Senator John D. Rockefeller IV (D-W.Va.) recently sent a letter to nine data brokers, asking them to provide detailed information about their privacy policies and practices for compiling, storing, and selling information about consumers. The nine firms – Acxiom, Experian, Equifax, Epsilon, Transunion, Reed Elsevier, Spokeo, Datalogix, and Rapleaf – are expected to respond to the series of questions laid out in the letter by November 2. The questions covered the type of consumer information each company collects and how it is obtained. Rockefeller also asked the entities to disclose the identities of the third parties that purchase and use the data brokers' lists. Purchasers of lists from data brokers can include major consumer brand companies who are interested in marketing to new potential customers. As chairman of the Senate Commerce, Science, and Transportation Committee, Rockefeller stated it was critical for his committee to better understand the industry's practices, particularly since consumers are largely unaware of how these companies use their sensitive information for financial gain. This inquiry follows the bipartisan probe launched by House lawmakers in July, and the FTC's statement in March encouraging Congress to enact legislation addressing "the invisibility of, and consumers' lack of control over, data brokers' collection and use of consumer information." Companies who purchase information from data brokers may find these inquiry letters of interest, and might want to take steps to make sure that should the probe turn to them, that they have a clear understanding of their privacy practices, and are comfortable that they have their privacy houses in order.

Tip: This inquiry is yet another example of increased scrutiny over company policies and practices for the collection, storage, and sharing of consumer information. While it is hard to tell if legislation will come out of this inquiry, companies should keep in mind the FTC's statements that it will continue to enforce privacy in the absence of legislation…as well as the continued class action filings in this area. Companies should take the time to examine whether they have their privacy "houses" in order, following steps like those we have outlined in the past, especially if they purchase lists from data brokers.