Before the

Federal Trade Commission
Washington, D.C. 20580

COMMENTS OF LEXIS-NEXIS

PUBLIC WORKSHOP ON CONSUMER INFORMATION PRIVACY:
DATA BASE STUDY--COMMENT, P974806
&
CONSUMER PRIVACY 1997--COMMENT, P954807

Date: April 15, 1997

Introduction

LEXIS-NEXIS is pleased to respond to the Commission's Notice Requesting Public Comment and Announcing Public Workshop, 62 Fed. Reg. 10271 (released March 6, 1997). LEXIS-NEXIS is a world leader in providing enhanced information services, online services, and management tools. We are the leading data base company for professionals, with a wide variety of products and services that help legal, business and government professionals collect, manage and use information more productively.

Among LEXIS-NEXIS' many data bases are a wide variety of news article files, public record files, and two person locator files that contain identifying information about individuals. As discussed in our response to Question 1.9, these data bases are used for a wide range of productive and socially beneficial uses.

The Commission's questions fail to differentiate between these very different types of data bases. As a preliminary matter, we emphasize that there are fundamental legal distinctions between these data base libraries, even though some files in each of these libraries afford the ability to find identifying information about individuals. LEXIS-NEXIS news libraries contain press articles. The public records data bases contain reproductions of federal, state and local government records. Content-based restrictions on access to or use of this information are subject to First Amendment protection.

One of LEXIS-NEXIS' two person locator services, P-FIND, is based upon a combination of public records and telephone white pages information, which as such individuals have consented to place in the public domain. Finally, LEXIS-NEXIS' other person locator data base, P-TRAK, contains a truncated version of credit header information, which the Commission agreed to permit credit reporting agencies to sell pursuant to a 1993 amendment to the consent decree in FTC v. TRW, 784 F. Supp. 361 (N.D. Tex. 1991). With the exception of our news files, this is the only LEXIS-NEXIS data base containing individual identifying information that is not based in whole or in part on public records or press reports.

Furthermore, none of the data displayed in LEXIS-NEXIS data bases in the context of our services should be considered "sensitive" within the meaning of the introduction in the Commission's Notice regarding the Workshop. See 62 Fed. Reg. 10271, 10272. Most of the information originates from public records that may be freely obtained in government offices. Other information is substantially similar to information contained in current and former telephone white pages directories on file in many public libraries. The additional information in the P-TRAK data base, which comes from credit header information, is restricted so as not to display social security number or the individual's actual date of birth. Moreover, to the best of our knowledge the P-TRAK and P-FIND data bases do not contain information regarding persons identified as being under age 18.

WORKSHOP I

Information Collection and Use

1.2 What information is contained in the data bases? Please provide specific examples.

1.3 What is the source of the information in the data bases?

LEXIS-NEXIS has two person locator data bases, P-TRAK and P-FIND, as well as a variety of public records data bases and news article data bases, some of which contain identifying information that relates to individuals.

P-TRAK and P-FIND are enhanced electronic white page-type directories. P-TRAK files contain an individual's name and address, and may contain up to two prior addresses, year and month of birth, a local phone number (without area code), and other names used by the individual, such as a maiden name. In addition, for a substantial majority of records, searches may be conducted using a social security number, although social security numbers are never displayed. Even if a search is conducted using the individual's social security number, that number is not displayed. The source of the information in P-TRAK is credit header information.

P-FIND files contain an individual's name, address, telephone number, the year the individual was first listed in the telephone book at the present address, census data on the median home value of the census tract in which the individual lives, an evaluation of the probability that the individual is a homeowner, and the names of other adults believed to reside at the listed address. The month and year of birth of the individual and other adults living at the same address may also be included in the files. P-FIND files are provided to LEXIS-NEXIS by a third party, and are compiled from telephone white pages information, aggregate census tract data, and public record sources.

In addition, LEXIS-NEXIS' public records data bases, available separately on our system, include a variety of information made available to the public by federal, state and local governments, such as professional license records, civil and criminal court records, real property records, bankruptcy and lien records, records of incorporation, vehicle and boat registration records, and Federal Election Commission filings. Most public record information is obtained by LEXIS-NEXIS directly from the government custodian of the records.

LEXIS-NEXIS news data bases also contain articles with a variety of identifying information about individuals.

1.7 Who has access to the information in the data bases?

Only LEXIS-NEXIS subscribers with a valid contract with LEXIS-NEXIS, proprietary software from our company, and a confidential subscriber identification number have access to the information in P-TRAK. Subscribers under deeply discounted pricing plans, such as law schools, do not receive access to the information in P-TRAK, P-FIND and the ASSETS real estate public records data base.

1.9 What are the uses of the information in the data bases? Are there beneficial uses of the information in these data bases? If so, please describe. Are there risks associated with the compilation, sale, and use of this information? If so, please describe.

A. Benefits

LEXIS-NEXIS' person locator and public records data bases serve a variety of important, socially productive functions, a few of which are discussed as part of this answer. We emphasize that the public records data bases in many cases advance the important First Amendment function of permitting citizens to obtain information about the operations of their government. In addition, the public records data bases typically advance the purpose for which the government in question has placed them in the public domain. For example, online availability of land records and lien records makes it easier and faster to verify title as part of the purchase of a new home.

A few beneficial uses are discussed below in greater detail. LEXIS-NEXIS would be happy to assist the Commission in locating users of our services who would testify as witnesses at the Workshop addressing the beneficial uses of the person locator and public record data bases.

1. Child Support Enforcement

LEXIS-NEXIS' person locator and public records data bases are very helpful in tracking down the hardest-to-find "deadbeat parents" who have refused to pay child support. In this way, these services can advance personal responsibility, give much-needed income to divorced parents and their children, help to free families from welfare dependency, and provide a source of additional revenue and a reduction in expenses for state welfare programs.

For example, when a non-custodial parent leaves a state's jurisdiction, the custodial parent usually bears sole responsibility for collecting court-ordered child support. By using P-TRAK to search on the ex-spouse's social security number, a lawyer for the custodial parent or a government employee charged with child support enforcement can locate the non-custodial parent quickly, even though he or she may be actively disguising his or her identity.

For governments, locator services are likely to play an important role in making welfare reform a success at a time of tightening state budgets. Congress recognized the importance of locator data bases in enacting the 1996 Welfare Reform Act, which expands use of the Federal Parent Locator Service to enforce child support orders and directs the states to establish state data bases. Commercial locator services can play an important role in supplementing and filling gaps in this important federal data base, as well as in furnishing information for the state locator data bases.

2. Uniting Separated Families

P-TRAK, P-FIND and similar commercial locator data bases permit law enforcement personnel, lawyers for parents or children, and advocates for children to reunite family members. For example, customers have informed us of cases where they have used P-TRAK to reunite brothers who were separated for 17 years, and public records data bases to help a state agency locate a 10-year-old child's aunt who at his request adopted him, avoiding the need to place him in foster care.

3. Locating Heirs To Estates

Social security numbers are often included in wills to offer assistance in locating beneficiaries. Commercial locator services offer a cost-effective means for the estate's attorney/executor to locate the heirs even if decades have transpired since the will's execution, heirs and witnesses have relocated or married and changed their names, etc. In one case,

P-TRAK was used to help locate a destitute Montana farmer who received a $4 million inheritance.

4. Pension Fund Beneficiaries

Pensions provide important supplemental income that permits millions of elderly Americans to continue to live a comfortable existence after retirement. Yet every year, thousands of pension fund beneficiaries are unable to receive pensions owed to them because the trustee or administrator of the fund is unable to locate them. Commercial locator data bases, such as P-TRAK and P-FIND, are used to help solve this problem by providing an effective and simple way for the trustee or administrator -- who has the Social Security Number of the former employee on tax records, even though decades may have passed since the beneficiary left the company -- to make sure that beneficiaries receive pension money owed to them. Indeed, federal law requires the administrators of certain plans to use commercial locator services to search for missing plan participants. See 29 C.F.R. § 4050.4(B)(3) (July 1, 1996).

5. Locating Trial Witnesses, and Aiding Investigations and Criminal Prosecutions

Another significant use of P-TRAK and P-FIND is to help locate uninsured motorists, eyewitnesses to accidents, and other witnesses for civil litigation. For example, personal injury cases often take years to go to trial because they are usually filed one or more years after the accident, delayed in the judicial process, and compete for time on crowded judicial dockets. This means that in many cases attorneys have an "old" address for a witness. By using P-TRAK to search by name and prior address, these witnesses can be found years after the accident.

P-TRAK and P-FIND provide important tools to law enforcement officials for criminal investigations and prosecutions because they are ideally suited for tracking witnesses and investigative targets efficiently. Up-to-date information from these services has permitted law enforcement officials to locate and arrest significant numbers of hard-to-find criminals who often move and assume different names in efforts to evade capture. The services have likewise assisted law enforcement in locating witnesses to crimes, in advancing criminal investigations and in trial preparation. In addition, LEXIS-NEXIS' public records products are used by law enforcement to track criminals' commercial activities, such as land purchases, incorporation of corporate "front companies," and to learn of criminals' assets in preparation for criminal prosecutions or civil forfeiture actions.

LEXIS-NEXIS' public record products have a variety of uses in civil litigation, including negotiating more equitable settlements (in light of prior verdicts in a jurisdiction), identifying real parties in interest in a dispute, ascertaining bias of witnesses who have a financial interest in a litigation, assessing business assets and liabilities, and assisting in service of process on corporations.

6. Tracing the Influence of Money in Politics

Public record products perform an important function in advancing the transparency of government operations. A leading example is LEXIS-NEXIS' data base of FEC filings, which affords the press and government watchdog groups, including Common Cause, as well as political parties themselves, easy access and flexible search capacity to review records of federal political campaign contributions. The data base has also been used in political corruption investigations.

Moreover, both the Democratic National Committee and Republic National Committee use LEXIS-NEXIS press articles and our public records data bases as a cost-effective way to run checks on political contributors. Indeed, the DNC recently resumed use of these data bases for this purpose.

B. Risks

While LEXIS-NEXIS knows of many beneficial uses of its data bases containing individual identifying information, it is not aware of any instance of improper use of its data bases containing personal identifying information that raises privacy concerns. For reasons explained in the answers to Questions 1.10, 1.11 and 1.12 below, LEXIS-NEXIS does not believe that there are any appreciable risks associated with use of these data bases in light of the information contained in the data bases and LEXIS-NEXIS' policies governing the data bases.

1.10 Do these data bases create an undue potential for theft of consumers' credit identities? How is such potential for theft created? Please provide specific examples. What is the extent to which these data bases (as opposed to other means) contribute to consumer identity theft? Is this likely to change in the future? If so, please describe.

While LEXIS-NEXIS cannot speak to all data bases containing personal identifying information, we believe that our own data bases do not pose an appreciable risk of identity fraud. LEXIS-NEXIS is aware of no instance in which any of these data bases has been used to commit identity theft. Conversely, we are aware of a number of instances in which our data bases have been used in uncovering identity fraud and tracking white collar criminals.

Indeed, to date no evidence has been presented of actual use of an online data base in perpetration of identity fraud. Significantly, the Federal Reserve Board ("the Fed") recently examined whether data bases containing sensitive personal identifying information pose a risk of fraud to federally insured banking institutions. In the course of this study, the Fed examined the relationship between data bases containing sensitive information and the problem of identity fraud. It actively solicited evidence of identity fraud stemming from use of these data bases, and received comments from over one hundred commenters, among them consumer advocates, state consumer protection agencies, credit card companies, and banks and credit unions. Not one commenter offered any specific evidence of use of such a data base for identity fraud.

Accordingly, the Fed, while expressing concern about identity fraud, found that "There is little 'hard' evidence on how fraud due to the usage of sensitive information occurs, the frequency with which it occurs, or the amount of associated losses." Board of Governors of the Federal Reserve System, Report to the Congress Concerning the Availability of Consumer Identifying Information and Financial Fraud, at 21 (March, 1997).

In contrast, the Fed Report strongly suggested that illegal means of acquiring information to commit identity fraud are the real problem. The Report noted that "unlawful access to sensitive information may often be the precursor to this type of fraud." It also added that "The number of ways in which a person can illegally obtain information that will enable fraud to be committed is virtually limitless." Id. at 18 & n.14.

Based upon our knowledge of the subject to date, most credit fraud is perpetrated by obtaining unauthorized access to below-the-line credit report information, by stealing credit card numbers, or by intercepting a credit card application, then filling out the application in the name of the person to whom the application was addressed.⁽¹⁾

P-TRAK is of virtually no use for any of these approaches because it contains no financial information, does not reveal a social security number to someone who searches on an individual's name, address, etc., and does not reveal an individual's date of birth. LEXIS-NEXIS has decided not to display individuals' social security numbers ("SSNs"), while permitting searches by social security number by users who already know the SSN of the individual they are looking for.⁽²⁾

Moreover, P-TRAK does not contain individuals' actual birth dates -- only their month and year of birth. The policy of not displaying SSNs, the limited content in the data base, the product's per-search cost, and its limited availability make such abuse highly unlikely.

P-FIND simply furnishes telephone white pages information, plus some aggregate data on the individual's neighborhood and the likelihood that the individual is a homeowner, and possibly the individual's month and year of birth. This limited information can be obtained through other means -- for example, by examining a telephone directory and one or two public records on file with government agencies or posted on the Internet. Far more detailed, highly sensitive information can be obtained through either authorized or unauthorized access to the same individual's credit report.

Far from presenting a risk of crime, P-TRAK, P-FIND and LEXIS-NEXIS' public records data bases are used to prevent and to track crime by law enforcement agencies. In fact, P-TRAK has been used to prevent fraud -- both in finding white collar criminals and in revealing that someone else is using an individual's social security number or other identifying information. For example, by searching on their social security number using P-TRAK, identity fraud victims have discovered that another person has obtained credit at a different address using their name and social security number.

P-TRAK has been the subject of distorted rumors that emerged on the Internet in September 1996 alleging that it displays information -- including mother's maiden name, social security number, credit card and bank account numbers -- useful for perpetrating identity fraud. In reality, P-TRAK displays none of this information.

LEXIS-NEXIS would be happy to assist the Commission in locating a witness with law enforcement expertise who is familiar with problem of identity fraud and with the sorts of data bases that are the subject of this Notice and Workshop I.

1.11 How do the risks of the collection, compilation, sale, and use of this information compare with the benefits?

The concrete, demonstrable benefits of the sale and use of the information in LEXIS-NEXIS data bases discussed in response to Question 1.9 far outweigh the largely theoretical risks associated with the sale and use of this information discussed in response to Question 1.10.

Indeed, eliminating availability of information such as prior addresses or social security number search functions from these data bases would likely leave consumers more, rather than less exposed, to white collar criminal activity. It would deprive law enforcement of a significant tool to fight such fraud, and would make it more difficult to uncover such fraud and to prosecute civil enforcement actions against such criminals because of difficulty finding the defendants, their assets, and witnesses to their crimes.

1.12 Are there means that are currently available to address the risks, if any, posed by these data bases? If so, please describe.

On its own initiative -- months before P-TRAK became the subject of false Internet rumors -- LEXIS-NEXIS worked with its data supplier to adopt several measures which further reduce the remote risk that the product would be used for an improper purpose. As noted in response to Question 1.10, the product does not display individuals' dates of birth or social security numbers. In addition, upon written or electronic request of an individual, LEXIS-NEXIS will remove from P-TRAK any record of the individual that matches or corresponds to the request. Finally, LEXIS-NEXIS works with its data suppliers to remove the records of all individuals identifiable as minors from the P-TRAK and P-FIND data bases.⁽³⁾

1.17 How should the benefits of the collection, compilation, sale, and use of information from these data bases be balanced against privacy or other legal interests implicated by such practices? Are there other ways to obtain these benefits without implicating privacy or other legal interests? If so, please describe.

The benefits of sale and use of information from these data bases can be balanced against corresponding privacy interests through responsible industry action. LEXIS-NEXIS actively embraces policies that it believes strike the proper balance between these interests:

Delivering the vast majority of its services via a proprietary online data base with safeguards to protect against unauthorized access

No display of social security numbers or dates of birth in its P-TRAK data base

No display of information about persons identified as minors in locator service documents

No display of personal medical information⁽⁴⁾ or "below-the-line" credit report information

In response to an individual's request, LEXIS-NEXIS will remove from the P-TRAK data base any record that matches or corresponds to the individual's request.

Strict security measures to maintain the integrity of the data bases

A good example of such balance is LEXIS-NEXIS' policy of offering users who already know a social security number the ability to search by that number, but never displaying a social security number on the P-TRAK data base. This search capability is of enormous importance to the effectiveness of P-TRAK, as well as to the social benefits that flow from use of the product. Social security number searches play an invaluable role in helping to locate individuals such as child support obligors, heirs to wills, pension fund beneficiaries, and missing children -- whose social security numbers are often known by the person seeking them. By affording SSN search capability, but not SSN display, P-TRAK offers substantial protection of individual privacy interests without sacrificing the important benefits that flow from the product.

LEXIS-NEXIS has taken a leadership role in the data base industry in developing such a balance. Our industry is working presently to achieve broader industry consensus on responsible industry action.

Self-Regulation

1.27 Have data base operators undertaken self-regulatory efforts to address concerns raised by the collection, compilation, sale, and use of sensitive consumer identifying information?

LEXIS-NEXIS has adopted internal privacy policies discussed in response to Question 1.17, and is in the final stages of codifying these policies in information guidelines.

Furthermore, LEXIS-NEXIS is working with other data base companies and with industry associations to explore ideas for self-regulation. LEXIS-NEXIS hopes that these discussions will prove fruitful.

WORKSHOP III

3.12 What steps have children's commercial Web site operators taken since June 1996 to address children's online privacy issues? To what extent have they adopted the principles outlined in the following documents submitted at the June 1996 Workshop: (1) the Joint Statement on Children's Marketing Issues presented by the Direct Marketing Association and Interactive Services Association; (2) Self-Regulation Proposal for the Children's Internet Industry presented by Ingenius, Yahoo and Internet Profiles Corporation; and (3) Proposed Guidelines presented by the Center for Media Education and Consumer Federation of America?

LEXIS-NEXIS has voluntarily worked with its data supplier to remove records of all persons identified as minors from the P-TRAK data base.

1. See, e.g., In the Matter of Consumer Identity Fraud Meeting at 12, 20-21, 21-22, 47-48 (August 20, 1996) (testimony before the Commission discussing the ease with which identity fraud may be committed through obtaining an individual's credit report through an auto dealership, stealing a credit card and filing a fraudulent credit card change of address request, and through intercepting pre-approved credit card applications).

2. P-TRAK displayed SSNs for the first ten days the product was available, from June 1 until June 10, 1996. Thereafter, P-TRAK has not displayed SSNs.

3. A small number of older minors may have credit accounts, and would therefore otherwise have identifying information entered in the P-TRAK data base but for these measures.

4. Personal medical information is on occasion published in press reports and judicial decisions. However, LEXIS-NEXIS does not distribute any confidential medical information.