In re Premier Capital Lending, Inc., et al., FTC File No. 072 3004 (Dec. 16, 2008) (holding end user liable for 1

failing to adequately secure its online portal for accessing consumer reports. 

UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

WASHINGTON, D.C. 20580

Office of the Secretary

August 17, 2011

Text of Commission Letters To Individual Business Commenters

Re: In the Matter of SettlementOne Credit Corporation, File No. 082 3209

In the Matter of ACRAnet, Inc., File No. 092 3088

In the Matter of Statewide Credit Services, File No. 092 3089

Thank you for your letter commenting on the Federal Trade Commission=s proposed

consent agreements in the above-referenced proceedings. The Commission has placed your

comment on the public record pursuant to Rule 4.9(b)(6)(ii) of the Commission=s Rules of

Practice, 16 C.F.R. ' 4.9(b)(6)(ii), and has given it serious consideration. 

Your letter raises several concerns. First, your comment expresses concern that the

Commission is imposing new obligations on consumer reporting agencies. Specifically, you

object to the Commissioners’ statement that in these three cases, the FTC held resellers

Aresponsible for downstream data protection failures.@ 

The Commission agrees that resellers should not be held strictly liable for end user

security breaches. In these three cases, the Commission has applied the standard that is

consistent with its other data security cases – that of reasonable security. This reasonableness

standard is flexible and recognizes that there is no such thing as perfect security. However,

consumer reporting agencies that provide end users with online access to consumer report

information must take into account the risks posed in providing such access, and must take

reasonable steps to ameliorate these risks. This means that resellers should take reasonable steps

to ensure that the end users’ systems for accessing the online portal are secure.

Also, your letter states that the Commission targeted the wrong parties in these matters

because end users have independent legal duties to safeguard nonpublic personal information. 

The Commission acknowledges that end users such as mortgage lenders have independent

responsibilities to ensure the security of the data they obtain, and the Commission has brought

actions against such companies that allegedly failed to provide reasonable security to protect

sensitive consumer data. The fact that these end users have independent responsibilities under 1

the law, however, does not relieve resellers of their responsibility to ensure the security of the

consumer information to which they sell access.
Your letter further objects to language in the Commissioners’ statement indicating that

the Commission should not hesitate to seek civil penalties against similarly situated resellers in

the future. The FCRA requires that consumer reports be furnished only to those with a specified

permissible purpose. Hackers do not have such a permissible purpose. Thus, when resellers’

failures lead to the furnishing of consumer reports to hackers, we believe such conduct may

violate the FCRA and subject the resellers to civil penalties in appropriate circumstances. 

Finally, your letter takes issue with the wording of certain statements in the press release,

complaint and Commissioners’ statement. The Commission notes that the consent orders are

what govern the conduct of the three resellers going forward, not the statements cited in the

documents you mention.

In light of these considerations, the Commission has determined that the public interest

would best be served by issuing the Decisions and Orders in final form. The final Decisions and

Orders and other relevant materials are available from the Commission’s website at

http://www.ftc.gov. It helps the Commission=s analysis to hear from a variety of sources in its

work, and we thank you again for your letter.

By direction of the Commission.

Donald S. Clark

Secretary