Kohl’s sued over identity theft
It allegedly failed to give records to victims
Kohl’s Corp. for more than two years failed to adequately provide records to victims of identity theft, according to a lawsuit filed Monday.
The federal government sued the Wisconsin-based retailer for violating the Fair Credit Reporting Act under the Federal Trade Commission Act in the Eastern District Court of Wisconsin. The policy has since been changed and the company agreed to a stipulation order also filed Monday.
According to the lawsuit, Kohl’s from February 2017 through March 2019 had policies that limited the ability of victims of identity theft to receive records from the company.
Victims of identity theft were unable to obtain application and business transaction records related to the identity theft suffered, according to the lawsuit. The lawsuit said that on several occasions, Kohl’s failed to respond to victims within 30 days.
Under the policy established in 2017, Kohl’s would only share information that would identify the identity thief with law enforcement or a victim’s attorney, upon their direct request. In 2018, it revised the policy to only provide the records with law enforcement.
The policy for handling requests for application and business transaction records from victims of identity theft was changed in April 2019. The new policy required Kohl’s to provide victims of identity theft with the application and business transaction records requested, following the Fair Credit Reporting Act.
“Kohl’s takes compliance matters seriously, including the responsibility to assist victims of identity theft,” the company said in a statement. “Kohl’s has coordinated with the Federal Trade Commission (FTC) to take measures to address their concerns and revise our policies accordingly. In February 2020, Kohl’s notified approximately 50 Kohl’s customers to resolve any outstanding requests. We believe the matter has been transparently addressed to resolution.”
In a stipulation order, Kohl’s agreed to add visible information to its website about requesting documents related to fraudulent activity, notify all who requested application and transaction records during the two-year period and pay $220,000 to the Treasurer of the United States.