Testimony of Chris Jay Hoofnagle
Director, Electronic Privacy Information Center West Coast Office
SB 550
Before the
Senate Judiciary Committee
April 26, 2005
Chairman Dunn, Vice-Chairman Morrow and Members of the Committee, thank you for extending the opportunity to testify on SB 550. My name is Chris Hoofnagle and I am director of the Electronic Privacy Information Center's (EPIC) West Coast office. Founded in 1994, EPIC has closely tracked the development of entities we call "commercial data brokers," companies like Choicepoint, Lexis, and Acxiom that buy and sell personal information for a variety of purposes.
We appear today to express strong support for SB 550. Commercial data brokers sell detailed dossiers with your personal information to anyone they deem as a "qualified subscriber." Currently, one has no statutory right of access to or correction of these reports. Furthermore, there is no ability to "opt-out" or otherwise limit the collection, processing, and transfer of your personal information.
SB 550 would give individuals substantive rights in the reports sold by commercial data brokers. The bill would:
-
Give individuals access, so that one can see what is in the dossier.
-
Give individuals an audit trail, so that one can see when and why their dossier has been sold.
-
Give individuals an opt-out, so that one can limit the transfer of personal information.
-
Give individuals a right of correction, so that less inaccurate personal information will be traded.
-
Give individuals a credit freeze when there is a breach, so that individuals can protect themselves from identity theft.
It Is Critical to Understand that Choicepoint Sells Sensitive Personal Information Outside the Accountability and Fairness Provisions of the Fair Credit Reporting Act
Commercial data brokers often perform several functions, some of which are already covered by federal privacy law (such as credit, insurance, tenant, and employment screening, which is governed by the Fair Credit Reporting Act). SB 550 concerns itself with the non-FCRA sale of personal information by commercial data brokers. For example, Choicepoint sells "AutoTrackXP," a personal information product, outside the FCRA. AutoTrackXP is a database of 17 billion records that includes Social Security Number, addresses, property and vehicle information, and other information.[1]
On its website, ChoicePoint describes AutoTrackXP as:
AutoTrackXP and ChoicePoint Online provide Internet access to more than 17 billion current and historical records on individuals and businesses, and allow users to browse through those records instantly. With as little information as a name or Social Security number, both products cross-reference public and proprietary records including identity verification information, relatives and associates, corporate information, real property records and deed transfers. In addition, access is available to a staff of field researches who perform county, state and federal courthouse searches.[2]
The advertised data elements in AutoTrackXP include:
Discovery PLUS!ú - through ChoicePoint Online* Compiles a comprehensive report on an individual including current and previous addresses, relatives, assets, corporate involvement and derogatory information.* Returns list where no matches were found.* Also available Discovery PLUS! with Vehicle Identification Number.Info:PROBEú - through ChoicePoint Online* Checks millions of records simultaneously and provides a "shopping list" of databases, which contains records that match the search criteria. A client can then choose which databases to view.[·]National Comprehensive Report ö through AutoTrackXP* Searches national and state databases for a summary of assets, driver licenses, professional licenses, real property, vehicles, and more.* Each report offers the ability to add associates to the report, which include relatives, others linked to the same addresses as the subject and neighbors.[3]
A sample AutoTrackXP report on the ChoicePoint web site shows that it contains Social Security Numbers; driver license numbers; address history; phone numbers; property ownership and transfer records; vehicle, boat, and plane registrations; UCC filings; financial information such as bankruptcies, liens, and judgments; professional licenses; business affiliations; "other people who have used the same address of the subject," "possible licensed drivers at the subject's address," and information about the data subject's relatives and neighbors.[4]
SB 550 Will Make Sale of Personal Information More Accountable
The Fair Credit Reporting Act creates several avenues for law enforcement and businesses to purchase personal information. Under the FCRA, individuals' personal information can be obtained with consent of the individual, a court order, in connection with credit and insurance transactions, and for child support enforcement.
Commercial data brokers step in to sell personal information to businesses and law enforcement when a permissible purpose is not present. In short, commercial data brokers have built their reports to narrowly escape the privacy protections of the FCRA, and enable the sale of information in the absence of a Congressionally-approved permissible purpose. SB 550 will patch this loophole in federal law, and make the sale of personal information more accountable.
[1] ChoicePoint, AutoTrackXP and ChoicePoint Online, http://www.choicepoint.com/industry/retail/public_cbi_1.html.
[2] ChoicePoint, AutoTrackXP and ChoicePoint Online, http://www.choicepoint.com/industry/retail/public_cbi_1.html.
[3] Id.
[4] ChoicePoint, AutoTrackXP Report, http://www.choicepoint.com/sample_rpts/AutoTrackXP.pdf.
Last Updated:
April 26, 2005
Page URL: http://www.epic.org/privacy/choicepoint/casjud4.26.05.html