The Certegy Data Misappropriation Case

Introduction

Created in 2001, Certegy sought to empower check users by insuring checks written to merchants. Certegy did not use credit or bank records, instead Certegy’s algorithm used artificial intelligence to predict whether a check would bounce. A merchant who subscribed to Certegy’s check verification service would enter the check information and would receive notification as to whether this check was insured by Certegy. If the check was insured and bounced, Certegy reimbursed the merchant. The system was far from perfect; many customers had $10 checks declined with $100,000 in their bank accounts. Often, the reason was that no significant history had been established by the check writer.

On July 3, 2007, Certegy announced that one of its employees had misappropriated 8.4 million records over a five-year period and sold that data to marketers. A class action lawsuit was brought against Certegy. In September 2008, a settlement was approved by a federal judge. The settlement provides for a range of credit monitoring services and reimbursement of expenses for those whose identity was stolen. All that Certegy is required to pay under the terms of the settlement are the legal fees and credit and bank monitoring fees for members of the class, amounting to less than $5 million.

Was Certegy guilty of any crime? If so, what crime? Was there negligence on their part? Most importantly, were there any damages?

Discussion

1. Was there any violation of law when the data was sold to marketers?

Surprisingly, there is no single source of privacy rights in the U.S. governing personal information in privately owned computer data banks. Instead, there is an extensive patchwork quilt of federal and state laws governing personal privacy. In 1999, President Clinton signed into law the Financial Services Modernization Act (otherwise known as the Gramm-Leach-Bliley Act). The act requires that financial institutions may not disclose a consumer's nonpublic personal information to nonaffiliated third parties, unless the consumer is given clear notice of this possibility, and an opportunity to opt out of such disclosures before they occur.

Is a check writer a consumer of Certegy’s service? Technically, the merchant is Certegy's consumer; a contract exists between Macy’s and Certegy, not between John Doe and Certegy. Nevertheless, it is logical to assume that John Doe is also a consumer of Certegy’s product. John directly benefits from Certegy's service in that the merchant is now willing to accept his checks.

2. Was Certegy negligent?

Although the intrusion was not an external one, Certegy was negligent on two counts. First, there was no need for any data to be stored on Certegy’s computers. Certegy’s algorithm based its decision on a number of factors, none of which had anything to do with this specific check writer’s history with Certegy. Thus, John Doe, a first time Certegy user, has the same chances of having his check approved as Jane Doe, a frequent check writing Certegy customer. The act of storing the information is per se negligent because Certegy should have anticipated that data might be misappropriated. The rebuttal to this argument – the data was saved automatically through no affirmative action of Certegy – is both weak and fatalistic. Computers do as they are told; if Certegy’s computers saved the data, that is because their programming told them to do so.

Second, Certegy was negligent by giving the keys to the kingdom to its employees. Although their network was secure from external threats, perhaps the overemphasis on external security caused them to neglect guarding against internal theft. Certegy should have ensured that a system of checks and balances existed. No one person should have had access to this data without oversight by some committee. The system Certegy had in place was insecure and was begging to be compromised.

3. What damages occurred?

In Smith v. Chase Manhattan Bank, the court held that misappropriated data used to offer products and services to class members which they were free to decline, did not qualify as harm. Moreover, no harm exists where a class member cannot prove that he suffered actual harm due to the receipt of an unwanted telephone solicitation or a piece of junk mail.

Although at first glance the Certegy case seems similar to Chase, a closer look distinguishes it from Chase. In Certegy, the data was sold to a company who in turn sold this data to other marketing firms that were being investigated by the FTC for marketing and telemarketing fraud. One of the companies was running a scam with the data it received where they would contact consumers with a compelling offer for some largely worthless gifts in exchange for accepting a free trial in a discount-shopping club. After tricking the consumers into providing their bank account numbers, the company would make unauthorized debits.

In Forbes v. Wells Fargo Bank, although the court found that the personal time and money spent by the class in monitoring their financial accounts against potential loss due to data misappropriation "was not the result of any present injury, but rather the anticipation of future injury that has not materialized", using the argument mentioned above, it would seem that the Certegy data theft was a ‘present injury’ unlike the future injury in Forbes. In the Certegy case, the data had been delivered to unscrupulous marketing corporations who used the data for their nefarious schemes. A possibility exists that these firms may in turn pass along this sensitive data to others who might attempt to take out bank loans or open credit cards with this information. Thus, the affected class members are not simply taking steps to avoid future injury; they were aware of a clear and present danger and are therefore entitled to seek reimbursement for their damages from defendant Certegy.

Conclusion

Although no actual financial fraud took place as a direct result of the data misappropriation, had this case gone to trial, Certegy would have been found to have negligently violated the Financial Services Modernization Act.

-- DavidMehl - 26 Apr 2010