Lenders Settle with FTC over Privacy Violations

Nationwide Mortgage, Cendant subsidiary accused of Gramm-Leach-Bliley violations

March 2, 2005

By PATRICK CROWLEY

Both companies were accused of violating the Gramm-Leach-Bliley Safeguard Rule by failing “to implement safeguards to protect its customer’s names, Social Security numbers, credit histories, bank account numbers, income tax returns and other sensitive financial information,” the FTC said in a written statement.

The charges were the first brought by the FTC under the new Safeguards Rule, which Congress enacted in 1999.

Sunbelt has agreed to a consent order that mandates changes in how it handles customers’ information, according to FTC documents, while Nationwide is also attempting to settle the charges and working on a proposed consent agreement.

The companies could not be reached to comment.

The FTC said that companies reaching consent agreements make no admission of guilt or wrongdoing and signing such an agreement is for “settlement purposes only and does not constitute an admission…that the law has been violated as alleged.”

In the settlement, Sunbelt agreed to change its policies to comply with the federal regulations and submit to an independent financial audit every other year for 10 years.

The company must also explain how its new safeguards “meet or exceed the protections required by the Safeguards Rule,” according to a copy of the agreement.

In addition to mortgage companies, the Safeguards Rule also applies to a variety of “financial institutions” that include payday lenders, check-cashing businesses, tax preparers, credit counselors, real estate settlement companies and retailers that issue credit cards.

The FTC said Nationwide and Sunbelt were targeted as part of a nationwide sweep to determine if automobile dealers and mortgage companies were complying with the law.

The sweep “showed significant failures to comply” with the rule by Nationwide and Sunbelt.

“Nationwide failed to train its employees on information security issues, oversee its loan officers’ handing of customer information and monitor its computer network for vulnerabilities,” the FTC said. “Sunbelt also failed to oversee the security practices of its service providers and of its loan officers working from remote locations throughout the state of Florida.”

Both companies also allegedly violated the act’s privacy rule, which requires financial institutions to provide consumers with privacy notices describing how they use and disclose consumers’ personal information.

“Nationwide did not provide the privacy notices to its customers, and Sunbelt did not provide the notices to its online customers,” the FTC said.

As part of the agreement Sunbelt is barred from future violations of the Safeguards Rule and must have its compliance and security plan implemented by June.

Patrick Crowley is a political reporter and columnist and former business writer for The Cincinnati Enquirer. Email Patrick at: pcrowley@enquirer.com