FTC ENFORCES GRAMM-LEACH-BLILEY ACT’S SAFEGUARDS RULE AGAINST MORTGAGE COMPANIES
The Federal Trade Commission has charged a mortgage broker and a mortgage company with violating the agency’s Gramm-Leach-Bliley (GLB) Safeguards Rule by not having reasonable protections for customers’ sensitive personal and financial information and the GLB Privacy Rule by not providing certain consumers with privacy notices.
These are the FTC’s first enforcement actions under the Safeguards Rule, which implements the security requirements of the GLB and requires financial institutions to have reasonable policies and procedures to ensure the security and confidentiality of customer information. The Safeguards Rule became effective on November 13, 2000, with compliance required by July 1, 2001. The “financial institutions” covered by the Rule include lenders and other traditional financial institutions as well as other entities such as payday lenders, check-cashing businesses, auto dealers engaged in financing or leasing, electronic funds transfer networks, mortgage brokers, credit counselors, real estate settlement companies and retailers that issue credit cards to consumers.
According to the FTC’s complaints: (i) both companies failed to comply with the Safeguard Rule’s basic requirements, (ii) one company failed to properly train its employees, oversee its loan officers and monitor its computer network and (iii) one company failed to oversee its service providers and of its loan officers.
One company has agreed to settle with the FTC. The proposed consent order bars the company from future violations of the Safeguards Rule and the Privacy Rule and requires the company to have its security program certified as meeting or exceeding the standards in the consent order by an independent professional within six months and every other year thereafter for 10 years. The remaining complaint will be heard by an administrative law judge.
FTC ISSUES FINAL REGULATION ON CONSUMER INFORMATION AND RECORDS DISPOSAL The Federal Trade Commission has issued a final rule regarding the proper disposal of consumer report information and records under the Fair and Accurate Credit Transactions Act of 2003 (FACTA) and the Fair Credit Reporting Act (FCRA). The final rule is similar to the proposed rule issued in April 2004 and will become effective on June 1, 2005.