IV. FTC Correspondence Systems of Records

FTC-IV-1

SYSTEM NAME:

Consumer Information System–FTC. 

SECURITY CLASSIFICATION:

Not applicable. 

SYSTEM LOCATION:

Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC 20580. 

This system is operated off-site by a contractor. See Appendix III.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

(1) Individual consumers who submit complaints to the FTC about identity theft, or the 

business practices of a company or individual, as well as consumers who request information or 

assistance.

(2) Individuals who submit their complaints about identity theft or the business practices 

of a company or individual to another organization that has agreed to provide its consumer 

complaint information to the FTC.

(3) Individuals acting on behalf of another consumer to submit the other consumer’s 

complaint about identity theft, or the business practices of a company or individual, or to request 

information or assistance on behalf of another individual.

(4) Individuals who are the subjects of complaints about identity theft or about the 

business practices of a company or individual.

(5) FTC or contractor staff assigned to process or respond to such communications. 

(6) Other system users outside the FTC (e.g., law enforcement agencies authorized to

have access to the system under confidentiality agreements). 

CATEGORIES OF RECORDS IN THE SYSTEM:

(1) Personally identifying information about the individual who submits a complaint or 

requests information or assistance, including, for example, the individual’s name, address, 

telephone number, fax number, date of birth, Social Security or credit card numbers, e-mail 

address and other personal information extracted or summarized from the individual's complaint.
(2) Personally identifying information about the individual who submits a complaint or 

requests information or assistance on behalf of someone else, including, for example, the 

submitting individual’s name, address, phone or fax number and e-mail address.

(3) The name, address, telephone number or other information about an individual who is 

the subject of a complaint, or is allegedly associated with the subject of a complaint.

(Information in the system about companies or other non-individuals is not covered by the

Privacy Act.)

(4) The name and reference number of FTC or contractor staff person who entered or 

updated the complaint information in the database.

(5) Name, organization, and contact data for system users outside the FTC (e.g., staff of 

other authorized law enforcement agencies).

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

Federal Trade Commission Act, 15 U.S.C. 41 et seq.; section 5 of the Identity Theft and

Assumption Deterrence Act of 1998 (ITADA), 18 U.S.C. 1028 note. 

PURPOSE(S):

To maintain records of complaints and inquiries from individual consumers; to track and 

respond to such communications (e.g., providing information to consumers over the phone or 

fulfilling requests by consumers to be mailed copies of FTC publications); identify consumer 

problems and issues that may lead to law enforcement investigations, litigation, or other 

proceedings; to be used in and made part of the records of such proceedings, or to be referred to 

other person, entities, or authorities, where appropriate, covered by other Privacy Act system of 

records notices; and to provide statistical data on the number and types of complaints or other 

communications received by the FTC. Also, to satisfy the requirement of the ITADA that the 

FTC compile and refer ID theft complaints to “appropriate entities,” and to provide useful 

information that may contribute to regulation and oversight of institutions and systems that play 

a role in or are affected by fraudulent business practices or identity theft.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING 

CATEGORIES OF USERS AND THE PURPOSES OF SUCH USES:

(1) Consumer complaints can be disclosed to the subject of the complaint for purposes of 

attempting to resolve the complaint;

(2) ID theft complaints also can be disclosed to the three major national credit reporting 

agencies and other appropriate entities to fulfill the requirements of section 5 of the ITADA; and

(3) Contact data for non-FTC users of this system (e.g., staff of authorized law 

enforcement agencies) can be shared among such users or with others within or outside the FTC 

to enable them to communicate with one another.
See Appendix I for other ways that the Privacy Act allows the FTC to use or disclose 

system records outside the agency.

DISCLOSURE TO CONSUMER REPORTING AGENCIES:

Identity theft complaints may be referred to consumer reporting agencies, as authorized 

by the ITADA. Disclosure of system records is also authorized under 5 U.S.C. 552a(b)(12) 

when trying to collect a claim of the Government. See Appendix I.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 

AND DISPOSING OF RECORDS IN THE SYSTEM:

STORAGE:

Communications are received from consumers in a variety of paper and electronic 

formats (e.g., by letter, e-mail, Web-based form, facsimile, telephone, TTY). The FTC 

maintains a Consumer Response Center, which can be reached through a toll-free telephone

numbers, for the collection of complaints from consumers. Communications referred to the FTC 

from other sources (e.g., other law enforcement agencies, private consumer protection 

organizations) may also be provided to the FTC in paper or electronic format (e.g., by letter,

e-mail, CD-ROM, disk drive). Data from such communications are entered into a structured 

electronic database maintained by a contractor on the agency’s behalf, and accessible by

Web-based interface to FTC staff, contractors, and other authorized users (e.g., law enforcement 

partners) subject to strict access and security controls (see “Safeguards” below).

RETRIEVABILITY:

Records may be retrieved and indexed by any category of data that is submitted by 

consumers or otherwise compiled in association with such records (e.g., name, subject of the 

complaint).

SAFEGUARDS:

The system can currently be accessed by FTC staff, contractors, and other system users, 

such as authorized law enforcement agency personnel. This access occurs via a Web-based 

interface and is authorized only on a need-to-know basis to those individuals and organizations 

requiring access. Contractors and other non-FTC users must sign confidentiality and 

nondisclosure agreements, and, in some cases, are required to undergo additional security 

clearance procedures. Letters or other system records in paper format are maintained in lockable 

rooms and cabinets. Access to the electronic database requires users to have the correct “user 

ID” and password combination, individual security token code, and Internet protocol (“IP”) 

address for the user’s law enforcement agency. The system database is maintained on secure 

servers, protected by firewalls, access and usage logs, and other security controls. Servers are 

maintained in a secure physical environment, including building locks, security guards, and 

cameras.
RETENTION AND DISPOSAL:

Records are retained and destroyed in accordance with schedules and procedures issued 

or approved by the National Archives and Records Administration.

SYSTEM MANAGER(S) AND ADDRESS:

Assistant Director, Division of Planning and Information, Bureau of Consumer

Protection, Federal Trade Commission, 600 Pennsylvania Avenue, NW., Washington, DC

20580.

NOTIFICATION PROCEDURE; RECORD ACCESS PROCEDURES; AND CONTESTING 

RECORD PROCEDURES:

See Appendix II. Individuals who call the FTC’s Consumer Response Center can also 

use their FTC reference number to identify complaints they have previously submitted in order 

to update them.

RECORD SOURCE CATEGORIES:

Consumers and entities who communicate with the FTC; FTC staff and contractors; other 

law enforcement agencies and non-FTC organizations.

EXEMPTIONS CLAIMED FOR THE SYSTEM: 

Pursuant to 5 U.S.C. 552a(k)(2), records in this system relating to identity theft are exempt 

from the requirements of subsections (c)(3), (d), (e)(1), (e)(4) (G), (H), (I), and (f) of 5 U.S.C. 

552a, and the corresponding provisions of 16 CFR 4.13. See FTC Rules of Practice 4.13(m), 16 

CFR 4.13(m).