HP Settles California 'Pretexting' Charges, Pays $14.5 Million

Lockyer filed a civil complaint that mirrors charges in a felony criminal complaint filed in October and also filed a settlement of the civil complaint, which the Santa Clara County Superior Court approved Thursday. There was no finding of liability against HP by Lockyer or the court.

The civil complaint alleges HP used "false and fraudulent pretenses" to obtain confidential information, including people's detailed billing records, from phone companies. The victims included HP employees, board members and their family members, and reporters and their family members. It alleges HP of willfully and knowingly accessed, and without permission used, computerized telephone account data belonging to the victims. It also charges that HP violated California's identity theft statute by obtaining personal identifying information about the victims, then using that information for an unlawful purpose.

Most of the money from the settlement will establish a new fund to fight violations of privacy and intellectual property rights, while HP adopts corporate governance reforms, Lockyer's office announced Thursday afternoon.

"The Hewlett-Packard incident has helped shine a national spotlight on a major privacy protection problem," Lockyer said through a prepared statement. "With its governance reforms, this settlement should help guide companies across the country as they seek to protect confidential business information without violating corporate ethics or privacy rights. And the new fund will help ensure that when businesses cross the legal line they will be held accountable. Fortunately, Hewlett-Packard is not Enron. I commend the firm for cooperating instead of stonewalling, for taking instead of shirking responsibility, and for working with my office to expeditiously craft a creative resolution." HP will pay $13.5 million to create a new "Privacy and Piracy Fund." HP will pay $650,000 in civil penalties and $350,000 to cover the attorney general's investigation and other costs. HP has agreed to "injunctive relief" provisions that include stronger in-house monitoring and oversight to ensure compliance with legal and ethical standards, and protection of privacy rights, during investigations. Those provisions will last five years.

Lockyer's office will receive up to $500,000 each year and local prosecutors will receive up to $500,000 to prosecute privacy and intellectual property rights violations.

HP issued a statement outlining internal process controls resulting from talks with Lockyer.

"We are pleased to settle this matter with the attorney general and are committed to ensuring that HP regains its standing as a global leader in corporate ethics and responsibility," Mark Hurd, HP's chairman and CEO, said through a prepared statement.

The company plans to have an expert conduct comprehensive reviews of HP's investigative practices and work with the ethics and compliance officer in making improvements when necessary. It will also expand the ethics chief's responsibilities to include reviews of investigations to ensure they address privacy and ethics issues. The company will also designate an independent director to review and report on compliance with legal and ethical requirements related to investigations.

HP will expand its employee and vendor codes to include the company's legal and ethical standards that apply to investigations. The company will also create a Compliance Council within HP that will develop, revise, and oversee policies and procedures for ethics and compliance programs. Finally, HP's annual training requirement will include a more prominent ethics component as well as additional training for employees involved in investigations. Former HP board chairperson Patricia Dunn, former counsel Kevin Hunsaker, and three contractors still face felony criminal charges related to the investigation. They have all pleaded not guilty.