The Never-Ending ChoicePoint Story

In the wake of the settlement the Federal Trade Commission announced last week with the data broker ChoicePoint, most of the attention has been on the biggest, baddest number of them all: $15 million. Six zeroes. Thats the total amount of money that ChoicePoint has to fork over to the feds within ten business days of reaching the settlement.

Yes, $15 million is a big number, even for a company like ChoicePoint, which celebrated a record revenue of $1.1 billion for 2005 only hours before the announcement of the settlement. ChoicePoints net income was $141 million, so a $15 million settlement for fraudulently disclosing personal information about 163,000 consumers (discussed here) is reason for more than a mere Gesundheit.

The $15 million comes on top of other millions, toolike the $19.3 million charge that the company took for specific legal expenses and other professional fees related to the fraud; the almost certainly millions in expenses for the third-party security audits ChoicePoint must go through for the next 20 years; and a loss of revenue stemming from ChoicePoint exiting some of its riskier lines of business, which the company warned shareholders last March would amount to a $15 million to $20 million loss of revenue.

(Given all this, its a wonder that ChoicePoints stock price opened today at 41.25, about 90 percent of its price of 46.01 on the day before the scandal broke last February. But I digress.)

No, the most important number of all may be the $5 million of the settlement that is intended for consumer redress.

In case you havent read the fine print, $10 million of the $15 million settlement is the civil penalty, the largest the FTC has ever levied. This is the part of the settlement that is supposed to say to ChoicePoint that when it was bad, it was horrid. Or, as FTC Chairman Deborah Platt Majoras put it in a statement, The message to ChoicePoint and others should be clear: Consumers private data must be protected from thieves.

But the other $5 million is another matter, and one that makes it clear that the ChoicePoint sagaalready legendary not just for its scope, but also for the extraordinary number of details that have been made public through SEC filings and other documentshas only begun to unfold. The $5 million will be used to create a fund for persons who become victims of fraud or identity theft due to the breach. This money may not be lost to ChoicePoint forever. In fact, the settlement states that any funds that remain after redress is completed may be used to address the practices, including information remedies, that the FTC laid out in its original complaint against ChoicePoint. [Correction: According to the FTC, leftover funds can be used not by ChoicePoint but by the FTC for related activities, such as consumer awareness about identity theft.]

The big question, though, is how appropriate the redress fund will be in relationship to the size and scope of the breach. This is uncharted territory. The fact is, we have no idea how much the final bill is likely to be. A survey on identity theft released by the FTC in September 2003 found vast discrepancies in the cost of identity theft based on the type of fraud that occurs and how quickly it is identified. Sixteen percent of surveyed victims said that more than $5,000 was lost due to the misuse of personal information, but 20 percent reported that less than $100 was involved. For victims of the most serious forms of identity theft, the average loss topped $10,000.

Lets just scratch some numbers out here. The FTC says there have already been at least 800 cases of identity theft resulting from the ChoicePoint breach (a number that ChoicePoint disputes). If this is the final number, the redress fund would amount to an average of $6,250 per personprobably plenty. But if every one of the 163,000 consumers becomes the victim of identity theft (an unlikely scenario, but one worth considering), the $5 million would only amount to $30.67 per personnot even enough for a year of credit monitoring.

FTC commissioners reached the settlement with ChoicePoint in a 5-0 decision, but the more complicated series of decisions still awaits us. How will the FTC trace identity theft back to the ChoicePoint breach? When will the redress case be considered closed, when fraudsters may wait months or years to use information like Social Security numbers? How will the FTC actually disburse the funds, and exactly which expenses will be covered? ChoicePoint executives are understandably ready to put this case behind them. But the most telling and difficult questions may yet lie ahead.

For the latest installment in this never-ending story, see Feds Make Progress with ChoicePoint Victims (But Barely).