On June 10, 2020, the Federal Trade Commission announced that it had reached a $220,000 settlement with Kohl’s Department Stores, Inc., resolving allegations that the company violated Section 609(e) of the Fair Credit Reporting Act, 15 USC § 1681g(e), which requires companies to provide to victims of identity theft with all business transaction records evidencing fraudulent transactions made in a victim’s name within thirty days of the victim’s request.
According to the FTC’s complaint, beginning in 2017, Kohl’s instituted a policy of denying requests for fraudulent transaction records unless the requests were made by law enforcement or by a victim’s attorney. The FTC alleged that Kohl’s failed in some instances even to deny victims’ requests within thirty days, and did not correct its conduct until six months after receiving a Civil Investigative Demand from the FTC.
This is the first enforcement action that the FTC has brought pursuant to Section 609(e), which was added to the FCRA in 2003. In announcing the settlement, the Director of the Bureau of Consumer Protection of the FTC noted: “If someone stole your identity, it’s your right to get the records related to the theft – and that’s a right the FTC takes seriously…This case is a warning to other companies: We will hold you responsible if you fail to give identity theft victims the required business records.”
The U.S. Department of Justice’s Consumer Protection Branch filed the complaint on behalf of the FTC. The settlement was approved by the United States District Court for the Eastern District of Wisconsin.