ChoicePoint has been credited by some with improving its business and data protection practices following the February 2005 debacle where it sold some 163,000 consumer dossiers to fly-by-night identity thieves. That event resulted in at least 3,200 known cases of identity theft, a $10 million FTC fine and accompanying $5 million consumer dollar restitution order and also triggered "the year of the breach," which precedes the "year of the recall" on the consumer calendar. While the FTC did impose its largest ever privacy fine in this case, it has never responded to allegations in a petition filed in 2004 by the Electronic Privacy Information Center and George Washington University Law Professor Daniel Solove that ChoicePoint sells products that appear to be credit reports but are sold outside of Fair Credit Reporting Act rules. ChoicePoint is a spinoff of the credit bureau Equifax.

Here is EPIC's detailed ChoicePoint page, which includes updated information about the original complaint. Lexis-Nexis has also been involved in a security breach, but of the more garden variety-- it didn't go out and sell the information, its safeguards were weak and it was hacked through a compromised subscriber account.

In a book, No Place To Hide, the Post's O'Harrow coined the term "security-industrial complex" to describe the threats to privacy posed by the new relationships between private data vendors collecting commercial data and selling it to government agencies. Unless subject to rigorous privacy scrutiny, this union will exacerbate that threat.