EPIC - EPIC v. Education Department - Private Debt Collector Privacy Act Compliance

EPIC v. Education Department - Private Debt Collector Privacy Act Compliance

Top News |
Background |
Legal Documents|
Freedom of Information Act Documents |
Released Documents |
News Items

Top News

EPIC FOIA - EPIC Uncovers Information About Debt Collector Practices from Education Dept.: Pursuant to a Freedom of Information Act lawsuit against the Education Department, EPIC has obtained documents which reveal that many private debt collection agencies maintain incomplete and insufficient quality control reports. As government contractors, debt collectors are required to follow the Privacy Act, a federal law that protects personal information. The Education Department also requires student debt collectors to submit quality control reports indicating whether the companies maintain accurate student loan information. The documents obtained by EPIC in this FOIA lawsuit reveal that many companies provide small sample sizes to conceal possible violations of the Act. The documents also show that many companies do not submit required information about Privacy Act compliance to the Education Department. EPIC has recently settled the case and obtained attorneys fees for making this information available to the public. For more information, see EPIC v. Education Department - Private Debt Collector Privacy Act Compliance. (Nov. 1, 2013)
EPIC Sues Education Department, Seeks Documents about Debt Collectors and Student Privacy: EPIC has filed a Freedom of Information Act lawsuit against the Education Department, following the agency's failure to release documents about private debt collection and compliance with federal privacy law. The Department has contracts with at least twenty-three private debt collectors who obtain sensitive personal information, including contact information, loan status, income, Social Security number, and credit history. The Department is expected to publish a procedures manual that instructs debt collectors on privacy safeguards. The Department is also supposed to require debt collectors to submit compliance reports to the agency. EPIC's sought release of the procedures manual and compliance reports for the last three years. After the Department failed to disclose any records in response to the FOIA request, EPIC sued. For more information, see EPIC: Open Government and EPIC: Student Privacy. (Mar. 18, 2013)

Background

The Department of Education relies heavily on private debt collectors to recoup money from borrowers who have defaulted on student loans. As the total amount of outstanding student debt rises, private collection firms view student loans as a burgeoning market and are aggressively seeking contracts with the department. In 2011, the Education Department paid about $355 million to private debt collector companies. The Department has contracts with at least twenty-three private debt collectors.

Some of these debt collector companies have been accused of abusive or unsavory tactics. In 2011, the Education Department received 1,406 complaints about its collection contractors, a 41% increase from the previous year. Outsourcing the collection of student loans raises important questions about borrowers' privacy. Private debt collectors are entrusted with sensitive personal and financial data of student borrowers. Under the Privacy Act of 1974, the Department may release certain information about student borrowers to collection firms, but those firms must in turn abide by the Privacy Act safeguards.

The Department publishes a detailed privacy manual, the "PCA Procedures Manual," and distributes it to contractors in order to instruct debt collectors about federal statutory requirements. The most recent public version of the manual was published in 2013.

Collection firms with Department of Education contracts are required to submit various compliance and disclosure reports on a regular basis. Each student loan collection firm must sign a "Certification of Privacy Act Training" form certifying that the employee has received proper annual privacy training. Collection firms are required to submit monthly "Quality Control Reports" to the Department which must include a section on privacy and any problems or corrective actions. Collection firms must also submit "Security Awareness and Privacy Act Training Reports" which must state the date of the firm's last privacy training.

All three of these compliance reports are matters of significant public interest because they represent the primary oversight mechanism for determining whether numerous federal contractors are adequately protecting the privacy of student-loan borrowers.

EPIC's Freedom of Information Act Request and Subsequent Lawsuit

In September 2012, EPIC submitted a FOIA request to the Education Department requesting:

The most currently updated version of the "PCA Procedures Manual" that the Department of Education publishes as guidance for its debt-collection contractors. The 2009 version of this manual was prepared by the Federal Student Aid Operation Services Processing Division.
All "Certification of Privacy Act Training" forms, "Quality Control Reports," and "Security Awareness and Privacy Act Training Reports" submitted by private debt-collection firms to the Department of Education during the last three years.

When the Education Department failed to produce any documents, EPIC filed its administrative appeal in November 2012.

On March 15, 2013, EPIC filed a lawsuit against the Education Department based on the agency's failure to comply with statutory deadlines and unlawful withholding of agency records.

The Education Department released documents in response to EPIC's lawsuit. On November 4, 2013, EPIC settled the case with the Education Department and was awarded $9,000.00 in attorney’s fees.