. . . , . - i

, . . ., . . - . :

kL . . „ ~ i F.- " ---, .

. .

.L . , :- - 0 Ick

JAI 1) ! 20 IN

THE LT'_1,T1TED STATES DISTRICT COURT

FOR THE NORTHERN DISTRICT ' {)F GEORGIA FEB 1 2006

}

DDefendant

liNnTD STATES OF AI~MRICA,

Ptiaiiii x ff,

v.

F id r~

Civil Action No.

S'1'YPULA'rED FINAL JUDGMENT AND ORDER FOR CIVY1, PENALT1E ,

PERMANENT INJUNCTION, AND OMER EQUITABLE RELIEF

Plaintiff, the United States of Arneri ca, acting upon not] ficati on and authorization to the

Attornc} general by the Federal Trade Commission ("F TC:" or "Commission"), is concurrently

filing its Complaint, which alleges that Defendant hoicePoIzP i inc- has e n gaged in violations of

the Fair credit Reporting Acs ( "F RI, 1 5 U. § 1681-16 8 i x, and in unfai r or deceptive

arts or practic~s i n violation of Section 5 of the, Federal Tra de Commission Act (.vm Act"), 15

U. _C . § . 45(a) . The, parties have agreed to the entry . of this Stipulated Final Judgment and Or&r

(or Civi l penalties, Fern tent Injunctr.on, and OtheriEguitabie Relief of C'Order") to resole all

matters ur dispute i-a this action without trial or adj udi=iari of any issue of ] a or fact herein and

without Defendant admitting the truth of, or ji ah111 ty BUT, any of the matters alleged in the

ornp l=t- Defendant has waive d ser vice of the b ur ns and amglai nt .

THX2EFORE, IT IS HEREBY ORDERED, ADJUDGED, AND DECREED as

folios ;

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 1 of 30

0

0

--

F N

I . This Ccu rt has j urisdiction over the subject matter of this case and over Defend ant

ChoicePoint Inc.

Venue in # hi s di strict is proper under 2.$ U, . 139] (b and (c), and 1 5 T.S . .

§ 53(b) .

The acts and practices of Defendant are in or affecting coirnmerce, as "commerce"

i s defined in acti on 4 of the FTC Act, 1 U. S, C . § 44 .

4. The. Complaint states claims upon which relief may be tented against Defendant

undo Sections 5 (a (1 ), 13 ( b), 16(a), end 1 9 af the Ff Act, 1 5 U. ,C .- § 45(a){I } , 5 3 (6), 5 6(a),

and 57b; d unde r e 7 on 621(a) of the FC A, 1 5 U3 ,C . § 16£i ] s( a) .

5 . Defendant makes no admissions to, and denies. the aflegations in #hi~ Complaint,

other than e j urisdicti onal facts6, Defcndant waives: (~ ah rights to seek appellate rev i ew car otherwise e chal len6-- oar

contest the validi ty of this Order, (b) any claim Defendantt may have against the omrnsssxon, its

employaes, representatives, or ag=ts that re l ate to the mat ter stated he~in; (c) all claims under

tie dual Access. to. Justice Act 2 U. . § 2412, as amended by Fib . L. . 1 04-12. 1, 1 1 0 Stat.

847, 8 63 - 64 (1996) ; and d) any rights to attornc} +~ ' fees that rmiy arise under said provision of

l aw.

7. Entry of th i s Order i s in the, publ ic interes t .

DEFINITIONS

For purposes ofthis Order, the followi ng defi niti ons s hall appl y :

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 2 of 30

E

"Fair Credit Reporting pct" or "F CPA" rcfcrs to 15 T 1 . 1681-168 lx, as

- 3-

amended,

2 . The terms "persog,," "consumer,," "Consu=r resor t," and" consumer repoa't ing

agency" mean as defined in Sections 603(b), ( c), (d) , and (f) > rcspectivcly, of the F RA, 15

CJ,, C §1681a{h}, 1 6s1a(c), 168 1 a(d), and 1681 a(f)

'Tennissiblc purpose" meansa amy of the. purposes list W in section 604 of tbe

FCRA, 1 5 U, 1 681b, for which a consumer reporting agency may lawfully finiish

cons umer report.

4"subscriber" means any. person or entity, excluding cxxnstiniers, that enters into

agreement with Defendant pursuant towhich that PerWn or tat may request Qr obtain a

cons=err report or other personal information from Defendant .

"Mixed-use subscriber" means. a subscriberr that in the ordinary course of husincq .1;

typically has both permi ssible and irnpcntussible purposes for ordcring consumer reports,

6. "Pers onal in formation" means individually identifiable, information from or about

an individual consumer inludinbut not limited #o . (a) a first and last name or first initial and

fast name ; (h) a home or. otb cr physical address, which includes at ie~t street name =d uaznc of

city or town ; (c) an a mail address; ( d} a Wl ephanca number ; (c) a Social security number ; (t credit

=d/or debit card information ., including credit =d+'or debit =j number with expiration date ; (g)

date of birth ; . (h) a driver's license number ; or (i) any other information from or about an

individual consumer that isa combined with (a through (h) above,

i 'Signing". or. "signed" mea ns either a hand ril tm signature inc hid in g those

svbsaquently. tran .~mittcd b farsi. xnil e , pdf files, or. other d ial Or ele aronic mews} or an

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 3 of 30

0 0

-4-

"electronip, signature" as that germ is defined in the Electronic Sign atuxes in Global and National

Commerce Act, 15 U . S, C. 7006(5)-

8. Unless otherwise specified, . "Defendant" means ChoicePoi nt Inc., it s sribsidi aries

and operating companies, and their successors and assigns, offiaers, agents, representatives, ud

employees .

9. ornmerce" means as defined in Section 4 o f tbe Federal Trade. Commission

Act, 1 5 LT,S . _ § 44 .

ORDER

1 . . CIVIL PENALTY

I T IS ORDERED that Defendant shall pay to Plaintiff, ptirsuant to Section fil l {a} ofthe

FP-A, 1 5 U, ,C . § 1 6 8 1 s(a)1 and Section 5(m)(1 }(A) of # ha F'TC Act, 1 5. U . .. 45(rn)( 1 }(A~, a

civil penalty in the arrYo u-nt often million doll ars (S 1 .0,000,

Defendant shall m ake, the payment required by Paragraph I within seven (7) business days

of the, date o f s ervice of this Order by fund transfer in aocordancc with imt-ructions

provided by th Vice of Consumer Li# ~gat ian, Civil Division, Q.T.S . Deparirnent a f,T nsti ce,.

Washington, -D. 0 530, for appropriate disposi tj on .

In the event of acv default irx payment- which default continues for ten days beyond the

due date of payment, the entire wnpaid pimafty, together with interest, as computed pursuant to 28

. 1961 from the date of default to the date o#' pa nem, shall irnmccliatcly become due and

11. PROMBMD BUSINESS ACTIVITIES

IT I S F[: THER ORDERED that Defendant and all oth er persons or entities within the

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 4 of 30

scope of Fed . R. iv. P. 65, whether. acting directly or through any sol e proprie#ol^shxp,

partnership, limited liability c*mpstYy, corporation, subsidiary, brmch, division, or other entity,

who receive, actu al notice of this Order b y per sonal serv ice or otherwise, are hereby penmanMt1y

restrained nd enjoined f pn .

A. ' Violating Section 604 of the FCRA, 1 5 U. 168 by furnishing eonsuMer

report to any person who does not have a peTriv ssible purpose tO receive a consumer -report .

B . Fai ling to maint ain i easo nablek procedures designed W limit t h e furnishing of

c.onsumer r eports to slab scri bers that have permiss ibl e purposes to receive them =der Sect i on

604 of the FCRA, 1 5 U, . § 16 91 b, as negvjred by Section 607(a) of the FRA, 15 UP . . C §

168 1 e{a} n Such procedures s h all inch ude , but not necessasi. ly he limited to'

1 . with respect to prospective Fubscribcrs, before furnkshiag a consumcr

report to any such subscriber ; . with r f~sP ect to current su bscrib ers, within

one hun dred eighty ( 180) days after the date of service of thi s Orde r; end

with respect to subscribers ofcompanies acquired by Defendant after the

date of service of t hi s Order, withi n ni nety (90) days after the closing of

the acquisition transaction for acquired companies Wit live thousand

{S OOU} or fewer subscribers and within one, hundred eigbty (180). days after

the closing of the wquis ition transactiorp for. acquired cornpar~ics with

more than five thousand (5000) subscribers ;

(a) Obtaining from. each srxbsct-iheT a written certification, either in

pape r o r. electronic form, stating the nature o f the bscri bct 's

busincss md all p urposes for whi ch the subscriber plans to obtai n

-5-

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 5 of 30

0

0

- 6 -

consurncr report s from Defendant . Each ce rtifi cation under this

pravisioir : ~ must be dated and signed; (2) .m ust bear. the p6ntcd

or type d na me of the person signing it ; an d (3) must state that die

pe rson s i gndng it has d ire.c#t knowledge of the facts cerEfied,

provided, ho~v euer, that frsr

current subscribers, the, ce ttificatiori

may, inn l icu of ~;Wiii g th at the pe rs on signing it has direct

knowledge fthe facts ~er ti fie d, attest to the truth o fthe matters

ce rti fie d a nd the authority of t he person to sign on behalf ~4 the

subscriber.

(b) Determining, based on the information i n the 5uhscnber 's

certification under subparagraph (a) above, and any otherr factors of

which Defendant is .ware o r, under the circumstances, should

reasonably asccrtain , that each ~,ubs cri ber has a permissible

purpose tinder Section 6[}4 of the FCRA for the types of reports die

sQbs criber plans to ob i ain, or, whe re the subscriber is a resell er of

consumer reports, that t he subscriber complies with section

607~e)() of the FRA .

(c) As to s ubsenber s that businesses, verf~n (1 ). th e business

identity of the subscriber; axed (2) tha#t the sx+scri herr is a lc ti mmte

bus iness engaged in tie busi ness ccrtified, and has a permissibl e

purpose fog obtaining consumer reports . Defendant shall con duct

an on-site visual inspcctiosl of the bu siness premises of each

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 6 of 30

0 0

-7 -

subscrib er, or, in the case Df a subscriber .vith multiple 1oLc at io%,

the headquarters location of the subscriber, prnvided. h o wver, that

(i) for a prospective subscribcr, Defendant does not need to

conduct a site visit if i fondant independently venues that

at the ti me of application :

(1 ) the applicant is a publicly held company under

the regulatory authority of thi~ . United States

Sectr7ities and Exchange Commission;

() ) the applicant is subjert to the replatary

authority of any agency listed in section 621 ( b) of

( 3) the applicant is an insurance agent sponsored by

at least one insurance company that has been a

subscriber of Defendant for at ]east one (1 ) year and

has coxitractually agreed to assume financial

responsibility cxr payment of the sponsored agent's

acquisition of con surner rcgortss from Defendant ;

(4) the applicaut has been approved by the Internal

Revenue Service, as atax-exempt organization

pursuant to Section 501 c)~3) o f the Intcmal

revenue bode, 2 IJ. S -C . § 50]{c}(3), and as a

subscriber i 1 1 not receive from Defendant , unless

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 7 of 30

_g_

E

first provided to Defendant by the subscriber, any of

th e fol l owi ng in formation about co nsurners ;-

untrunaated Social Security numb m ; Lintrancawd

dates& of birth ; unt-uncat ed drivers' l ice nse numbers;

or untruncated cred it oard, debit card, batik cnu~it,

or. other financial account numbers ;

(5) the a plioant hisa been certified b y the small

business Adrninistratian for participation in are

FHA-administered pro r-am, such as the Section 8(a)

Business Development program and the Small

Disadvantaged Business Pragr„ I .F , Ft . part

1 24, or the Historically Undcrtittilized Business

and 126; of

(6 ) e. applicant has been certified b y the

Department of Transportation for pcipatiori in

the Department of Transportation's Disadvantaged

Business Enterprise Pragrarn, 49 C .F.R. dart 26.

{ii) for a current suhwriber, Defendant dai~s riot geed to

conduc t a site visit i f:

(1) Defendant has independently verified that at

least one of the eleFnents set out in (c){i} above is

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 8 of 30

ectio~i 60 8 of the FCRA, 15 U . Z 168 f, ar that curtify

a permissible purpose solcl}' under Sections 6U4(a)(3B),

604(a){3)(D), 604(a)(4), 6{4(a)(5), 626, or 627 . 15 U .S .Q .

1 6!v_

9.-preset

-

with respect to that subscriber ; or

(2.) Defendant conducted a site visit v~ithin the meyear peri od immediately pri or to the da te of ser vice

of this Order that confirmed the l egi timacy of the

business, and the subscriber has not subseguWXy

changed its address .

viii} Defendant does& not need to cvn&ct a si c visit for

subscribers that are Federal or tote agencies or

departments that obtain consume ;- reports solely under

d) Informing each subscriber in ritmg, either in paper or electronic

Corms, that the F R imposess crimiual pen airies against anyone

who knowingly and willfully obtains infonnation an a consumer

from a consumer reporting agency under falset preti=5es, including

a fins, up to two years fn Prison, Or . both, pursuain i to Section G 19 of

ft- F R.. , 15 U , . § 1681 q, provided that the recitation . of

pcnaliic ss shall be adjusted for any change in applicable l aw

pursuant to Section 619 of the F Rr 15. U. 1 6 8 I q .

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 9 of 30

0 0

-to-

(c) Provi di ng t o each subscriber to whom Defendant furnishes

c onsumer rep*rLs a written copy of t he "Notice to [Seers of

cons umer Re}~o r#s: Obligations f scrs Under the F AA," 16

C . F. lt . Pt . 601 App. endix C, as required b &~ctiau 0 d) Q f the

FRA-, 15 U. .C, 1681 c(d), provi de d, however, that Defendant

may furnish an electronic copy of this notice if a subscribff obtains

consumer repons frarn Defendant in electronic form .

Beginning within thirty (3 U) days of the date of sc icy of this or der, wi th

respect to both current and prospective aubscribers, or, with respect to

subscribers of companies acquired by I fendaW after the date of service of

this Order, within s ixty (60) days after the c losing of the acquisition

transaction:

a eac h time any subscr iber cert i fiess a permissible purpose under

Section 604(a)(3) of the FCRA, requhing t he subscriber to. id tify

and certify the specific subsection of Section 604(a)(3) (6th~ir by

se ction or dcsc rip tionL s uch a s "insurance u nderwriti ng„) tha t

prmvides the perntissible purpose to obtain the report .

(b Requiring each mixed-use subscriber that certifies a permissible

purpose under Section fi04 (a) (3 )(A) ) of the F CRA to further id entify

awd certify with specificity he intende d t under that subsection

each time it re quest s a consumer r oport. (e - g, , an attorney subscriber

who. certifies a permissible purpose

under Section 604(a)(3)(A)

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 10 of 30

0

0

-11-

would also specify that it i s "col lect in g a dcbt") ; . provided that such

certification may he'made at log-on, rather than on a per consumer

rp~port basis, in eases where the subscribcru orders consumer reports

througb an interactive clectronic ordering system operAW by

Defendant, and the subscriber has contractually certified only wie

permissible puiTose specified in Section 04(a)(3)(A) to obtain

consumer reports .

(c) Requiring, each timc y subscriber certifies as its perrnissibIt!

Purpose a "legitimate business need". purstiant to Section

6{}4(a (3)(F) of the FAR , that tbe, subscriber cwify and identify

with specificity that business need (e .g ., `fin wnnection with

FI AiC¢C1Y ns for apartment rentals" or "apPticatio-ris to open

checking accounts") . In those cases where a subs(,ft7iber has

penmissi`b1e purposes that encompass more than one "legitirnate

business. nccd" under Section 04(a)( )(F), then individiial

certification and identification with specificity must be obtained b

Defendant each ii ine the subs cribcr requests a consumer report.

d) Ensuring that the following tnessager orr one sikstan#i~1 l y identical

to it, is displayed clearly and consp icuous ly ors the. subscriber's

screen each time

a subscriber transmits a request ele ctro nically for

a consumer report; "The federal Fair. Credit Reporting Act ir o poses

cr~1 penal# ii~ s - including a fire, up to two years in prison, or

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 11 of 30

0 E

- 12

bv-tli - against anyone who knowingly and willfully obtains

information .cm a consumer m a consumer orting agency

false pFinmS esr and other pe n alties for an arse who obtains

such consumer information without a peirni ss ihle purpose,"

provided t hat tie recitation of penaltaes sha ll be adjusted for. my

change i n app l i cable law pursuant to section X 1 9 of the FCR .4, 1 5

U.S.C. § 1 6S l q.

(e ) Employing reasonable proccdxtrcs to verify that subsonben

obtaining c t umtr reports are, in fazt, wixr the reporis solely for

permissible purposes . Such procedures ma r include, but are not

I! mited to, periodic. Defendant-initiated audits that rely, at least in

part, upon consumer or otherr non-subseriber third-party

dmumen#ation of perntvssiBlyo purposes ; provided that Defendant is

not required to obtain additiomil verification of the pcm-iissible

purpose it]) respect to any consumer ort for which Defendant

has. received and retained for purposes of demonstrating

compliance -with this su6gara ph :

(1) a copy of a court order or a federal grand j-~iry subpoena

ordering rel ease of such repcyrt ;

(2) verified documentation signed by the rons=cr on whom the

report was furnished expressly authorizing the release of such

r eport ;

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 12 of 30

-13-

(3). i n the case o#' a report for which the purpose ce rtified was the

collection of a judgment, a copy ofthe court JudD-nent ;

~4) in the case of a repor#t for which the purpose certified was. the

evaluation of um ermploycee for promotion, reaissigmrnent, or

retention, a copy of an official business record (e .g., a W- Form)

clearly ident iF~ing the subscriber. or t a e g u€czib er's pri ncipal as

the cmployer of the consumer on whom the report was f umk sh ed;

or

(5) verification that the subscribes is a Federal or State agency ar

department that obtains consumer reports 5olzly under action 608

of the F ICA, 15 U. .C;. § 1 81 f, or that certifies a perTnissiblr,

purpose solely under Sections 04(a)(3)B), fip4(s)(3)(),

6l?4(a(4, bf}4(a){5}, 626, or 627 of the FCRA, 15 U.,C. §

X 1 b(a) (3 )(B), (a)(3) (D), {a}(4), (a)(5 ) ; l 6BIu., a nd ]Slv.

(f) Desisting furnishing consumer reports to any subscriber as to

which :

(1) Defendant learns, T rough the -pro=ciure s describc~ d in

subparagraph (e), or o#herwis ,has obtained, after the date of

service of this order, a con s~uner report for any purpose other than

a pe-rmiss ible purpose, unle ss ; (i) that s ubscriber obtained suc h

report through inadvertent error, i, e- , a mechanical, el ectron i c , or

clerical error that the subscriber ciemmsErates was intentional

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 13 of 30

9

-1 4 -

aid occurred -notwithstanding axe maintenance of procedures

reasonably designed to avoid such errors; or (i i) such consumer

report was obtained through the acti ons of a person acting without

subscriber authoriza#ianr such mq h}+ using such subscriber's user

identification and password, and the subscriNr dernonstrates that it

has impiernented reasonable and appropriate procedures to prevent

a similar action or error from recurring ; or

(2) Defendant has reasanablee grounds to believe will not use the

rcport sole far permissible purpoiq~.s,

III. INFORMATION SECURITY PROGRAM

IT IS FURTHER ORDERED that Defendant and all otter persons or entiti es within the

scope of Fed, R. div . P . 65, whether acting dimtly or through any sole prupnetorship,

partnership, lunit ed liability cornpan , corporation, subsidiary, b rarch, division, or otherr entity,

why rece i ve actual noti ce ofthia Order by perwnal s ervice or otherwise, are hereby. permanently

estrainecl and enj oined from, no later than the date o f sci- v i c e. of this .rdq-.r -

A . Failing to establish and irnplernent and thereafter maintain, a comprehensive

inforfnation security program that is reasonably designed to protect the security, confidentiality,

and integrity of personal information collected from or about consumers . Such program, the

coment and irnglenienta#ion of b iah must be fully do-cunneirited in writing, Oall contain

administrative, te-chntcal, and physical safeguards appropriate to Defendant's size and

complexity, #he nature, artd s opt of Defendant's activiti es, and the sensitivity of the personal

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 14 of 30

infaTnatiorY collected from or about consumers, inCluding ;

- 1 5,

0

1 . The designation of an employee or Mployees to coordinate and be

accountable for the information security program .

The identification of material internal and extal risks to . the security,

confidentiality, and integrity of personal information that could result in the

unautbonz~,d disclosure, m isuse, loss, alteration, destruction, or Other compromise

of such iaformation, anti assessment of the sufflciency of any safeguards i n place

to control these risks . At a minimuFn, this risk assessment should include

cansidaration of" risks in each area of relevattt op ratiQn, including, but not limited

to: (a) employee training md rnauaagement ; (b) information systems, including

network and software design, in formation proc~,-ssing, storage, transrni,-'sion, end

disposal ; and {r,} prcveptinn, detection, and response to attacks, intrusions, or

others stems failures . .

_ The design and implemsn#atiofl of masonable safeguards w control the

risks identified through risk assessment, and regular testing oT . monitoring of the

effmtivencss of the safeguards' key controls, sterna, and procedures .

4. The evaluation and adjustment of Defendant's anforrnatiorF sc~ccurit

program in light of the results of t be testing and monitoring required by

subparagraph 3, any material changes to Defendant's operationss or business

arrangements, or any other aircurn stances that Defendant know or his reason to

know may have a mnal impact o n the effec ;tivenes~; of its information security

P UCase 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 15 of 30

L_J

1

B . Mi srepre senting i n .a~y runner, express ly or b i l ication , the, manner ur extent

t o which Defendant mainta ins and protect the prrivacy, confidentiality, or security o f any

pcrsonai information collected frnrn or about consumers .

IV. BIENNL41, ASSESSMENT REQUIREMENTS

IT i FLT RTnEA ORDERED that Defendant shal l obt ai n inidai and biennial

assessrnents and reports ("Assessments"} from a qualified, objective, i ndependent third-part

professional who uses procedures and standards generally epted i n the profession . The

reporting period for the Assessments shall cover : (1) the ffi-st one hundred and eighty ( 1 80 days .

after service of the Orde r for the initial Assessment, a nd (2) each two (2) year period thereaft er

fur twenty {20 .years after s v i se of the Order for the, biennial Assessments . Each Assessrnent

shah :

A . set forth the specific administrative, technical, and physical safeguards that

Defendant has implemented and maintained during the reporting period to comply with

Paragraph LII of this Oe&r,

B, explain by such safeguards aze- appropriate to Dcfendant 's s ize and complexity,

the nature and scope of Defendant's activit i es, and the smisitivit y of the personal inform atiot

collected from or about consumers ;

explain how the safeguards that have been implemented meet or exceed the

protections require d by Paragraph III of this Order; and

D. certify that Defendant's security program is operating with sufficient effectiveness

to provide reasonable ass ancc that the security, confidentiality, and inteotofpersonal

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 16 of 30

0

1 7 -

infoxrnat ion is protected said, for bi ennial repasts, has so operate throughout the reporting

period.

Each ssessmenE shall be prepmd and completed within sixty {5{} ) days after the end of

the reporting period t o whic h t he Assessment appl ies by a person qualified as a certified

infiirmation System Security Profe ssional { j F} or as a Certified Infortnati on Systems Audit or

(I); a permn holding Global Infvrr iaeian Assurance er E i.fi cation {CxiAQ from the

SysAdmin, A udit , Network, Security (SANS) Institute ; ora similarly quali fi ed person or

organization approved by the Associate Diroc[ox' fo r EnforcerF'i"t, Bureau of Consumer

Protection, Federal Trade Commission,

Defendant shall provide the initial Assessment to the Assoc41te Director for Enfor rent,

bureau of Consumer Protection ., Fed" Trade Commission, VVasbin toy, D.C. 20580, within ten

( ] 0) businesss days after tie Assessment has boon prepared . A11 subsequent biennial As se~Ments

shall be retained hy Defendant until three years after completion o f the final Asscs~ment and

provided to. the Associate Director uf Enforccmctst upon request .within ten 10) business days

after Defendant receives such requW.

V. C01+1 UE RED

1 'Y' I FURTHER ORDERED that no hater than ten (10) days after tie date of service of

this order, Defendant shall pay to the Federal Trade Commission the s= of five- million dollars

( ,O 00,U40, 00) under the following terms and c andit ions.

A. The payment shall be~ ukado by wire transfer or cealfied or cashi~,-r's check made

payable to the Federal Trade Cortrnission . In thee event aff any default in payment, which default

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 17 of 30

E E

- I $ -

continui~s fog tcn (1 0) days due date ofpayment, the amount due, together with

interest, aa computed pursuant to 2$ U_ . § 196 firm the date of default to thea date. Qf

payment, shall immediately become due and payabl e .

B. All finds paid pursuant to this P=graph ahall be deposited intoo a fund

administ ere d by th e Commission o-r its agent to b e. used for e qui tabl e re lief, including but not

lunitcd to consumer re dress and any att endant expenses #'or the administration of any redress

fund . Any consumer .redmss distribu ted by the Commission pmuant 1,0 this Part shall be

accompanied by a s utement that provision of surkt redre ss by th e Commission does not cans iit um

an admission by clef dart o f wrongdoing, In #he event that direct re dress& to consumers is

dally or partially i mpracticabi c or funds remain aftcr redress i s completed, the Commission may

apply any remaining nds for such other equitable elief ( i ncl uding information rernedi e s ) as i t

determines to he reasonably related to Defendant's practices alleged in the Complaint . . Any fund

not. applied by the Commission for equitable relief shall b e depositcd to the United tats

Treasury. Defendant smell have no right to c hal leage the anm-nXSSion's choic e of remedies,uxi cte r

this Paragraph . -

No portion~ of any pa xtleP#s under this Paragraph 9hall be deemed a payment of any fune,

penalty, Ptuiitivee assessment, or forfeiture,

VI. CONTI-JANCE MONITORING

IT I FURTHER [] FRED that, for the purpose, v f monitoring and

investigating compliance with any provision f this Order,

A. Within thirty (30) days ofrecr,-ipt ofwritten noti ce from a ri-,presen#a#ive- of the

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 18 of 30

0 0

19-Commission,

-

Defendant shall submit additional written reports, sworn to under penOty of

pedu*y; Producee docurnents for inspection and copying; appear fir depositiou ; and/or provide,

entry during normal business hours to any business location in Defend ant's possession ar direst

or indirect control. to inspect the business operation,

B. In addition, th e Commission i s. authoriz e d to monitor. compliarxc i~, with this Order

by all other law ful mrans, including but not lin-~ted to the following .

1 . Obtaining discovery from any wi thout further l eave of court , us ing

the procedures pre scribed by Fed. R. d iv. P . 30, 3 1 , 33, 34, 36, and 45 .

2. PQsing as consurne~ and suppliers to Defbndant, Ddendattt'ss en-rpWyees,

or any other entity managed or control led it whole or in part by Defendant,

without the n ecessity of ident ific ati on or prior noticeC. Defendant shall pemii t repres entatives of the, Commission t o i nterview any

consult t, independent cop tractor, representative, agent, or employeee who has agx d to such an

intervie,relating in any way trx any conduct subject to this C3raer . The person interviewed may

have counsel present .

Provided that nothing in this Order shall limit the Commission's& lawful use off

compul sor y praccss, pursuant t o Sections 9 and 20 of the FTC Art, 1 5. li , 49, 57b-1, to

obtain any documentary materiel , tangible t hings, testimony, or information relevant to unfair or

deceptivec acts or practices in or affecting commerce ( wit hkp the mean in g of 15 U. .

V11. COMPLIANCE REPORTING DEFENDANT

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 19 of 30

0

-20-

IT I FURTHER ORDERED that, in order that compliance with the provisions of this

Or&r may be monitored,

A . For a period of twenty (20) yearss from the dat e of seMce of this Order, Defendant

shall notify the omin"rssion of any changes. in corporate structure that may affect aomplianca

obligationss ari s ing under this Ordcr, including but not limited to a dissolution, assignment, s al e,

merger, c~r other action that would result in the emergence of a successor entity ; t ae creation or

dissolution of a subsidiary, parent, or affiliate that engages in any acts or practicess that ire subject

to this Order, the filing of a bankruptcy pthfion ; or a change, in the corporate mune or address, at

least thirty (3 0) days prior ta such change, provided that, with respect to arl y pivpased change in

the corporation about which Defendant learns less than thirty (30) days prior to the dwc such

action is to take place, Defendant shill notify the Commission as soon as i s practic able after

obtaining s uch kmowledge.

B, one hundred eighty (180) d ays& after th e date o f scrvioe~ of th is Qrdcr, Defendant

shall provide a written report to the FTC, sworn to under penalty of perjury, setting forth in detail

the manner. and form in which i t has complied a nd is complying with thi s Qrciex. I'bi s report s l

include, but not be limited to -

1 . Any changes required to bee reported pursuant to Paragraph VII . A .

A copy of each acknowledgment of receipt of this Order obtained pursuant

to. Paragraph lX_

For the purposes of this Order, Defendant shall, unlesss otherwise directed by the

Commission's authuxi ed repnseniafivcs, mai l a) I written notifications to the Commission to ;

ssocia#e, Director, Division of Enforcement

Bureau of Consumer Protectim

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 20 of 30

Federal Trade commissi on

Washington, D . 205 SO

1 -

D. Forpurposes the compliance reporting and monitoring required by this rder,

the Commission i s authorized to con-anunicate directly .v itb Defendant .

1' Y 1 L RECORD : YIN

rT I FURTHER ORDFFD thatA. For a period . of six (6) years from the date of service of this Order, Defendant and

its ants, employees, officers, oorporadons, successors, and assigns, and those persou s in active

nc-ert or partzcipation with them who receive actual native of this Order b personal service or

otherwise, are hereby restrained and enjaiuned fro m failing to create and retain the following

1 . Subscriber ti l e s containing the name s, addresses, Lelephone numbers, al l

ccr-ci f rati ons made by the, subscriber pursuant to Section on 6 [}7(a) of the

F and Paragmph iT .B. I (a) -(b) of thi s Order, a .n d all materials

considered by Defb ndwin connection with its verification of the identity

of the subs c ri ber and venfi catsar,k of the certi ftcations made under Section

fi(17(s), as required by Section X07(a) of the F R and Paragraph 1I.B. I {c}

ofthis order.

Consumer complaints (whether received In written or clcctironic form,

di rec tl y, indirectly or througb any third pa*), azd any. r esponses to those

compiaints, whether in written oTelech-cxnic fDrm, that relate to

Defendant's activities as alleged in the omplainf and Defendaut's

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 21 of 30

El

compliance with the provis i ons of thi s Order .

2 -

0

3 . spies of all training materials that relate to Defendant's activities as

alleged i n the Complaint an d I}efendant's c o Vfiani,~o with the provisions

of this Order.

4. - Copies of all s ubpotnas and other communications with l aw enforcement

entities or personnel, whether in written or electronic torrr, if such

document!~ bearr in any respect on Defendant's collection, -maintmance, or

fumishing of consumer reports or othev personal in formation of

oaIR swnM.

5 . All records and documents necessary to demonstrate fil l compliance with

each provisa on of this Order, including but not limited to, ct'ypics of

acknowledgments. of receipt of this order, required b Paragraph IX-B, and

X1 1 reports submitte d to the FTC pursuant t o Paragraph l .f .

B. For a period of three (3) years after the date of p reparation o f each biennial

Assessment raqn ire d under Paragraph I of th is rcl e r: all p l ans, reports, studies, rcvicws, audits,

audi t t miI s, policies, traini ng material s, woAc p apm, and assessments, whethe r prepared by or -on

behalf of Defendant, relati ng to Defe ndant 's compliance with Paragraph III of this Order for the

c ompli ance. peri od coveted h such b iennt al Asses sment.

IN, DISTRIMUTION OF ORDER BY DEFENDANT

IT IS OR DF RED th at, for a period o f five (5) yews from thee date of. service

c)f this Order, Defendant shall deliver copies of this Order as directed below :

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 22 of 30

r--]

1

Defendant shall deliver a capyy of this Order to all of its officers aid directors, and

to al l managers wh o have respons ibil i ty directly or indirectly fb r any mat ters coveted by this

order. Defendant also shall deliver an acc~c summary of this, Order to all of its employees

who arcm engaged in conduct rebated to Defendant's compliance, wit h Section 607 (a) of the FCRA,

including but not l imi ted to those empiay~es who verify the identity of prospective users of

consumer. reports, those employees who verify the uses oerd fled to Defendant by prospective

us ers of can 5urnerr reports, and those employe es who monitor or audit the continued comph ance

b Defendan t's sub ribers with thei r certification of pernussibl e purposes . Defendant also shall

dd giver any accurate summary of this order to all of its employees who are engaged in conduct

related to I7cfind ant's activities that are the subject ofParagraphs Ill and I of thi,: Order,

including but not limited to those empk~ees designated as W formation security program

c oordinators. For current personnel, &, livery shall occur within t f;n 1 D) business days ofthe dateofstrvi.ce of this den upon Defendant. for new personnel, d el ivery s h all occur. no later than

when they ass ume. their fob responss 6il i tic s .

B_ Defendant shall srcure a si gned and dates statetnent acknowledging meipt of thi s

Order, within thirty (30) days of de l iv e ry to s uch pers ons, from each person re ceiving a copy of

the Order pursuant to this Paragraph .

X. ACKNOWLEDGMENT OF RECEIPT OF ORDER BY DEFENDANT

Fr I FURTHER Ol E D that Defendmit, within fivu {5) business days of service of

this order, shall submit to the Commission a t ruth fat sworn statement acknowledging rece ipt o f

thi s order, in the form shown on Attachment A.

3 .

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 23 of 30

11 E

IT i 0 ORllE1tED.

STA'I'ES DISTRICT jUDGE

-24-

1 . RETENTION OF nMSDICTION

IT IS FUR'I HIR ORDERED that thi s Co urt shall retain j uris dict ivn of this matter for

puqo~es of construcfion, rt~oditication, and enforcement of this Order_

7L COSTS AND ATTORNEYS' FEE S

I T I FURTHER ORDERED that each party shall bear i t s own costs and attorneys' fees

incurrcd in connection with this action .

Iii . NOTICE OF ENTRY OF ORDER

IT I FURTHER ORDERED that e ntry ire the docket of this order bthey Clerk o f Court

shall in st i tute notice. to. Defen daMof the t erms. and conditions, o f th i s Orde r, and that Bed dant

waves all right-, to contest is any future pmce~cding whether Defendant was properly served with

- thi5 Order.

The parties, hereby sti pul at e to the entry o f the fom-going Order, whic h shal l constitute a

final Order in this &di011 .

Dated thisc day of

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 24 of 30

DALi3 E. NRIVfIA

United States Attorney

Northern District of Georgia

Dated- ~ ~

--.25-

The parties, by their rDspective counsel, hereby consent to the terms and conditions ofthe

Stipulated Order asset forth above and consent to the entry thereof . Defendant waives any rights

that may arise under the Equal Access to. Justice pct, 28 U.S .C. 2412, as amended b Pub. L.

1 04-1 1, 110 tax ., 847, S 63- 4 ( 1 99 6) -

RQ R THE UNF[ED STATES OF AMERICA :

pffr ER D . ', i sLEP., .r .

Msis#&n! Attorney icn l

Civil Division

J . S. D e parftant of Justice

Dated- i! Bye L . ..R

AMY L. BRNE

Assistant United totes ttvrncy

Georgia Bar No. 006670

Northern District ofGe orgia

600 United States Courtliou ~e

75 Spring Met, S. W.

Atlanta , Georgia 30303

Tel: (404) 581 - 6261

Fax: (404) 581-6163

~ +

AL:. F. Pi~E S

Trial Attorney

Offic e of Conguiner Litigation

Civil D ivision

U_ . Department of Justice

ashingtnn, D. . 2 0530

Tel. (202) 307-6154

Fax; (202 5 14-874

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 25 of 30

Ej

_ 6_

pj

FOR THE FF,I3ER L TRADE C.OiSI 0N-

.To Winston

ass c ate Direc t or fair P r i vacy e n d Identity Protection

Je ioa Ric h ~~

Dista n t T}t r cc[ o r for Pr isfacy and i dentity Pratcc i ion

at1~rXr.17.R 6

Attorney

--~ ~ n~o~iy cry ~~,~

Attomey

f]ivigi ou of Privacy and I d enti t y ProteC ti nn

$ urca L ur Consumer ProtcQfltrn

Hecl~ral Tra d e Commis~,. i un

Washington! D . . 20580

(202) 3 26-3 224

FOR THE DEF END A T, Ch oiceY oint Inc . :

~ug C: ur lit

President, hoicePoint Inc .

Robsr4R, Relair +~

IC.az-l a J . I .etsc h C

Kevi n L. Coy

Oldaker , B id m & 13e l a ir, LLP

R 18 inn»ecti rj ut A V entL e, NIM,

Suite I 100

At torneys fur Defendant

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 26 of 30

0

-27-

J 'SLY o~t ~~,~o~

~ ~ ~ Fcn~.i ~. is

Akin Oump sc x aus s H aucr & Fe I a LLP

1333 New Hampshire Avenue, -K _ _

Wa i iiing#.on, D . C . OA36

Attorney for Defendant

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 27 of 30

, l

0

Defendant.

-28-

UNITED STATES DISTRICT COT JRT

NORTHERN DISTRICT OF GEORGIA

P

UNITED STATES OF AMERICA,, CV

laintiff, .

V. AFFIDAVIT OF

DEFENDANT

iI O 1 EFOIT F .

HO1 . EPYNT ., a

corporatian,

Same of De fendant's certifying official ], hci ng duly sworn, hereby states and. affirm,,; as

follow,;-

I , y name i s ' ---- -- My currant rc: sirlence addre s s is

. I am a citizen of #he. United tats

and am over the a of 1~ ighteen r . I have personal knowledge of the facts set forth in this

Affidavit,

T an officer of Dcfcndant hoicePoint in Uni ted States ofAtraer*a v.

~ Choice-Point Inc. nlwd States District Court fur the Northem District of Georgia) .

i 3. C x , I received a copy of ibc Stipulated Final Judgment

and Order for Civil Penalties, Permanent Injunction, and Other EqW table Relief, which was

signed by the Honorable ~ and en#eri~d by the Court on

. treee and correct copy of the Order I received is appended to this

Affidavit.

I declare under penalty of perjury under the 1 a s of the United States that the foregoing is

true and curruct . Executed on , W06, at

By:

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 28 of 30

My ornrni ssiorx Fx.pires :

state, o f City of

Subscribed end sworn to before me

this day of , 2006_

Notary Public

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 29 of 30

For the foregoing easonq, the Commission beii evos that the sefflesncnt b y ant of the

attach ed 4ina1 order is i ustified and weld within the public ztiterc~st_

40 0

REASONS FOR SETTLEMENT

This statcment accompanies the final order executed b cie&~ndant CjioicePoanx hYC, The

final order enjoins hoi"Poxnt Ins . from violating L'ie Fair credit Rcporting ,fact, 15 U, .

1Er8]-1 81x, and imposes specific requiremertis intended to further the "reasonable

procedures'' requirement of the F RA, The final order also enjoins 'hai ePotn# from failing to

establish and imp] ernent, and thereafter maintain, a comprehensive information security program

that Ss reasonably resigned to protect the security, con ft dMtiality, and integrity of personal

information collected from ar about car u=rs ; and frorn misrepresenting in any expressly or

by irnpli implication, the manner or exWnt to which ChoicePoint inc . maintains aTicl

protects the privacy, aon_fi dents alit}, or security of any personal infoTnation collected from or

aboti# con summ . The final order ako requires hoicePoint inc_ to pay a civil penalty ux the

arnount often million dollars ($1(},040, 0N), and to pay five million dollars (S5,000,000) into a

fund to be used for equitable rclitf, including but not limited to nsum .e~r redress .

Pursuant to Section 5 (m)(3) of the Federal Trade Commission Act, as amended, 15

U. S. . § 45(m)(3), the Commission hereby sets forth its reasons for settlfment b y entry of a

Stipulated Final Judgment and order for evil Penalties, Permanent Injtinction, and Other

Equitable Relief ("final ordet")'. .

On the basis of iht~ all egativns contained in the cumpWnt, and the statutoq factors in the

FCRA and the FTC Act, the Commission be.1 teves that the payment of V 0,000,000 in civil

penalties and $ ,000,00 i» equitable reliefconititutcs payment of appropriate amounts on which

to base the settlement, and that the provisions enjoining the defendant from failing to comply

with die Fair Credit Reporting Act (including affirmative requirements for compliance) ; from

failing to establish, implement, and thereafter maintain a comprehcnsive infom-tarion security

program; and from making certain misrepresentations should assure defendant's future

compliance with the law . With the entry of the final order, the time and expcnse of litigation will

be a.voidod .

Case 1:06-cv-00198-JTC Document 5 Filed 02/15/2006 Page 30 of 30