Frequently Asked Questions About Equifax and The IRSG Principles

Q1. What Types of Information Does Equifax Collect and Make Available for Identifying Individuals, Verifying Identities and Locating Individuals?

A1. Equifax offers its customers two types of information products which are covered by the Individual Reference Services Group ("IRSG") Privacy Principles. Equifax makes name-and-address-only information available to qualified professional and commercial users who use this information for identification and location purposes in the normal scope and course of their business or profession. In addition, Equifax offers a name, address and Social Security Number product to certain selective and limited business and professional subscribers which use this information only for agreed upon, appropriate purposes.

As a national consumer reporting agency, Equifax provides consumer credit reports for permissible purposes. These reports are closely regulated by the federal Fair Credit Reporting Act, as well as state law and, as such, are not subject to the IRSG Principles. I n addition, Equifax provides certain other non-location or information products which are outside the scope of, and which are not intended to be covered by, the IRSG Privacy Principles.

Q2. How Does Equifax Collect This Information?

A2. The data for Equifax’s IRSG products (name -and-address-only products, and name, address and Social Security Number products) are collected and obtained by Equifax from the identification portion of the consumer credit file assembled and compiled by Equifax Credit Information Services, Inc. This identification portion of the consumer credit file is frequently referred to as the "credit header." It is well established law, including Federal Trade Commission ("FTC") opinion, that credit header information is not subject to Fair Credit Reporting Act restrictions.

Q3. What Are Equifax’s Sources for This Information?

A3. The name, address and Social Security Number information in a credit header is obtained by Equifax from consumers, credit grantors, employers and other entities engaged in legitimate business transactions with consumers. This information may also come from a host of publicly available sources, such as various public directories, or from public record sources, such as federal, state or local government databases open for public inspection.

In accordance with applicable law and business custom, Equifax has developed reasonable procedures to assure that Equifax knows the identity of every furnisher of information to Equifax and that Equifax understands the nature of the furnisher’s relationship with the consumer and how the furnisher collects information from the consumer. In addition, Equifax has devoted substantial resources to developing and operating automated and other types of systems to guarantee that Equifax has reasonable procedures in place to assure the maximum possible accuracy for all information maintained by Equifax, including name, address and Social Security Number information.

Q4. To What Types of Entities Does Equifax Disclose Information Covered by the IRSG Principles?

A4. Equifax does not make any IRSG information products available directly to the general public. Further, Equifax does not provide any IRSG information products to the private investigative industry. Equifax makes name and address products available only to established and qualified governmental, commercial and professional entities.

Equifax makes Social Security Number information available only to established and qualified governmental, commercial or professional subscribers which have satisfied Equifax that they have a legitimate and appropriate need for Social Security Number information. This information is provided under contract. If the subscriber is another Individual References Service, that reference service must agree in writing to comply with the IRSG Privacy Principles. Equifax has reasonable measures in place to assure that these reference services will use the information in compliance with the IRSG Principles. If the subscriber is a government agency or a commercial or professional end user, Equifax similarly employs reasonable measures to assure that the information is being used appropriately and in accordance with contractual agreements.

Q5. How Do Equifax Customers Use the IRSG Information Which They Obtain from Equifax?

A5. Equifax customers are permitted to use Equifax name-and-address-information for any type of location or identification purpose in the normal course and scope of their business or profession.

Equifax customers are permitted to use Social Security Number information obtained from Equifax only for purposes deemed appropriate by Equifax and which are further appropriate in light of the nature of the customer’s business or profession. These uses will vary, depending upon the type of the business or profession engaged in by the customer and the nature of the agreement between the customer and Equifax. Appropriate uses can include a variety of governmental purposes, as well as identifying or locating potential witnesses, heirs, debtors, licensees, parent scofflaws, or individuals suspected of fraud.

Equifax will be conducting reviews of Equifax subscribers and their intended use of Social Security Number information prior to (and after) making this information available to the subscribers. In addition, Equifax will maintain a record of the identity of the subscribers, their types of uses, and the terms and conditions under which they have agreed to use Social Security Number information. Equifax will also employ measures to help assure that these subscribers are using Social Security Number information appropriately and consistently with their representations and understandings between Equifax and the subscriber. In addition, Equifax is implementing reasonable mechanisms to remedy any abuses by subscribers of their uses of Social Security Number information.

Q6. Does Equifax Engage in Educational Activities to Inform Users and the Public About Privacy Issues Associated With Their IRSG Products?

A6. As a national consumer credit reporting agency, Equifax provides educational information regarding privacy and consumer information, including information about name, address and Social Security Numbers, on a national and international basis. As a part of this educational activity, Equifax is an active member of the Online Privacy Alliance, the Better Business Bureau Online Privacy Initiative, various Privacy & American Business initiatives and Associated Credit Bureau’s privacy-related activities and programs. Senior Equifax officials are frequent speakers and writers about privacy topics. Equifax has numerous brochures and publications which address Equifax’s privacy principles and policies, as well as other privacy issues. Through Equifax’s web site (www.Equifax.com), Equifax provides additional information about privacy issues.

In addition, Equifax has taken the lead in educating high school students about financial responsibility through an innovative program called Youth Enlightenment Series (Y.E.S.). This is a five-hour course to educated juniors and seniors about responsible financial management and how to be fiscally savvy. The program has been launched in more than 350 schools in 29 states reaching more than 35,000 high school students.

Q7. Does Equifax Maintain Facilities and Systems to Protect Information From Unauthorized Access?

A7. As a national consumer credit reporting agency, Equifax employs state-of-the-art, technical, physical, administrative and personnel security measures. All Equifax employees and contractors are required to sign confidentiality agreements and are subject to close supervision in the discharge of privacy-sensitive services. In addition, Equifax’s employee training program includes training regarding privacy, confidentiality and security.

Q8. Does Equifax Provide Consumers With Access to Information About Them Which Equifax Maintains?

A8. Equifax, upon request, provides consumers with access to all information which, under the FCRA and under the IRSG Principles, Equifax is required to or has voluntarily agreed to disclose to record subjects. This access includes public record and publicly available information, such as name and address information, as well as non-public information, such as Social Security Numbers. The only information that Equifax ever provides in its services covered by the IRSG Principles is name, address and, sometimes, Social Security number. No other "credit header" or identifying data are provided.

In addition, whenever a consumer disputes the accuracy of any item of information that the consumer has obtained from Equifax, Equifax will, pursuant to the Fair Credit Reporting Act, reinvestigate the accuracy of the information as set forth in the Fair Credit Reporting Act.

Q9. What Information About Children Under the Age of 18 Does Equifax Provide?

A9. Equifax does not knowingly maintain any name, address or Social Security Number information about children under the age of 16. For children who are 16 or 17, Equifax may maintain information if the child has a driver’s license, is employed or is otherwise participating in the economy. Equifax makes Social Security Number information about 16 and 17 year olds available only to selected and limited governmental, commercial or professional subscribers who are qualified to obtain this information for predetermined, appropriate purposes.

Q10. Will Equifax Undergo an Assurance Review by an Independent Third Party?

A10. By March 31, 1999 and at least once a year thereafter, Equifax will commission a review by an independent third party of Equifax’s compliance with the IRSG Privacy Principles. Equifax will make a summary of those reviews available to the public.