ChoicePoint Settles With 44 States in Data Losses
Data broker ChoicePoint agreed Thursday to pay $500,000 to 44 states as part of a settlement stemming from a 2005 data breach at the Alpharetta, Ga.-based company. The breach involved more than 160,000 records.
Context & Ripple Effects
ChoicePoint's 2005 breach exposed more than 160,000 consumer records sold through its data-broker business, and the company has been paying for it ever since — this $500,000 payment to 44 states closes out the states' share of the reckoning. What makes the settlement notable is who extracted it: not Congress or a federal regulator, but a coalition of state attorneys general acting in concert.
Syndicated coverage captured the mood at the time — Ars Technica's take was that the state AGs were doing the work while "Congress twiddles thumbs" on breach-notification legislation, which is exactly why this settlement matters beyond its dollar amount.
First-order effects
- ChoicePoint pays $500,000 to 44 states and accepts ongoing scrutiny of its security practices, converting a one-time 2005 incident into a standing compliance obligation across nearly the whole country.
- State attorneys general establish themselves as the enforcement venue of record for data-broker breaches, since the settlement shows 44 offices can act as a single negotiating bloc.
Second-order effects
- Other aggregators of consumer data now price multi-state attorney-general action into their risk models, because the coalition format demonstrated here scales to any broker whose records cross state lines.
- Breach costs begin migrating from customer notification alone toward regulatory settlements, changing the calculus of how much a data broker invests in vetting who buys its data.
Third-order effects
- If federal breach legislation stays stalled, state AG coalitions become the de facto national privacy regulator — an enforcement structure built case by case through settlements like this one rather than by statute.
- Data brokerage as a business model starts carrying a structural liability premium: firms that aggregate personal records hold them under terms set by whichever states choose to sue, not by a single national rule.
The trend: In the absence of a federal breach law, coordinated state attorney-general settlements are hardening into America's working privacy-enforcement regime, one data-broker breach at a time.