Reference no: EM132217847

Questions: Explain how ChoicePoint’s business model might be different from that of data aggregators that focus on gathering and using consumers’ online activities for marketing purposes. Why might someone believe that the personal information collected by ChoicePoint is more sensitive or private than profiles of online behavior and purchases? How might ChoicePoint better protect its consumer information from unauthorized access?

CASE: As the chief executive officer and chairman of ChoicePoint, Derek V. Smith believed that the company’s business of collecting information on virtually every American and providing it to customers was a great public service. He asserted that “ChoicePoint is built on the premise that the responsible use of information will reduce risk and make the world safer and more secure.” However, some critics think that ChoicePoint and the information collection industry as a whole pose great hazards. ChoicePoint’s Business Based in Alpharetta, Georgia, a suburb of Atlanta, ChoicePoint was formed in 1997 as a spin-off from Equifax, the giant credit reporting company. Under Mr. Smith’s leadership, ChoicePoint bought more than 70 informationgathering companies over the next seven years to amass billions of pieces of data on individual Americans. This information included motor vehicle records, credit histories, insurance claims, birth and death certificates, marriage and divorce decrees, criminal actions, civil judgments, and real estate transactions. Among the customers for ChoicePoint’s services were banks, insurance companies, debt collectors, landlords, private investigators, law enforcement agencies, and the federal Department of Homeland Security. By 2004, the company provided more than 100,000 individual, corporate, and government customers with reports, which generally cost between $5 and $15 each and which generated around $1 billion in annual revenues. Benefits and Harms Aside from generating profits for ChoicePoint and its main competitors, Acxiom and Lexis-Nexis, computerized data collection and dissemination produce many benefits that are expressed in the company’s motto, “smarter decisions, safer world.” Business transactions are quicker and more secure when both parties know each other. In Mr. Smith’s view, easy access to reliable personal information helps restore a lost America in which neighbors in small towns knew each other and could conduct business with confidence. With the advent of centralized computer databases of personal information, the approval of applications for jobs, loans, credit cards, insurance policies, housing rentals, and the like can be done much more quickly than in the past. In addition, ready information enables banks and credit card companies to combat fraud, which benefits consumers by reducing costs. Costs are also reduced when companies use information in ChoicePoint reports to avoid hiring problem employees. Although law enforcement agencies have their own databases, which include nonpublic information gained by eavesdropping and other kinds of surveillance, they can prevent or solve crimes more effectively when they have access to the additional public information offered by commercial firms. ChoicePoint and other private companies are useful to law enforcement and Homeland Security officials because they can collect some information that government agencies cannot because of public sector privacy laws. These benefits of the data collection industry are offset by some possible harms. Critics also charge that commercial data collection is a threat to privacy. Most of the information provided by ChoicePoint and other companies is drawn from records in government offices and courthouses, which have long been available to the public. However, people’s privacy has been preserved in the past by the fact that the personal information from these scattered sources has been costly and time-consuming to acquire. With the advent of large computers, though, it is possible to make information about individuals readily available in one place for anyone with a legitimate need to know. One consequence of this development is that damaging information, such as an arrest record, may follow an individual throughout life, thereby creating what some critics call a “scarlet letter” society, in which people’s transgressions are publicly displayed for all to see. However, defenders of the data collection industry question whether the inability to escape from one’s past constitutes a violation of privacy. Mr. Smith argues that there is a big difference between privacy and anonymity. “Yes we have a right to privacy. But in this society we can’t have a right to anonymity.” Security Breaches In February 2005, ChoicePoint acknowledged that serious security breaches had occurred. The company notified 163,000 people that data thieves, posing as representatives of legitimate businesses, had gained unfettered, round-theclock access to the company’s computerized records. Although ChoicePoint employs sophisticated technology to keep hackers out of its computer system, the thieves exploited gaps in the company’s verification procedures to register as customers. At least 800 cases of identity theft were known to have resulted from these data losses. In their defense, ChoicePoint executives argued that the rogue customers were sophisticated enough to get business licenses and other credible documents. However, a report by the FTC concluded that the company was lax in its procedures and had overlooked obvious “red flags.” For example, ChoicePoint did not question applications that had incomplete or contradictory information, that listed residences or commercial mail services as addresses and cellular telephone numbers as contacts, and that were sent from fax machines in public locations, such as Kinko’s stores. In some instances, the submitted documents showed that the company’s incorporation or tax registration had been suspended or cancelled. One information security consultant observed, “It was a well-known fact back then that ChoicePoint would do business pretty much with anyone who came along.” Following this acknowledgment of security breaches, ChoicePoint was severely criticized by privacy groups. The human rights organization Privacy International bestowed its 2005 Lifetime Menace Award on the company. The Electronic Privacy Information Center (EPIC) filed a complaint with the FTC and called for a congressional investigation, which was subsequently undertaken. Faced with this outpouring of criticism, Mr. Smith and other ChoicePoint executives were forced to consider their response.