Privacy & Information Security Law Blog

On April 13, 2015, the Federal Trade Commission announced that it has settled charges with two debt brokers who posted consumers’ unencrypted personal information on a public website. The settlements with Cornerstone and Company, LLC (“Cornerstone”), Bayview Solutions, LLC (“Bayview”), and the companies’ individual owners resulted from initial complaints about the debt brokers in 2014. Cornerstone and Bayview allegedly had posted the personal information of their debtors in unencrypted Excel spreadsheets on a publicly accessible website geared to buyers and sellers of consumer debt. The information included consumers’ names, addresses, credit card numbers, bank account numbers and debt amounts.

The FTC’s complaints against the debt collectors alleged numerous harms caused by the disclosure of the consumers’ sensitive personal information. In addition to harms associated with potential identity theft, invasion of privacy and loss of income, the complaints also alleged that consumers could be exposed to “other persons or entities attempting to collect the purported debt unlawfully even though those entities will not have purchased or acquired the authority to collect the debt.” As a result of the FTC’s complaints, a federal court ordered the debt brokers to notify affected consumers and forced the website that hosted the information to immediately remove the data.

In each Stipulated Final Order for Permanent Injunction, the companies and their respective owners are obligated to:

• establish and implement comprehensive information security programs;
• obtain initial and biennial assessments of their security programs from an independent third party;
• retain records relevant to compliance with the FTC’s orders;
• cooperate with the FTC in any investigations related to the transactions or occurrences that are the subject of the complaint;
• distribute the orders to relevant officers, employees and others; and
• submit compliance reports on a periodic basis or upon request by the FTC.

The settlements with Cornerstone and Bayview come two months after the FTC sent a letter to the Consumer Financial Protection Bureau that highlighted these cases among other FTC efforts in the debt collection arena.