FTC: Self-Regulate on Data Privacy Or Deal with a Stirred-Up Congress

ensnare banks and other information-intensive businesses in a tighter regulatory web. If the corporate sector proves irresponsible with personal information or violates consumers' trust, it "will be legislated, and it's going to be your worst nightmare," Federal Trade Commissioner Christine Varney warned at a national business privacy conference this week. In an attack aimed in part at the many banking and consumer credit industry officials in her audience, Ms. Varney suggested their attempts at self-regulation are falling short. She revealed that the FTC had received an urgent request from three senators to investigate alleged private-sector violations of privacy rights. Along with a similar, more targeted study under way by the Federal Reserve Board, the FTC inquiry indicates that privacy is becoming a front- burner issue that could pose political and operational challenges for banks and their suppliers of consumer information. "For self-regulation to work, it has to exist," Ms. Varney told the conference sponsored by the newsletter Privacy and American Business. Industry representatives were taken aback. A year ago at the same conference, Ms. Varney, who has generally advocated industry self-policing and obtaining consumers' consent for using personal information, had delivered a more conciliatory message about the government's remaining in the background as the private sector sorted out data base capabilities and policies. Just last week, financial industry interests were buoyed when the legislation that shored up the thrift deposit insurance fund put to rest several longstanding controversies regarding information-sharing restrictions in the Fair Credit Reporting Act. A Louis Harris & Associates survey, sponsored annually by Equifax Inc. and released at the conference, showed the public would support government intervention if it deemed existing laws and practices inadequate. Still, 67% of consumers favored "the present system of privacy protection" over "creating a federal government privacy commission." In a combative exchange Wednesday, Ms. Varney said she was "discouraged" by private industry's performance. She read the letter her agency had received that day from the three senators - Democrats Richard Bryan of Nevada and Ernest Hollings of South Carolina and Republican Larry Pressler of South Dakota - seeking an investigation of companies that compile, sell, and use "electronically transmitted data bases that include identifiable personal information of private citizens without their knowledge." The senators said they had received calls and letters from constituents concerned about how companies use their data. The broad scope of the request was viewed by some privacy experts at the meeting as a "wake-up call." "The letter is far-reaching," said one executive. "It would affect any company that maintains a data base, including any bank." Fueling the public outcry was an incident last month on the Internet, when a widely circulated message accused a Lexis-Nexis data base service of selling Social Security numbers and mothers' maiden names "to anyone with a credit card." The service, called P-Trak and designed as a "white pages" directory for the legal and law enforcement community, was mischaracterized, and Lexis- Nexis said it was a victim of misinformation. But the damage was done. In an interview, Ms. Varney said the incident "awakened a fear in the public." FTC attorney David Medine added, "It is significant that P-Trak evoked such a strong public concern." The Federal Reserve staff, in a project requested by Congress two weeks ago and also believed to have been prompted by the P-Trak incident, will work with the FTC to study the collection, use, and public disclosure of identifying information by companies not covered by the Fair Credit Reporting Act. It excludes credit bureaus and is directed at federally insured institutions. Mr. Medine said the Fed is to deliver a report to Congress in six months. When Commissioner Varney finished her address, her stunned audience responded with tepid applause - in stark contrast to the enthusiasm that had greeted her last year. Representatives of such companies as Lexis- Nexis, First Data Corp., and Donnelley Marketing (recently acquired by First Data) swarmed around Ms. Varney and other FTC officials to ask about the senators' letter. Ms. Varney said the letter sets the tone for a February meeting, the next in a series of business privacy workshops sponsored by the FTC. She said companies are on notice to bring specific ideas on self-regulation. When one executive asked, "Why don't you tell us what you want?", Ms. Varney replied, "No - you write down what is real."

For reprint and licensing requests for this article, click here.
MORE FROM AMERICAN BANKER