US Firm Accused of Data Breach Pays $800k

US data broker Spokeo has paid $800k to settle Federal Trade Commission (FTC) charges that it sold consumer profiles gathered from the web and from social media data, without first taking the legal steps required to protect the individuals concerned.

Spokeo collects personal information about consumers from hundreds of online and off-line data sources, including social networks. It then merges this data to create detailed consumer profiles, which contain demographic information, along with details about hobbies, ethnicity, religion, participation on social networking sites, and photos.

The FTC alleges that from 2008 to 2010 Spokeo marketed the profiles as an employment screening tool to human resources professionals, staff recruiters and others. According to the charge, Spokeo encouraged recruiters to 'Explore Beyond the Resume', using online ads and a recruiter section on its web site.

Spokeo is also accused of selling data without taking the necessary steps required under the Fair Credit Reporting Act (FCRA) to ensure that it was accurate, and would only be used for legally permissible purposes; and of deceptively posting 'independent' endorsements of its service on news and technology web sites and blogs which were in fact created by its own employees.

In addition to imposing the $800k civil penalty, the FTC's settlement order gives specific warnings over future violations of the FCRA, misrepresentation in endorsements and failure to disclose material connections with endorsers.

This case is part of the FTC's ongoing enforcement of the FCRA, which was introduced to ensure consumer reporting agencies comply with principles of accuracy, fairness, and privacy of information.

Web sites: www.spokeo.com and www.ftc.gov .