-1-

UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF MINNESOTA

 

)

)

UNITED STATES OF AMERICA, )

Plaintiff, )

)

v. )

)

RENTAL RESEARCH SERVICES, INC., ) Civil Action No.

a corporation and )

)

LEE MIKKELSON, ) 

individually and as an )

officer of the corporation, )

Defendants. )

)

)

 )

STIPULATED FINAL JUDGMENT AND ORDER FOR CIVIL PENALTIES,

PERMANENT INJUNCTION, AND OTHER EQUITABLE RELIEF

Plaintiff, the United States of America, acting upon notification and authorization to the

Attorney General by the Federal Trade Commission (“FTC” or “Commission”), is concurrently

filing its Complaint herein, which alleges that Defendants Rental Research Services, Inc. and

Lee Mikkelson have engaged in violations of the Fair Credit Reporting Act (“FCRA”), 15 U.S.C.

§§ 1681-1681x, and in unfair or deceptive acts or practices in violation of Section 5 of the

Federal Trade Commission Act (“FTC Act”), 15 U.S.C. § 45(a). The parties have agreed to the

entry of this Stipulated Final Judgment and Order for Civil Penalties, Permanent Injunction, and

Other Equitable Relief (“Order”) to resolve all matters in dispute in this action without trial or

adjudication of any issue of law or fact herein and without Defendants admitting the truth of, or
-2-

liability for, any of the matters alleged in the Complaint. Defendants have waived service of the

Summons and Complaint.

THEREFORE, IT IS HEREBY ORDERED, ADJUDGED, AND DECREED as

follows:

FINDINGS

1. This Court has jurisdiction over the subject matter of this case and over Defendants

Rental Research Services, Inc. and Lee Mikkelson.

2. Venue in this district is proper under 28 U.S.C. § 1391(b) and (c), and 15 U.S.C. § 53(b).

3. The acts and practices of Defendants are in or affecting commerce, as “commerce” is

defined in Section 4 of the FTC Act, 15 U.S.C. § 44.

4. The Complaint states claims upon which relief may be granted against Defendants under

Sections 5(a)(1), 13(b), 16(a), and 19 of the FTC Act, 15 U.S.C. §§ 45(a)(1), 53(b),

56(a), and 57b; and under Section 621(a) of the FCRA, 15 U.S.C. § 1681s(a).

5. Defendants make no admission to the allegations in the Complaint, other than the

jurisdictional facts.

6. Defendants waive: (a) all rights to seek appellate review or otherwise challenge or

contest the validity of this Order; (b) any claim Defendants may have against the

Commission, its employees, representatives, or agents that relate to the matter stated

herein; (c) all claims under the Equal Access to Justice Act, 28 U.S.C. § 2412, as

amended by Pub. L. 104-121, 110 Stat. 847, 863-64 (1996); and (d) any rights to

attorneys’ fees that may arise under said provision of law.

7. Entry of this Order is in the public interest.
-3-

DEFINITIONS

For purposes of this Order, the following definitions shall apply:

1. “Fair Credit Reporting Act” or “FCRA” refers to 15 U.S.C. §§ 1681-1681x, as amended.

2. The terms “person,” “consumer,” “consumer report,” and “consumer reporting agency”

mean as defined in Sections 603(b), (c), (d), and (f), respectively, of the FCRA, 15

U.S.C.§§ 1681a(b), 1681a(c), 1681a(d), and 1681a(f).

3. “Permissible purpose” means any of the purposes listed in Section 604 of the FCRA, 15

U.S.C. § 1681b, for which a consumer reporting agency may lawfully furnish a consumer

report.

4. “Personal information” shall mean individually identifiable information from or about an

individual consumer including, but not limited to: (a) a first and last name; (b) a home or

other physical address, including street name and name of city or town; (c) an email

address or other online contact information, such as an instant messaging user identifier

or a screen name, that reveals an individual’s email address; (d) a telephone number;

(e) a Social Security number; (f) credit or debit card information, including card number,

expiration date, and data stored on the magnetic strip of a credit or debit card; (g)

checking account information, including the ABA routing number, account number, and

check number; (h) a driver’s license, military, or state identification number; (i) a

persistent identifier, such as a customer number held in a “cookie” or processor serial

number, that is combined with other available data that identifies an individual consumer;

or (j) any information that is combined with any of (a) through (i) above.

5. “Individual Defendant” means Lee Mikkelson.
-4-

6. “Corporate Defendant” means Rental Research Services, Inc., and its successors and

assigns.

7. “Defendants” means both the Individual Defendant and the Corporate Defendant

individually, collectively, or in any combination.

6. “Commerce” means as defined in Section 4 of the Federal Trade Commission Act, 15

U.S.C. § 44.

ORDER

I. CIVIL PENALTY AND RIGHT TO REOPEN

IT IS ORDERED that:

A. Judgment in the amount of Five Hundred Thousand Dollars ($500,000.00) is

hereby entered against Defendants, jointly and severally, as a civil penalty,

pursuant to Section 621(a) of the FCRA, 15 U.S.C. § 1681s(a). Based upon

Defendants’ sworn representations in financial statements and information, full

payment for the foregoing civil penalty judgment is suspended, contingent upon

the accuracy and completeness of the financial statements and information, as set

forth in Subparagraph B of this Paragraph.

B. Plaintiff’s agreement to this Order is expressly premised upon the truthfulness,

accuracy and completeness of the Defendants' sworn financial statements and

supporting documents submitted to the Commission, which include material

information upon which Plaintiff relied in negotiating and agreeing to this Order. 

If, upon motion by Plaintiff, this Court finds that any Defendant has failed to

disclose any material asset or materially misstated the value of any asset in the

financial statements and information submitted to the Commission, or has made
-5-

any other material misstatement or omission in the financial statements and

related documents described above, then this Order shall be reopened and

suspension of the judgment against that particular Defendant shall be lifted for the

purpose of requiring payment of civil penalty in the full amount of the judgment

($500,000.00). Provided, however, that in all other respects this Order shall

remain in full force and effect, unless otherwise ordered by the Court.

C. Defendants relinquish all dominion, control, and title to any funds paid to the

fullest extent permitted by law. Defendants shall make no claim to or demand

return of the funds, directly or indirectly, through counsel or otherwise.

D. This judgment represents a civil penalty owed to the United States Government,

is not compensation for actual pecuniary loss, and, therefore, is not subject to

discharge under the Bankruptcy Code pursuant to 11 U.S.C. § 523(a)(7). 

Defendants agree that the facts as alleged in the complaint filed in this action

shall be taken as true, without further proof, in any subsequent civil litigation

filed by or on behalf of the Commission to enforce its rights to any payment or

money judgment pursuant to this Order.

II. PROHIBITED BUSINESS ACTIVITIES

IT IS FURTHER ORDERED that Defendants and all other persons or entities within

the scope of Fed. R. Civ. P. 65, whether acting directly or through any sole proprietorship,

partnership, limited liability company, corporation, subsidiary, branch, division, or other entity,

who receive actual notice of this Order by personal service or otherwise, are hereby permanently

restrained and enjoined from:
-6-

A. violating Section 604 of the FCRA, 15 U.S.C. § 1681b, by furnishing a consumer

report to any person that does not have a permissible purpose to receive a

consumer report;

B. failing to maintain reasonable procedures designed to limit the furnishing of

consumer reports to persons that have permissible purposes to receive them under

Section 604 of the FCRA, 15 U.S.C. § 1681b, as required by Section 607(a) of the

FCRA, 15 U.S.C. § 1681e(a); and

C. failing to maintain reasonable procedures designed to ensure that consumer

reports (or information contained in consumer reports) are resold only for a

purpose for which consumer reports may be furnished under Section 604 of the

FCRA, 16 U.S.C. § 1681b, as required by Section 607(e)(2) of the FCRA, 15

U.S.C. 1681e(e)(2).

III. INFORMATION SECURITY PROGRAM

IT IS FURTHER ORDERED that Corporate Defendant and all other persons or entities

within the scope of Fed. R. Civ. P. 65, whether acting directly or through any sole proprietorship,

partnership, limited liability company, corporation, subsidiary, branch, division, or other entity,

who receive actual notice of this Order by personal service or otherwise, shall, no later than the

date of service of this Order, establish and implement, and thereafter maintain, a comprehensive

information security program that is designed to protect the security, confidentiality, and

integrity of personal information collected from or about consumers. Such program, the content

and implementation of which must be fully documented in writing, shall contain administrative,

technical, and physical safeguards appropriate to the entity’s size and complexity, the nature and

scope of the entity’s activities, and the sensitivity of the personal information collected from or

about consumers, including: 
-7-

A. the designation of an employee or employees to coordinate and be

accountable for the information security program. 

B. the identification of material internal and external risks to the security,

confidentiality, and integrity of personal information that could result in

the unauthorized disclosure, misuse, loss, alteration, destruction, or other

compromise of such information, and assessment of the sufficiency of any

safeguards in place to control these risks. At a minimum, this risk

assessment should include consideration of risks in each relevant area of

operation, including, but not limited to: (1) employee training and

management; (2) information systems, including network and software

design, information processing, storage, transmission, and disposal; and

(3) prevention, detection, and response to attacks, intrusions, or other

systems failures. 

C. the design and implementation of reasonable safeguards to control the

risks identified through risk assessment and regular testing or monitoring

of the effectiveness of the safeguards’ key controls, systems, and

procedures. 

D. the development and use of reasonable steps to select and retain service

providers capable of appropriately safeguarding personal information

received from the entity, and requiring service providers by contract to

implement and maintain appropriate safeguards. 

E. the evaluation and adjustment of the entity’s information security program in light

of the results of the testing and monitoring required by sub-Part C of this Section,

any material changes to the entity’s operations or business arrangements, or any
-8-

other circumstances that the entity knows or has reason to know may have a

material impact on the effectiveness of the information security program

IV. BIENNIAL ASSESSMENT REQUIREMENTS

IT IS FURTHER ORDERED that Corporate Defendant shall, in connection with its

compliance with Paragraph III of this Order, obtain initial and biennial assessments and reports

(“Assessments”) from a qualified, objective, independent third-party professional, who uses

procedures and standards generally accepted in the profession. The reporting period for the

Assessments shall cover: (1) the first one hundred eighty (180) days after service of the Order

for the initial Assessment, and (2) each two (2) year period thereafter for twenty (20) years after

service of the Order for the biennial Assessments. Each Assessment shall:

A. set forth the specific administrative, technical, and physical safeguards

implemented and maintained during the reporting period;

B. explain how such safeguards are appropriate to the entity’s size and complexity,

the nature and scope of the entity’s activities, and the sensitivity of the personal

information collected from or about consumers;

C. explain how the safeguards that have been implemented meet or exceed the

protections required by the Paragraph III of this Order; and

D. certify that the security program is operating with sufficient effectiveness to

provide reasonable assurance that the security, confidentiality, and integrity of

personal information is protected and, for biennial reports, has so operated

throughout the reporting period.

Each Assessment shall be prepared and completed within sixty (60) days after the end of

the reporting period to which the Assessment applies by a person qualified as a Certified

Information System Security Professional (CISSP) or as a Certified Information Systems
-9-

Auditor (CISA); a person holding Global Information Assurance Certification (GIAC) from the

SysAdmin, Audit, Network, Security (SANS) Institute; or a similarly qualified person or

organization approved by the Associate Director for Enforcement, Bureau of Consumer

Protection, Federal Trade Commission, Washington, D.C. 20580.

Corporate Defendant shall provide the initial Assessment to the Associate Director for

Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C.

20580, within ten (10) days after the Assessment has been prepared. All subsequent biennial

Assessments shall be retained by Corporate Defendant until the order is terminated and provided

to the Associate Director of Enforcement within ten (10) days of request.

V. COMPLIANCE MONITORING

IT IS FURTHER ORDERED that, for the purpose of (i) monitoring and investigating

compliance with any provision of this Order, and (ii) investigating the accuracy of any of

Defendants’ financial statements upon which the Commission’s agreement to this Order is

expressly premised:

A. Within ten (10) days of receipt of written notice from a representative of the

Commission, Defendants each shall submit additional written reports, which are

true and accurate and sworn to under penalty of perjury; produce documents for

inspection and copying; appear for deposition; and/or provide entry during normal

business hours to any business location in each such Defendants’ possession or

direct or indirect control to inspect the business operation;

B. In addition, the Commission is authorized to use all other lawful means, including

but not limited to:

1. obtaining discovery from any person, without further leave of court, using

the procedures prescribed by Fed. R. Civ. P. 30, 31, 33, 34, 36, 45, and 69;
-10-

2. posing as consumers to Defendants, their employees, or any other entity

managed or controlled in whole or in part by any Defendant, without the

necessity of identification or prior notice; and

C. Defendants each shall permit representatives of the Commission to interview any

employer, consultant, independent contractor, representative, agent, or employee

who has agreed to such an interview, relating in any way to any conduct subject

to this Order. The person interviewed may have counsel present.

Provided, however, that nothing in this Order shall limit the Commission’s lawful use of

compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1, to

obtain any documentary material, tangible things, testimony, or information relevant to unfair or

deceptive acts or practices in or affecting commerce (within the meaning of 15 U.S.C.

§ 45(a)(1)).

VI. COMPLIANCE REPORTING

IT IS FURTHER ORDERED that, in order that compliance with the provisions of this

Order may be monitored:

A. For a period of four (4) years from the date of entry of this Order, 

1. Individual Defendant shall notify the Commission of the following:

a. Any changes in such Defendant’s residence, mailing addresses,

and telephone numbers, within ten (10) days of the date of such

change; 

b. Any changes in such Defendant’s employment status (including

self-employment), and any change in such Defendant’s ownership

in any business entity, within ten (10) days of the date of such

change. Such notice shall include the name and address of each
-11-

business that such Defendant is affiliated with, employed by,

creates or forms, or performs services for; a detailed description of

the nature of the business; and a detailed description of such

Defendant’s duties and responsibilities in connection with the

business or employment; and

c. Any changes in such Defendant’s name or use of any aliases or

fictitious names;

2. Defendants shall notify the Commission of any changes in structure of

Corporate Defendant or any business entity that any Defendant directly or

indirectly controls, or has an ownership interest in, that may affect

compliance obligations arising under this Order, including but not limited

to: incorporation or other organization; a dissolution, assignment, sale,

merger, or other action; the creation or dissolution of a subsidiary, parent,

or affiliate that engages in any acts or practices subject to this Order; or a

change in the business name or address, at least thirty (30) days prior to

such change, provided that, with respect to any proposed change in the

business entity about which a Defendant learns less than thirty (30) days

prior to the date such action is to take place, such Defendant shall notify

the Commission as soon as is practicable after obtaining such knowledge. 

B. One hundred eighty (180) days after the date of entry of this Order and annually

thereafter for a period of four (4) years, Defendants each shall provide a written

report to the FTC, which is true and accurate and sworn to under penalty of

perjury, setting forth in detail the manner and form in which they have complied
-12-

and are complying with this Order. This report shall include, but not be limited

to:

1. For Individual Defendant:

a. such Defendant’s then-current residence address, mailing

addresses, and telephone numbers;

b. such Defendant’s then-current employment status (including

self-employment), including the name, addresses, and telephone

numbers of each business that such Defendant is affiliated with,

employed by, or performs services for; a detailed description of the

nature of the business; and a detailed description of such

Defendant’s duties and responsibilities in connection with the

business or employment; and

c. Any other changes required to be reported under Subsection A of

this Section.

2. For all Defendants:

a. A copy of each acknowledgment of receipt of this Order, obtained

pursuant to the Section titled “Distribution of Order;” and

b. Any other changes required to be reported under Subsection A of

this Section. 

C. Each Defendant shall notify the Commission of the filing of a bankruptcy petition

by such Defendant within fifteen (15) days of filing.

D. For the purposes of this Order, Defendants shall, unless otherwise directed by the

Commission’s authorized representatives, send by overnight courier all reports
-13-

and notifications required by this Order to the Commission, to the following

address:

Associate Director for Enforcement

Federal Trade Commission

600 Pennsylvania Avenue, N.W., Room NJ-2122

Washington, DC 20580

RE: FTC v. Rental Research Services, Inc. and Lee Mikkelson

Provided, that, in lieu of overnight courier, Defendants may send such reports or

notifications by first-class mail, but only if Defendants contemporaneously send an electronic

version of such report or notification to the Commission at: DEBrief@ftc.gov. 

E. For purposes of the compliance reporting and monitoring required by this Order,

the Commission is authorized to communicate directly with each Defendant. 

Provided, however, nothing in this provision shall limit the Commission’s

authority to pose as a consumer or supplier pursuant to Subsection B.2 of the

Section titled “Compliance Monitoring.”

VII. RECORD KEEPING PROVISIONS

IT IS FURTHER ORDERED that:

A. For a period of seven (7) years from the date of entry of this Order, Defendants

and their agents, employees, officers, corporations, and those persons in active

concert or participation with them who receive actual notice of this Order by

personal service or otherwise, are hereby restrained and enjoined from failing to

create and/or retain the following records:

1. Files containing the names, addresses, telephone numbers, all

certifications made by persons pursuant to Section 607(a) of the FCRA,
-14-

and all materials considered by Defendants in connection with their

verification of the identity of the persons and verification of the

certifications made under Section 607(a), as required by Section 607(a) of

the FCRA.

2. Consumer complaints (whether received in written or electronic form,

directly, indirectly, or through any third party), and any responses to those

complaints, whether in written or electronic form, that relate to

Defendants’ activities as alleged in the Complaint and Defendants’

compliance with the provisions of this Order.

3. Copies of all training materials that relate to Defendants’ activities as

alleged in the Complaint and Defendants’ compliance with the provisions

of this Order.

4. Copies of all subpoenas and other communications with law enforcement

entities or personnel, whether in written or electronic form, if such

documents bear in any respect on Defendants’ collection, maintenance, or

furnishing of consumer reports or other personal information of

consumers.

5. All records and documents necessary to demonstrate full compliance with

each provision of this Order, including but not limited to, copies of

acknowledgments of receipt of this Order, required by the Sections titled

“Distribution of Order” and “Acknowledgment of Receipt of Order” and

all reports submitted to the FTC pursuant to the Section titled

“Compliance Reporting.”
-15-

B. For a period of three (3) years after the date of preparation of each biennial

Assessment required pursuant to the Section titled “Biennial Assessment

Requirements:” all plans, reports, studies, reviews, audits, audit trails, policies,

training materials, work papers, and assessments, whether prepared by or on

behalf of Defendants, relating to Defendants’ compliance with pursuant to the

Section titled “Information Security Program” for the compliance period covered

by such biennial Assessment.

VIII. DISTRIBUTION OF ORDER

IT IS FURTHER ORDERED that, for a period of five (5) years from the date of entry of this

Order, Defendants shall deliver copies of the Order as directed below:

A. Corporate Defendant must deliver a copy of this Order to (1) all of its principals, officers,

directors, and managers; (2) all of its employees, agents, and representatives who engage

in conduct related to the subject matter of the Order; and (3) any business entity resulting

from any change in structure set forth in Subsection A.2 of the Section titled 

“Compliance Reporting.” For current personnel, delivery shall be within five (5) days of service

of this Order upon such Defendant. For new personnel, delivery shall occur prior to them

assuming their responsibilities. For any business entity resulting from any change in structure

set forth in Subsection A.2 of the Section titled “Compliance Reporting,” delivery shall be at

least ten (10) days prior to the change in structure. 

B. For any business that an Individual Defendant controls, directly or indirectly, or in which

such Defendant has a majority ownership interest, such Defendant must deliver a copy of

this Order to (1) all principals, officers, directors, and managers of that business; (2) all

employees, agents, and representatives of that business who engage in conduct related to

the subject matter of the Order; and (3) any business entity resulting from any change in
-16-

structure set forth in Subsection A.2 of the Section titled “Compliance Reporting.” For

current personnel, delivery shall be within five (5) days of service of this Order upon

such Defendant. For new personnel, delivery shall occur prior to them assuming their

responsibilities. For any business entity resulting from any change in structure set forth

in Subsection A.2 of the Section titled “Compliance Reporting,” delivery shall be at least

ten (10) days prior to the change in structure.

C. For any business where an Individual Defendant is not a controlling person of a business

but otherwise engages in conduct related to the subject matter of this Order, such

Defendant must deliver a copy of this Order to all principals and managers of such

business before engaging in such conduct.

D. Defendants must secure a signed and dated statement acknowledging receipt of the

Order, within thirty days of delivery, from all persons receiving a copy of the Order

pursuant to this Section. 

IX. ACKNOWLEDGMENT OF RECEIPT OF ORDER

IT IS FURTHER ORDERED that each Defendant, within five (5) business days of

receipt of this Order as entered by the Court, must submit to the Commission a truthful sworn

statement acknowledging receipt of this Order. 

X. RETENTION OF JURISDICTION

IT IS FURTHER ORDERED that this Court shall retain jurisdiction of this matter for

purposes of construction, modification and enforcement of this Order.

XI. COSTS AND ATTORNEYS’ FEES

IT IS FURTHER ORDERED that each party shall bear its own costs and attorneys’

fees incurred in connection with this action.

XII. NOTICE OF ENTRY OF ORDER
-17-

IT IS FURTHER ORDERED that entry in the docket of this Order by the Clerk of

Court shall constitute notice to Defendants of the terms and conditions of this Order, and that

Defendants waive all rights to contest in any future proceeding whether Defendants were

properly served with this Order.

The parties hereby stipulate to the entry of the foregoing Order, which shall constitute a

final Order in this action.

IT IS SO ORDERED:

Dated this ________ day of _____________________, 2009

______________________________

UNITED STATES DISTRICT JUDGE

The parties, by their respective counsel, hereby consent to the terms and conditions of the

stipulated Order as set forth above and consent to the entry thereof. Defendants waive any rights

that may arise under the Equal Access to Justice Act, 28 U.S.C. § 2412, as amended by Pub. L.

104-121, 110 Stat. 847, 863-64 (1996).

FOR THE PLAINTIFF 

UNITED STATES OF AMERICA:

MICHAEL F. HERTZ

Acting Assistant Attorney General

Civil Division

United States Department of Justice

FRANK J. MAGILL JR.

United States Attorney

District of Minnesota

____________________________

Assistant United States Attorney

600 U. S. Courthouse

300 South Fourth Street 

Minneapolis, MN 55415 
-18-

612-664-5600

612-664-5787 (fax)

EUGENE M. THIROLF

Director

Office of Consumer Litigation

KENNETH L. JOST

Deputy Director

Office of Consumer Litigation

 

DANIEL K. CRANE-HIRSCH

Trial Attorney

Office of Consumer Litigation

U.S. Department of Justice

PO Box 386

Washington, D.C. 20044

202-616-8242

202-514-8742 (fax)

Daniel.Crane-Hirsch@usdoj.gov

FOR THE FEDERAL TRADE COMMISSION:

 

JOEL WINSTON

Associate Director

Division of Privacy and Identity Protection

 

REBECCA E. KUEHN

Assistant Director

Division of Privacy and Identity Protection

 

SANDRA MCCARTHY

Attorney

 

MOLLY CRAWFORD

Attorney

Division of Privacy and Identity Protection
-19-

Federal Trade Commission

Washington, D.C. 20580

Tel: (202) 326-2252

Fax (202) 326-3768
-20-

FOR THE INDIVIDUAL DEFENDANT, Lee Mikkelson

___________________________

LEE MIKKELSON

Vice-President and Managing Officer

Rental Research Services, Inc.

FOR THE CORPORATE DEFENDANT, Rental Research Services, Inc.

___________________________

LEE MIKKELSON

Vice-President and Managing Officer

Rental Research Services, Inc.

____________________________

Robert P. Thavis

Leonard, Street & Deinard

150 South Fifth Street Suite 2300

Minneapolis, Minnesota 55402

Tel: (612) 335-1501

Fax: (612) 335-1657

Attorney for Defendants