden Prairie, Minnesota 55344. RRS

transacts or has transacted business in this district.

5. Defendant Lee Mikkelson is the Vice-President and Managing Officer of RRS. 

His business address is the same as that of RRS. At all times material to this Complaint, acting

alone or in concert with others, he has formulated, directed, controlled, or participated in the acts

and practices of RRS, including the various acts and practices set forth in this Complaint. He

transacts or has transacted business in this district.

COMMERCE

6. The acts and practices of Defendants alleged in this Complaint have been in or

affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 15 U.S.C. § 44.

THE FAIR CREDIT REPORTING ACT

7. The FCRA was enacted in 1970, became effective on April 25, 1971, and has

been in force since that date. The Fair and Accurate Credit Transactions Act amended the FCRA

in December 2003.

8. Section 621 of the FCRA, 15 U.S.C. § 1681s, authorizes the Commission to use

all of its functions and powers under the FTC Act to enforce compliance with the FCRA by all
-3-

persons subject thereto except to the extent that enforcement specifically is committed to some

other governmental agency, irrespective of whether the person is engaged in commerce or meets

any other jurisdictional tests set forth by the FTC Act.

9. RRS is in the business of selling tenant screening reports, which are used by

landlords and others for consumer eligibility determinations, such as whether to rent an

apartment to a given individual. The tenant screening reports that RRS provides to third parties

are consumer reports as defined in section 603(d) of the FCRA, 15 U.S.C. §1681a(d). That

section defines a “consumer report” as 

any written, oral, or other communication of any information by a consumer reporting

agency bearing on a consumer’s credit worthiness, credit standing, credit capacity,

character, general reputation, personal characteristics, or mode of living which is used or

expected to be used or collected in whole or in part for the purpose of serving as a factor

in establishing the consumer’s eligibility for (A) credit or insurance to be used primarily

for personal, family, or household purposes; (B) employment purposes; or (C) any other

purpose authorized under section 604. 

RRS’s tenant screening reports are communicated to third parties; bear on the consumer’s credit

standing, mode of living, and/or other attributes listed in section 603(d); and are used as a factor

in determining the consumer’s eligibility for a purpose specified in section 603(d). 

10. In providing tenant screening reports, RRS is now and has been a “consumer

reporting agency” as that term is defined in section 603(f) of the FCRA, 15 U.S.C. § 1681a(f). 

That section defines a “consumer reporting agency” as 

any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly

engages in whole or in part in the practice of assembling or evaluating consumer credit

information or other information on consumers for the purpose of furnishing consumer

reports to third parties, and which uses any means or facility of interstate commerce for

the purpose of preparing or furnishing consumer reports.

RRS regularly sells in interstate commerce information on consumers (including credit account

information and credit scores) that it assembles for the purpose of furnishing consumer reports to
-4-

its clients.

DEFENDANTS’ BUSINESS PRACTICES

11. Defendants contract with CSC Corporation, a consumer reporting agency, to

obtain consumer reports which Defendants assemble and merge into their tenant screening

reports and sell to their own customers. The consumer reports that Defendants obtain contain

credit account and public record information from Equifax, Inc., a nationwide consumer

reporting agency, and credit scores from Fair Isaac Corporation.

12. Defendants sell tenant screening reports online to businesses and individuals. 

Tenant screening reports are one type of consumer report, and contain the personal information

of consumers, including names, Social Security numbers, dates of birth, bank and credit card

account numbers, and credit histories, much of which is sensitive and not publicly available. 

RRS obtains consumer data from other consumer reporting agencies; the company collects the

information without making any contact with the consumers whose information it sells, and

consumers cannot prevent RRS from obtaining their personal information. 

13. RRS does not have written procedures for its employees to use in screening the

applications of new customers, and instead relies on informal screening procedures. To obtain

consumer report information from RRS, a potential customer fills out an application online

through RRS’s website, www.rentalresearch.com. The application asks that the applicant

provide a name, company name, company type, state of incorporation, number of years in

business, number of rental units managed, address, e-mail address, telephone number, fax

number, and website (if applicable, but not required). After receiving the online application,

RRS purports to check whether the applicant’s website exists, if it lists one, and to consult

business directories to see if the business exists. For many applicants, RRS does not request any
-5-

further information and approves the application. Once approved, the customer is e-mailed login

and password information and may purchase an unlimited number of RRS consumer reports

from www.rentalresearch.com. The approval process is a one-time event, and once approved a

customer is not subjected to any further screening by RRS.

14. RRS claims to request documentation from some applicants, which

documentation may include personal identification, property tax statements, telephone bills,

voided checks, rental ads, management agreements, executed lease agreements, and/or Secretary

of State certificates. RRS does not have guidelines to determine under what circumstances

applicants will be required to provide documentation, and instead makes decisions on an ad hoc

basis. RRS also lacks consistent standards for determining the type of documentation required

or the factors used to assess the appropriateness or validity of the documentation supplied.

15. From January 4 through February 3, 2006, RRS sold at least 318 consumer

reports to identity thieves. On January 2, 2006, identity thieves claiming to be a person with the

initials C.N., who is an actual person operating a legitimate business, filled out an online

application with RRS using publicly-available information. The thieves provided a name, a

business name, number of years in business, number of rental units managed, a physical address,

a Hotmail e-mail address, a cellular telephone number, a fax number, and a statement that the

individual sought consumer reports for renting a 150-unit property that he owns. On or before

January 4, 2006, RRS approved the application without seeking any further information or

documentation, or performing any investigation. RRS then e-mailed a login ID and password to

the Hotmail e-mail address on the application. These credentials gave the identity thieves

unlimited, online access to consumer reports, which they used to purchase at least 318 consumer

reports.
-6-

16. On January 31, 2006, a consumer contacted RRS after he noticed the notation of

an inquiry by RRS on his consumer report and believed his identity had been stolen. RRS

personnel told the consumer that C.N. had requested a copy of his consumer report, and the

consumer advised RRS personnel that he had not authorized C.N. to access his report. RRS took

no further action regarding C.N.’s account at that time. On February 6, 2006, a second consumer

contacted RRS stating that his consumer report had been impermissibly accessed. When RRS

discovered that this consumer’s report also had been requested by C.N., it sought but was unable

to obtain an explanation from the individual purporting to be C.N. Accordingly, RRS disabled

C.N.’s account, preventing access to any more consumer reports.

17. Defendants failed to prevent the disclosure of consumer reports to identity thieves

because Defendants’ practices and procedures, taken together, do not constitute reasonable

procedures to verify or authenticate the identities and qualifications of prospective subscribers. 

Among other things, Defendants failed to: establish procedures to determine whether and when

to require supporting documentation from applicants to verify their identities and their certified

permissible purposes for obtaining consumer reports; take reasonable steps to verify information

provided by RRS’s applicants and follow up to address any inconsistencies, such as by requiring

information from applicants that is not simply available in public resources (and could, therefore,

be readily obtained by an identity thief); and monitor users’ ongoing activities in order to limit

the furnishing of consumer reports to the purposes listed under section 604 of the FCRA, such as

by failing to detect a high volume of requests that was inconsistent with the information

provided by the identity thieves in their application for access. 

VIOLATIONS OF THE FCRA

COUNT I
-7-

18. Section 604 of the FCRA, 15 U.S.C. § 1681b, prohibits a consumer reporting

agency from furnishing a consumer report except for specified “permissible purposes.”

19. As described in Paragraphs 7 through 17, in at least 318 instances, Defendants

furnished consumer reports to persons that did not have a permissible purpose to obtain a

consumer report.

20. By and through the acts and practices described in Paragraph 19, Defendants have

violated Section 604 of the FCRA, 15 U.S.C. § 1681b.

COUNT II

21. Section 607(a) of the FCRA, 15 U.S.C. § 1681e(a), requires every consumer

reporting agency to maintain reasonable procedures to limit the furnishing of consumer reports

to the purposes listed under Section 604 of the FCRA, 15 U.S.C. § 1681b, including making

reasonable efforts to verify the identity of each new prospective user of consumer report

information and the uses certified by each prospective user prior to furnishing such user a

consumer report. 

22. As described in Paragraphs 7 through 17, Defendants have failed to maintain

reasonable procedures to limit the furnishing of consumer reports to the purposes listed under

Section 604 of the FCRA, have failed to make reasonable efforts to verify the identity of each

new prospective new user of consumer report information, and have failed to make reasonable

efforts to verify the uses certified by each prospective user prior to furnishing such user a

consumer report. 

23. By and through the acts and practices described in Paragraph 22, Defendants have

violated Section 607(a) of the FCRA, 15 U.S.C. § 1681e(a). 

COUNT III
-8-

24. Section 607(e)(2) of the FCRA, 15 U.S.C. § 168le(e)(2), requires any person who

procures a consumer report for purposes of reselling the report to establish and comply with

reasonable procedures designed to ensure that the report is resold only for a purpose for which

the report may be furnished under Section 604 of the FCRA, 15 U.S.C. § 1681b. 

25. As described in paragraphs 7 through 17, Defendants procure consumer reports

for the purposes of reselling those reports, but did not establish and comply with reasonable

procedures to ensure that the reports were resold only for purposes authorized by Section 604 of

the FCRA. 

26. By and through the acts and practices described in Paragraph 25, Defendants have

violated Section 607(e) of the FCRA, 15 U.S.C. § 1681e(e). 

27. Pursuant to Section 621(a) of the FCRA, 15 U.S.C. § 1681s(a), the acts and

practices alleged in paragraphs 20, 23, and 26 also constitute unfair and deceptive acts or

practices in violation of Section 5(a)(1) of the FTC Act, 15 U.S.C. § 45(a).

VIOLATIONS OF SECTION 5 OF THE FTC ACT

28. As described in Paragraphs 7 through 17, Defendants have not employed

reasonable and appropriate measures to secure the personal information RRS collects for sale to

its customers, including reasonable policies and procedures to (1) verify or authenticate the

identities and qualifications of prospective subscribers; or (2) monitor or otherwise identify

unauthorized subscriber activity.

29. Defendants’ failure to employ reasonable and appropriate security measures to

protect consumers’ personal information has caused or is likely to cause substantial injury to
-9-

consumers that is not offset by countervailing benefits to consumers or competition and is not

reasonably avoidable by consumers. This practice was, and is, an unfair act or practice in or

affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C.

§ 45(a).

THIS COURT’S POWER TO GRANT RELIEF

30. Section 621(a)(2)(A) of the FCRA, 15 U.S.C. § 1681s(a)(2)(A), authorizes the

Court to award monetary civil penalties of not more than $2,500 per violation of the FCRA in

the event of a knowing violation, which constitutes a pattern or practice of violations. 

Defendants’ violations of Sections 604, 607(a), and 607(e) of the FCRA, as alleged in this

Complaint were knowing and constituted a pattern or practice of violations.

31. Each instance in which Defendants have failed to comply with Section 604 or 607

of the FCRA, 15 U.S.C. §§ 1681b and 1681e, constitutes a separate violation of the FCRA for the

purpose of assessing monetary civil penalties under Section 621 of the FCRA. Plaintiff seeks

monetary civil penalties for every separate violation of the FCRA.

32. Under Section 13(b) of the FTC Act, 15 U.S.C. § 53(b), this Court is authorized to

issue a permanent injunction prohibiting Defendants from violating the FCRA and the FTC Act. 

PRAYER FOR RELIEF

WHEREFORE, Plaintiff requests that this Court, pursuant to 15 U.S.C. §§ 45(a)(1), 53(b),

56(a), and 1681s, and pursuant to the Court’s own equitable powers:

(1) Enter judgment against Defendants and in favor of Plaintiff for each violation

charged in this Complaint;

(2) Award Plaintiff monetary civil penalties from Defendants for each violation of the

FCRA alleged in this Complaint; 
-10-

(3) Enter a permanent injunction to prevent future violations of the FCRA and the FTC

Act by Defendants;

(4) Order Defendants to pay the costs of this action; and

(5) Award Plaintiff such other and additional relief as the Court may determine to be

just and proper.

Dated:
-11-

OF COUNSEL:

JOEL WINSTON

Associate Director

Division of Privacy and Identity Protection

REBECCA E. KUEHN

Assistant Director

Division of Privacy and Identity Protection

SANDRA MCCARTHY

Attorney

Division of Privacy and Identity Protection

MOLLY CRAWFORD

Attorney

Division of Privacy and Identity Protection

Federal Trade Commission

Washington, D.C. 20580

FOR THE PLAINTIFF 

UNITED STATES OF AMERICA:

MICHAEL F. HERTZ

Acting Assistant Attorney General

Civil Division

United States Department of Justice

FRANK J. MAGILL JR.

United States Attorney

District of Minnesota

____________________________

Assistant United States Attorney

600 U. S. Courthouse

300 South Fourth Street 

Minneapolis, MN 55415 

612-664-5600

612-664-5787 (fax)

EUGENE M. THIROLF

Director

Office of Consumer Litigation

KENNETH L. JOST

Deputy Director

Office of Consumer Litigation

 

DANIEL K. CRANE-HIRSCH

Trial Attorney

Office of Consumer Litigation

U.S. Department of Justice

PO Box 386

Washington, D.C. 20044

202-616-8242

202-514-8742 (fax)

Daniel.Crane-Hirsch@usdoj.gov