Suzanne Sloane knew giving birth would be painful, but she did not foresee the ensuing two-year ordeal that would wreck her credit and drive her to the brink of divorce.

As Sloane delivered a boy at Prince William Hospital in Virginia on June 25, 2003, Shovana Sloan, a recent hire in the hospital's administration surreptitiously stole the new mother's identity.

Capitalizing on Sloane's similar name and birth date, the rogue employee began in November and December 2003 to use Sloane's Social Security number to obtain credit cards, loans, cash advances and other goods and services totaling more than $30,000. Sloane didn't discover the fraud until the end of January 2004, when Citibank notified her it had cancelled her credit card and advised her to contact Equifax Information Services.

Thus began what the 4th Circuit described recently as Sloane's “many months of emotional distress, mental anguish, and humiliation” as she tried repeatedly to correct errors in the credit reporting agency's file.

The upshot in 2006 was a near-record $351,000 federal jury verdict against Equifax for actual damages: $106,000 for Sloane's economic losses, $245,000 for her mental anguish, plus an order by the judge that Equifax foot Sloane's entire $181,083 legal bill. That grim news for Equifax brightened on Dec. 27, 2007, when the 4th Circuit vacated the grant of attorneys' fees pending further submissions and chopped $95,000 off the emotional distress award. Yet the remaining $150,000 mental anguish award is among the largest ever awarded for negligent erroneous credit reporting under the federal Fair Credit Reporting Act (FCRA).

“The message is that companies who ignore the damages caused by [violations of] the FCRA do so at their peril,” says Sloane's attorney A. Hugo Blankingship III, a partner with Blankingship & Associates in Alexandria, Va. The 4th Circuit's approval of hefty compensatory damages is a wake-up call not just for credit bureaus, but for banks, retailers, cellular phone companies and other businesses who risk law suits if they negligently fail to correct erroneous credit information they furnish to credit reporting agencies, Blankingship suggests. “It's going to cost them a lot of money.”

Downside Risk
The 4th Circuit's award is a harbinger, says Fred Cate, a professor at Indiana University's School of Law-Bloomington. “It is a high award, [but] I don't think we will look back in three or four years and think so. It's part of a broader willingness of juries, judges and government officials to find liability for errors in data systems that harm people.”

Because many businesses just “ignore errors … we are going to see more liability,” predicts Cate, an expert on information security. The downside risk could be immense since an estimated 27 million adults were identity theft victims between 1998 and 2003. While court-approved jury awards for emotional distress under the FCRA typically have ranged between $20,000 and $75,000, the 4th Circuit bluntly served notice that “past precedent fails to fully reflect the unfortunate current reality” of identity theft.

Sloane made a sympathetic plaintiff. Before she sued Equifax, she endured what the 4th Circuit described as “21 months of struggle” to repair her credit score, which had plummeted. Not only did Equifax fail to remove all the mistaken information brought to its attention, it restored to Sloane's credit report two incorrect items it had previously deleted. To add insult to injury, Equifax sent a letter to Sloane's house, addressed to the identity thief, warning the culprit that she might be a victim of identity theft.

Sloane's disastrous credit score meant that she and her husband were repeatedly denied loans or charged more for credit. Her husband dropped plans for a new business. The couple fought often and retreated to separate bedrooms. Sloane became insomniac and sometimes nodded off while driving home from work.

Negligent Investigation
The jury found that Equifax violated the FCRA by failing to follow reasonable procedures designed to assure maximum accuracy on Sloane's credit report and by failing to conduct a reasonable investigation to determine whether the disputed information was inaccurate. Equifax was also found negligent for failing to delete information that the company found to be inaccurate, incomplete or unverified, and for reinserting previously deleted information into her credit file.

On appeal Equifax didn't dispute the findings, but said that the District Court should have ordered remittitur of the emotional distress damages to no more than $25,000. The 4th Circuit panel held that there was “substantial … objective evidence” supporting a significant emotional distress award. While other FCRA compensatory awards have been much lower, the plaintiffs in those cases experienced “isolated or accidental reporting errors,” the appeals court noted. Alarmingly for defendants, the 4th Circuit said it found guidance on damages in defamation case law where emotional distress awards in the range of $250,000 are frequently sustained.

FCRA litigation, including class actions, is burgeoning, suggesting that many businesses have not yet adopted adequate safeguards against the dissemination of erroneous credit information, says Joel Reidenberg, Fordham University law professor and director of the Centre on Law and Information Policy. “We will see, in the next couple of years, more litigation that will have as its effect changes in business practices, and changes in the way the electronic systems treat this data,” he predicts.