Consumer complaint received 2024-07-09
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Improper use of your report — Reporting company used your report improperly
Company: TRANSUNION INTERMEDIATE HOLDINGS, INC. (CA)

Plaintiff, : XXXX XXXX XXXX XXXX XXXX ATTORNEY IN FACT for its Complaint alleges : XXXX. Notice to brings this action under Section 13 ( b ) of the Federal Trade Commission Act ( FTC Act ), 15 U.S.C. 53 ( b ), and the Standards for Safeguarding Customer Information ( Safeguards Rule ), 16 C.F.R. Part 314, issued pursuant to Sections 501-504 of the Gramm-Leach-Bliley Act ( GLB Act ), 15 U.S.C. 6801- 6804, to obtain permanent injunctive relief, restitution, and other relief for TRANSUNION LLCs violations of the FTC Act, 15 U.S.C . 45 ( a ), and the Safeguards Rule, 16 C.F.R. Part 314. Definitions ; rules of construction 15 U.S.C 1681 ( a ) ( 2 ( i ), : Responsibilities of furnishers of information to credit reporting agencies 15 U.S.C 1681s- ( 2 ), Compliance procedures 15 U.S.C 1681 ( e ) ( b ), Obligations with respect to disclosures of personal information 15 USC 6802, 15 USC 1681 ( 1 ) ( b ), Aggravated identity theft 18 USC 1028 ( A ), Protection of nonpublic personal information 15 USC 6801 ( a ) ( 1 ) ( 3 ), Chapter 41 Title 15 Consumer Credit Protection Rights , Violation of Truth in Lending Act, and Violation of Fair Credit Reporting Act. 

15 U.S.C. 41-58. Plaintiff, XXXX XXXX XXXX XXXX XXXX ATTORNEY IN FACT, to enforce Section 5 ( a ) of the FTC Act, 15 U.S.C . 45 ( a ), which prohibits unfair or deceptive acts or practices in or affecting commerce. XXXX XXXX XXXX, ATTORNEY IN FACT also here to enforce the Safeguards Rule, 16 C.F.R. Part 314, which requires financial institutions to protect the confidentiality, and integrity of customer information. 

TRANSUNION LLC TRANSUNION Originally founded in XXXX  by the XXXX XXXX XXXX. Currently ( the Corporation ). The Corporation was incorporated under the name XXXX XXXX XXXX XXXX, by the filing of its original Certificate of Incorporation with the Secretary of State of the State of XXXX. The address of the registered office of the Corporation in the State of XXXX  is XXXX XXXX XXXX XXXX in the City of XXXX XXXX XXXX of XXXX XXXX, XXXX. The name of the registered agent of the Corporation in the State of Delaware at such address is THE COMPANY CORPORATION. TRANSUNION LLC Headquarters address XXXX XXXX XXXX XXXX, XXXX IL XXXX through certain of its XXXX, XXXX. The purpose of the Corporation is to engage in any lawful act or activity for which corporations may be organized under the General Corporation Law of the State of Delaware ( the DGCL ). TRANSUNION LLC has transacted business in this District and throughout the United States.

COMMERCE At all times material to this Complaint, TRANSUNION LLC has maintained a substantial course of trade in or affecting commerce, as commerce is defined in Section 4 of the FTC Act, 15 U.S.C. 44.

TRANSUNION LLCS NATURE OF BUSINESS ACTIVITIES TRANSUNION LLC, one of the three nationwide consumer reporting agencies in the United States, offers various credit reporting and information products and services to businesses and consumers. TRANSUNION LLC collects, processes, stores, and maintains vast quantities of personal information, including personal information of XXXX XXXX XXXX and more than XXXX XXXX U.S. consumers. 

TRANSUNION LLC stores much of this information in its main U.S. credit reporting database, known as Automated Credit Reporting Online ( ACRO ). TRANSUNION LLC uses XXXX  to provide credit reports, credit scores, collections, and prescreening products, among other things. 

TRANSUNION LLC also maintains on its network a system referred to as the XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX  is a network of applications and automated processes that handles XXXX XXXX XXXX questions, concerns and disputes regarding XXXX XXXX XXXX credit data. Among other things, the XXXX XXXX services an online dispute portal ( the XXXX Dispute Portal ), a web application where XXXX XXXX XXXX can dispute items appearing on XXXX XXXX XXXX credit reports and upload supporting documentation. XXXX also services TRANSUNION LLCs platform for XXXX XXXX XXXX credit freezes and fraud alerts, as well as all XXXX XXXX XXXX requests for a free annual file disclosure through AnnualCreditReport.com ( ACR ). 

When XXXX XXXX XXXX disputes items on his credit report through the XXXX Dispute Portal or otherwise transacts with TRANSUNION LLC for a consumer product or service ( such as a subscription to a credit monitoring product, a request to freeze the XXXX XXXX XXXX credit, or a request for a free credit report from XXXX ), XXXX XXXX XXXX must first submit sensitive personal information. For example, XXXX XXXX XXXX who requests a free credit report from XXXX must submit, among other things, his name, date of birth, and Social Security number ( SSN ). When XXXX XXXX XXXX who requests a security freeze or a copy of his credit score or credit report must submit personally identifiable information ( PII ), as well as a credit card number and expiration date if a purchase is being made. TRANSUNION LLC logs and stores XXXX XXXX XXXX XXXX in databases connected to XXXX. These databases thus contain hundreds of millions of records of sensitive personal information of XXXX XXXX XXXX and more than XXXX XXXX U.S. consumers. 

TRANSUNION LLC IN VIOLATION OF THE GLB ACTS SAFEGUARDS RULE TRANSUNION LLC is a financial institution, as that term is defined by Section 509 ( 3 ) ( A ) of the GLB Act, 15 U.S.C. 6809 ( 3 ) ( A ), and is subject to the GLB Act. The Safeguards Rule, which implements Section 501 ( b ) of the GLB Act, 15 U.S.C. 6801 ( b ), requires financial institutions to protect the security, confidentiality, and integrity of customer information by developing a comprehensive written information security program that contains reasonable administrative, technical, and physical safeguards, including, among other things, identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and assessing the sufficiency of any safeguards in place to control those risks; designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards key controls, systems, and procedures ; and evaluating and adjusting the information security program in light of the results of testing and monitoring, changes to the business operations or business arrangements, and any other relevant circumstances. 16 C.F.R. 314.3 and 314.4. Violations of the Safeguards Rule are enforced through the FTC Act. 15 U.S.C. 6805 ( a ) ( 7 ). For the reasons previously described, TRANSUNION LLC has not design and implement safeguards to address foreseeable internal and external risks for XXXX XXXX XXXX personal and private information, nor has TRANSUNION LLC regularly test or monitor the effectiveness of the safeguards or evaluate and adjust the information security program considering the results of testing and monitoring and other relevant circumstances regarding XXXX XXXX XXXX personal and private information. TRANSUNION LLC has therefore violated the GLB Act Safeguards Rule. 

Unfair Acts or Practices Regarding TRANSUNION LLCs Data Security Practices As described above TRANSUNION has failed to provide XXXX XXXX XXXX with reasonable security for his sensitive personal information collected, processed, maintained, or within TRANSUNION LLCs computer networks. TRANSUNION LLCs actions has caused or are likely to cause substantial injury to XXXX XXXX XXXX that XXXX XXXX XXXX can not reasonably avoid. TRANSUNION LLCs acts or practices set forth in constitute unfair acts or practices in violation of Section 5 of the FTC Act, 15 U.S.C. 45 ( a ) and 45 ( n ). 

VIOLATIONS OF THE GLB ACT SAFEGUARDS RULE In numerous instances, TRANSUNION LLC failed to protect and safeguard the security, confidentiality, and integrity of XXXX XXXX XXXX information and more than XXXX XXXX U.S. consumers. TRANSUNION LLC has not monitored the effectiveness of the safeguards and has not evaluated and adjusted TRANSUNION LLCs information security program in light of the results of testing and monitoring, and other relevant circumstances, as required by the Safeguards Rule, 16 C.F.R. Part 314. 46.. TRANSUNION LLCs acts or practices, as described above, TRANSUNION LLC has violated the Safeguards Rule, 16 C.F.R. Part d.