List Report
TransUnion Loses Its Header
Judge upholds restrictions on basic data use
NOT EVEN THE NAME AND ADDRESS?
Credit bureau TransUnion received a sweeping legal defeat April 30 when a federal judge ruled that the firm cannot share basic credit header information with clients unless the consumer has had a chance to opt out.
That means names, addresses and phone numbers are just as protected as other types of data mentioned in the Gramm-Leach-Bliley financial modernization act.
But that’s the least of it. U.S. District Judge Ellen Segal Huvelle also ruled that use of this data is not protected by the First Amendment. And this is the biggest threat of all, legal strategists say.
“[Similar restrictions] can be spread to catalog lists if there’s legislation,” says Oscar Marquis, an attorney working in the privacy practice of Huntoon & Williams, Atlanta. “This decision makes it easier to pass [a bill] because you don’t have the First Amendment argument.”
This is the second legal defeat suffered by TransUnion in a month. On April 13, an appeals court ruled that target marketing lists based on credit reports are regulated by the Fair Credit Reporting Act.
In essence, Huvelle’s 62-page opinion upheld rules issued by the Federal Trade Commission and five other government agencies last year to implement the Gramm-Leach-Bliley act. That bill said, among other things, that financial information could not be shared with third parties unless the consumer had been given a chance to opt out.
Although the language in Gramm-Leach-Bliley was vague on this point, the FTC included credit header information — name, address, Social Security number and telephone number — extracted from credit reports.
TransUnion uses this data in a line of target marketing products, including TransLink, which electronically supplies retailers with the names and addresses of customers who have made a purchase with a credit card. The firm also puts it to use in services like Trace, which allows a client to input a Social Security number and receive the name and address of the person.
The credit bureau filed suit last year, challenging the FTC rules as “arbitrary and capricious.” It also argued that as a credit bureau it is not a financial institution, and therefore not subject to Gramm-Leach-Bliley.
TransUnion was joined in the action by the Individual References Services Group Inc. (IRSG), a trade association made up of information companies like Acxiom, ChoicePoint, Equifax Credit Information Services, and First Data Solutions LLC.
IRSG’s challenge was not as sweeping as TransUnion’s, but it was slapped down just as thoroughly by Huvelle.
Sources say it’s likely that IRSG will appeal. It was not known at press time whether TransUnion would appeal.
“We’re disappointed with the court’s ruling, and are currently evaluating our legal options,” says Trans Union spokesman Jeffrey Junkas.
The problem is that Huvelle’s opinion was very well written and covered all the bases, legal observers say.
Why did the FTC restrict use of credit headers? Apparently because Gramm-Leach-Bliley prohibits use of any information volunteered by consumers when seeking financial products.
Huvelle agreed that the language in the act was “ambiguous” on this point but argued that the agencies’ interpretation was entitled to “deference.” She upheld the rules against use “even where the information is otherwise publicly available.”
In her most sweeping statement, Huvelle rejected the claim that the sharing of credit header information is free speech protected by the U.S. Constitution. She cited prior court decisions that recognized “the limited nature of First Amendment protection for the commercial activities of information-based businesses.”
Marquis is aghast at the idea that “simple disclosure of non-public information [presents] enough harm to overcome the First Amendment.”
That wasn’t the only setback for TransUnion. Huvelle also disallowed use of aggregate data in modeling products like the firm’s SUM-it unless consumers have had a chance to opt out.
Responding to another point, Huvelle ruled that TransUnion qualifies as a financial institution. And she threw out a rash of other objections, including the claim that the rules violate TransUnion’s right to due process and equal protection under the Fifth Amendment.
What is the practical impact of this ruling? Marquis says the decision threatens use of basic credit header data by law enforcement. Junkas agreed.
“Obviously, collection agencies and government agencies use this data,” he says. “I think this will impede them.”
Any good news? Yes. Huvelle agreed that the data can be used when the consumer has been offered an opportunity to opt out.
Junkas adds that credit header data is “not the end-all and be all. It’s not the sole source of this information.”
