ChoicePoint to pay $15 million for data breach

ChoicePoint Inc., the data broker that set off a national debate after disclosing a data breach early in 2005, will pay US$15 million in fines and other penalties for lax security standards, the U.S. Federal Trade Commission (FTC) announced Thursday.

ChoicePoint's $10 million fine is the largest civil fine in the FTC's history, the FTC said. Under a settlement with the FTC, the Georgia company will also set up a $5 million fund to aid victims of identity theft that resulted from the data breach, and the company has agreed to implement new security measures and have an independent auditor review its security every other year until 2026, said FTC Chairwoman Deborah Platt Majoras.

"This is an important victory for consumers and an equally important opportunity for ChoicePoint to get data security right," Majoras said. "Companies like ChoicePoint are realizing now that it is a bad business practice to ignore the security of customer data."

Last February, ChoicePoint announced that scammers had set up bogus businesses and contracted with the company to gain access to the personal information of 145,000 U.S. residents. The company, which found out about the breach in September 2004, later said the number of affected people was 163,000.

ChoicePoint was notified by law enforcement officials of potentially fraudulent activity as early as 2001, the FTC said. "This breach occurred because ChoicePoint failed to implement reasonable and appropriate procedures for approving new customers and for monitoring existing ones," Majoras said. "ChoicePoint failed to monitor or otherwise identify fraudulent customer activity even after repeated subpoenas from law enforcement."

ChoicePoint holds billions of personal records, including credit histories, Social Security numbers and employment histories. The company provides background checks for more than 50,000 businesses and government agencies, and in most cases, the company does not notify the people whose records it sells.

About 800 people have so far been identified as victims of ID theft-related crimes in connection with the ChoicePoint breaches, Majoras said.

ChoicePoint, in a press release, said it has taken several steps to improve security since the data breach was announced, including the hiring of an independent credentialing, compliance and privacy officer. The company has also stopped selling products containing sensitive personal information in some markets, it said.

“The events of early 2005 provided critical lessons from which ChoicePoint and, indeed the entire industry, has learned a great deal,” Derek V. Smith, ChoicePoint chairman and chief executive officer, said in a statement. “The men and women of this company take nothing more seriously than their responsibility to safeguard consumer information and, as a direct result of those lessons learned, we have, for the past several months, been in the process of implementing nearly all of the changes reflected in today’s settlement.

"I firmly believe that the changes we’ve implemented in the past year were not only the right thing for this company to do, but are equally important for the entire industry to consider,” Smith added.