ChoicePoint has reached a settlement with the Attorneys General of 44 states over its mishandling of personal information that led to the now-infamous sale of data to a ring of Nigerian criminals in 2005.
Under the terms of the settlement, ChoicePoint will implement stronger security measures, including audits and inspections of companies that want to purchase its data records.
The Alpharetta, GA-based data broker will also pay $500,000 to the states. ChoicePoint privacy officer Carol DiBattiste said she hoped the states would use the money "to address important issues like consumer education on personal privacy protection."
"We settled because in the two years since ChoicePoints incident we have moved, in the words of one analyst, from 'poster child' to 'model' corporate citizen," DiBattiste said in a statement.
"We take that title seriously and when the Attorneys General came to us with reasonable issues and then agreed to reasonable solutions it was an easy decision. This is where the industry is going to wind up, [and] we felt like it make good business sense to get there before anyone else."
Connecticut Attorney General Richard Blumenthal called the settlement "a historic first."
"[This is] the first time a data broker has agreed to safeguard certain sensitive publicly available information, including Social Security numbers, using the same credentialing methods as it uses to safeguard private financial information that is protected by law," Blumenthal said.
The company admitted no fault in its settlement. Six states, including Georgia, were not part of the agreement.
ChoicePoint previously paid $15 million to the Federal Trade Commission (FTC) as part of a federal settlement over the 2005 breach.
The federal settlement also mandated that ChoicePoint improve its security measures and submit to audits to ensure it maintains high standards of information protection.
The case not only brought issues relating to data breaches and data protection laws to public awareness, but also thrust ChoicePoint abruptly into the spotlight. Security analysts, journalists, and privacy advocates repeatedly referenced the company as an example of the dangers of shadowy "data brokers" that gather information on individuals and resell it.
In response, ChoicePoint went to great lengths engineering a public makeover, reselling itself as a standard-bearer for maintaining privacy and security.
The company even turned a member of its legal counsel into a ChoicePoint Names a "Consumer Advocate" in order to ensure that individuals had someone to talk to if they felt their data was being misused or was inaccurate.
Although respected analysts such as Gartner's Avivah Litan praised ChoicePoint for its turnaround, she also warned that the company and others like it cannot afford to become complacent in matters of privacy and data security.
