Two mortgage companies are facing government legal actions for failing to adequately secure the private information of former borrowers and applicants. The case of one of the companies, which shut down this summer, is likely to be repeated across the country given the scale of the mortgage meltdown. And if branch managers of local operations fail to secure files upon the closing of local offices — officers and directors could be held criminally liable.
American United Mortgage Co. agreed to pay a $50,000 penalty after it placed files with customers’ personal and financial information in a public dumpster, the Federal Trade Commission announced today. A stipulated judgment and order were filed by the Justice Department in the U.S. District Court for the Northern District of Illinois, Eastern Division.
The illegal actions allegedly occurred between July 2001 and March 2006. American United was warned about the violations in March 2006 but continued to violate the rules, FTC alleged.
“In February 2006, for example, hundreds of such documents were found, many in open trash bags, including consumer reports for 36 consumers,” the statement said. “In March 2006, FTC staff notified the company in writing about this situation, and on at least two occasions afterward, more such documents were found in and around the same dumpster.“
The Northbrook, Ill.-based company improperly disposed of credit reports and information taken from the reports, violating the agency’s Disposal and Gramm-Leach-Bliley Safeguards rules, the FTC said. It also did not provide customers with required privacy notices describing its data collection and sharing practices with affiliated and non-affiliated third parties, violating the agency’s Privacy Rule.
American United had no plan to deal with the disposal of customers’ personal information that included Social Security numbers, bank and credit card account numbers and income histories.
“Every business, whether large or small, must take reasonable and appropriate measures to protect sensitive consumer information, from acquisition to disposal,” FTC Chairman Deborah Platt Majoras said in the release. “This agency will continue to prosecute companies that fail to fulfill their legal responsibility to protect consumers’ personal information.”
The settlement requires American United to obtain an audit from a qualified, independent, third-party professional every two years ensuring it adheres to the order.
In Ohio, the state’s attorney general and Department of Commerce filed a lawsuit in Franklin County Common Pleas Court Thursday against Randall Mortgage Services Inc. and its owner and president, Robert Shepherd, for allegedly abandoning loan files after it shut down, according to an announcement from Attorney General Marc Dann.
The Dublin-based company, which also had branches in Fairlawn and Cincinnati, reportedly surrendered its mortgage broker certificate of registration on Aug. 29, 2007. The company originally registered as a broker in 1993.
The landlord of the abandoned space notified the state about the customer files with personal information left behind by Randall Mortgage, according the attorney general. Ohio sent a letter to Shepard on Oct. 25 warning him to collect the records and safeguard them, but he ignored the state’s request.
In the lawsuit, Randall Mortgage is accused of violating the Ohio Mortgage Broker Act and the Ohio Consumer Sales Practices Act. The state is seeking a permanent injunction, civil penalties and attorney fees and court costs.
“Businesses that collect our personal information are responsible for protecting it just like they would protect their own information,” Dann stated in the announcement. “It must be properly maintained, so that no one else will gain access to it.”
Randall Mortgage’s situation is likely to be repeated across the country.
Since last year, around 160 mortgage company failures have been documented by MortgageDaily.com. In addition, the U.S. Labor Department reports that “mortgage and nonmortgage loan brokers” have fallen from 146,700 in October 2006 to 127,700 in October 2007.
Owners of the failed firms, faced with the daunting task of winding down their businesses and finding new sources of income, are likely overwhelmed and short on cash, John D. Socknat, a partner with the Washington, D.C., law firm of Weiner Brodsky Sidman Kider PC, told MortgageDaily.com. But state regulators are still inquiring about the disposition of loan files and personal data when the companies surrender licenses.
Socknat added that some states and the FTC may hold officers and directors at the headquarters offices criminally liable if branch managers who have been laid off due to office closures fail to secure the customer files and data.
“Officers of companies that violate can face personal liability for violations,” he said.
