InfoBytes Blog
Filter
Subscribe to our InfoBytes Blog weekly newsletter and other publications for news affecting the financial services industry.
FTC settles with mortgage analytics company over vendor oversight deficiencies
On December 15, the FTC announced a settlement with a Texas-based data mortgage analytics company (defendant), resolving allegations that the defendant violated the Gramm-Leach Bliley Act’s Safeguards Rule (Safeguards Rule) and the FTC Act by failing to ensure a third-party vendor hired to perform text recognition scanning on tens of thousands of mortgage documents was adequately securing consumers’ personal data. The FTC’s complaint alleges that the vendor stored the unencrypted contents of these documents on a cloud-based server without any protections to block unauthorized access, such as requiring a password. The data contained sensitive personal information, including “names, dates of birth, Social Security numbers, loan information, credit and debit account numbers, drivers’ license numbers, credit files, or other personal and financial information of borrowers, as well as of family members and others whose information was included in the mortgage application.” According to the FTC, because the vendor did not implement and maintain appropriate safeguards to protect customer information, the cloud-based server containing the data was accessed approximately 52 times. The FTC claims, among other things, that the defendant failed to adequately vet its third-party vendors and never took formal steps to evaluate whether the vendors could reasonably protect the sensitive information. Moreover, the defendant’s contracts allegedly did not require vendors to implement appropriate safeguards, nor did the defendant conduct risk assessments of all of its vendors as required by the Safeguards Rule.
The proposed settlement requires the defendant to, among other things, implement a comprehensive data security program and undergo biennial assessments conducted by a third party on the effectiveness of its program. Additionally, the defendant must report any future data breaches to the FTC no later than 10 days after it provides notice to any federal, state, or local government entity.
SEC awards whistleblower with audit responsibilities more than $300,000
On December 14, the SEC announced a more than $300,000 whistleblower award in connection with a successful enforcement action. According to the redacted order, in connection with the whistleblower’s audit-related responsibilities, the whistleblower became aware of potential securities law violations and voluntarily provided original information that contributed significantly to the enforcement action. The whistleblower also met with enforcement staff numerous times, helped to identify potential witnesses, and “aggressively attempted to remedy the misconduct and suffered a unique hardship.” The SEC notes in its press release that while individuals with audit or compliance responsibilities are generally ineligible for awards, “a whistleblower who reasonably believes that an entity is engaging in conduct that would impede the investigation falls within one of the exceptions to that rule.” This is the fourth award paid to a whistleblower with internal audit or compliance-related responsibilities.
The SEC has now paid approximately $731 million to 124 individuals since the inception of the program.
FCC: Contractors must get consent to make robocalls under TCPA
On December 14, the FCC released an order concluding that federal and state contractors are subject to the restrictions of the TCPA and must obtain prior express consent to call consumers. The order reverses a 2016 decision, which extended the presumption that “the word ‘person’ [in the TCPA] does not include the federal government absent a clear ‘affirmative showing of statutory intent to the contrary’” to calls made by contractors acting as agents of the federal government. The FCC acknowledges a number of requests to reconsider this conclusion, and in an effort to combat unwanted robocalls, the FCC now concludes that this presumption should not be extended to contractors. The FCC notes that there is “no longstanding presumption that a federal contractor is not a ‘person’” and the FCC did not “find any ‘context that otherwise requires’ [them] to ignore the express language of the Communications Act’s definition of the term ‘person’ in this situation.” While the presumption still applies to federal and state governments, the order clarifies that local governments are still considered a “person” under the TCPA and therefore, subject to the robocall restrictions without prior express consent.
Federal and state authorities target income scams
On December 14, the FTC, along with 19 federal, state, and local law enforcement partners, announced “Operation Income Illusion,” which encompasses more than 50 enforcement actions against scams targeting consumers with false promises of income and financial independence. According to an analysis of complaint data by the FTC, consumers have reported that they lost more than $610 million to income scams since 2016—with more than $150 million of losses reported in the first nine months of 2020—which the FTC attributes to the increase in scams related to the Covid-19 pandemic.
The announcement also includes four new enforcement actions and one settlement that are part of Operation Income Illusion, (i) an action and temporary restraining order against a Florida-based operation, which sold expensive memberships to programs by promoting earnings between $500 and $12,500 per sale; (ii) an action against a company with Spanish-language ads targeting Latina consumers with false promises of large profits reselling luxury products; (iii) an action and temporary restraining order against a company marketing investment-related services claiming they would enable consumers to make consistent profits off the market; (iv) an action and temporary restraining order against companies perpetuating a telemarketing scheme claiming false affiliation with Amazon.com to get consumers to purchase business opportunity programs; and (v) settlements (available here and here) with ten defendants involved in a scam targeting older adults while selling various money-making opportunities.
The other agencies reporting actions as part of the sweep include: the SEC, CFTC, the U.S. Attorney’s Office for the Eastern District of Arkansas; and state and county agencies in Arizona, Arkansas, California, Florida, Indiana, Maryland, New Hampshire, Oregon, and Pennsylvania.
FTC orders social media and video streaming companies to provide data on privacy practices
On December 14, the FTC issued orders to nine social media and video streaming companies requiring each company to provide information on their collection, use, and presentation of personal information, including their data gathering and advertising practices. The orders are issued pursuant to Section 6(b) of the FTC Act, which authorizes the FTC “to conduct wide-ranging studies that do not have a specific law enforcement purpose.” According to a sample order, the FTC seeks information concerning the companies’ privacy policies, procedures, and practices, including: (i) how personal and demographic information for both desktop and mobile devices is collected, used, tracked, estimated, or derived; (ii) how user attribute information is derived in order to determine which ads and other content are shown to consumers; (iii) whether algorithms or data analytics are applied to personal information; (iv) how user engagement is measured, promoted, and researched; and (v) how company policies, procedures, and practices are affecting children and teens, including how children and families are targeted and categorized. The Commission voted 4-1 to issue the orders, with Commissioners Chopra, Slaughter, and Wilson releasing a joint statement highlighting the need for the inquiry in order to, among other things, understand the “full scale and scope of social media and video streaming companies’ data collection.” The Commissioners also emphasized the FTC’s interest in “better understand[ing] the financial incentives of social media and video streaming services.” In dissent, Commissioner Phillips argued that the orders are “an undisciplined foray into a wide variety of topics, some only tangentially related to the stated focus of th[is] investigation.”
OFAC releases new Non-SDN sanctions reference tool
On December 14, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) published a new reference tool, the Non-SDN Menu Based Sanctions List (NS-MBS List), which “identities persons subject to certain non-blocking menu-based sanctions that have been imposed under statutory or other authorities, including certain sanctions described in Section 235 of the Countering America’s Adversaries Through Sanctions Act (CAATSA), as implemented by Executive Order 13849, and the Ukraine Freedom Support Act of 2014, as amended by CAATSA.” OFAC noted that the NS-MBS List is distinct from its List of Foreign Financial Institutions Subject to Correspondent Account or Payable-Through Account Sanctions, which identifies foreign financial institutions subject to correspondent or payable-through account sanctions.
OFAC announces Hong Kong-related designations
On December 7, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) added 14 Chinese citizens to the Specially Designated Nationals List. The individuals were designated under Executive Order (E.O.) 13936, which was issued by President Trump in July and, among other things, targets and authorizes the imposition of sanctions on persons who materially assist, sponsor, or provide financial, material, or technological support to activities contributing to the undermining of Hong Kong’s democracy and autonomy. Additionally, E.O. 13936 states that “[a]ll property and interests in property that are in the United States, that hereafter come within the United States, or that are or hereafter come within the possession or control of any United States person, . . .are blocked and may not be transferred, paid, exported, withdrawn, or otherwise dealt in” with any foreign person identified to have engaged in the aforementioned activities.
Treasury submits Hong Kong Autonomy Act report to Congress
On December 11, the U.S. Treasury Department released a report submitted to Congress pursuant to Section 5(b) of the Hong Kong Autonomy Act (the Act), which was enacted on July 14. The Act requires that the Secretary of State submit to Congress a report (Section 5(a) Report) that includes (i) “an identification of the foreign person”; and (ii) “a clear explanation for why the foreign person was identified and a description of the activity that resulted in the identification.” The Secretary submitted the Section 5(a) Report on October 14, which identified 11 foreign persons that OFAC designated pursuant to Executive Order 13936 on August 7. The Act requires Treasury to submit the Section 5(b) report between 30 and 60 days of the Section 5(a) submission, detailing any foreign financial institution (FFI) that knowingly conducts a significant transaction with a foreign person identified by the Secretary in the Section 5(a) Report. The 5(b) Report notes that Treasury has no information on any FFIs that have conducted significant transactions with the designated foreign persons, after conducting “regular searches of all available sources of information, including classified and unclassified holdings.” Treasury notes that it will continue to monitor for new activity that meets the criteria and engage with foreign governments and FFIs to ensure they “they understand the reporting requirements and sanctions risks under the [the Act].”
Maryland extends restrictions on repossessions and residential foreclosures
On December 17, 2020, the governor of Maryland issued an executive order that further prohibits certain repossessions, suspends foreclosures of occupied residential property absent adherence to specific procedural protections, including those provided by the federal CARES Act. The foreclosure suspension is in effect until the “re-start date,” which is either (1) January 31, 2021, or (2) such later date as established by the commissioner of financial regulation, not to be more than 30 days after the state of emergency is terminated.
Fed will maintain federal funds rates due to Covid-19 effects
On December 16, the Federal Reserve Board stated it intends to keep the target range for the federal funds rate at zero to 0.25 percent until the unemployment rate lowers and inflation has risen to two percent steadily. While the Board notes that “[o]verall financial conditions remain accommodative,” and “[e]conomic activity and employment have continued to recover,” the Covid-19 pandemic has still caused tremendous economic hardship that has left overall economic levels “well below their levels at the beginning of the year.” According to the Board, the Federal Open Market Committee (FOMC) is seeking to achieve maximum employment and inflation at the rate of two percent over the longer run before adjusting the current monetary policy. Additionally, the Board notes that it will continue to increase its holdings of Treasury securities by at least $80 billion per month and of agency mortgage-backed securities by at least $40 billion per month. FOMC will monitor the economic outlook and is prepared “to adjust the stance of monetary policy as appropriate if risks emerge that could impede the attainment of the Committee’s goals.”