An on-line data broker named Spokeo recently agreed to pay almost one million dollars to the Federal Trade Commission to settle claims that it violated a federal law which regulates consumer reporting agencies. As part of the deal, Spokeo also had to promise to comply with the consumer protection law from here on in by submitting compliance reports to the FTC for the next twenty years. This is ostensibly the first case involving the sale of internet data for use in employment screening.
According to the FTC, Spokeo violated the Fair Credit Reporting Act by selling information about job applicants to prospective employees. Basically, Spokeo created the consumer information profiles by using data collected from the internet and social networking sites and sold the profiles to people who used them as an employment screening tool. Spokeo failed to ascertain the accuracy of the information before it sold the data to the prospective employees. Moreover, it failed to ensure that the prospective employers were going to use the reports for a purpose intended under the statute. It also allegedly violated the portion of the law requiring consumer reporting agencies to verify the identities of purchasers. Additionally, it failed to tell the prospective employees that reports about them were being purchased—something also required by that law.
The Fair Credit Reporting Act requires reporting agencies to take steps to make sure that their reports are accurate when they are used for employment, housing and credit purposes. The law also allows consumers to challenge the accuracy of the reports.
In its defense, Spokeo claimed that it was not a consumer reporting agency and that, therefore, the law did not apply to them. However, in light of the FTC charges, it did agree to make changes to its website and to change its internal business practices to make sure that they are in compliance with the Act’s requirements and to ensure that its reports are honest and accurate.
According to the FTC, Spokeo purposely marketed itself to human resources managers, background screeners and recruiters in connection with their search for information about prospective employees. Spokeo went as far as purchasing keywords such as “employment background checks, applicant screening and recruiting”. Furthermore, its advertisement material encouraged human resources managers to use Spokeo to obtain information about prospective employees’ online activities.
In a separate charge, the FTC also contended that Spokeo ordered its employees to post fake endorsements for Spokeo on news and tech sites. Spokeo used tactics to mislead readers into thinking that the comments had been submitted by independent, ordinary consumers or business users.
Two years before the FTC initiated its enforcement action against Spokeo, the digital rights group, Center for Democracy & Technology, filed a complaint against Spokeo claiming that it had been violating the federal fair credit law.
The FTC has shown a growing interest in making sure that online data brokers comply with the federal credit reporting law. Just a few months ago, it warned three such brokers that their mobile apps must comply with the reporting law.
In a bid to increase the transparency of the data brokers’ reporting practices, the FTC has also stepped up efforts to have Congress enact new laws that would require data brokers to give consumers access to information about them. The FTC also urged data brokers to create a centralized website that would explain to consumers how information about them is being collected and used. Although, without legislation requiring data brokers to establish such a site, the FTC’s exhortation does not seem to have any teeth.
Spokeo is not entirely out of the woods just yet. Although it settled the FTC charges against it, it is still open to a class action suit from consumers. Stay tuned…