U.S. Trustee Program Announces Settlement with CitiGroup Inc. Protecting Consumers’ Personal Information in Bankruptcy Cases

WASHINGTON — The U.S. Trustee Program (USTP) today announced the unsealing of a settlement with Citigroup Inc. (Citi) that protects the personal information of nearly 150,000 consumers in 85 jurisdictions around the country. Citi agreed to redact proofs of claim filed in bankruptcy cases nationwide in which the personal information of consumer debtors and third parties, including Social Security numbers and birthdates, had not been properly redacted as required by the bankruptcy rules. Citi also agreed to notify all affected consumers and offer them one year of free credit monitoring. An independent auditor appointed under the settlement is reviewing the accuracy of the correction process.

The settlement, approved by the U.S. Bankruptcy Court for the Southern District of New York on March 13, 2012, had been sealed to prevent potential wrongdoers from learning of the breach and seeking to victimize the affected consumers. On July 11, 2013, the bankruptcy court granted the parties’ motion to unseal the proceedings.

“Under this unprecedented settlement, nearly 150,000 consumers whose personal information was placed at risk through no fault of their own have received notice of the improper disclosure and can further protect their information through free credit monitoring,” stated Clifford J. White III, Director of the Executive Office for U.S. Trustees. “Creditors in bankruptcy cases have a legal duty to protect certain personal information of their customers. This settlement should remind all major financial institutions and other creditors that violations cannot be tolerated.”

The settlement resolved the objection of the U.S. Trustee for Region 2, Tracy Hope Davis, to a motion Citi filed under seal in September 2011. Citi’s motion disclosed that between 2007 and 2011 its subsidiaries, including CitiMortgage Inc., Citibank N.A. and CitiFinancial Inc., filed proofs of claim in thousands of consumer bankruptcy cases seeking payment of amounts alleged to be owed by debtors. In April 2011, Citi discovered that certain personal information that should have been redacted under bankruptcy court rules, including consumers’ Social Security numbers and birth dates, had not been properly redacted.

The U.S. Trustee agreed that the information should be redacted, but objected to Citi’s motion because it did not disclose the nationwide scope of the breach. In addition, Citi did not propose a verifiable solution to correct the problem or provide assurance that the matter would be made public and the seal lifted once the information was redacted and affected consumers received notice.

On March 13, 2012, the bankruptcy court approved the settlement calling for the redaction and electronic filing of replacement claims at Citi’s expense. The settlement also included specific consumer protections, including: assurance that the original claims would not be overwritten or altered in the replacement process; notification to the affected debtors and third parties that their personal information was not properly redacted and of its correction; and an offer of one year of free credit monitoring.

Under the settlement, the court also appointed an independent auditor to review and file certifications with the court confirming that Citi’s investigation to determine the scope of the breach was adequate, that Citi filed properly redacted claims and did not overwrite or replace the original claims in the process, and that Citi’s policies and procedures for future filings are reasonably calculated to prevent recurrence of the redaction error.

On July 19, 2012, Citi certified to the bankruptcy court the successful redaction and replacement of the filings in the Southern District of New York. During that process, Citi discovered additional redaction issues and, in accordance with the settlement, filed a plan of corrective action expanding the scope of the settlement to include the redaction of approximately 50,000 additional bankruptcy filings.

Courts in 60 other jurisdictions served by the USTP have entered the settlement under seal and accepted the redacted replacement filings. Courts in the remaining jurisdictions handled the correction of the filings according to their local rules and orders, and Citi is otherwise following the terms of the settlement in those jurisdictions.

On June 4, 2013, the independent auditor certified to the U.S. Bankruptcy Court for the Southern District of New York and the 60 other participating courts that Citi had mailed letters notifying affected consumers of the privacy breach, its correction and the availability of one year of free credit monitoring at Citi’s expense. The independent auditor is reviewing Citi’s redaction and replacement process and is expected to issue its certification on that process by the end of the year.

Consumer debtors who believe they were affected may contact Citigroup Customer Service at 1-866-613-5636.

The U.S. Trustee Program is the component of the Justice Department that protects the integrity of the bankruptcy system by overseeing case administration and litigating to enforce the bankruptcy laws.

The settlement is filed in In re Matter of Citi Replacement Filings, No. 11-00405 (Bankr. S.D.N.Y.).