UNITED STATES DISTRICT COURT 

EASTERN DISTRICT OF WISCONSIN 

MILWAUKEE DIVISION 

UNITED STATES OF AMERICA, 

 Plaintiff, Civil Action No. 2:20-cv-859 

v. Judge Lynn S. Adelman 

KOHL’S DEPARTMENT STORES, INC., 

 Defendant. 

STIPULATED ORDER FOR PERMANENT INJUNCTION, OTHER EQUITABLE 

RELIEF, AND CIVIL PENALTY 

Plaintiff, the United States of America, acting upon notification and authorization to the 

Attorney General by the Federal Trade Commission (“Commission”), pursuant to Section 

16(a)(1) of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. §56(a)(1), filed its 

Complaint for Permanent Injunction, Other Equitable Relief, and Civil Penalties (“Complaint”), 

in this matter, pursuant to Section 13(b) of the FTC Act, 15 U.S.C. § 53(b), and Section 621(a) of 

the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681s(a). Defendant has waived service of 

the summons and the Complaint. Plaintiff and Defendant stipulate to the entry of this Stipulated 

Order for Permanent Injunction and Civil Penalty (“Order”) to resolve all matters in dispute in 

this action between them. 

THEREFORE, IT IS ORDERED as follows: 

FINDINGS 

1. This Court has jurisdiction over this matter. 

Page 1 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 1 of 14 Document 4 
 

 

2. The Complaint charges that in responding to certain requests for application and business 

transaction records under FCRA Section 609(e), Defendant participated in acts or 

practices in violation of Section 5 of the FTC Act, 15 U.S.C. § 45, and the FCRA, 15 

U.S.C. §§ 1681–1681x. 

3. Defendant neither admits nor denies any of the allegations in the Complaint, except as 

specifically stated in this Order. Only for purposes of this action, Defendant admits the 

facts necessary to establish jurisdiction. 

4. Defendant waives any claim that it may have under the Equal Access to Justice Act, 28 

U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, 

and agrees to bear its own costs and attorney fees. 

5. Defendant and Plaintiff waive all rights to appeal or otherwise challenge or contest the 

validity of this Order. 

DEFINITIONS 

For the purpose of this Order, the following definitions apply: 

A. “Defendant” means Kohl’s Department Stores, Inc. and its successors and 

assigns. 

B. “Victim” means a consumer whose means of identification or financial 

information has been used or transferred (or has been alleged to have been used or 

transferred) without the authority of that consumer, with the intent to commit, or to aid or 

abet, an identity theft or a similar crime. 

C. “Eligible Victim” means any Victim for whom Defendant has a record that the 

Victim requested from Defendant, during the time period of February 1, 2017 to April 15, 

Page 2 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 2 of 14 Document 4 
 

2019, application and business transaction records evidencing any transaction alleged to be 

a result of identity theft. 

ORDER 

I. PROHIBITED BUSINESS PRACTICES 

IT IS ORDERED: 

A. That Defendant and Defendant’s officers, agents, employees, and attorneys, and all other 

persons in active concert or participation with any of them, who receive actual notice of this 

Order, whether acting directly or indirectly, in connection with the sale of any good or service by 

Defendant, are hereby permanently restrained and enjoined from failing to, within 30 days of the 

date of receipt of a valid written request under FCRA Section 609(e), from a Victim mailed to 

the address or other channel specified by the Defendant, and subject to verification of the identity 

of the Victim and the claim of identity theft in accordance with paragraph I.B, provide, without 

charge to the Victim, a copy of application and business transaction records in Defendant’s 

control, whether maintained by Defendant or by another person on behalf of Defendant, 

evidencing any transaction alleged to be a result of identity theft as required by FCRA Section 

609(e). Such records, which may include information that identifies the alleged identity thief, 

shall be provided to: 

1. the Victim; 

2. any Federal, State, or local government law enforcement agency or officer 

specified by the Victim in such a request; or 

3. any law enforcement agency investigating the identity theft and authorized by the 

Victim to take receipt of records, 

when Defendant has provided credit to, provided for consideration products, goods, or services 

to, accepted payment from, or otherwise entered into a commercial transaction for consideration 

Page 3 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 3 of 14 Document 4 
 

with, a person who has allegedly made unauthorized use of the means of identification of the 

Victim. 

B. Before Defendant provides any information under paragraph I.A, unless Defendant, at its 

discretion, otherwise has a high degree of confidence that it knows the identity of the Victim 

making a request under paragraph I.A, the Defendant may require the Victim to provide to 

Defendant: 

1. as proof of positive identification of the Victim, at the election of the Defendant: 

a. the presentation of a government-issued identification card; 

b. personally identifying information of the same type as was provided to 

Defendant by the unauthorized person; or 

c. personally identifying information that Defendant typically requests from 

new applicants or for new transactions, at the time of the Victim’s request for 

information, including any documentation described in clauses I.B.1.a and 

I.B.1.b; and 

2. as proof of a claim of identity theft, at the election of Defendant: 

a. a copy of a police report evidencing the claim of the Victim of identity 

theft; and 

b. a properly completed: 

i. copy of a standardized affidavit of identity theft developed and 

made available by the Consumer Financial Protection Bureau; or 

ii. affidavit of fact that is acceptable to Defendant for that purpose. 

C. Defendant may decline to provide information under paragraph I.A if, in the 

exercise of good faith, Defendant determines that: 

Page 4 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 4 of 14 Document 4 
 

1. paragraph I.A does not require disclosure of the information; 

2. after reviewing the information provided pursuant to paragraph I.B, Defendant 

does not have a high degree of confidence in knowing the true identity of the 

individual requesting the information; 

3. the request for the information is based on a misrepresentation of fact by the 

individual requesting the information relevant to the request for information; or 

4. the information requested is Internet navigational data or similar information 

about a person’s visit to a website or online service. 

D. Nothing in this Order shall be construed to waive or alter any defense under Section 

609(e), including the affirmative defense to file an affidavit or answer stating that: (A) the 

business entity has made a reasonably diligent search of its available business records; and (B) 

the records requested under Section 609(e) do not exist or are not reasonably available. 

E. No provision of Title V, subtitle A, of the Gramm-Leach-Bliley Act, 15 U.S.C. §§ 6801-

6809 prohibiting the disclosure of financial information by a business entity to third parties, shall 

be used to deny disclosure of information to the Victim under paragraph I.A. 

F. Except as provided in paragraph I.D, nothing in this subsection permits or requires 

Defendant to disclose information, including information to law enforcement under paragraphs 

I.A.2 and I.A.3, that Defendant is otherwise prohibited from disclosing under any other 

applicable provision of Federal or State law. 

II. MONETARY JUDGMENT FOR CIVIL PENALTY 

IT IS FURTHER ORDERED that: 

A. Judgment in the amount of two hundred and twenty thousand ($220,000) is entered in 

favor of Plaintiff against Defendant as a civil penalty. 

Page 5 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 5 of 14 Document 4 
 

 

 

 

 

 

B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the 

United States, two hundred and twenty thousand ($220,000) which as Defendant stipulates, its 

undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. Such 

payment must be made within 7 days of entry of this Order by electronic fund transfer in 

accordance with instructions previously provided by a representative of Plaintiff. 

C. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all 

assets transferred pursuant to this Order and may not seek the return of any assets. 

D. The facts alleged in the Complaint will be taken as true, without further proof, in any 

subsequent civil litigation by or on behalf of the Commission, including in a proceeding to 

enforce its rights to any payment or monetary judgment pursuant to this Order. 

E. Defendant acknowledges that its Taxpayer Identification Numbers (Employer 

Identification Numbers), which Defendant previously submitted to the Commission, may be used 

for collecting and reporting on any delinquent amount arising out of this Order, in accordance 

with 31 U.S.C. § 7701. 

III. NOTICES TO ELIGIBLE VICTIMS AND OTHER VICTIMS 

IT IS FURTHER ORDERED that: 

A. On or before 30 days after entry of this Order, and for three years following, Defendant 

must provide a website notice on a page of Defendant’s website, www.kohls.com, in a place 

where consumers seeking information about fraud and identity theft would reasonably expect to 

find such information, information directing Victims how to ask Kohl’s to provide copies of 

application and business transaction records related to a fraudulent transaction or account. Such 

notice must provide an email address, postal address, and fax number, to any one of which the 

Victim can elect to send the request. Such notice must not require the Victim to provide anything 

other than what is required by law (15 U.S.C. § 1681g(e)), namely (1) the Victim’s driver’s 

Page 6 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 6 of 14 Document 4 
 

 

 

 

 

 

 

 

license or other government-issued identification; (2) personally identifying information to verify 

the requestor’s identity; (3) sufficient information for Defendant to identify and locate the 

transaction alleged to be a result of identity theft; (4) the police report the Victim filed about the 

identity theft; and (5) an affidavit reporting the identity theft, like the Identity Theft Report the 

Victim can create at IdentityTheft.gov (the “Verification Documents”). Finally, the notice must 

affirm that Kohl’s will send copies of records required to be sent under Section 609(e) that relate 

to the identity theft Victim’s request within 30 days after receiving the request and the 

Verification Documents (if required by Kohl’s). 

B. Defendant shall, within 14 days after entry of this Order, provide the Commission with its 

certification, signed by Kohl’s Chief Marketing Officer on behalf of Kohl’s, that Kohl’s has sent 

all application and business transaction records in its control evidencing any transaction alleged 

to be a result of identity theft to any Eligible Victims who previously submitted a request to 

Kohl’s that included each of the Verification Documents. 

C. Defendant shall, within 14 days after entry of this Order, provide the Commission with its 

certification, signed by Kohl’s Chief Marketing Officer on behalf of Kohl’s, that Kohl’s has 

provided a notice to Eligible Victims who previously submitted a request for application and 

business transaction records (which request did not include each of the Verification Documents), 

informing the Eligible Victims that Kohl’s may have additional application and business 

transaction records that relate to the fraud or identity theft claim, and that the Eligible Victim 

may request those records by following the same process described in paragraph III.A above. 

D. Defendant shall, within 14 days after entry of this Order, provide the Commission with its 

certification, signed by Kohl’s Chief Marketing Officer on behalf of Kohl’s, that Kohl’s has 

delivered all application and business transaction records in its control evidencing any 

Page 7 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 7 of 14 Document 4 
 

 

 

 

 

transaction alleged to be a result of identity theft to any Eligible Victims who received the notice 

described in paragraph III.C above and who sent Kohl’s each of the Verification Documents, 

regardless of whether the request specifies particular records sought. 

IV. ORDER ACKNOWLEDGMENTS 

IT IS FURTHER ORDERED that Defendant obtain acknowledgments of receipt of this 

Order: 

A. Defendant, within 7 days of entry of this Order, must submit to the Commission an 

acknowledgment of receipt of this Order sworn under penalty of perjury. 

B. For 5 years after entry of this Order, Defendant must deliver a copy of this Order to: (1) 

all employees having managerial responsibilities for conduct related to Section I of the Order and 

all employees and representatives responsible for responding to requests under FCRA Section 

609(e); and (2) any business entity resulting from any change in structure as set forth in the 

Section titled Compliance Reporting. Delivery must occur within 7 days of entry of this Order 

for current personnel. For all others, delivery must occur before they assume their 

responsibilities. 

C. From each individual or entity to which Defendant delivered a copy of this Order, 

Defendant must obtain, within 30 days, a signed and dated acknowledgment of receipt of this 

Order. 

V. COMPLIANCE REPORTING 

IT IS FURTHER ORDERED that Defendant make timely submissions to the 

Commission: 

A. One year after entry of this Order, Defendant must submit a compliance report, sworn 

under penalty of perjury. Defendant must: (1) identify the primary physical, postal, and email 

address and telephone number, as designated points of contact, which representatives of the 

Page 8 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 8 of 14 Document 4 
 

Commission and Plaintiff may use to communicate with Defendant; (2) identify all of 

Defendant’s businesses by all of their names, telephone numbers, and physical, postal, email, and 

Internet addresses; (3) describe the activities relevant to the scope of the Order of each business 

with such activities; and (4) describe in detail whether and how Defendant is in compliance with 

each Section of this Order; and (5) provide a copy of each Order Acknowledgment obtained 

pursuant to this Order, unless previously submitted to the Commission. 

B. For 10 years after entry of this Order, Defendant must submit a compliance notice, sworn 

under penalty of perjury, within 14 days of any change in: (1) any designated point of contact; or 

(2) the structure of Defendant or any entity that Defendant has any ownership interest in or 

controls directly or indirectly that may affect compliance obligations arising under this Order, 

including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate 

that engages in any acts or practices subject to this Order. 

C. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, 

insolvency proceeding, or similar proceeding by or against Defendant within 14 days of its filing. 

D. Any submission to the Commission required by this Order to be sworn under penalty of 

perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I 

declare under penalty of perjury under the laws of the United States of America that the 

foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s full name, 

title (if applicable), and signature. 

E. Unless otherwise directed by a Commission representative in writing, all submissions to 

the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight 

courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 

Page 9 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 9 of 14 Document 4 
Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 

DC 20580. The subject line must begin: FTC v. Kohl’s Department Stores, Inc. (X ). 

VI. RECORDKEEPING 

IT IS FURTHER ORDERED that Defendant must create certain records for 10 years 

after entry of the Order, and retain each such record for 5 years. Specifically, Defendant must 

create and retain the following records to the extent they relate to this Order: 

A. accounting records showing the revenues from all goods or services sold; 

B. personnel records sufficient to show: (1) for each person having managerial 

responsibilities related to this Order, whether as an employee or otherwise, that person’s: 

name; address; telephone numbers; job title or position; dates of service; and (if 

applicable) the reason for termination; and (2) for each agent or employee designated by 

the Company to respond to requests for application and business transaction records, that 

person’s: name; address; telephone numbers; job title or position; dates of service; the 

number of requests for application and business transaction records that the individual 

responds to annually; information identifying the specific requests that the individual 

responds to; any disciplinary action against the individual related to the individual’s 

response to requests for application and business transaction records; and (if applicable) 

the reason for termination; 

C. records of all written consumer complaints relating to requests for application or 

business transaction records, pursuant to FCRA Section 609(e), whether received directly 

or indirectly, such as through a third party, and any response; 

D. records tracking each request for records covered by paragraph I.A of this Order that 

Defendant receives, including: 

1. the date Defendant received each request; 

Page 10 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 10 of 14 Document 4 
2. if applicable, the date Defendant provided the records in response to the request; 

and 

3. for any request where Defendant declines to provide the records, the reasons for 

such denial; and 

E. all records necessary to demonstrate full compliance with each provision of this Order, 

including all submissions to the Commission. 

VII. COMPLIANCE MONITORING 

IT IS FURTHER ORDERED that, for the purpose of monitoring Defendant’s compliance 

with this Order: 

A. Within 14 days of receipt of a written request from a representative of the Commission or 

Plaintiff, Defendant must: submit additional compliance reports or other requested information, 

which must be sworn under penalty of perjury; appear for depositions; and produce documents 

for inspection and copying. The Commission and Plaintiff are also authorized to obtain 

discovery, without further leave of court, using any of the procedures prescribed by Federal 

Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69. 

B. For matters concerning this Order, the Commission and Plaintiff are authorized to 

communicate directly with Defendant. Defendant must permit representatives of the Commission 

and Plaintiff to interview any employee or other person affiliated with Defendant who has agreed 

to such an interview. The person interviewed may have counsel present. 

C. The Commission and Plaintiff may use all other lawful means, including posing, through 

their representatives as consumers, suppliers, or other individuals or entities, to Defendant or any 

individual or entity affiliated with Defendant, without the necessity of identification or prior 

notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, 

Page 11 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 11 of 14 Document 4 
 

 

pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1. Defendant may assert any 

and all defenses, rights, or privileges available to it. 

VIII. RETENTION OF JURISDICTION 

IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 

purposes of construction, modification, and enforcement of this Order. 

SO ORDERED this 10th day of June, 2020. 

s/Lynn Adelman 

Judge Lynn S. Adelman 

UNITED STATES DISTRICT JUDGE 

SO STIPULATED AND AGREED: 

FOR PLAINTIFF: 

THE UNITED STATES OF AMERICA 

JOSEPH H. HUNT 

Assistant Attorney General 

Civil Division 

ETHAN P. DAVIS 

Deputy Assistant Attorney General 

GUSTAV W. EYLER 

Director 

Consumer Protection Branch 

/s/ Speare I. Hodges___ 

Speare I. Hodges 

Trial Attorney 

Consumer Protection Branch 

U.S. Department of Justice 

P.O. Box 386 

Washington, DC 20044 

(202) 532-0295 

Speare.I.Hodges@usdoj.gov 

Page 12 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 12 of 14 Document 4 
FEDERAL TRADE COMMISSION 

\llb

blbl 

itnr:"J' A_ Ml.)Ore

J~ci: , Atto~ 

Division of Pr:ivscy :md Id~ tity Prowi;llon 

FcderaJ Tr-arlle Com.mi si 

\Va.-,hington. DC 2.0S:80 

2{f2-l26-264S 

Ellli3 Jmwn, Attorney 

Di.vision of iPt'ivaey i; Id,:ntity P~"Cctiou 

.f cdtt.BJl TrSJ!fc C Otttm i:ss toll 

\V,R.1h.ington1 DC 20580 

202-326,.)00 [ 

Page 13 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 13 of 14 Document 4 
Page 14 of 14 

Case 2:20-cv-00859-LA Filed 06/10/20 Page 14 of 14 Document 4 

Kdltc~• [)ryr; & W.1ro:n, LLP 

\\1.nsbin ton Rmbor. Suit~ -400 

30SO K Stred NW 

W~ingit.oo, DC 20007 

(202.) 34:2-8603 

C/-~!°..U-<A~· _'Ii)~ ~ 0 le: ~ I 5 {'o,Q 

Johl!I E. Vinafutnoo, Esq. 

K.Glloy Dzyc & W~n., LlP 

Wru1hingl:ml ITarooT; Sui 400 

'JOSO K Sb:1.-'ci m\' 

\Vusl1h1gion. DC 200Ll7 

(202) 342-8~23 

··?- ·) ~ ..-x -- ) 

,· ~ - ~_p.-z,--_> J · ~°Z _,. Date: ~. / ~j" / ~O~tl 

·-oaanel[y L. McDoweU, ~• 

Kiellcy Drye & Warren. LLP 

Washington Haroo, Sui,tc 4.00 

3050 K. s~t mv 

Wa&hington, DC 20007 

(202) 342-8645 

COUNSfil.. FOR KOHL'S DliPARTht:ENT STORES, INC.