Chapter 13

Expert Witness Report and Analysis Regarding Credit Reporting

Since 1981, Evan Hendricks has served as Editor/Publisher of the Privacy Times, a biweekly newsletter in Washington that reports on privacy and freedom of information law. He has served as an expert witness in several cases involving the Fair Credit Reporting Act. He may be contacted at evan@privacytimes.com, Privacy Times, PO Box 302, Cabin John MD 20818, (301) 229 7002, fax: (301) 229 8011. Hendricks is author of the books, Credit Scores & Credit Reports (2004), Your Right To Privacy (1990 So.Ill.Univ.Press), and Former Secrets, a 1982 compilation of 500 examples of significant disclosures to the public under the FOIA. From 1977-80, he was Editor of Access Reports and a newsletter on FOIA/Privacy. A graduate of Columbia University, Hendricks regularly lectures on information policy issues in the United States, Canada and Europe. Some of his recent lectures and expert presentations include Harvard Universitys Kennedy School of Government, Brookings Institution, the 16th Annual Conference on Data Protection in The Hague, and Reed College Lecture Series on Privacy and Censorship. He has been interviewed on various FOIA and privacy issues by the Oprah Winfrey Show, Geraldo, ABC Nightline and World News Tonight, NBC Nightly News, CBS Evening News, CNN News Watch, The Washington Post, New York Times, Wall Street Journal, and radio talk shows such as KABC (Ray Briem, LA), KFI (Tom Likus-LA) WLS (Both Tom Johnson and Bob Wade), Scams Across America (Business Radio Network, Richard Cooper) WOR (New York) and KFYI, (Phoenix). He has done contract research for the Office of the Canadian Privacy Commissioner and the Australian Human Rights & Equal Opportunity Commission, as they needed a survey of American experiences in the course of formulating their national policies. In 1991, Hendricks became Chairman of the U.S. Privacy Council, a new organization and the first dedicated to the protection of privacy and improving our nation's law and policy. Hendricks is a native of Portland, Oregon. Section 13.1 is Hendricks expert witness report in a Fair Credit Reporting Act case involving the mixing of files of two consumers with the same name, and the failure of the credit reporting agency to use the consumers social security numbers to properly separate the two consumers credit files with the result that the erroneous mixed information was repeatedly remixed after one of the consumers complained of the error. The report continues with an analysis of the consumers damages as a result of the repeated mixed credit files, the consumers youth, and the harm to his good reputation. Section 13.2 is an excerpt from Chapter 20, Damage and Damages, from Hendricks new book, Credit Scores & Credit Reports (Privacy Times 2004). It analyzes how consumers are damaged by often repetitive inaccuracies in their credit reports and describes a paradigm for calculating the resulting damages.

13.1 Expert Witness Report Regarding Mixed Credit Files

PLAINTIFFS RULE 26(a)(2) EXPERT WITNESS REPORT [Combine Sample For NCLC Certain Information Redacted] I, Evan Hendricks, provide the following supplemental Expert Report pursuant to Federal Rules of Civil Procedure 26(a)(2) in connection with the action entitled Jason Turner v. Equifax Credit Information Services, Inc.: U.S. District Court for the Northern District of Alabama (Southern Div); Case No. CV 02-J-0787-S. My preliminary report was completed on October 30, 2002. I have had the opportunity to review the depositions of Equifax employees Alicia Fluellen, Phylliss Dorman, Celestina Spencer, and of Deborah and Jason Turner, as well as frozen data scans, ACRO Maintenance Transaction Summaries, Equifax Indicating, Fraud and Mixed Files manuals, consumer reports sent to plaintiff or to credit grantors, and various correspondence. BACKGROUND & QUALIFICATIONS My expertise in credit reporting stems from several of my professional activities, including: (1) Editor/Publisher of a specialty news reporting service that covers credit reporting, (2) author of the book Credit Scores and Credit Reports: How The System Really Works, What You Can Do (Privacy Times 2004), and co-author of a book with a chapter on credit reporting; (3) an expert witness qualified by the federal courts in Fair Credit Reporting Act (FCRA) litigation: (4) an expert on credit reporting who has testified before Congress on numerous occasions, including four hearings in 2003, and who has testified twice before the California legislature in regards to legislation on the use of financial data; and (5) an expert consultant to government agencies and private corporations, and a member of the Consumer Advisory Council of defendant Experian, who is one of the three national Credit Reporting Agencies (CRAs). Since 1981, I have been Editor/Publisher of Privacy Times, a biweekly, Washingtonbased newsletter that reports on privacy and information law, including the Fair Credit Reporting Act. The newsletter ranges from 8-12 pages, 23 issues per year. This means that in this newsletter (and its three-year predecessor), I have researched, written, edited and published well over 2,500 pages relating to information law and policy, including Congressional and State legislative actions, judicial opinions, technology developments, industry trends and actions, executive branch policies and consumer news. By my conservative estimate, at least 20 percent of my professional work since 1977 has concerned issues relating to consumer reporting and personal financial information. These endeavors have allowed me to accumulate a specialized body of knowledge in relation to the collection, use and disclosure of credit report data and personal financial information, and the standards governing them. Privacy Times is a subscription-only newsletter. The readers are generally the attorneys and specialists within government agencies, corporations, law firms, universities and public interest groups that are responsible for issues relating to freedom of information and privacy laws, including the FCRA and similar state statutes. I am author of the book, Credit Scores and Credit Reports: How The System Really Works, What You Can Do (Privacy Times 2004). The book has 22 Chapters, 359 pages and 369

footnotes. As the title indicates, it describes how the credit scoring and credit reporting systems work and what consumers can do to obtain their reports, read and understand them, correct errors in them and enforce their rights. I also am co-author of Your Right To Privacy: A Basic Guide To Legal Rights In An Information Society (2nd Edition, Southern Illinois University Press, 1990), which has a chapter on credit reporting. Since the early 1990s, I have served as an expert witness in numerous FCRA cases and have been qualified by the federal courts.1 As an expert witness, I have had the opportunity to read thousands of pages of deposition testimony by consumer reporting agency officials and by credit grantor personnel responsible for reporting data to CRAs. This is significant because CRAs and credit grantors do not openly discuss or publish information on their procedures and practices for handling personal data. In fact, CRAs typically consider such procedures and practices to be proprietary and/or trade secrets. To my knowledge, the best (and possibly only) sources for finding candid descriptions of CRAs and credit grantors procedures and practices in relation to credit reporting data are the depositions of CRA and credit grantor employees in FCRA litigation. Due to my access to this information, I have augmented my specialized body of knowledge on practices and procedures related to credit scoring and credit reporting. I have testified before Congress on numerous occasionsalways by invitation. In 2003, I testified twice before the Senate and twice before the House, and presented once before the FTC. The hearings covered a wide range of credit reporting issues, accuracy, fairness, privacy, CRA procedures and security. The following are the titles and dates of only the 2003 hearings in which I testified, or in the case of the FTC, presented: The Accuracy of Credit Report Information and the Fair Credit Reporting Act;2 Senate Banking Committee, July 10, 2003 The Role of FCRA in the Credit Granting Process,3 House Financial Services Subcommittee on Financial Institutions & Consumer Credit, June 12, 2003 Database Security: Finding Out When Your Information Has Been Compromised,4 Senate Judiciary Subcommittee on Technology, Terrorism and Government Information, Nov. 4, 2003 Fighting Fraud: Improving Information Security, House Financial Services Subcommittee on Financial Institutions & Consumer Credit, and Oversight, April 3, 20035 Information Flows: The Costs and Benefits to Consumers and Businesses of The Collection and Use of Consumer Information,6 Federal Trade Commission, National Workshop, June 18, 2003

1 See, for example, Adelaide Andrews v. TRW, Inc. 225 F.3d 1063 (9th Cir. 1990). Although the trial judge qualified me, the Ninth Circuit, in reversing part of her opinion in favor of defendant, ruled that she overly limited the scope of my testimony as to the prevalence of identity theft and its impact on credit report accuracy and integrity. In making that determination the jury would be helped by expert opinion on the prevalence of identity theft, as the district court would have been helped if it had given consideration to the Plaintiffs witnesses on this point before giving summary judgment, the 9th Circuit panel wrote. 2 http://banking.senate.gov/03_07hrg/071003/index.htm 3 http://financialservices.house.gov/hearings.asp?formmode=detail&hearing=229) 4 http://judiciary.senate.gov/testimony.cfm?id=983&wit_id=2790 5 http://financialservices.house.gov/media/pdf/040303eh.pdf 6 http://www.ftc.gov/bcp/workshops/infoflows/030618agenda.html

Some of my recommendations were reflected in the final FCRA Amendments approved by Congress and signed by President Bush in December 2003. On December 3, 2002, I testified before the California State Senate Insurance Committee. On January 29, 2003, I testified before the California State Assembly Insurance Committee. Both Committees were considering financial privacy legislation (SB 1), which ultimately was enacted by the legislature and signed into law in September 2003. Two of the three major CRAs have acknowledged that I am an expert on credit reporting as it relates to Fair Information Practices. First developed in the United States in the late 1960s, Fair Information Practices (FIPs) standards are at the core of the FCRA and most other U.S. and European privacy and data protection laws, and serve as an internationally accepted standard for gauging privacy policy and practices. In 1990, Equifax, another national CRA, published The Equifax Report on Consumers In the Information Age, a nationwide opinion survey and analysis by Louis Harris and Associates and Prof. Alan F. Westin. The report listed me as a privacy expert to whom the authors expressed appreciation for my advice on survey coverage. In April 2002, I accepted Experians invitation to serve on the Experian Consumer Advisory Council of Experian (formerly TRW), a national CRA and vendor of other information services. The Council meets twice a year to offer non-binding advice and to discuss a host of credit reporting, marketing and other privacy-related topics. Since August 1998, I have served under contract as a member of the Social Security Administrations Panel Of Privacy Experts advising the agency on a host of issues. SUPPLEMENTAL OPINIONS At this point in time, to a reasonable degree of professional certainty, I hold the following additional opinions in the case of Jason Turner v. Equifax Credit Information Services, Inc. SUMMARY OF SUPPLEMENTAL OPINIONS For the convenience of the reader of this report, I summarize my opinions in this supplementary report. The inability of Equifax employees to explain precisely why plaintiffs information was improperly mixed with the Other Jason Turners data demonstrates that Equifax does not fully understand or have adequate control over its own system Equifax [REDACTED] caused plaintiffs identifying data to be merged with the Other Jason Turners (OJT) identifying information, including Social Security number (SSN) and date of birth, and OJTs derogatory trade lines, after plaintiffs application for credit prompted Capital One to send an inquiry to Equifax for plaintiffs consumer report. [REDACTED} By failing to significantly upgrade its procedures after the 1992 State AG agreement and the 1994 FTC consent agreement, Equifax was ignoring the expectation of

oversight authorities and the public that Equifax would attend to a higher standard of care in ensuring accuracy, avoiding mixed files, improving reinvestigations and preventing the reappearance of previously deleted data. Equifaxs dispute handlers and their supervisors are unfamiliar with the workings of the search/matching logic that can cause mixed files. This can make it more difficult for dispute handlers to properly diagnose the reason for inaccuracies, to correct inaccuracies and to prevent future inaccuracies. Equifax is not sufficiently responsive to consumers and their disputes, as it sometimes fails to respond or acknowledge receipt of a dispute. Equifaxs system and personnel failed to consider adequately the possibility that Mixed Files was the cause of plaintiffs problems. When responding to consumer disputes, and to plaintiffs dispute in particular, Equifax has failed to employ its SSN search function and its name and address search functions to unmix mixed files, correct inaccuracies and prevent future mixing and inaccuracies. Equifaxs internal definition of a file was faulty and influenced Equifaxs failure to respond adequately to plaintiff, to correct inaccuracies and prevent future inaccuracies. Equifaxs method of reinvestigation overly relies upon verification by credit grantors, and fails to adequately utilize information provided by the consumer to resolve a dispute. Equifaxs system is inadequate to ensure that all relevant information provided by the consumer in the course of a dispute is forwarded to the furnisher. Equifaxs practice of attempting to verify information about plaintiff by sending a CDV consisting of data on the Other Jason Turner to the credit grantors with whom only the Other Jason Turner had a relationship was not logically calculated to achieve its purported goal. There is a lack of follow up and follow through in the Equifax system to ensure that inaccuracies are properly corrected and remain corrected. Equifaxs primary function for preventing the combining of personal data from separate files, the Do Not Combine function, does not adequately prevent the improper mixing of records.

THE MERGING OF DATA ON PLAINTIFF & THE OTHER JASON TURNER (OJT) A primary problem in this case is that the three Equifax employees that were deposed 5

were unable to explain precisely why and/or how the identifying data and derogatory trade lines of the Other Jason Turner (herein, OJT) were merged onto a credit report with plaintiffs current address and SSN, and returned (i.e. disclosed) to a credit grantor when plaintiff first applied for credit in May 2000. Given the long-standing, widespread problem of mixed files and credit report inaccuracy, it is incumbent upon consumer reporting agencies (CRAs) to identify why and how their systems cause the improper mixing of data on two consumers. Only if they understand why their systems cause the mixing of files will CRAs be able (1) to reduce the number of mixed files; (2) provide appropriate assistance and remedies for specific victims of mixed files and (3) avoid re-mixing of files and/or reinsertion of previously deleted data. In my opinion, a feature of Equifaxs system, referred to as search logic by Phylliss Dorman, caused identifying data and derogatory trade lines of O JT to be merged onto a credit report with plaintiffs current address and SSN, and returned to a credit grantor when plaintiff first applied for credit in May 2000. In this instance, the returned credit report caused Capitol One to deny credit to plaintiff based upon inaccurate information. In my opinion, the search logic and its application demonstrates that Equifax did not attend to a high enough standard of care to ensure maximum possible accuracy, given the widespread, long-standing problem of mixed files. Since 1991, Equifax for the most part has used the same system for determining how to assign data provided by subscribers (credit grantors) to individual consumers. [THREE PAGES REDACTED] This problem was recognized back in the early and mid-1990s by the State AG and FTC consent agreements with Equifax. The AG agreement required Equifax, for identification and matching purposes, to use full identifying information, meaning full last and first name, middle initial, full street address, zip code, year of birth, any generational designation, and Social Security number. Similarly, the FTC agreement aimed to prevent reporting to subscribers information as pertaining to a particular consumer unless Equifax identified by at least two of the following identifiers: (i) Consumers name; (ii) the Consumers SSN; (iii) the Consumers date of birth and (iv) the Consumers account number with a subscriber or a similar identifier unique to the Consumer. Dorman testified that Equifax does not adhere to the more specific standard of care articulated in the two agreements, and emphasizes the priority of maximizing the amount of data it discloses to subscribers:
3 4 5 6 7 8 Full identifying information means full last and first name, middle initial, full street address, zip code, year of birth, any generational designation, and Social Security number. Q. One of the things it includes is the Social Security number? A. Correct.

[REDACTED] In my opinion, the State AGs and the FTC sought to reduce the prevalence of mixed files and harm to consumers by articulating a higher and more specific standard of care. Dormans

testimony shows that Equifax did not adhere to the higher standard of care articulated by the agreements. Accordingly, mixed files and inaccuracy to date have persisted as problems for consumers. In my opinion, if Equifax had adhered to these standards, it would have avoided mixing OJTs credit history and identifiers onto the report on plaintiff that was returned to Capital One. DISPUTE & INVESTIGATION In my opinion, Equifax caused, in plain English, the mixing, merging and/or combining of plaintiffs and OJTs data. After that initial error, Equifax had a myriad of opportunities to unmix the two mens files and to keep them separated so they would not mix, merge or combine again. However, in my opinion a multitude of defects in Equifaxs practices caused the continued mixing of the two mens files for more than two years despite repeated notifications from plaintiff and his mother that plaintiffs credit report was inaccurate. In my opinion, Equifax was unable under its normal practices to properly separate, or, stop the wrongful mixing of, the two mens data. One fundamental problem with Equifaxs dispute handling system is that the dispute handlers are not familiar with how the above-described search logic works. Since that search logic can cause the mixing of files, it is imperative that Equifax dispute handlers know how it works so it can unmix files and prevent future mixing. However, Alicia Fluellen, senior manager for the Equifax Office of Consumer Affair, the person responsible for supervising and handling escalated disputes from consumers, testified that she did not know why Equifaxs mixed the files and then disclosed it to Capitol One. She also did not know how many identifiers had to match.
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Q. Okay. Lets move on. Okay. So if this is a report, why did Equifax, when Capital One requested a report with my client, Jason Turners information, did they send them a report with the other Jason Turners information? A. I dont have an answer to that one. I dont know. Q. Is that a mistake to do that? A. It appears to be a mistake. Q. Okay. Like you testified before, the proper thing to do would be to say we dont have an account for this Social Security number, date of birth, and name? A. Yes. Q. How many, for Equifax to send out an a report, how many items have to match, do you know? A. I dont know the specifics of that. Q. It may be a question for Phylliss? A. Yes. (Fluellen, Page 44)

Similarly, Fluellen did not know how to prevent SSNs from changing on a credit report.
20 21 22 Q. what safeguards does Equifax have to keep a Social Security number from changing on an account, on a credit report? A. I dont know the safeguards. (Fluellen, Pg. 57)

Had Fluellen and her dispute handlers had some familiarity [REDACTED] . . . they would have been able to recognize the reasons why plaintiff and his mother were complaining of a mixed file, and then could have at least attempted to take the appropriate corrective measures. But because they did not understand why the improper mixing occurred, the dispute handlers were, in a sense, flying blind. In my opinion, Equifax over-compartmentalized what dispute handlers needed to know about its system and search logic, and that this hampered Equifaxs ability to maximize accuracy once information was disputed. INITIAL NON-RESPONSE & RESPONSE Despite sending copies of a plaintiffs birth certificate, drivers license and Social Security card to Equifax on May 26, 2000, Equifax did not respond. In my opinion, this showed that there were defects in Equifaxs system for receiving, logging and responding to routine consumer disputes. After plaintiffs mother communicated with Equifax, she was connected to Ms. Tina Spencer, to whom she re-faxed the materials that she originally sent May 26. The routing of plaintiffs case to Ms. Spencer, a member of the fraud team, underscored a defect in Equifaxs system. Plaintiffs mother had made no allegation of fraud, nor was there any evidence of fraud in Equifaxs records. On its face, it appeared to be a straightforward Mixed File case. Ms. Spencer did nothing to correct the front lines misinterpretation and in fact, agreed that it belonged in the fraud department. She testified
13 14 15 16 17 18 19 20 21 22 -- at that time, the fraud perpetrator unit was handling minor cases because, obviously, there was a perpetrator on the other end of that Social and that child being a minor. (Spencer, Pg. 63) Q. If youre under 18, why does it go directly to the fraud perpetrator unit? A. Because a person under 18 in general would not have a credit file, so it would not be the consumers file, it would be the perpetrators side we would be looking at. (Spencer, Pg. 64)

In my opinion, given the history and prevalence of mixed files and the consent agreements, Equifaxs system and personnel should in such circumstances consider mixed files as a possible cause of plaintiffs problems. But nowhere along the way did Equifax recognize it as such. As a supervisor in the Office of Consumer Affairs, Spencer testified she may have handled over 100 mixed files cases. Yet her testimony showed that mixed files was not predominant in her thinking or memory..
1 2 3 4 5 6 A. This is the mixed files training manual for Equifax. Q. Did you receive a copy of that? A. I do not recall. Yes, I did go to a mixed files class. I must have received the manual. Q. Okay. And how long was the class, if you recall --

7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22

A. I dont recall. Q. -- on mixed files? A. I do not recall. Q. Does everyone go to a class on mixed files? A. Yes. Q. Have you ever -A. Not everyone, but if youre going to work on a mixed files case, yes, but not everyone is selected to work -- to go to the class. Q. How were you selected to go to the class? A. Im not sure what it was based on. I imagine it was performance or need, Im not sure, but I did go to the class. Q. Did you tell me how long the class was? A. I dont recall.

(Spencer, Page 111) (Continued)

7 8 9 10 11 12 13 14 15 16 17 18 20 21 22 23 Q. Jason Turners disputes, were they handled pursuant to the Office of Fraud Assistance Manual? A. After the Fraud Assistance Manual. Q. Okay. But they were handled as a fraud, not as a mixed file? A. Thats correct. Q. And the policies set forth in the mixed file manual were never applied to Jason Turners disputes or concerns? A. I cannot say that I did not -- because I was experienced in both, I cannot say that I didnt mix the two policies. I cannot say emphatically, no. Q. Did you treat Jason Turners disputes or file as a mixed file? A. No, I treated his file as a fraud file, fraud situation.

(Spencer, Page 112) To solve a problem, it must be diagnosed correctly. In my opinion, Equifaxs system and personnel failed to consider adequately the possibility that Mixed Files was the cause of plaintiffs problems. THE SSN SEARCH Spencer testified that an Equifax supervisor can do an SSN search, which will only produce data that are associated with all nine digits of the SSN. (Spencer, Page 29, Line 4) [REDACTED] In my opinion, Equifax could have contained plaintiffs mixed file problem through appropriate use of its SSN and name and address search functions. Clearly, by August 2000, Equifax, and specifically Ms. Turner, knew plaintiff s SSN, DOB and address, and, knew the OJTs SSN, DOB and address. By then doing [REDACTED]

But instead of this approach, Spencer said the usual procedure was to do a name-andaddress search to see if more than one SSN was associated with one name or address.
15 16 17 18 19 20 21 22 23 24 25 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 A. When I do -- I cant speak for Equifax, but when I did a perpetrator search, it was not a Social Security search, its a name and address search to see if there are other Social Security numbers attached to that person living at that address. Q. And you would not do a Social Security number search to see if the perpetrator were using other names, but with the same Social? A. I cannot say emphatically that I didnt look or see, but it was not procedure. Q. Okay. A. I mean, we searched using everything we had available, Social Security search, name and address search. Q. So you did do a Social Security search? A. No, not specifically. Q. It was tied to the name and address that you inputed? A. Yes. Perpetrators are tied to the name and address. Q. Okay. But it was possible you could have done strictly a Social Security number search? A. Its possible, but it was not for the purpose of linking, it was just for the purpose of additional information just to paint the whole picture. In other words, if Jane Doe was using my Social Security number, she has her own number, one, two, three, four, five, six, seven, eight, nine, 10, but shes using my number, if I get Jane Doe at 123 Main Street and my number, then I might look at that number to say who does this number really belong to. But in that case, Im just trying to determine is this a made-up number or is this a number that belongs to someone in our system.

(Spencer, Pg. 30) Given the prevalence of both mixed files and identity theft, in my opinion, it is important that Equifax, upon receiving a not mine dispute, employ its SSN, name and address search functionality to correct mistakes expeditiously and improve overall accuracy. Ms. Spencer testified that if she would have done any SSN search, it would not have been for the purpose of linking. What she and Equifax fail to appreciate, is that this was a case of improperly linking the data of two separate men, and the purpose of the SSN search was to properly separate them. THE NO-FILE FILE When Deborah Turner disputed her sons credit report in August 2000, and again disputed it in October 2000, Ms. Spencer did not start an investigation or correct any of the

10

errors. In my opinion, Equifax should make it clear to dispute handlers that upon receiving a dispute, they should investigate and correct inaccurate information. (Spencer, Pg. 85) Spencer testified that no investigation was started because, in Equifaxs view, plaintiff had no file; hence, there was nothing to be done.
11 12 13 14 15 16 17 18 19 A. No, I would not have considered it frivolous, but I think I was still trying to explain to her that nothing was being done because there was nothing to do. It was not frivolous -- I was not considering it frivolous, no. Q. You just wanted her to understand that nothing was being done? A. I wanted her to understand that it was not his credit file for me to do anything to.

(Spencer, Pg. 88) Equifaxs view that plaintiff had no credit file is a theme that runs through the testimony of its employees in this case. For instance, Fluellen on two occasions said;
19 20 21 22 23 24 Fluellen: Also, what I believe should have been done in this case, what our procedures uphold is to advise this consumer that Jason Turner under the Social Security number that hes providing theres not a credit file for. That should have been done. Q. Do you know if that was done? A. I dont know if that was done.

(Fluellen, Pg. 73)

12 13 14 15 16 17 A. At that point, it appears as though this individual had a special communication with these plaintiffs, so they would have called the consumer back and let them know this is the Social that we have, and this particular person does not have a file.

(Fluellen, Pg. 75) Phylliss Dorman echoed this view:

13 17 18 19 20 21 22 23 24 25 26 Q. . . . [B]ut with like a Florida address or one of the other Jason Turners addresses, why would that cause an account associated with a completely different Social Security number, such as the Social Security number of the other Jason Turner, to land on the plaintiffs credit report? A. It didnt land on the plaintiffs credit report, it landed -- it had its own credit report, so the other Jason Turner had a credit history with a credit file whose Social [redacted].

(Dorman, pgs 39-40) What is striking here is the gap between how Equifax employees internally viewed

11

plaintiffs non-file status, and the consumer report that Equifax returned to credit grantors to whom plaintiff had applied for credit. Due to the depositions, Equifax employees upon reflection see that plaintiff in reality had no credit history, and conclude that he did not have a credit file. What they fail to acknowledge is that because of plaintiffs application for credit and the subsequent inquiry by Capital One, Equifax created a consumer report on plaintiff and disclosed it to Capital One. Because of the flaws in its system, it continued sending prospective credit grantors inaccurate consumer reports. However, it was precisely because she felt that Equifax had no file on plaintiff, that Ms. Spencer initially did nothing to stop Equifax from providing subscribers with inaccurate consumer reports regarding plaintiff. Or, as Ms. Spencer put it, nothing was being done because there was nothing to do. . . . I wanted her [Mrs. Turner] to understand that it was not his credit file for me to do anything to. Thus, Equifaxs faulty, internal definition of a file was a factor in its failure to respond appropriately to plaintiffs dispute and halt the dissemination of inaccurate credit reports. This all served to prolong and exacerbate plaintiffs damages. At the same time, because of this view, Ms. Spencer misled Ms. Turner or even concealed from her what would or would not be done to rectify the situation, as well as the reasons for inaccuracies in plaintiffs report. Finally, the Equifax view that there was no file on plaintiff underscored the fact that the problem would not begin to be adequately addressed until a lawsuit elevated it above their already-elevated positions. (The FCRA defines the term consumer report. In this case Equifax employees testified that their database did not contain a file on plaintiff. Yet this view is at odds with the wellknown standards of another fair information practice statute, the U.S. Privacy Act, which defines a record as any item or collection of information about an individual . . . and which contains that individuals name or other identifying particular. The U.S. Office of Management and Budget, which oversees the Privacy Act, said that this definition requires that a record actually be retrieved by reference to a personal identifier. In this case, Equifax produced a consumer report on plaintiff because it could retrieve from its database a collection of information by reference to plaintiffs identifiers.) The confusion engendered by Equifaxs system may have best been summed up by Ms. Spencer when she said of the possibility of a file on the Other Jason Turner,
1 2 3 4 A. There should not have been a file, but there could have been because his addresses are here because they would have keyed in his name and his addresses. Our system -- I dont know how to answer that question. He is there, but he is not there.

(Spencer, Page 131) THE CDV On April 2, 2001, Ms. Spencer finally started an investigation because, she testified, as a result of a phone call with Miss Turner that I was convinced, that she was convinced that this was his file, so proceeded to make the changes that she had been asking me about over the previous months. Yet despite the repeated phone calls and the documentation previously provided by plaintiff, Ms. Spencer did not instantly correct all the information. Instead, she engaged in Equifaxs customary practice of relying on credit grantors to verify information

12

before deciding to delete or suppress it. To accomplish this, Equifax sent a consumer dispute verification form (CDV) to various credit grantors, including Capital One. In my opinion, this process is defective for several reasons. First, when combined with the information on the two Jason Turners already in Equifaxs system, Ms. Spencer had sufficient documentation from and communications with Ms. Turner to build separate files for each Jason Turner. Yet Equifax only encourages its dispute handlers to unilaterally make cosmetic corrections. For more substantive disputes, Equifax normally requires CDVs be sent to the furnisher. The second defect is that the CDV requirement resulted in Ms. Spencer sending a CDV to the OJTs creditors, with OJTs SSN, DOB and derogatory trade lines. As she testified:
16 17 18 19 So the file itself -- the file in conjunction with the other Jason Turner was not fraudulent; however, I believe what I was attempting to do was have the credit grantors verify that these accounts do not match Jason Turner, your client.

(Spencer, Pg. 97) In my opinion, this practice defied common sense. How, by sending OJTs data (but with plaintiffs address) to OJTs credit grantors, did Equifax expect to verify plaintiffs claim that OJTs data did not belong to plaintiff.? Equifax did not send out a CDV with plaintiffs SSN. Naturally, the furnishers verified the information, guaranteeing that plaintiffs file would be marred by inaccuracies for many more months. Ms. Fluellen confirmed this was standard Equifax procedure.
6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 0073 1 2 3 4 5 Q. Okay. So what would Equifaxs procedure be normally in response to a dispute like this? A. It would be to start an investigation on -- well, theyre disputing the Social Security number, so were to verify the Social with creditors on the credit file to make sure that we have the correct Social Security number and that that is whats being reported. Q. So Equifax would contact the creditors on the report thats Exhibit 9? A. Yes. Q. And say is this the Social Security number on that account? A. Yes. Q. If the creditor says, no, thats not the Social Security number, what would Equifax do? A. If they say, no, thats not the Social Security number -Q. First, let me ask you, when -- all right. The report says the Social Security number is 421-27-7488, -A. Yes. (Shook head affirmatively.) Q. -- but the plaintiff says that thats not his Social Security number, so when Equifax contacts the creditors, do they say -- do they just ask what

13

6 7 8 9 10 11 12 13 14 15 16 17

Social Security numbers on the report or on the account? A. Im sorry? Q. Im sorry, I confused you. When Equifax contacts the creditor, do they just ask what Social Security number is on this account? A. No. We have the form where the name, address, and Social is already prefilled, and the credit grantor will denote what Social Security number they have, whether its verified correct as reported or they have a different Social other than provided.

(Fluellen, Pgs. 73-74)

Q. 20 21 22 23 24 25 1 2 3 4 5 6 Well, I guess what Im saying is, are theyre other methods of investigation despite the CDV or other than the CDV? A. No, we send out a CDV. Q. Thats it. If it comes back one way, good for the consumer, if it comes back agreeing with the creditor, then not agreeing with the consumer, then it stays? A. Correct. Q. Basically, Equifax takes the word of the creditor, whatever the creditor says is what Equifax does? A. Yeah.

(Fluellen, Pgs. 83-84)

LACK OF FOLLOW-THROUGH TO ENSURE CHANGES/CORRECTIONS ARE INSTITUTED In my opinion, in a complex or particularly nettlesome case where inaccuracies consistently recur, a certain amount of follow up and follow through is necessary to ensure the problem is finally resolved. Yet such follow up and follow through is not part of the Equifax system. As Ms. Spencer testified:
5 6 7 8 9 10 11 12 13 14 15 16 17 Q. And the former addresses were not deleted? A. They were deleted. Well, Im sorry, I only made a comment that she denies -- that the former address and the second former address were denied. It does not appear that they were being deleted. Q. Okay. So based on this report, they were not deleted? A. I dont see the outcome of the credit file. I dont see the final credit file. To my knowledge, from what I can tell, no they were not deleted. Yes, correct, they were not deleted. No action was taken on these segments.

(Spencer, Pg. 99)

14

Ms. Spencer also testified:

6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 Q. And you sent out a CDV with the other Jason Turners information? A. Thats correct. Q. And when they came back, they verified the accounts did, in fact, belong to the other Jason Turner? A. Thats correct. Q. But you did not delete them from the file which now contained our Jason Turners Social Security? A. Thats correct. I was not responsible for the maintenance. I did the investigation. I dont know who did the maintenance. The maintenance person should have reviewed the results of the investigation according to what I had keyed in and asked the credit grantors to provide.

(Spencer, Pg. 123) Ms. Spencer, continuing:

14 15 16 17 18 19 20 21 22 23 24 25 1 2 3 Q. When you changed the credit files date of birth to our Jason Turners date of birth, did you delete the other Jason Turners date of birth from Equifaxs system? A. No. Q. So the other Jason Turners Social Security number and date of birth are still there? A. I was not responsible for the back end. I did not change it. I did key in the information to be changed. What was done at the end, I dont remember. I dont remember if I was the maintenance person at the end fixing all of that that was requested or if someone else was the maintenance person at the end fixing all of what was requested.

(Spencer, Page 126-127) EQUIFAXS DO NOT COMBINE FUNCTION DOES NOT PREVENT MIXED FILES Prominent throughout many of the Frozen Data Scans was the phrase Do Not Combine. This implied that Equifax had an automated function to prevent the mixing of files. But the 1992 Agreement of Assurances with the State AGs defined Mixed Files as, A Consumer Report in which some or all of the information pertains to a person or persons other than the person who is the subject of the Consumer Report. Under this definition, a definition to which Equifax agreed some eleven years ago, the Do Not Combine function neither prevents mixed files, nor is designed to prevent mixed files. As Ms. Fluellen testified:
8 9 10 11 Q. (By Mr. Kittell) Again, this report is a little bit different. It contains the plaintiffs date of birth and address, correct? A. Yes, it does.

15

12 13 14 15 16 17 18 19 20 21 22 23 24 25 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18

Q. But now the Social Security number is changed back to being the other Jason Turners Social Security number, correct? A. Yes, sir. Q. Do you know what prompted that change? A. I see -- well, reporting by creditor. Q. Okay. Just the typical monthly reporting -A. Yes, sir. Q. -- could have changed it back? A. Yes. Q. Okay. We dont see a do not combine on this report anymore, do we? A. No. Q. Do you know when that was removed? A. No. Q. Would that be why this information can flip-flop back between one Social Security number and another because the do not confine has been removed? A. No. Q. Thats not why or does that have any effect on the Social Security number changing? A. No. The do not combine strictly prohibits two credit files from combining to a different credit file. Q. Okay. I guess its your contention that these two credit files havent been combined even though the information from one is appearing with the personal information of the other creditor, I mean, other consumer? A. It doesnt appear to me that theyve been combined. Q. Why do you say that? A. Its the same information, and this man -this procedure, not procedure, but these actions happened before the do not combine was placed on there some time in -- before we saw the do not combine, we saw the Social Security number flopping or changing with the tape reporting. Q. Are you saying that its -A. Im sorry, I havent known the do not combine to prevent the Social Security number from changing. Q. Okay. So what does the do not combine prevent? A. Two individual files from becoming combined, two multiples. Q. So does it prevent an account with one Social Security number from landing on a credit report with another Social Security number? A. No. Q. Okay. So it doesnt prevent that. Isnt that what a mismerge is, a mismerge file when several accounts with -- all related to one Social Security number get merged onto a credit report with another Social Security number?

16

19 20 21 22 23 24 25 1 2 3 4 5 6 7 8 9 10

MR. FRIEDLINE: Objection. A. (By Ms. Fluellen) No. It happens when two different credit files become merged into one. Q. Okay. I dont understand at all. So how does that happen when two credit files get merged into one? A. From my understanding, when we go to or someone requests a copy of the credit file and, for example, a creditor will put in a particular consumers information, if two credit files had, for example, the same name, current address, those two files will become merged into one. Q. Has it ever happened where two people with the same name, but different Social Security numbers can be merged into one file? A. To my knowledge, not in an automated fashion, no.

(Fluellen, Pgs. 123-126)

IDENTIFYING & MEASURING DAMAGES As noted in my preliminary report, Jason Turners privacy was damaged in several ways by the failure of Equifaxs failure to adhere to a proper standard of care. Again, I am discussing damages here in the context of the goals of Fair Information Practices and the harms they were supposed to prevent. After identifying some of the specific damages, I will then propose a preliminary formula for measuring damages. This formula is designed to assist the trier of fact in gauging damages in the relatively new field of FCRA and privacy. The primary guidance for evaluating damages is the statute, which sets forth the CRAs duty to exercise their grave responsibilities with fairness, impartiality, and a respect for the consumers right to privacy. The statute emphasizes the data be handled in a fair, equitable and impartial manner. It also emphasizes that accuracy is paramount, and that inaccuracy is not only is damaging to the consumer, but to the efficiency of the banking system and can undermine public confidence. Another useful guide for evaluating damages is the State Attorneys General agreements (cited above) and the FTC agreements with CRAs. With this in mind, here is a preliminary list of the ways in which Jason Turner was damaged by Equifaxs practices. CATEGORIES OF DAMAGES 1. Discovered that he was inaccurately characterized as person with a terrible credit history, including collection accounts and charge-offs, 2. Discovered/aware that this information was shared with credit grantors 3. Improperly denied credit because of inaccurate information 4. Forced to expend time and energy to correct errors not of his making 5. Chilled from applying for credit 6. Chilled from applying for some jobs 7. Had a very unpleasant problem, not of his making, infect his communications and relationship with his mother 8. Sense of helplessness concerning his own credit history and personal information 17

9. The emotional distress stemming from, and associated, with all of the above Because there was a pattern to Equifaxs errors, and because these errors occurred over a period of time, a formula is needed to measure the extent and impact of the damages. In one recent FCRA case, (Boris v. ChoicePoint: USDC-W.D. Kentucky (Louisville) No. 3:01CV342-H; March 14, 2003) plaintiffs counsel calculated that Plaintiff worried about or was tormented for 15 hours per week, or slightly less than 2.5 hours per day, about inaccuracies in her consumer report. While this is a start, in my opinion, a more robust formula is needed to fairly gauge Jason Turners damages. I propose a formula that takes into account: FACTORS 1. 2. 3. 4. 5. The nature and substance of the above described category of damage Time & energy to solve the immediate problem The expectation that the problem was solved The number of recurrences The period of time over which the problem persists

In essence, the formula would need to assign weights or points to each factor and then multiply Factor (1) by Factor (2); then that result would be multiplied by Factor (3), and then by Factor (4), etc. The purpose is to measure the compounding nature of the damage. Another factor that runs through the calculation, and distinguishes this case from others on which I have worked, was the close relationship between Jason and his mother the latters intense involvement in the discovery of errors and efforts to correct them. To a certain extent, the damages to Jasons mother throughout this process resulted in damages to Jason himself, because of the affairs interference in and alteration of their normal relationship and the emotional distress that this created within the home. For instance, take the first bullet inaccurate characterization. Jason Turners first discovery in May 2000 that his credit report was polluted with the Other Jason Turners (OJT) highly negative collection and charge-off accounts was momentous event, deserving a significant assignment of points under the formula. After all, this was a 17-year-olds first interaction with the national credit reporting system, so the shock value (Bullet #9, emotional distress) was relatively high. Rather than routinely extending him credit, the system falsely branded him unworthy of credit. Further points are assigned because this inaccurate characterization coincided with the unjust denial of credit (Bullet #3), and with being humiliated in front of a friend and a salesman (Bullet #9), and with being unable to do anything about it (Bullet #8). Thus, the formula assigns a relatively large number of damage points for Jason Turners first interaction under Factor #1, as compared to a consumer who only finds a few minor inaccuracies on his credit report which did not result in a denial of credit, humiliation and sense of helplessness. Again unusual is that Jason did not personally expend as much time and energy as victims of mixed files (Factor #2 = low) because his mother did much of the work. However, because of his mothers efforts, he clearly had at one point a high expectation that the problem was solved (Factor #3), and that he finally would be able to obtain credit like a normal consumer. Thus, a second high-impact moment, in which the formula would assign a great many points, is

18

when Jason learned that his expectation was wrong (Factor #3 = High) and that he was still being mischaracterized by Equifax as unworthy of credit (Factor #1= high). If we assume that this was the second time this happened, then Factor #4 = 2. Since several months had gone by between Jasons first and second mischaracterization experience, Factor #5 = moderate. Since these incidents coincidentally involved Category 1 (mischaracterization) and Category 3 (unjust denial of credit), by multiplying Factor #1 by Factors 3, 4 and 5, we see how damages to Jason Turner begin to grow exponentially. As more times goes by, and Jason continues to be mischaracterized, the other categories increasingly come into play. Specifically, categories 5-9 grow in importance, as Jason was chilled from applying for credit and for jobs, the problem increasingly affected his relationship and communications with his mother, his sense of helplessness grew, as did his emotional distress.* (* For examples of emotional distress, see Deposition of Deborah Turner, see Page 9, he is withdrawn; and He has a learning disability, so he doesnt show his emotions a lot. But he doeshe has cried about some things on it, because hes wanted a new car. Page 25, When he sees the offers come in . . . You know, he is scared. ) In my opinion, Categories 5-9 represent serious damages, all of which Jason Turner experienced. For the latter stages of Jasons experience, these categorical damages must be multiplied by Factors #4 & #5, as their were both recurrences and additional passage of time. In applying this formula, one needs to factor in the gravity of those instances in which Equifax supposedly reinvestigated Jasons disputes and even told his mother they would be taken care of, and then repeatedly reported the same or similar inaccurate, derogatory information. Most importantly, the formula needs to assign the appropriate weight to the protection of ones good name, and conversely, the severe damage that is caused to an individual when his good name is unfairly tarnished. Whether it be quotes from Shakespeare, or from Benjamin Franklin, or the fact that identity theft for three consecutive years has been the leading cause of complaints to the FTC, there is abundant evidence that a persons desire to maintain her good name is a fundamental value, and that unfair loss of ones good name is extremely damaging. In my opinion, a fundamental purpose of the FCRA is to ensure that CRAs and credit grantors respect each consumers desire to maintain his good name, and to enable consumers to do something about it when CRAs and credit grantors fail to do so. I emphasize this point because traditionally, damages are tangible and therefore subject to standard methods of measurement: loss of income, loss of time, out-of-pocket expenses, etc. Assuredly, Jason Turner was damaged because he was unjustly deprived of material goods to which he was entitled. But the more profound damage and longer term damage that Deborah Turner observed, was the damage to Jasons good name, and how it seriously hampered his pursuit of happiness. Whether it was applying for credit or jobs, or what people felt about him, or how Jason felt about himself, the inaccuracies in Jasons credit report clearly changed his life for the worse. (By Ms.McCrae)
Q. 22 23 1 2 3 Well get to the specifics later on, Ms. Turner, but I would just like to hear in your own words now how your son has been damaged, and, I mean, in what way, and, frankly, the value that you personally, Im not asking you to tell me

19

4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 0010 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

what your lawyers have told you, but the value that you place on those damages. A. Well, Jason is a very quiet and shy person. He doesnt show a lot of his emotions. But I have noticed that since he -- a lot of this has come about, that he has kind of withdrawn a little bit. He hasnt wanted to apply for things again because he is embarrassed. Q. You mean credit? A. Right. He has been embarrassed about that. Hes just kept to himself a lot about it. He doesnt understand a lot of it. He has a learning disability, so he doesnt show his emotions a lot. But he does -- he has cried about some things on it, because hes wanted a new car. (OFF-THE-RECORD.) A. And so he wanted like a new car or something and he went to apply for one. He was really upset about that, because he went to a place where his friend works, It was his roommate at the time. Q. What is the name of this car place? A. King Acura. Q. Okay. I dont mean to interrupt you, but let me -- you say he doesnt want to apply for things. Is that just for creditor, or is that other things? A. Just apply for credit because hes been turned down so many times, he has kind of like given up. Q. Has he been reluctant to apply for jobs? A. Well, sometimes he has, because some of the applications state they will do a credit background and everything, and so he kind of just throws that one to the side and says, I dont want to go there.

(Deborah Turner Deposition, Pages 8-10) Ms. Turner also testified:

7 8 9 10 11 12 13 14 15 A. I havent thought about any kind of monetary money. I just know its affected him mentally, too. I mean, as far as being afraid that -- you know, once -- Im afraid as he goes on and gets married or whatever, and this happens again, that that will just kind of crush him. But, I mean, I havent put any kind of monetary on that.

20

As described in U.S. PIRGs first report on the FCRA, Nightmare On Credit Street, Or, How The Credit Bureau Ruined My Life, it is difficult to understand the damage to consumers if one fails to go beyond pecuniary matters. Executed This The 18th Day of June 2003, in Bethesda, Maryland. _________________________________ Evan D. Hendricks PO Box 302 Cabin John, MD 20818 (301) 229 7002

21

13.2 Excerpts from Chapter on Damages Resulting from Credit Reporting Errors

22

Excerpted From: Credit Scores & Credit Reports, by Evan Hendricks (Privacy Times, 2004) www.creditscoresandcreditreports.com Chapter 20 Damage & Damages
That doesnt mean that its not actual. It just means that its hard to quantify, but youve had the emotional harm. Why isnt that an actual harm? Justice Antonin Scalia Oral Argument, Buck v. Doe, (December 2003) Trans Union had put Judy Thomas through the wringer. Unbeknownst to her, it had first mixed the negative credit history of Judith Upton into her credit report in 1996. Thomas disputed the errors. Some, but not all of them, were deleted. More inaccuracies returned to her Trans Union (TU) credit report again in 1998, right when Thomas, a Klamath Falls, Oregon realtor, was applying for a mortgage. The episode painfully delayed approval of her mortgage and the purchase of her home, as it took TU months to clear up her credit report. Thomas remembered being in tears, sitting beside her mortgage broker, as the broker tried explaining and re-explaining to a TU phone representative that the bad data did not belong on Thomas report. TU grudgingly cleared up Thomas credit report a second time, and she was able to buy her house. But the experience gnawed at her for many months. After finally finding a pair of experienced lawyers1 to take her case in 2000, Thomas filed suit under the Fair Credit Reporting Act.
Thomas was represented by Robert Sola and Michael Baxter, of Portland, Oregon.
1

282

Credit Scores & Credit Reports

In a quiet moment just days before the start of her July 2002 trial, Judy Thomas was asked, Why did this bother you so much? It wasnt me, she responded. After a four-day trial which delved deeply into TUs standard operating procedures, a federal jury in Portland awarded Thomas $300,000 in compensatory damages and $5 million in punitive damages. The smaller amount was to compensate Thomas for the harm she endured; the latter amount was to punish TU so the company would not do to others what it did to Thomas.2 But What Are The Damages? Normally, when people think of damages in the legal context, they think of lost jobs or broken legs. In fact, when confronted with complaints about credit report errors or other invasions of privacy, the common refrain from the financial services industry and their lawyers is, Yeah, but what are the damages? Thomas case was a watershed because it demonstrated the high value that Americans place on two simple components of privacy in the information age: ones good name, and reasonable control over ones own personal data. If measured in hours, or in out-of-pocket expenses, Thomas damages were relatively small especially considering that the FCRAs statute-of-limitations is only two years.3 But the jury apparently placed profound importance on the humiliation and emotional distress that Thomas endured beThomas v. Trans Union LLC: U.S. Dist. Ct. Oregon No. 00-1150; In a Jan. 29, 2003. Opinion & Order, U.S. Magistrate Judge John Jelderks reduced the punitive damages from $5 million to $1 million, reasoning that the case only warranted a 4-1 ratio of punitive to compensatory damages. He awarded Sola and Baxter roughly $110,000 in fees and costs. 3 Under the 2003 FCRA Amendments, the statute of limitations has been modified and in some cases extended.
2

Damages

283

cause of the unjust besmirching of her good name and the associated hassles. Thats what Congress intended. The FCRA states that the banking system is dependent upon fair and accurate credit reporting, and that inaccurate credit reports directly impair the efficiency of the banking system, and unfair credit reporting methods undermine the public confidence which is essential to the continued functioning of the banking system. The FCRA also states, There is a need to insure that CRAs exercise their grave responsibilities with fairness, impartiality, and a respect for the consumers right to privacy. To achieve this, the FCRA provides for actual damages for negligent violations. Actual damages include out-of-pocket expenses, financial harm and emotional or mental distress. To recover for the latter, a consumer generally needs to provide evidence that he or she actually experienced distress. Such evidence can come in the form of credible testimony or medical or other records. The FCRA also provides for punitive damages for willful violations, which are intended to deter companies from making such violations by punishing them if they do. Courts have generally agreed that willful means that the company should have known better, that it either consciously or recklessly disregarded a consumers rights. Finally, the FCRA provides for attorneys fees when the consumer is the prevailing party. Some Dont See The Damage However, the What-Are-The-Damages syndrome still plagues consumers who try to stand up for their rights under the FCRA. Contrast Thomas experience with that of Mary Harris, a Texas resident whose credit report had been fouled, off-and-on for 16 years, by the negative history of another Mary Harris, who lived in South Carolina.

284

Credit Scores & Credit Reports

Mary Harris first discovered her Equifax file was mixed in 1986 when her husband told her that their mortgage application for a South Carolina home had been held up because of her bad credit. With the help of some in-laws, one of whom was a state judge and the other an employee of a credit bureau, Harris was able to dispute the errors and remove the inaccuracies. In 1996, again applying for credit, Harris learned that more bad data from the other Mary Harris had returned to her credit report. This time when she called Equifax, Harris said an agent told her that Equifax merely reported the information creditors provided them and it was not Equifaxs job to investigate errors. The agent told Harris that she had to contact the creditors, convince them to stop the errors, and direct Equifax to delete them. Not knowing her rights to demand an investigation, Harris contacted Sears, Household Credit, Lane Bryant and Discover Card, all of whom eventually agreed that mistakes did not belong on Harris report, and advised Equifax to delete them. In 1999, Harris and her husband had already sold their farm in Louisiana and applied for a mortgage for a home in Texas. But the same negative accounts were back on her credit report, and their application was declined. Under a tight deadline, the Mary and her husband had to redo the application so it was strictly in the husbands name. After staying in a camper on a fretful Sunday night in Houston, the Harrises learned that the husband-only application had been approved. In 2002, after applying for a home equity loan, Harris learned that the Sears, Household, Discover and Lane Bryant accounts had returned, along with American Express, MBNA, Providian and a collection account that was not hers. Inaccuracies also persisted in her name and address. This time the report was issued by CSC Credit Services, an Equifax affiliate that services Texas and other states in the South and Midwest. While CSC handles consumer disclo-

Damages

285

sures and requests for reinvestigations, it relies on the Equifax database for credit reports. Throughout 2002 and into 2003, credit report errors repeatedly prevented the Harrises from getting the best rates on home equity loans or refinancing packages at a time when those rates were heading to historic lows and millions of consumers were benefiting. Throughout the entire period, the situation was putting a great deal of stress on their relationship. Somebody, Help Me Harris finally complained about Equifax to the Texas Attorney General in the June of 2002, which tries to resolve complaints informally but does not have the authority to issue orders in individual cases. In October 2002, the office advised Harris that it had tried to contact Equifax on several occasions. Regretfully, we have not received any response to our inquiries, wrote Bach Stephens, a complaint analyst in the Houston office of Texas AG John Cornyn. Informal complaint resolution is not effective when a business does not respond. Therefore, we must close the file at this time. Stephens suggested that Harris might want to talk to an attorney. Harris finally did, and filed suit in federal court in Galveston.4 Initially, U.S. District Judge Sam Kent expressed disbelief that the inaccuracies could drag on for so long, Harris said. Judge Kent was considered friendly to plaintiffs, having heard many cases involving oil rig workers who were injured during explosions and other accidents in the Gulf of Mexico. Mary Harris thought she would finally get her day in court. She did kind of.

Harris was represented by Houston-area attorneys Steven L. Parker, and Jack and Jordin Nolan.

286

Credit Scores & Credit Reports

At her May 2003 trial in Galveston, about 40 minutes into her testimony, Judge Kent appeared to grow impatient. Harris said he interrupted her testimony, and curtly asked her to list her out-of-pocket expenses. Kent wrote them down and then ordered her lawyers, and the Equifax lawyers into his chambers. Symbolically, Harris was left sitting on the witness stand alone in the court room. Back in his chamber, in no uncertain terms, Judge Kent then advised her lawyers that he did not want to hear any more of her testimony, and advised them to settle the case right then and there. Harris felt she had no choice, and settled.5 She got the impression that Judge Kent did not think the credit denials, the ongoing hassles and the emotional distress were all that damaging. She also got the impression that Judge Kent would not even consider whether Equifax was liable for punitive damages, recalling that she understood him to say something to the effect that he didnt have authority to punish Equifax.6 Her long-awaited day-in-court aborted, Harris stood outside the Galveston courthouse, visibly shaken, and in tears. Help me! she said, sobbing softly. We are raised to believe that our legal system will protect the innocent. If the federal court cannot enforce the FCRA laws, then who can? she asked. Looking backs months later, Harris, commented on the power that CRAs have over consumers. Equifax controls our lives more than our own government. Equifax controls whether we have employment, housing, transportation, clothing, food, and most important, a good reputation with total and complete disregard to accuracy and accountability.

5 6

The terms of the settlement were confidential Mary M. Harris v. Equifax Information Services, L.L.C.: U.S. Dist. Ct. S. Dist. of Texas (Galveston) No. 02-CV-753. Harris attorneys waived a jury trial and opted for a bench trial.

Damages

287

She expressed concern that actions like Judge Kents had the effect of giving Equifax the green light to conduct business under its own rules, and reduced its incentive to comply with the FCRA. Privacy, Credit Reporting & FIPs Actually, there is an extensive body of research confirming that, for most people, it is very damaging to suffer the kinds of privacy invasions stemming from credit reporting, including inaccuracies and mixed files, impermissible access and disclosures, identity theft, failure to correct errors and reinsertion of previously deleted data. Its important to understand that credit reporting is a privacy issue because privacy in the modern age is defined and evaluated according to principles of Fair Information Practices (FIPs). These principles, which serve as the foundation for most privacy laws in the United States and abroad, encompass access and correction, data accuracy and integrity, purpose specification and use limitation, data security, transparency and enforcement.7
7

In 1980, the Organization of Economic Cooperation and Development (OECD), based in Paris, adopted the following eight principles of fair information practices, still referred to by some experts as the "Gold Standard" of privacy. These principles were endorsed by the Governments of the United States, Japan and most Western European countries in an OECD international accord. These principles effectively have been recognized by the United Nations in its work on privacy: (1) Collection Limitation; (2) Data Quality; (3) Purpose Specification; (4) Use Limitation; (5) Security Safeguards; (6) Openness (7) Participation and (8) Accountability. Also see Personal Privacy In The Information Age: The Report of the Privacy Protection Study Commission, (July 1977; GPO Stock No. 052003-00395) Herein referred to as the PPSC Report. The three general FIP principles endorsed by the PPSC were: (1) minimize intrusiveness; (2) open up record-keeping operations in ways that will minimize the extent to which recorded information about an individual is itself a source of unfairness in any decision about him made

288

Credit Scores & Credit Reports

The U.S. Privacy Protection Study Commission, in its 1976 report, noted the link between third-party recordkeepers, privacy and the rights of individuals. The intrusiveness, unfairness and unrestricted disclosure characteristic of so much organizational record keeping today is largely the result of weaknesses in the relationship between the individual and those who need to know intimate details of his life . . . As long as America believes, as more than a matter of rhetoric, in the worth of the individual citizen, it must constantly reaffirm and reinforce its protections for privacy, and ultimately the autonomy, of the individual.8 In fact, Equifax explicitly recognized the importance of Fair Information Practices principles in its groundbreaking, 1990 public opinion survey, entitled, Equifax Report on Consumers In The Information Age9
on the basis of it (maximize fairness); and (3) create legitimate enforceable expectations of confidentiality. Also see The 1973 Report of the [HEW] Secretarys Advisory Committee On Automated Personal Data Systems. The five FIP principles set forth by the HEW task force were: (1) there must be no personal data recordkeeping systems whose very existence is secret; (2) there must be a way for an individual to find out what information about him is in a record and how it is used; (3) there must be a way for an individual to prevent information about him obtained for one purpose from being used or made available for other purposes without his consent; (4) there must be a way for an individual to correct or amend a record of identifiable information about him; and (5) any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take reasonable precautions to prevent misuse of the data. 8 Personal Privacy In An Information Society, Op. Cit., 9 Equifax Report on Consumers In The Information Age, ( Equifax 1990), A national opinion survey conducted for Equifax, Inc. by Louis Harris & Associates and Dr. Alan F. Westin, professor of public law and government, Columbia University. Westin has served as a consultant to Equifax for several

Damages

289

However, despite extensive literature on the subject, there is not general familiarity with it outside of a small community of privacy experts and consumer advocates. Starter List of Harms Heres the short list of the ways in which consumers are damaged by inaccurate credit reports, non-responsiveness and faulty reinvestigations by CRAs and furnishers. Inaccurate data can lead to the unjust denial of credit or insurance In the age of risk-based pricing, inaccuracies can result in the granting of credit or insurance on less favorable terms. Attempting to correct inaccuracies can be timeconsuming, causing a loss of time, energy and opportunity. Often the most profound damage that consumers suffer is the emotional distress that accompanies: the discovery of inaccuracies in ones credit report; and/or the frustrating process of trying to correct errors that were to not of ones own making; and/or the unjust denial of credit; and/or of being told that false information has been verified, and/or that information that was previously deleted as inaccurate was reinserted without notice.

With identity theft, all of the above damages apply, compounded by the fact that a criminal is joyriding on your good credit, ruining your name.

years since the 1990 report. He was a special consultant to the PPSC and a member of the 1973 HEW Advisory Task Force.

290

Credit Scores & Credit Reports

History Offers Abundant Evidence One of the first recognized harms resulting from inaccurate data is the unjust denial of credit, insurance or employment. A 1994 House Banking Committee report on FCRA legislation said that an immediate damage from "inaccurate credit reports" was that they "can impede the ability of too many consumers to obtain credit or other benefits." Referring to the 1989 Williams study and the 1991 Consumers Union study, the Committee further specified why inaccuracies are damaging: "Both studies defined serious errors to mean those that could, or did, cause the denial of credit, employment or insurance." Similarly, the 1998 US PIRG report stated: In many instances, credit report errors cause consumers considerable harm. The results of mistakes can range from the rejection of a credit card application to the denial of a job. Also, errors often cause consumers to spend weeks sometimes years calling creditors, writing credit bureaus, and worrying anxiously in an effort to remove the inaccurate information from their record. One California victim of credit fraud who contacted PIRG was denied financing on her new car, even after she had contacted all three credit bureaus numerous times about the mistaken delinquencies on her credit report. Another California man had to hire an attorney to send a letter to the credit bureaus, "stating that I am who I am," before he could finally get a stranger's bad credit accounts removed from his credit report. While credit report errors almost always lead to a little consumer hassle, they also can create a ticking

Damages

291

time bomb waiting to wreck an unsuspecting consumer's good name at any moment. As Trans Union's Web site points out, a negative credit history will lower the credit score. A lower credit score means that a consumer will not be able to obtain credit or insurance, or will only be able to obtain them on less favorable terms. The damage of inaccurate credit reports will become clearer to more and more consumers because in the era of risk-based pricing, the credit score will define the terms of credit. As we said before, the lower the credit score, the worse the interest rate or insurance premium. Time Lost The process of cleaning up an inaccurate credit report can be time-consuming. In its 1994 report, the House Banking Committee wrote, "Compounding this high error rate problem is the difficulty that consumers face when they attempt to correct inaccurate or incomplete information contained in their credit files. The Committee cited the 1991 US PIRG study, based on the review of 155 consumer report complaints on file with the FTC, which found that the average duration of complaints against CRAs was 22.5 weeks, or nearly 6 months. The 1991 PIRG report was entitled "Don't Call; Don't Write; We Don't Care." Not Responsive The dispute correction process is prolonged when the CRAs are not responsive. This is what one unnamed consumer told US PIRG for its 1990 report: After 5 1/2 months of phone calls and letters, the CRA has absolutely refused to rectify the

292

Credit Scores & Credit Reports incorrect information on my report. . . I have submitted comments from institutions and from my own records that should clearly show that their report is incorrect. . . This has caused me untold humiliation and embarrassment with banks and credit agencies from which I have tried to obtain credit.10

Nancy Ross, a Washington Post writer, had a similar experience: For the past two years, I have been the victim in a case of mistaken identity that has ruined my credit rating. Despite my efforts to rectify the situation, I'm beginning to fear that my epitaph may read: 'Here lies a deadbeat.'11 On October 3, 1989, Privacy Times ran a lengthy story based on consumer complaints to the FTC regarding credit bureaus. One consumers letter referred to the frustrating and time-consuming nature of fixing the problem. "[It] looks like another round of letters is in order," the consumer wrote. The article noted that in several complaints, consumers referred to their attempts to correct errors as "humiliating and frustrating" experiences. One outraged consumer said 30 days after he had submitted corrections to TRW he received a reply stating that his "disputes are frivolous or irrelevant. Therefore, they will not be reinvestigated." After a year, the consumer was convinced that TRW was violating the FCRA, but said he was "powerless to obtain their compliance," explaining, "The FTC advised me to seek private council (sic) and pursue a civil action, while, at the same time, the FTC advised me that they would short10

"Nightmare On Credit Street, Or, How The Credit Bureau Ruined My Life," U.S. PIRG, June 12, 1990 11 Ross, Nancy, Washington Post, May 31, 1990

Damages

293

ly' file an action against TRW for 'similar' and other violations of the FCRA.' The Center for Law in The Public Interest advised me this was 'not the kind of case they do.' The law firm of Allred, Maroko, Goldberg & Ribicoff declined the case because the firm has 'no expertise in the field.' A meeting with an attorney provided by the L.A. County Bar Association, yielded that opinion that 'it would be timeconsuming and too costly to litigate.'" The 1993 US PIRG report, based upon consumer complaints to the FTC, found that 16% of "corrected" errors subsequently reappeared and that the average consumer had already contacted the credit bureau 3.6 times by phone call or letter without satisfaction before contacting the FTC. The 1998 US PIRG Report found that CRA nonresponsiveness relating to basic communications and simple access to their consumer reports continued to cause frustration to a significant percentage of consumers. Moreover, inaccuracies continued to cause damage: If a consumer's credit report is inaccurate, she may appear to be a bad credit risk because of a variety of factors: because she appears to have been delinquent on accounts that she was never late on, because she looks like she has too many credit accounts open at one time, because she has court judgments against her that are actually against a stranger, or many other unfortunate scenarios. Credit report errors can cause the denial of not only credit, but also employment, insurance, housing or even the right to cash a check, use a debit card or open a bank account.. . . The most valuable thing we have is our good name. Parallel With Identity Theft As mentioned before, identity theft is a subcategory of Mixed Files, as the imposter-generated data are mixed

294

Credit Scores & Credit Reports

into the consumer report of the innocent victim. Thus, the damages arising from identity theft, as they pertain to the interaction between consumers and CRAs, are similar to the damages arising from Mixed Files. In July 12, 2000 testimony before the Senate Judiciary Subcommittee on Technology, Terrorism and Government Information, Jodie Bernstein, then head of the FTC's Bureau of Consumer Protection, testified: The leading complaints by identity theft victims against the consumer reporting agencies are that they provide inadequate assistance over the phone, or that they will not reinvestigate or correct an inaccurate entry in the consumer's credit report. In one fairly typical case, a consumer reported that two years after initially notifying the consumer reporting agencies of the identity theft, following up with them numerous times by phone, and sending several copies of documents that they requested, the suspect's address and other inaccurate information continues to appear on her credit report. In another case, although the consumer has sent documents requested by the consumer reporting agency three separate times, the consumer reporting agency involved still claims that it has not received the information.12 In her March 7, 2000 testimony before the Subcommittee, Bernstein elaborated further: A consumer's credit history is frequently scarred, and he or she typically must spend numerous hours sometimes over the course of months or even years contesting bills and straightening out credit reporting errors. In the interim, the consumer victim may be denied loans, mortgages, a driver's license,
12

www.ftc.gov/os/2000/07/idtheft.htm

Damages

295

and employment; a bad credit report may even prevent him or her from something as simple as opening up a new bank account at a time when other accounts are tainted and a new account is essential. Moreover, even after the initial fraudulent bills are resolved, new fraudulent charges may continue to appear, requiring ongoing vigilance and effort by the victimized consumer. . . . Identity theft victims continue to face numerous obstacles to resolving the credit problems that frequently result from identity theft. For example, many consumers must contact and recontact creditors, credit bureaus, and debt collectors, often with frustrating results.13 The General Accounting Office wrote in one of if its first reports on identity theft in 1998: Identity theft can cause substantial harm to the lives of individual citizens -- potentially severe emotional or other non-monetary harm, as well as economic harm. Even though financial institutions may not hold victims liable for fraudulent debts, victims nonetheless often feel 'personally violated' and have reported spending significant amounts of time trying to resolve the problems caused by identity theft -- problems such as bounced checks, loan denials, credit card application rejections, and debt collection harassment," it wrote.14

13

Prepared Statement of Jodie Bernstein, Director of Consumer Protection, FTC; http://www.ftc.gov/os/2000/03/identitytheft.htm 14 (Identity Theft: Available Data Indicate Growth in Prevalence & Cost, GAO-02-424T, (www.gao.gov/new.items/d0242t.pdf)

296

Credit Scores & Credit Reports

FTC 2003 Survey In its September 2003 survey, the FTC found that the longer it took to discover the identity theft the greater the damages. While 63% had no out-of-pocket losses, victims reported a wide range of problems, including wrongful bank and credit card charges, harassment by collectors, loan or insurance rejection, cut off of utilities, civil lawsuits, and criminal investigations. The FTC also found that credit bureaus were instrumental in gauging damage to victims. Among those victims who contacted a credit bureau, 58% said they were either very or somewhat satisfied, while 29% said they were somewhat dissatisfied and 9% said they were very dissatisfied. Of those consumer who contacted all three major credit bureaus, 49% said they were satisfied with all three, 20% said they were satisfied with some of them, and 31% said they were dissatisfied with all three. Mental & Emotional Distress Whether it be inaccuracies resulting from a mixed file, or identity theft, many of the studies above have alluded to what might be the worst damage to consumers: mental and emotional distress. It is evident in the testimony of victims that we cited in previous chapters. Here is what two victims of mixed files described it in U.S. PIRGs 1990 report, "Nightmare On Credit Street, Or, How The Credit Bureau Ruined My Life" Michael Riley, Time Magazine. "Suddenly, the credit-travel enticement had turned into a Kafkaesque nightmare of mistaken identities, computer screw-ups and human errors, all spilling out of the vast and powerful credit-reporting system . . . not only was my credit a disaster, I was officially dead." (Time Magazine, April 9, 1990.)

Damages

297

Unnamed Consumer. "Early part of last year I was denied because of wrongful report. . . This past December. . . I was denied again . . . I was furious as this was to have been corrected the first time. . . There are exactly seven accounts that do not belong on here and I want them removed for good. On January 23rd of this year I received my credit rating and again they have many accounts incorrect." This author, along with other privacy experts, not surprisingly has observed that invasion of privacy causes emotional distress. It is distressful to learn first hand through no fault of your own how your good name and credit history is tarnished by the derogatory credit data of a complete stranger. It is distressful to find that, despite repeated efforts on your part, a credit bureau continuously fails to delete inaccurate or unverifiable data from your report, or a creditor continues to report false data. It is distressful to find that information, previously deleted because it was inaccurate, was inexplicably reinserted into your consumer report. It is distressful to be wrongly associated with highly derogatory credit data, and to have to clear your name. It also takes time and energy to try to correct the problem, often involving numerous phone calls and letters. Its distressful not knowing everyone who may have associated you with highly derogatory credit data. It can be difficult to maintain constructive personal relationships under stress.15 It can be difficult to perform adequately at one's job. ITRC Study In September 2003, the Identity Theft Resource Center (ITRC) published research that enumerated the many harms that victims suffer, and concluded that the emotional
15

In fact, the insurance industry says that stress, stemming from financial problems, can cause auto accidents, and therefore justifying its use of credit reports in setting insurance rates.

298

Credit Scores & Credit Reports

distress might be the worst of all. In the largest survey of its kind, the ITRC surveyed 173 actual victims of identity theft, and then had two experts review their responses.16 One was Paul Colins, a credit industry analyst. The range of emotions is wide and rather painful to read. Threefourths of victims were left with a feeling of financial insecurity, 88% experienced anger, and 75% expressed a feeling of helplessness, Colins commented. While these feelings do appear to subside a little over time, the survey clearly shows for many victims the feelings linger on. While most surveys have focused on the financial costs to victims, these psychological impacts are generally unreported. They may, however, have far worse consequences for victims.17 Dr. Charles Nelson, a licensed psychologist, and director of both the Crime and Trauma Recovery Program and the Family Treatment Institute, also reviewed victims responses. Identity theft has been classified in many realms as a victimless crime, Nelson wrote. This survey was designed to test the emotional impact of identity theft and to discover if sufferers of this crime exhibit similar responses as those of more commonly recognized victims including rape, repeated abuse, and violent assault victims. Many of the listed symptoms are classic examples of Post Traumatic Stress Disorder and secondary PTSD (from secondary wounding).18 While each crime has its own specific triggers and emotional responses, upon examination of these results, this study clearly proves that the impact of identity theft on its victims leaves similar scars and long-term impact as demonstrated by victims of violent crime.

16

Identity Theft: The Aftermath 2003, Identity Theft Resource Center (Sept. 2003); http://www.idtheftcenter.org/idaftermath.pdf 17 Id. 18 Id.

Damages

299

This comes as no surprise to victims of identity theft. Although there is no direct physical injury in this crime, identity theft victims know all too well the psychological, emotional, and social destructive swath of pain that has been cut through their lives. Furthermore, it is clear that this crime has a ripple effect on the relationships in the victims lives. This study found that numerous victims of this crime suffered a significant strain in the relationship with their significant other. Anecdotally, during ITRC focus groups victims have shared that this crime was a major contributing factor in a divorce due to the intense strain on one or both of the partners, he continued. Nelson noted that some ID Theft victims said they felt dirty or defiled, guilty, ashamed or embarrassed, being an outcast, undeserving of assistance or having brought this crime upon myself responses similar to the ones we saw after an extensive media information campaign on rape and sexual assault prevention. Consumers are being told that they are the responsible party, if a crime occurs. Top ten lists of how to avoid victimization add to this perception, he wrote. For the self-blaming response to stop, victims need to learn that they are not the responsible party for this crime. Victims are victims, each with his or her own fingerprint of painful responses to the crimes committed. There are commonalities within the victimization responses found in each category of crime victims. This study discovered that there are also far more response similarities that identity theft victims share with ALL victims than previously realized.19 It Shows In The Statistics The high value that Americans place in protecting and preserving their good names is reflected in FTC complaint statistics. As the 1993 U.S. PIRG studies revealed,
19

Id.

300

Credit Scores & Credit Reports

in the early 1990s, the leading cause of complaints to the FTC was inaccuracy in credit reports. Notice how complaints about mistakes, which do not always involve out-of-pocket loss, outpaced other categories which did entail loss of money. 1. Credit Bureaus (30,901); 2. Misc. Credit (22, 729); 3. Investment Fraud (12,809); 4. Equal Credit Oppt. (11,634); 5. Automobiles (6,901); 6. Truth-In-Lending (6,303); 7. Household Supplies (5,835); 8. Recreational Goods (5,747); 9. Mail Order (4,687) 10. Food/Beverage (2,738). Starting in 2000, and continuing for four consecutive years, complaints about identity theft far exceeded all other categories. Again, notice how an issue that is more concerned with ones good name than it is with out-ofpocket loss, far exceeded categories where consumers lost money. Here are the 2001 numbers: 1. Identity Theft (42%); 2. Internet Auctions (10%) 3. Internet Services and Computer Complaints (7%) 4. Shop-at-Home and Catalog Offers (6%) 5. Advance Fee Loans and Credit Protection (5%) 6. Prizes/Sweepstakes/Gifts (4%) 7. Business Opportunities &Work at Home Plans (4%) 8. Foreign Money Offers (4%) 9. Magazines and Buyers Clubs (3%) 10. Telephone Pay-Per-Call/Information Services (2%)20

20

http://www.ftc.gov/opa/2002/01/idtheft.htm

Damages

301

The 2002 numbers were 43% of the complaints, identity theft, and 13%, Internet Auctions.21 For 2003, 42 % of the complaints were about identity theft. The FTC received more than half a million complaints in 2003, up from 404,000 in 2002.22 A Formula For Identifying and Measuring Damages In a 2003 FCRA case,23 plaintiffs counsel calculated that Plaintiff worried about or was tormented for 15 hours per week, or slightly less than 2.5 hours per day, about inaccuracies in her consumer report. While this is a start, in my opinion, a more robust formula is needed to fairly gauge damages. It seems logical that since we are relying so heavily on credit scores to summarize a consumers creditworthiness, we also should have a scoring model for measuring the damages and costs to consumer caused by defects in the national credit reporting system. Perhaps such a scoring model would finally help the financial services industry appreciate the extremely damaging nature of credit report inaccuracy. To that end, this author in 2003 unveiled the following proposed methodology, which first requires one to identify the applicable categories of damage in the given case, and then determine which of the factors listed below are appropriate multipliers.24

http://www.ftc.gov/opa/2003/01/top10.htm http://www.ftc.gov/opa/2004/01/top10.htm 23 Boris v. ChoicePoint: USDC-W.D. Kentucky (Louisville) No. 3:01CV-342-H; March 14, 2003 24 Prepared Statement of Evan Hendricks, The Accuracy of Credit Report Information and the Fair Credit Reporting Act, Senate Banking Committee; July 10, 2003 http://banking.senate.gov/03_07hrg/071003/index.htm; and, Presentation of Evan Hendricks, Information Flows: The Costs and Benefits to Consumers and Businesses of The Collection and Use of Consumer
22

21

302

Credit Scores & Credit Reports

Some Categories of Typical Damages/Costs of ID Theft & Inaccuracy (1) Inaccurately described as deadbeat to third parties (2) Improperly denied credit because of inaccurate data (3) Expended time and energy to correct errors not of ones making (4) Wrongfully received debt collection calls (5) Chilled from applying for credit (6) Sleeplessness, physical symptoms (7) Sense of helplessness, loss of control over personal data (8) The emotional distress stemming from, and associated, with all of the above I propose a formula that takes into account the following factors. FACTORS 1) 2) 3) 4) 5) The nature and substance of the category of damage Time & energy to solve the immediate problem The expectation that the problem was solved The number of recurrences The period of time over which the problem persists

In essence, the formula, like a credit scoring model, would need to assign weights or points to each factor and then multiply Factor (1) by Factor (2); then that result would be multiplied by Factor (3), and then by Factor (4), etc. The purpose is to measure the compounding nature of the damage. As a preliminary example, take the Category 1 inaccurate characterization. Lets say John Doe, a victim of identity theft, discovers in January 2001 that his credit report
Information. Federal Trade Commission National Workshop; June 18, 2003. http://www.ftc.gov/bcp/workshops/infoflows/030618agenda.html