UNITED STATES OF AMERICA

FEDERAL TRADE COMMISSION

WASHINGTON, D.C. 20580

Office of the Secretary

August 17, 2011

Mr. Stuart K. Pratt

Consumer Data Industry Association

1090 Vermont Ave, NW, Suite 200

Washington, DC 20005

Re: In the Matter of SettlementOne Credit Corporation, File No. 082 3209

In the Matter of ACRAnet, Inc., File No. 092 3088

In the Matter of Statewide Credit Services, File No. 092 3089

Dear Mr. Pratt:

Thank you for your letter on behalf of the Consumer Data Industry Association

(“CDIA”) commenting on the Federal Trade Commission’s proposed consent agreements in the

above-referenced proceedings. The Commission has placed your comment on the public record

pursuant to Rule 4.9(b)(6)(ii) of the Commission’s Rules of Practice, 16 C.F.R. § 4.9(b)(6)(ii),

and has given it serious consideration. 

Your comment raises several concerns. First, your comment expresses a concern that the

Commission is imposing “potentially very significant new obligations” on consumer reporting

agencies. Specifically, CDIA objects to the Commissioners’ statement that the FTC holds the

resellers in these three cases “responsible for downstream data protection failures.” It further

asserts that resellers “cannot be held responsible for the failure of end-users’ security programs.” 

The Commission agrees that resellers should not be strictly liable for end user security

breaches. In these three cases, the Commission has applied the standard that is consistent with

its other data security cases – that of reasonable security. This reasonableness standard is

flexible and recognizes that there is no such thing as perfect security. However, consumer

reporting agencies that provide end users with online access to consumer report information

must take into account the risks posed in providing such access, and must take reasonable steps

to ameliorate these risks. This means that resellers should take reasonable steps to ensure that

the end users’ systems for accessing the online portal are secure. 

Also, your letter asserts that the law does not require resellers to monitor end users’

security programs since end users have “specific and separate” legal duties under the Fair Credit

Reporting Act (FCRA). The Commission acknowledges that end users such as mortgage lenders

have independent responsibilities to ensure the security of the data they obtain, and the
In re Premier Capital Lending, Inc., et al., FTC File No. 072 3004 (Dec. 16, 2008) (holding end user liable for 1

failing to adequately secure its online portal for accessing consumer reports.) 

Commission has brought actions against such companies that allegedly failed to provide

reasonable security to protect sensitive consumer data. The fact that these end users have 1

independent responsibilities under the law, however, does not relieve resellers of their

responsibility to ensure the security of the consumer information to which they sell access. 

Your letter further objects to the language in the Commissioners’ statement indicating

that the Commission should not hesitate to seek civil penalties against similarly situated resellers

in the future. The FCRA requires that consumer reports be furnished only to those with a

specified permissible purpose. Hackers do not have such a permissible purpose. Thus, when

resellers’ failures lead to the furnishing of consumer reports to hackers, we believe such conduct

may violate the FCRA and subject resellers to civil penalties in appropriate circumstances.

Finally, your letter takes issue with the wording of certain statements in the press release,

complaint and Commissioners’ statement. The Commission notes that the consent orders are

what govern the conduct of the three resellers going forward, not the statements cited in the

documents you mention.

In light of these considerations, the Commission has determined that the public interest

would best be served by issuing the Decisions and Orders in final form. The final Decisions and

Orders and other relevant materials are available from the Commission’s website at

http://www.ftc.gov. It helps the Commission’s analysis to hear from a variety of sources in its

work, and we thank you again for your letter.

By direction of the Commission.

Donald S. Clark

Secretary