FTC Settles Data-Breach Cases

A spokeswoman for LexisNexis, which acquired Seisint in 2004, said the company has resolved the issues identified by the government.

The FTC did not impose financial penalties against the companies because it lacks the authority to do so. The commission has asked Congress for such authority since 2005.

In January 2006, consumer data provider ChoicePoint Inc. agreed to pay $15 million to settle FTC charges that its security and record-handling procedures violated consumers' privacy rights when thieves breached its database.

ChoicePoint is a credit reporting agency and was charged under the Fair Credit Reporting Act, while the latest settlements fall under the FTC Act, which doesn't give the agency civil penalty authority.

Last month, notices about compensation eligibility began going out to millions of customers who may have had credit card information compromised in the TJX data breach. The notices are part of a proposed settlement being overseen by the federal court in Boston handling a consumer lawsuit against TJX.

The breach is believed to have begun in mid-2005 but wasn't detected until December 2006. A judge on July 15 will consider whether to approve the settlement reached last September. The FTC said it coordinated its investigation of TJX with 39 state attorneys general, lead by Massachusetts.

Shares of TJX added 20 cents to $33.76 in afternoon trading, while Reed Elsevier dipped 31 cents to $50.49.