WASHINGTON, D.C.—Chairman John D. (Jay) Rockefeller IV yesterday sent a letter to Experian as part of his ongoing investigation into the data broker industry. Thus far, Experian has refused to fully respond to questions about identities of customers who purchase its data and specific sources of its data, as requested by Rockefeller’s October 9, 2012 letter to nine data brokers when he launched the investigation.

Rockefeller’s letter requests specific information about Experian’s vetting practices for customers and how it shares sensitive consumer data with them, in the wake of recent news reports that have raised alarms about practices of Experian subsidiary Court Ventures. The letter also requests a list of every entity to which Experian has sold or given data, and every source of that data, so the Committee can understand how consumer information is used.

Read the letter here.

A recent investigation by a prominent security reporter, Brian Krebs, alleges an Experian subsidiary Court Ventures sold data to an identity theft scheme. According to these reports, an alleged identity theft operation bought sensitive consumer data it used for this scheme from Court Ventures, which Experian acquired in March 2012. These purchases reportedly continued after Experian’s acquisition of Court Ventures until Experian was notified by the Secret Service that a customer was purchasing its data for possibly illegal purposes.

Rockefeller believes these allegations raise serious questions about Experian’s practices for vetting its customers and sharing consumer data. Rockefeller has said from the beginning of the investigation that his goal is to help consumers understand how their personal information is collected and sold to marketers. He wants to give consumers the ability to make informed decisions when sharing personal information.

Rockefeller wrote: “The Committee’s investigation has focused to date on how companies including Experian collect and sell consumer information for marketing purposes, while the information Experian reportedly sold to identity thieves – such as Social Security numbers and banking information – appears to be data Experian collects and sells for risk assessment activities. However, if these recent news accounts are accurate, they raise serious questions about whether Experian as a company has appropriate practices in place for vetting its customers and sharing sensitive consumer data with them, regardless of the particular line of business.”

In October 2012, Rockefeller launched an investigation into the data broker industry to give consumers a better understanding of how their personal information may be collected, shared, and used. Rockefeller expanded the investigation in September 2013 when he sent letters to twelve popular personal finance, health, and family-focused websites. He requested their assistance in his ongoing investigation into the way data brokers collect and share a consumer's personal information. Rockefeller expects this latest effort will help to further illuminate how data brokers collect and handle information.

###