Judge Approves FTC Restrictions on the Use of Consumer Data

WASHINGTON – A federal judge has ruled that the Federal Trade Commission may lawfully require credit reporting agencies not to use certain types of personal consumer data, unless the agencies observe rules established under a 1999 financial privacy law.

Trans Union and the Individual Reference Services Group, whose members include consumer credit information bureau Equifax and database service Lexis-Nexis, had filed suit against the FTC and several other government agencies, arguing that new restrictions on the use of "credit header" information violated credit reporting agencies' First Amendment free-speech rights.

However, U.S. District Judge Ellen Segal Huvelle ruled on April 30 that the government's privacy regulations "are neither unlawful nor unconstitutional" and are "a permissible construction" of the Gramm Leach Bliley Act of 1999. Huvelle's decision, filed April 30 but not disseminated until Monday, is a blow to credit reporting agencies, which do brisk business selling names, addresses and Social Security numbers, along with other data, to marketers and other entities.

The act requires the FTC, along with other government bodies such as the Federal Reserve and the Federal Deposit Insurance Corporation, to establish and enforce rules to protect the privacy of personal data used by financial institutions. The law covers firms ranging from banks and insurance companies to mortgage lenders and retailers who offer their own credit accounts. As of July 1, it requires financial institutions to provide customers with annual privacy notices and the chance to prevent the sharing of their data with third parties in many circumstances.

Financial institutions have spent months studying their internal data handling and preparing mass mailings to their customers to comply with the law. Consumer advocates say the law has too many loopholes to be effective.

The FTC's rule applies the law to credit header information, such as names, addresses and Social Security numbers that credit reporting agencies obtain from banks and other sources. The agencies resell credit header information, sometimes combined with other data, to marketing firms and individual reference services, such as those offered by Lexis-Nexis. The FTC rule generally forbids such reuses of credit header information obtained from financial institutions, unless the institution tells its customers that it shares their data with credit reporting agencies and gives them a chance to forbid it.

"Obviously, we are very pleased with Judge Huvelle's opinion," said FTC attorney John Daly. "Judge Huvelle recognized that Congress left considerable discretion to the agencies, and that the agencies exercised that discretion in a reasonable manner, consistent with both the statute and the First Amendment."

Ron Plesser, an attorney representing the Individual Reference Services Group, said his client was "disappointed" with Huvelle's ruling and would decide soon whether to appeal.