To: mishedlo who wrote (45282 ) 1/26/2006 2:06:59 PM From: shades Respond to of 116555 =DJ UPDATE: FTC Fines ChoicePoint $15 Mln Over Data Breaches (Updates with FTC quote in fourth paragraph, background starting in fifth paragraph and company comment in seventh and eighth paragraphs.) By Siobhan Hughes Of DOW JONES NEWSWIRES WASHINGTON (Dow Jones)--The Federal Trade Commission Thursday fined ChoicePoint Inc.(CPS) $15 million to settle allegations that it had failed to protect the security of thousands of consumer records. ChoicePoint will pay $10 million in civil penalties and $5 million in reparations under the settlement. The $10 million civil penalty is the largest in FTC history and, it said, is the first civil penalty to be imposed over data breaches under a federal law known as the Fair Credit Reporting Act. ChoicePoint, a data-collection company based outside of Atlanta, was accused of turning over Social Security numbers, credit histories, and other information to subscribers whose applications raised "obvious red flags." Although it received government subpoenas alerting it to fraudulent activity as long ago as 2001, ChoicePoint failed to tighten its application-approval procedures, the FTC said. "The message to ChoicePoint and others should be clear: Consumers' private data must be protected from thieves," said FTC Chairman Deborah Platt Majoras. "Data security is critical to consumers, and protecting it is a priority for the FTC, as it should be to every business in America." ChoicePoint also agreed to implement new procedures to ensure it provides reports only to legitimate businesses for lawful purposes, and to obtain an audit every other year for the next 20 years to ensure that its security program meets the standards of the FTC order. Last year, shoe retailer DSW Inc. (DSW) and discounter BJ's Wholesale Club Inc. (BJ) also agreed to outside security audits over their own data breaches, although neither company was fined. ChoicePoint, which was once a part of Equifax Inc. (EFX), became emblematic of data-security breaches in February 2005 when it notified consumers that their personal financial records may have fallen into the wrong hands. It wasn't alone: Citigroup Inc. (C), Bank of America Corp. (BAC), Wachovia Corp. (WB), Time Warner Inc. (TWX), Ameritrade Holding Corp. (AMTD) and Reed Elsevier PLC's (RUK) Lexis-Nexis unit all notified customers last year of the potential misuse or loss of personal data. Carol DiBattiste, the new chief compliance officer at ChoicePoint, said ChoicePoint would spend "millions" to combat the fraudsters she said were to blame, including by verifying the identity of subscribers through multiple methods, such as visiting their offices. "We are very pleased to be able to fully resolve this matter and put it behind us and move forward to protect consumers' information," DiBattiste told reporters after the FTC announced the settlement. The spate of potential security breaches is prompting some in Congress to push for new tools to guard against identity theft. "Congress should quickly pass meaningful ID theft prevention legislation, which I introduced last year, so that all companies abide by these privacy protections, not just companies that are caught red handed," said Sen. Charles Schumer, D-NY, in a statement. "We shouldn't have to wait for the next big theft to pass legislation to protect Americans." The Securities and Exchange Commission has launched a separate investigation into stock sales by ChoicePoint's top two executives before the February 2005 disclosure that personal data had been stolen. The FTC declined to provide information about that SEC probe, saying only that the SEC had provided assistance in the FTC case.