On June 12, 2012, the Federal Trade Commission (FTC) issued a press release announcing online data broker Spokeo, Inc. will pay $800,000 to settle FTC claims that the company violated the Fair Credit Reporting Act (FCRA) when it sold personal informational about potential employees to prospective employers to assist those employers in screening job applicants. This enforcement action is the FTC’s first in applying the Fair Credit Reporting Act in a social media context. As a practical matter it confirms that businesses must be mindful of the uses to which they put information obtained from social media sources and to continue to apply traditional privacy and consumer protection laws to that information in appropriate situations.
The FTC alleged Spokeo collected personal information about consumers from numerous online and offline data sources, including social networking sites, and merged the information to create detailed personal profiles of consumers. The company’s reports contained information such as the consumer’s name, address, age range, e-mail, ethnicity, religion, participation in social networking sites and other information.
According to the FTC, Spokeo marketed the profiles on a subscription basis to companies in the human resources, background screening, and recruiting industries as an employment screening tool, encouraging users of the reports to "Explore Beyond the Resume." The FTC alleged Spokeo also ran online advertisements intended to attract employers and recruiters and posted its own endorsements of its services, representing the endorsements as those of consumers or other businesses.
The FTC alleged that between 2008 and 2010, the company marketed its information profiles without taking the necessary steps required by the FCRA to protect consumers. The FTC characterized Spokeo’s behavior as “a consumer reporting agency” and as such noted Spokeo ignored the requirements of the FCRA by failing to ensure the information it sold would only be used for legally permissible purposes; failing to ensure the accuracy of the information it sold; and failing to tell users of the information about their duties under the FCRA, including the requirement to notify a consumer when a user of a consumer report takes an adverse action against the consumer based on information contained in the report.
In addition to imposing the $800,000 fine, the FTC’s settlement order bars Spokeo from any future violations of the FCRA and requires that the company refrain from making future misrepresentations about its endorsements.
Important bottom lines from this Spokeo enforcement action include these: first, if an employer is relying upon information to make critical employment decisions from a vendor like Spokeo, the FCRA applies; and second, consider what other important privacy or consumer protection laws will apply even in instances where instead of relying upon traditional sources of information for background checks or locational activities, the source is one of the many emerging social media sources.
Additional information about the settlement is available on the FTC’s website.