Security, Privacy and The Law : Security & Privacy Lawyer & Attorney : Foley Hoag Law Firm : Boston, Washington D.C.

RRS is a Minnesota company that sells residential tenant screening reports that contain consumers' names, Social Security numbers, dates of birth, financial account numbers and a range of credit reporting information. Landlords use these screening reports to determine whether to rent to individual tenants.

According to the FTC complaint filed in federal court in Minnesota, RRS and Mr. Mikkelson sold 318 screening reports directly to identity thieves posing as legitimate businesspeople. The FTC alleged that RRS required landlord applicants to identify the name of their businesses and provide contact information, but also that RRS did not have a consistent standard for authenticating that the applicant was who they said they were.  RRS allegedly would sometimes provide consumer screening reports without requiring any documentation or performing any investigation of its users.  The FTC asserted that RRS's conduct constituted an "unfair act or practice" in violation of Section 5(a) of the FTC Act (15 U.S.C. § 45(a)).  RRS has posted a press release indicating that, like the affected consumers, it fell victim to "experienced, technically sophisticated identity thieves" that had access to the affected consumer names, Social Security numbers and dates of birth prior to using RRS's service. RRS and the FTC negotiated a resolution to the FTC's claims and the terms of their agreement was entered as a Stipulated Final Judgment and Order in the federal district court. 

There are several important lessons to be learned from this case.  First and foremost, businesses should be managing information security broadly, not attempting to satisfy only specific rules governing limited categories of information. The FTC has been enforcing information security for over 10 years now as "unfair or deceptive acts or practices" under the Section 5 of the FTC Act.  Any business that believes it is immune to the Red Flags Rules, state identity theft regulations or the larger framework of specific privacy and information security rules, may still need to adopt an information security program to meet this general standard.  Because "unfair" acts are those characterized by "substantial injury," many kinds of information that may not fall squarely into state identity theft statutes could be covered by the FTC Act if they create or contribute to identity theft or cause some other kind of damage.  A business that ignores the general need for information security is exposing itself to significant liability, not only in the event that the FTC steps in, but also because state consumer protection laws, such as Mass. Gen. Laws ch. 93A, also prohibit "unfair or deceptive acts or practices" and permit citizens to bring private causes of action for treble damages and attorneys fees.

Second, companies need to keep in mind that the "reasonable" security measures include being prepared to deal with sophisticated criminals. Here, RRS appears to have relied on the fact that its users already had access to consumers' personal information to ensure that its service was being used for legitimate purposes. The FTC's clear view was that businesses need better authentication procedures if they are going to be providing their customers with access to sensitive personal information -- identity thieves, after all, typically obtain personal information and use it to commit fraudulent transactions. 

Third, the $500,000 fine is a reminder from the FTC that it is willing to set a high monetary value on lapses in information security.  The fact that the FTC suspended the $500,000 fine based upon the defendants' financial condition also suggests that, at this stage, the FTC may be willing to forego severe punitive measures in the current economic climate if it will commit to taking immediate action to improve security measures.  Companies should expect less of a reprieve from the FTC when the security issue is more eggregious. 

Fourth, there is no substitute for a comprehensive information security program.  It was critical to the resolution in the RSS case that the FTC required RRS to "establish and implement, and thereafter maintain a comprehensive information security program that is designed to protect the security, confidentiality and integrity of personal information collected from or about consumers."  In particular, the court's order specifies that an appropriate information security program must:

1. be in writing;
    
2. contain "administrative, technical, and physical safeguards appropriate to the entity's size and complexity, the nature and scope of the entity's activities, and the sensitivity of the personal information collected from or about consumers;"
    
3. designate personnel "to coordinate and be accountable for the information security program;"
    
4. expressly identify risks to the security, confidentiality and integrity of personal information;
    
5. assess risks present in "(1) employee training and management; (2) information systems . . . ; and (3) prevention, detection, and response to attacks, intrusions, or other system failures."
    
6. include regular testing and monitoring; and
    
7. contain a procedure for selecting and retaining "service providers capable of appropriately safeguarding personal information."

In addition, the FTC also took the position that the best way to ensure future compliance is to require independent security experts to evaluate the performance of a company's information security program.  The RRS order expressly requires RRS to submit to onerous biennial security audits for the next 20 years. 

Ultimately, we should expect to see the FTC pursuing similar terms when it begins enforcement of the Red Flags regulations in May: (1) stiff fines that may be suspended depending on economic condition and seriousness of the breach; (2) information security programs that contain a standard set of basic elements; and (3) independent security assessments to be submitted to the FTC over extended periods of time.  We should also expect state regulatory agencies around the country to be looking to this case and other FTC enforcement actions as a precedent for their own efforts.  Given the parallels between the information security program ordered in this case and state identity theft regulations, it seems highly likely that state regulatory agencies will be seeking similar orders, or more onerous ones, in their own enforcement efforts. 

Links:

• The FTC's announcement
• RRS and Lee Mikkelson's press release
• The FTC Complaint (.pdf), also available, in unexecuted form, from the FTC's website here (.pdf)
• The Stipulated Final Judgment and Order (.pdf), also available, in unexecuted form, from the FTC's website here (.pdf)

The FTC's Bright-Line Rule: A “Creditor” Is Any Business That Receives Payment After Delivery of Goods or Services 

The FTC has made it clear that it broadly interprets the term “creditor” to apply to any business or entity that allows customers to defer payment for goods or services until after they have been provided to the customer. This would include doctors, lawyers and a broad range of for-profit and non-profit businesses and organizations. The FTC has presented this interpretation in a number of public statements:

• In the commentary to the November 2007 Final Rules, the FTC and other federal rulemakers indicated that the term “creditor” includes traditional lenders “such as banks, finance companies,” but also automobile dealers, mortgage brokers, utility companies, and telecommunications companies. 
   
• In June 2008 guidance, the FTC indicated “[w]here non-profit and government entities defer payment for goods or services, they, too, are to be considered creditors.” 
   
• On a July 22, 2008 conference call with municipal and state utilities organizations, FTC representatives apparently indicated that the Red Flag requirements apply to all business “operations which provide services before they bill the customer.” [For an industry report on that call see this link (.pdf).]
• During a conference call with members from the healthcare industry, FTC staff attorneys apparently stated that physicians and hospitals are “creditors” subject to Red Flags regulation “if they do not require full payment up front at the time they see patients, but rather bill patients after the physician’s services are rendered.” The American Medical Association and several other healthcare groups objected to this broad interpretation in a September 30, 2008 letter (.pdf) to the FTC chairman.>
   
• In its October 2008 Enforcement Policy (.pdf) statement, the FTC affirmed this broad interpretation when it affirmed that “any person that provides a product or service for which the consumer pays after delivery is a creditor.” 
• The FTC’s Chief Privacy Officer Mark Groman reiterated that a “creditor” is any business, including law firms, that “defers payment” in exchange for goods and services during a January 2009 presentation at the Boston Bar Association. [See our piece on that event here.] 

From these public statements, it is clear that the FTC has adopted a bright line test: anyone that accepts payment after he/she/it provides goods or services is a “creditor” subject to the Red Flags regulations. In the FTC’s view, the regulations apparently apply equally to doctors who bill their patients after an office visit, to lawyers and consultants who present their clients with bills for past services on a periodic basis, as it does to banks and credit card companies.  Any business that does not demand up-front payment before it provides goods or services to its customers would apparently be a “creditor under the FTC’s current interpretation and, according to the FTC, should be developing a compliant identity theft prevention program (and, by the way, complying with federal lending laws). 

Federal Courts of Appeals: No Bright-Line Rule, Businesses That Accept Payment After Delivery May Not Be A “Creditor”

Notwithstanding the FTC’s statements on this issue, federal court of appeals decisions interpreting who is a “creditor” under federal law have construed the term somewhat narrowly. Importantly, the federal appeals courts have pointedly refused to adopt a bright line standard like the one announced by the FTC. 

Neither the Red Flags regulations nor the FACT Act define the term “creditor.” Instead, they incorporate the definition of “creditor” from a parallel federal statute, the Equal Credit Opportunity Act (ECOA). Under the ECOA, “creditor” is defined as “any person who regulatory extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation off credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit.” “Credit,” in turn, is defined in turn as the “right granted by a creditor to a debtor” to: (1) “defer payment of debt right granted by a creditor”; (2) “incur debts and defer its payment”; or, most broadly of all, (3) “purchase property and services and defer payment therefore.” As a result, the legal question for many businesses is whether they become a “creditor” simply by accepting payment for their services after they have been completed.

In Shaumyan v. Sidetex Co., 900 F.2d 16 (2d Cir. 1990), the Second Circuit Court of Appeals found that a contractor was not a “creditor” when it allowed a client to make incremental payments for home improvements that included installing siding and replacing doors and windows. In that case, the plaintiffs agreed to make a series of payments over time after work was completed, including an initial deposit, a payment when the work commenced, a payment after the project was half complete, a payment when the siding was installed and a final payment when the project after the windows and doors had been completed. Shaumyan, 900 F.2d at 17. The Second Circuit considered and rejected the argument this arrangement made the contractor a creditor under the ECOA merely because payment was not made before work begun or “instantaneously” when the services were provided. The Court reasoned that “[i]f this proposition were strictly applied . . . countless transactions in which compensation for services is not instantaneous would be characterized as credit transactions. Such indiscriminate application of the ECOA is not appropriate.” Shaumyan, 900 F.2d at 18-19 (internal citation omitted). Instead, the Second Circuit held that the contractor was not a “creditor” because payment was made “substantially contemporaneous” with the work that was performed. Shaumyan, 900 F.2d at 19 (“Since the … payment obligation was substantially contemporaneous with [the contractor’s] performance, the contract was not a credit transaction.”). 

More recently, in Riethman v. Berry, 287 F.3d 274 (3d Cir. 2002), the Third Circuit Court of Appeals flatly rejected the FTC’s current interpretation of “creditor.” There, the Third Circuit considered whether a law firm could be considered a creditor because it entered into an attorney fee arrangement that permitted the client to make payments after services were rendered, and allowed for late payments. The Court rejected the plaintiff’s argument that any “post-service billing” (or billing for services or goods already rendered) transformed the law firm into a “creditor” and suggested that the term “creditor” must be limited to more traditional financial institutions. Otherwise “in addition to attorneys' fees, [plaintiff’s] interpretation of the ECOA would embrace doctors' fees, dentists' fees, accountants' fees, psychologists' fees and virtually all other professional fees. In view of the statutory purpose underlying the ECOA, it seems implausible that Congress intended to cover not only banks and other such financial institutions but also all professions.” Riethman, 287 F.3d at 278. 

The Shaumyan and Riethman decisions appear to reject the FTC’s broad interpretation of “creditor” under the ECOA and, not surprisingly, industry groups such as the American Medical Association, brought these cases to the FTC’s attention in their September 2008 letter (.pdf). While other cases interpreting the ECOA may offer less support to industry groups resisting the FTC’s broad interpretation, they make clear that the federal courts that have examined issues have not adopted any bright line tests like the one announced by the FTC.   

In particular, the issue of who is a “creditor” under the ECOA has been hotly contested in the context of residential and commercial leases. This led to a number of decisions from federal circuit courts and the Federal Reserve Board, the agency empowered to issue interpretive guidance on the ECOA, has weighed in on the issue with a non-binding interpretation asserting that “Congress did not intend the ECOA . . . to cover lease transactions” and warning that enforcing the ECOA against lessors “could impose significant burdens for certain segments of the industry — such as furniture and appliance leasing.” 50 Fed. Reg. 48018, 48019-20 (1985). Key court decisions on this issue include the following cases:

• In Laramore v. Ritchie Realty Mgt. Co., 397 F.3d 544 (7th Cir. 2005), the Seventh Circuit Court of Appeals held that a residential landlord was not a “creditor” under the ECOA. The Court reasoned that “typical” rental payments are better seen as credits for future services, rather than a deferral of debt for the underlying lease obligation. Laramore, 397 F.3d at 547. However, the Court explicitly left the door open for the ECOA to cover a non-typical residential lease that requires payment at the end of the month for the preceding month’s rent. “For the purposes of this case, we are concerned only with leases that provide for the lease of residential property for a term and roughly equal rental payments are due to the landlord at the beginning of each month during that term.” Laramore, 397 F.3d at 547 n.2.
• The Court of Appeals for the D.C. Circuit held in Micks at Pa. Ave., Inc. v. BOD, Inc., 389 F.3d 1284, 1289 (D.C. Cir. 2004) that a residential sublease did not transform the sublessor into a “creditor” under the ECOA. The Court was skeptical that merely collecting monthly rental payments constitutes an ECOA “credit transaction” and also justified its holding based on the fact that the ECOA requires that a “credit transaction” be in the “regular” course of business, but the sublessor at issue in the case was a restaurant who did not “regularly” extend subleases. Micks, 389 F.3d at 1289. This decision suggests that the D.C. Circuit, much like the Third Circuit in the Riethman case, may be reluctant to identify “creditors” without also considering the types of goods and services purchased.
• In a break with other courts, the Ninth Circuit Court of Appeals held that an automobile lease transformer the lessor into a “creditor” under the ECOA. In Brothers v. First Leasing, 724 F.2d 789 (9th Cir. 1984), the Ninth Circuit held that the lessor was a “creditor” because an automobile lease requires a lessee to defer payment of the debt. Brothers, 724 F.2d at 798 n.8.

This much is clear: federal courts of appeals have not adopted the FTC’s bright-line test for what businesses are “creditors.” Instead, the federal courts have applied the ECOA on a case-by-case basis and exhibited a clear reluctance to define “creditor” so broadly that it includes all businesses that bill their customers for past services. In particular, several federal appeals courts and the Federal Reserve Board have indicated that the ECOA was not intended to apply the term “creditor” to industries beyond traditional lending institutions. 

Beyond legal formalities and abstractions, the concern expressed by these courts is grounded in common sense. If the FTC’s broad interpretation is not narrowed, who isn't a "creditor"?  Having announced no practical limitations on who is covered by the new rules, the FTC appears ready to push scope of the Red Flags regulations to new limits.  While many individuals and companies may have well-founded legal arguments that they are not subject to Red Flags regulations, anyone that ignores the new rules does so at their peril, given the FTC’s clear intention to enforce the regulations against virtually everyone.

Links:

• The FTC's website
•  The Federal Register publication of the final Red Flags Regulations are available here (.pdf), or directly from the FTC's website here (.pdf)
• The FTC's Business Alert from June 2008 is available here (.pdf) and this guidance is available directly from the FTC's website here.
• The Oklahoma Municipal League's Municipal Policy Review, which reported on FTC public statements is available here (.pdf), or from the Oklahoma Municipal League's website here (.pdf).
• The September 30, 2008 letter sent by a long list of medical organizations to the FTC chairman is avaialble here (.pdf) or from the AMA's website here (.pdf).
• The FTC's October 2008 Enforcement Policy Statement may be found here (.pdf) or on the FTC's website here (.pdf).
• Reithman v. Berry, 287 F.3d 274 (3d Cir. 2002) (.pdf) or directly from the Court of Appeals website (.pdf)

FTC Recommendation 1 - Businesses should improve their methods of authenticating the identity of consumers

By this, the FTC means that businesses should reduce or eliminate altogether the use of SSNs to authenticate a person’s identity. The FTC explains that SSNs themselves are not useful tools to confirm a person’s identity because SSNs are widely used as “identifiers” — information that, like your name and address, are commonly supplied to a range of merchants, employers, government agencies and financial institutions — rather than as “authenticators” — information like a password or personal information which remains secret. In short, because your SSN is generally no secret to your boss, your doctor, your bank, the IRS and a number of other entities, knowledge of your SSN is insufficient to prove that you are who you say you are. 

The FTC Report does identify some appropriate ways that SSNs may be used during the authentication process which might safely avoid some of the risks associated with using a SSN as an authenticator:

• using the SSN “to access databases containing information about an individual that can be used to formulate challenge questions that only the true individual should be able to answer (for example, the amount of her mortgage payment each month)”; [Report at 5]

• using the SSN to check an individual’s identity against a fraud database, for example, checking to see that the SSN matches the Social Security Administration’s listing for a living individual or whether the SSN is listed on industry databases of SSNs used to commit fraud; and

• using the SSN “as one element in their quantitative fraud prediction models, which are designed to flag suspect patterns of use of identifying information that might indicate that an application or proposed transaction is fraudulent” [Report at 5] — for example, a check to see whether there have been an unusually large number of credit applications or other suspicious activity using a particular SSN.  

While these examples can be found in the FTC Report, the FTC has made clear that they are not taking a stance on whether any specific techniques would ensure compliance with new federal regulations. In calling for rulemaking on this issue, the FTC indicates, as they have with respect to recent Red Flags regulation, “the standard should be one of reasonableness and not perfection, acknowledging that there is no fool-proof method of authenticating consumers and no likelihood that one will be developed in the foreseeable future.” [Report at 7] Nevertheless, given the FTC’s conclusion that use of SSNs to authenticate a person’s identity presents a risk of identity theft, it seems clear that businesses that rely on SSNs as an authenticator do so at their peril.

FTC Recommendation 2 - Businesses should abolish the public display and transmission of Social Security numbers

Here, the FTC’s guidance is abundantly clear: stop displaying and transmitting SSNs in unnecessary and potentially risky ways. While the FTC calls on regulatory agencies that oversee the use of SSNs to adopt rules on this issue, the FTC makes a series of specific recommendations to businesses in advance of further regulation: 

•  Stop using SSNs as employee or customer numbers;

• Stop printing SSNs on identification cards that would be compromised every time a wallet is lost or stolen;

• Stop printing SSNs on mailings, such as account statements or paychecks that can be lifted from a person’s mailbox or trashcan;

• Stop displaying SSNs in emails or website pages, which can be observed over a person’s shoulder;

• Encrypt SSNs when they must be transmitted over the Internet.

[Report at 8-9]

In addition, the FTC appears to take the view that displaying only a truncated portion of a person’s SSN provides little protection because the other digits can often be collected from other sources or fabricated based on other personal information. [Report at 8]

Given the level of confusion that plagues many businesses’ efforts to develop identity theft prevention programs, the FTC’s clarity on this issue should not be ignored, especially since many, if not all, of these steps are simple and inexpensive to implement.

Other FTC Recommendations

Perhaps not surprisingly given the confusion generated by new federal and state identity theft regulations, the FTC’s remaining recommendations call on Congress, other regulatory agencies and the FTC itself to develop national standards and provide guidance and leadership to dispel the widespread confusion on what we can do to reduce the threat of identity theft. The FTC outlines some specific guidance to businesses, such as:

• Collect SSNs only when necessary;
• Retain SSNs only as long as necessary;
• Consider how to properly and securely dispose of records containing SSNs;
   
• Secure and/or encrypt electronic transmissions containing SSNs;
• Limit employee access to SSNs;
• Conduct reasonable employee screening to avoid hiring identity thieves; and
• Conduct reasonable employee training to prevent potential mistakes.

For those businesses working to comply with recent Massachusetts identity theft regulations (201 C.M.R. § 17.03) or similar state regulations, the FTC's guidance may seem eerily familiar because it parallels many of state requirements. For example, in Massachusetts, 201 C.M.R. § 17.03(g) requires businesses to limit the amount of “personal information” (which includes SSNs) collected, limit access to that information to those employees that require access, and limit “the time such information is retained to that reasonably necessary to accomplish such purpose.”  This is good news for businesses worried that they may face inconsistent federal and state requirement and bad news for those having difficulty meeting these state standards.

Links:   

• The FTC Report - Security in Numbers - SSNs and ID Theft is available here (.pdf) or from the FTC here (.pdf)
• The FTC’s Staff Summary of Comments and Information Received Regarding the Private Sector’s Use of Social Security Numbers is available here (.pdf) or from the FTC’s website here (.pdf)
• The FTC’s website on the use of SSNs containing transcripts and webcast of public workshops, public comments, and press releases.
• The President’s Identity Theft Task Force website