If your company is in the business of pretzels or pitchforks, what you’re selling and who you’re selling to may not be a big deal. But if your stock-in-trade is personal information – sensitive stuff like people’s Social Security and bank account numbers – what’s reasonable under the circumstances may be different. That’s the message companies can take from the FTC’s settlement of a pending complaint against data broker LeapLab.
Cash-strapped consumers are likely to look online for a way out of their financial fix, including visiting sites that claim to offer help in getting payday loans. In the course of the application process, consumers are asked to turn over sensitive personal information – lots of it. According to the FTC, the defendants went to the companies running those sites and acquired hundreds of thousands of applications that contained the name, address, phone number, employer, Social Security number, bank account number, and routing number of people looking for loans.
Was LeapLab a lender? No. The FTC says data broker LeapLab sold about 5% of the applications it acquired to online lenders, who paid the company between $10 and $150 per lead.
So what did LeapLab do with the remaining 95%? They sold them for $.50 a shot to third parties who also weren’t lenders. According to the complaint, those buyers had no legitimate need for the financial information. In fact, at least one of LeapLab’s customers, Ideal Financial Solutions, used the information to help themselves to millions of dollars from consumers’ bank accounts without the account holder’s authorization – conduct that resulted in an FTC lawsuit and substantial injury to people who were already in financial distress.
The settlement prohibits LeapLab, corporate officer John Ayers, and Leads Company from selling or transferring consumers’ sensitive personal information to third parties, misleading consumers about the likelihood of getting a loan or line of credit, or misrepresenting the terms of any loan offer. In addition, they have to destroy all consumer data in their possession.
Defendants agreed to judgments of $5.7 million, which have been suspended based on their financial condition. The court entered an unsuspended $4.1 million default judgment against SiteSearch, the remaining defendant in the case.
Recent FTC workshops, reports, and law enforcement actions have explored the work of data brokers and lead generators. These settlements offer insights into the consumer protection concerns when those two industries intersect. The cases also illustrate the risks of selling consumers’ sensitive personal information to parties without a legitimate need.