A recent "test-shopping" operation by the Federal Trade Commission (FTC or Commission) resulted in warning letters to ten data broker companies that appeared willing to sell consumer information without complying with the requirements of the Fair Credit Reporting Act (FCRA).

Under the FCRA, consumer reporting agencies (CRAs) that collect, distribute or sell consumer information must comply with certain requirements to ensure the fairness, accuracy and confidentiality of the information they provide to their customers. For example, CRAs must take reasonable steps to ensure that information in consumer reports is accurate and that the CRAs’ customers have a legitimate purpose for receiving the information.

In the FTC’s "test-shopping" operation, Commission staff posing as corporate representatives contacted forty-five companies to obtain consumer information relating to creditworthiness, insurance eligibility, or employment suitability. Ten of the companies that were contacted reportedly failed to comply with FCRA requirements, prompting the FTC to warn the companies that they "may be" selling consumer information, which "may violate the FCRA." The warning letters made clear that the FTC did not evaluate whether the companies were in fact subject to the requirements of the FCRA and the Commission did not determine whether the companies’ practices complied with the FCRA or not. Instead, the FTC explained that it was making the companies aware of the requirements of the FCRA so that they could ensure their practices were in compliance, while the Commission reserved the right to take action against the companies in the future.

The FTC’s recent "test-shopping" exercise is a timely reminder that CRAs and other companies that work with consumer information should conduct regular reviews of their products and services along with company policies, employee training, and other procedures to ensure compliance with all applicable provisions of the FCRA. As the FTC admonished in its warning letters, a violation of the FCRA could result in legal action by the FTC, in which it would be entitled to seek injunctive relief and/or monetary penalties of up to $3,500 per violation.