From the FTC:
Spokeo, Inc., a data broker that compiles and sells detailed information profiles on millions of consumers, will pay $800,000 to settle Federal Trade Commission charges that it marketed the profiles to companies in the human resources, background screening, and recruiting industries without taking steps to protect consumers required under the Fair Credit Reporting Act. This is the first Commission case to address the sale of Internet and social media data in the employment screening context.
The FTC alleged that Spokeo operated as a consumer reporting agency and violated the FCRA by failing to make sure that the information it sold would be used only for legally permissible purposes; failing to ensure the information was accurate; and failing to tell users of its consumer reports about their obligation under the FCRA, including the requirement to notify consumers if the user took an adverse action against the consumer based on information contained in the consumer report.
The FTC also alleged that Spokeo deceptively posted endorsements of their service on news and technology websites and blogs, portraying the endorsements as independent when in reality they were created by Spokeo’s own employees.
In addition to imposing the $800,000 civil penalty, the FTC’s settlement order bars Spokeo from future violations of the FCRA, and bars the company from making misrepresentations about its endorsements or failing to disclose a material connection with endorsers.
According to the FTC, Spokeo collects personal information about consumers from hundreds of online and offline data sources, including social networks. It merges the data to create detailed personal profiles of consumers. The profiles contain such information as name, address, age range, and email address. They also might include hobbies, ethnicity, religion, participation on social networking sites, and photos.
The FTC alleges that from 2008 until 2010, Spokeo marketed the profiles on a subscription basis to human resources professionals, job recruiters, and others as an employment screening tool. The company encouraged recruiters to “Explore Beyond the Resume.” It ran online advertisements with taglines to attract employers, and created a special portion of the Spokeo website for recruiters. It created and posted endorsements of its services, representing those endorsements as those of consumers or other businesses.
The case against Spokeo is part of the FTC’s ongoing enforcement of the FCRA, a law passed by Congress to promote the accuracy, fairness, and privacy of information in the files of consumer reporting agencies, and to regulate the use and dissemination of consumer reports. The FTC alleges that Spokeo failed to adhere to three key requirements of the FCRA: to maintain reasonable procedures to verify who its users are and that the consumer report information would be used for a permissible purpose; to ensure accuracy of consumer reports; and to provide a user notice to any person that purchased its consumer reports. It also charges that Spokeo’s misleading “endorsements” were a violation of the FTC Act.
The Commission vote to authorize the staff to refer the complaint to the Department of Justice and to approve the proposed order was 4-0-1, with Commissioner Maureen K. Ohlhausen not participating. The DOJ filed the complaint and proposed order on behalf of the Commission in the U.S. District Court for the Central District of California. The proposed order is subject to court approval.
Note that this may not be the end of Spokeo’s problems, as the plaintiff in a lawsuit in the Ninth Circuit has appealed the court’s dismissal of his case.