INFORMATION INDUSTRY VOLUNTARILY AGREES TO
STRONGER PROTECTIONS FOR CONSUMERS, FTC SAYS

Social Security Numbers, Birthdates, and Mother's Maiden Names
No Longer Available to General Public

In response to growing public and Congressional concern that technology is allowing increased access to sensitive personal information, the Federal Trade Commission today released a report that discusses new industry principles to limit the availability of certain types of personal information. The industry also will allow consumers access to their own non-public information and to opt-out of the non-public information distributed to the general public. In addition, industry has agreed to undergo annual compliance reviews, the results of which will be made public.

The Commission's study analyzed computerized databases -- services that disseminate personal identifiable information, often referred to as "individual reference services" or "look-up services" -- which are used to locate, identify, or verify the identity of individuals. The report summarizes how these services work, examines their risks and benefits, and details the self-regulatory principles that will, among other things, prohibit distribution to the general public of Social Security numbers; mother's maiden names; and dates of birth, if obtained from non-public sources.

"Consumers have been justifiably concerned about the extent to which their personal information has become publicly available," FTC Chairman Robert Pitofsky said in releasing the report to Congress. "The information industry's innovative and far-reaching, self-regulatory program will go a long way to address these concerns and lessen the risk that these services will be misused. The industry should be commended for its responsiveness and commitment.

"Certain important issues regarding consumers' access to public information obtained or compiled by the look-up services remain, however. The Commission is concerned that individuals have no way of discovering or correcting errors that may have occurred in the transcription, transmission, or compilation of this information. We trust the industry will bring the same spirit of cooperation to resolving these remaining issues. We also encourage industries doing business on-line to develop similar self-regulatory efforts to protect consumers' privacy," Pitofsky added.

According to the report, a great deal of information about consumers is available through these individual reference services. This often sensitive personal identifying information comes from a variety of public and non-public sources. Most look-up services operate through their own proprietary networks. Advances in computer technology have allowed consumers' personal identifying information to be aggregated and accessed more easily and cheaply than ever before, often without their knowledge or consent. Surveys show that consumers are increasingly concerned about the use of their personal information. Today, through the use of computers and the Internet, vast amounts of personal information about consumers can be accessed as a result of a simple search. "The present challenge is to protect consumers from threats to their psychological, financial and physical well-being while preserving the free flow of truthful information and other important benefits of individual reference services," the Report says.

The FTC report, titled "Individual Reference Services: A Report To Congress," was requested by Senators John McCain (R-AZ), Ernest Hollings (D-SC), and Richard Bryan (D-NV) and former Senator Larry Pressler (R-SD).

"I appreciate the work of the FTC and the industry on this important issue. I am particularly pleased with the prospect for a framework of industry self-regulation. I look forward to working with all parties on these important issues," said Senator McCain, Chairman of the Senate Commerce Committee.

"I am encouraged by the progress made by the Federal Trade Commission and the individual reference services industry to address consumer privacy issues involved in 'look-up services,'" said Senator Bryan. "While the efforts at self-regulation by the industry could serve as a model to duplicate elsewhere, we must not give up on our efforts to ensure the standards are adequate to protect against identity theft and other threats to consumer privacy. It is clear that continued oversight is warranted and I will be requesting that the Commerce Committee hold hearings on this issue in the coming year."

Congressman Billy Tauzin (R-LA), Chairman of the House Telecommunications, Trade and Consumer Protection Subcommittee, said, "I am very pleased that industry has stepped up to the plate with serious self-regulation that protects individual privacy while preserving the many beneficial uses of the databases. This is an important first step toward ensuring the privacy of users, while keeping government intrusion at a minimum."

The Report gives an overview of the types and sources of personal identifying information available. It explains that information about a person comes from public sources, such as real property records; marriage and divorce records; birth certificates; driving records; court records; postal records; and government applications, as well as from non-public sources, including survey data and credit and marketing information. Other sources of information about a person also can now be found using the Internet to access published materials, phone numbers and addresses, and information from Web sites where people publish their own identifying information.

"Convenient access to so much information about individuals through individual reference services confers myriad benefits on users of these services and on society. The look-up services enable law enforcement agencies to carry out their missions, public interest groups to find missing children, banks and corporations to prevent fraud, journalists to report the news, lawyers to locate witnesses, and consumers to find lost relatives," the Report states.

At the same time, the Report acknowledges that the increasing availability of this information poses various risks, including a potential threat to individual privacy and harm from unlawful uses of personal identifying information, such as identity theft and credit card fraud.

In addition, "[g]iven the ease with which information can be gathered, aggregated, and shared, errors could be widely replicated and the harm long-lasting."

Last June during the Commission's Workshop on Consumer Privacy, the information industry submitted an initial set of draft self-regulatory principles to protect consumers. The signatories to the principles include companies that directly offer individual reference services, information vendors, and the three national credit reporting bureaus. As a result of the agreement, the primary sources of non-public and public information have agreed not to sell personal identifying information to those who will not abide by the principles.

According to the Commission's Report, the principles address most concerns raised by the dissemination of non-public personal identifying information. They "impose restrictions on access to . . . 'non-public information' . . . [that will] vary according to the category of customer. . . . In general, customers that have less restricted access to non-public information are subject to greater controls. Conversely, the general public has more restricted access to non-public information . . . "

According to the voluntary industry principles agreed to by the signatories:

• Individual reference services will not distribute to the general public certain non-public information, such as Social Security number, mother's maiden name, birth date, credit history, financial history, medical records, or similar information, or any information about children.

• They also will not make available unlisted telephone numbers obtained from sources other than public records, or unlisted addresses obtained from the telephone company.

• Look-up services may not allow the general public to run searches using a Social Security number as a search term.

• Consumers will be allowed to obtain access to the non-public information maintained about them and to opt-out of the non-public information distributed to the general public.

• Look-up services may not make available information gathered from marketing transactions.

According to the Report, the look-up services must maintain facilities and systems that will prohibit unauthorized access to non-public information. They also must undergo an annual compliance review by a third-party, the results of which will be made public. "This compliance assurance mechanism will curb misuse of non-public, personal identifying information and should significantly affect the practices of the entire individual reference service industry," Pitofsky said.

The Report points out, however, that "[d]espite the laudable efforts . . . important issues related to individual reference services remain." The principles do not provide any limitations "on the availability or uses of public records and publicly available information. Accordingly, they do not limit the potential harm that could stem from access to and exploitation of sensitive information in public records and publicly available information." In addition, they "fail to provide individuals with a means of accessing public records and other publicly available information maintained about them by individual reference services."

The Report concludes with several recommendations that address other concerns left unresolved by the industry proposal. One of the most important of those recommendations "[e]ncourages public agencies to consider the potential consequences associated with the increasing accessibility of public records when formulating or reviewing their public records collection and dissemination practices."

The Commission vote to authorize release of the Report was 4-0.

 

Copies of the Report, "Individual Reference Services: A Report To Congress," the agenda and transcripts from the FTC's June 1997 Privacy Week, a December 1996 FTC report on consumer privacy, and FTC press releases are available on the Internet at the FTC's World Wide Web site at: http://www.ftc.gov (no period). FTC documents also are available from the FTC's Consumer Response Center, Room 130, 6th Street and Pennsylvania Avenue, N.W., Washington, D.C. 20580; 202-326-3128; TTY for the hearing impaired 1-866-653-4261. To find out the latest news as it is announced, call the FTC's NewsPhone recording at 202-326-3710.

Media Contact:

Victoria Streitfeld
Office of Public Affairs
202-326-2718

Staff Contact:

David Medine
Bureau of Consumer Protection
202-326-3224

Lisa Rosenthal
Bureau of Consumer Protection 2
02-326-3224

(FTC File No. P974 806)