A US-based credit rating agency and data broker that provides risk mitigation services to immigration authorities and customized software to law enforcement agencies.
TransUnion, headquartered in Chicago, is a credit rating agency that provides an expansive information database to its clients. The company collects information on finances, identity, healthcare, insurance, and more from banks and other financial institutions, private databases, and public records. Along with Equifax and Experian, it is one of the top three credit reporting agencies.
In 2013, TransUnion acquired TLO, a company focused on producing information and analytics software that identifies risk for clients. TLO’s main product, TLOxp, uses TransUnion “data matching capabilities across various datasets to identify and investigate relationships among people, assets, locations and businesses,” and claims to “offer enhanced due diligence, threat assessment, identity authentication and fraud prevention and detection solutions” to law enforcement agencies.
TLOxp includes over 100 billion public and proprietary data points. With data on more than 95% of the U.S. population, it offers law enforcement agencies customized tools for searching through its system. It includes access to individuals’ residential history, incarceration and arrest information, social media content, and driver’s license data, which may link individuals to their relatives, acquaintances, and “business associates.” Furthermore, the TLOxp platform provides location data on vehicles in the U.S. through a “user-friendly map.”
TransUnion contracts with U.S. immigration authorities Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE). Most of its contracts with these agencies have been for access to credit reporting databases, presumably for background checks on prospective agents. However, one ICE contract worth a potential $1.1 million for TransUnion “support services” is significantly larger than the rest and may represent ICE’s use of TLOxp or another TransUnion product that is tailored specifically for the agency to use in surveilling immigrants. ICE awarded the contract to TransUnion in September 2023 and it has a potential end date of September 2028. Similarly, CBP awarded TransUnion a contract specifically for TLOxp, but that contract ended in 2015. Reports from organizations like Just Futures Law and Mijente have revealed how ICE uses information from data brokers like TransUnion to track immigrants slated for deportation.
TLOxp has also been used at fusion centers such as the Austin Regional Intelligence Center in Texas. Fusion centers are collaborative efforts between the Department of Justice (DOJ), DHS, and other federal, state, and local agencies to share information that can be used to surveil people for arrest, incarceration, and deportation.
Other Controversies
In February 2023, TransUnion was sued for failing to implement “reasonable cybersecurity procedures,” which caused a data breach in 2022, exposing records of 200 million customers in the U.S. The class action suit argued that, given the nature of the information stored at TransUnion, it was a likely target for hackers, and that the company had failed to secure sensitive data. In fact, this was the second credit rating agency that has been hacked in recent years. In 2017, Equifax’s data system was hacked and 143 million records were stolen, including Social Security numbers and credit card information.
In April 2022, the U.S. Consumer Financial Protection Bureau (CFPB) sued TransUnion for “continuing to employ deceptive sales and marketing tactics.” The CFPB received 150,000 complaints against TransUnion in 2021 and argued in its case against the company that it deceived users into buying products that should have been provided for free.
In June 2021, TLOxp provided police in Scottsdale, Ariz., with an incorrect Social Security number, leading to a fine and garnishment of over $1,000 from the wrong person. Both TransUnion and the Scottsdale Police Department insisted that the incident was isolated. According to a public records request, the purchasing office was “unable to find any contract or award information to vendor TLOxp and/or TransUnion and/or TransUnion Business Services with the City of Scottsdale or Scottsdale Police Department.”