Nationwide Mortgage Group, Inc

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF NATIONWIDE MORTGAGE GROUP, INC., ET AL. CONSENT ORDER, ETC., IN REGARD TO ALLEGED VIOLATIONS OF THE SAFEGUARDS RULE AND THE PRIVACY RULE Docket 9319; File No. 0423104 Complaint, November 9, 2004--Decision, April 12, 2005 This consent order, among other things, prohibits the respondent, a Floridabased corporation, from violating the GLB Safeguards Rule and the GLB Financial Privacy Rule, and requires the respondent, for ten years, to secure biennial assessments and reports to ensure that its information security program complies with the Safeguards Rule and is sufficiently effective to provide reasonable assurance that the security, confidentiality, and integrity of customer information is protected.

Participants For the Commission: Susan E. McDonald, Kathryn Ratte, Alain Sheer, Jessica L. Rich, Joel Winston, and Louis Silversin. For the Respondents: F. Douglas Ross, Odin, Feldman & Pittleman.

COMPLAINT The Federal Trade Commission (“Commission”), having reason to believe that Nationwide Mortgage Group, Inc. and John D. Eubank, individually and as President and owner of Nationwide Mortgage Group, Inc. (“respondents”), have violated the provisions of the Commission’s Standards for Safeguarding Customer Information Rule (“Safeguards Rule”), 16 C.F.R. Part 314, and the Commission’s Privacy of Consumer Financial Information Rule (“Privacy Rule”), 16 C.F.R. Part 313, each issued pursuant to Title V of the Gramm-Leach-Bliley Act (“GLB Act”), 15 U.S.C. § 6801 et seq., and it appearing to the Commission that this proceeding is in the public interest, alleges: VOLUME 139 Complaint 1. Respondent Nationwide Mortgage Group, Inc. (“Nationwide”) is a mortgage broker with its principal office or place of business at 10301 Democracy Lane, Fairfax, Virginia, 22030. Nationwide collects nonpublic personal information from its customers, including customer names, Social Security numbers, credit histories, bank account numbers, and income tax returns, in the course of processing, underwriting, and closing residential mortgage loans.

2. Respondent John D. Eubank is President and owner of Nationwide. Individually or in concert with others, he formulates, directs, or controls the policies, acts, or practices of Nationwide, including the acts or practices alleged in this complaint. His principal office or place of business is the same as that of Nationwide.

3. The acts and practices of respondents alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 15 U.S.C. § 44. 4. Nationwide is a “financial institution,” as that term is defined in Section 509(3)(A) of the GLB Act, and is therefore subject to the requirements of the Safeguards Rule and the Privacy Rule.

SAFEGUARDS RULE 5. The Safeguards Rule, which implements Section 501(b) of the GLB Act, was promulgated by the Commission on May 23, 2002, and became effective on May 23, 2003. The Rule requires financial institutions to protect the security, confidentiality, and integrity of customer information by developing a comprehensive written information security program that contains reasonable administrative, technical, and physical safeguards, including:

A. Designating one or more employees to coordinate the information security program;

NATIONWIDE MORTGAGE GROUP, INC., ET AL. 247 Complaint B. Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and assessing the sufficiency of any safeguards in place to control those risks; C. Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards’ key controls, systems, and procedures; D. Overseeing service providers, and requiring them by contract to protect the security and confidentiality of customer information; and E. Evaluating and adjusting the information security program in light of the results of testing and monitoring, changes to the business operation, and other relevant circumstances. VIOLATIONS OF THE SAFEGUARDS RULE 6. Since the Rule’s effective date, Nationwide has collected sensitive customer information, including Social Security numbers and bank account numbers, without implementing reasonable policies and procedures to ensure the security and confidentiality of that information. For example, although Nationwide stored customer information on a computer network accessible to all employees and connected to the Internet, it failed to monitor the network for vulnerabilities that would expose customer information to attack. Nationwide also failed to assess its security risks, implement reasonable policies and procedures with respect to information security, train employees on information security issues, or oversee the collection and handling of customer information by its loan officers.

7. By failing to implement reasonable security policies and procedures, respondents engaged in violations of the Safeguards Rule, including but not limited to: VOLUME 139 Complaint A. Failing to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information;

B. Failing to implement information safeguards to control the risks to customer information and failing to regularly test or monitor them;

C. Failing to develop, implement, and maintain a comprehensive written information security program; and D. Failing to designate one or more employees to coordinate the information security program.

8. A violation of the Safeguards Rule constitutes an unfair or deceptive act or practice in violation of Section 5(a)(1) of the FTC Act.

PRIVACY RULE 9. The Privacy Rule, promulgated under Section 502 of the GLB Act, went into effect on July 1, 2001. The Rule requires financial institutions, inter alia, to provide customers with clear and conspicuous notices, both when the customer relationship is formed and annually for the duration of the customer relationship, that accurately reflect the financial institution’s privacy policies and practices. VIOLATIONS OF THE PRIVACY RULE 10. Since the Rule’s effective date, respondents have failed to provide their customers with the notice required by the Privacy Rule.

11. A violation of the Privacy Rule constitutes an unfair or deceptive act or practice in violation of Section 5(a)(1) of the FTC Act.

NATIONWIDE MORTGAGE GROUP, INC., ET AL. 249 Complaint 12. The acts and practices of respondents as alleged in this complaint constitute unfair or deceptive acts or practices in violation of Section 5(a)(1) of the FTC Act. NOTICE Proceedings on the charges asserted against you in this complaint will be held before an Administrative Law Judge (ALJ) of the Federal Trade Commission, under Part 3 of the Commission's Rules of Practice, 16 C.F.R. Part 3. A copy of Part 3 of the Rules is enclosed with this complaint. You may file an answer to this complaint. Any such answer must be filed within 20 days after service of the complaint on you. If you contest the complaint's allegations of fact, your answer must concisely state the facts constituting each ground of defense, and must specifically admit, deny, explain, or disclaim knowledge of each fact alleged in the complaint. You will be deemed to have admitted any allegations of the complaint that you do not so answer.

If you elect not to contest the allegations of fact set forth in the complaint, your answer shall state that you admit all of the material allegations to be true. Such an answer will constitute a waiver of hearings as to the facts alleged in the complaint and, together with the complaint, will provide a record basis on which the ALJ will file an initial decision containing appropriate findings and conclusions and an appropriate order disposing of the proceeding. Such an answer may, however, reserve the right to submit proposed findings and conclusions and the right to appeal the initial decision to the Commission under Section 3.52 of the Commission's Rules of Practice.

If you do not answer within the specified time, you waive your right to appear and contest the allegations of the complaint. The ALJ is then authorized, without further notice to you, to find that the facts are as alleged in the complaint and to enter an initial decision and a cease and desist order.

VOLUME 139 Complaint The ALJ will schedule an initial prehearing scheduling conference to be held not later than 14 days after the last answer is filed by any party named as a respondent in the complaint. Unless otherwise directed by the ALJ, the scheduling conference and further proceedings will take place at the Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. Rule 3.21(a) requires a meeting of the parties' counsel as early as practicable before the prehearing scheduling conference, and Rule 3.31(b) obligates counsel for each party, within 5 days of receiving a respondent's answer, to make certain initial disclosures without awaiting a formal discovery request. A hearing on the complaint will begin on February 9, 2005, at 10:00 A.M. in Room 532, or such other date as determined by the ALJ. At the hearing, you will have the right to contest the allegations of the complaint and to show cause why a cease and desist order should not be entered against you. The following is the form of order which the Commission has reason to believe should issue if the facts are found to be as alleged in the complaint. If, however, the Commission should conclude from record facts developed in any adjudicative proceedings in this matter that the proposed order provisions might be inadequate to fully protect the consuming public, the Commission may order such other relief as it finds necessary or appropriate.

Moreover, the Commission has reason to believe that, if the facts are found as alleged in the complaint, it may be necessary and appropriate for the Commission to seek relief to redress injury to consumers, or other persons, partnerships or corporations, in the form of restitution for past, present, and future consumers and such other types of relief as are set forth in Section 19(b) of the Federal Trade Commission Act. The Commission will determine whether to apply to a court for such relief on the basis of the adjudicative proceedings in this matter and such other factors as are relevant to consider the necessity and appropriateness of such action.

NATIONWIDE MORTGAGE GROUP, INC., ET AL. 251 Complaint ORDER DEFINITIONS For purposes of this order, the following definitions shall apply: 1. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44.

2. Unless otherwise specified, “respondents” shall mean Nationwide Mortgage Group, Inc., its successors and assigns and its officers; John D. Eubank, President and owner of Nationwide; and each of the above’s agents, representatives, and employees. 3. All other terms are synonymous in meaning and equal in scope to the usage of such terms in the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq.

I.

IT IS ORDERED that respondents shall not, directly or through any corporation, subsidiary, division, Web site, or other device, violate any provision of the Gramm-Leach-Bliley Act’s (“GLB Act”) Standards for Safeguarding Customer Information Rule (“Safeguards Rule”), 16 C.F.R. Part 314, or the Gramm-Leach- Bliley Act’s Privacy of Consumer Financial Information Rule (“Privacy Rule”), 16 C.F.R. Part 313.

In the event the Safeguards Rule or Privacy Rule is hereafter amended or modified, respondents’ compliance with these Rules as so amended or modified shall not be a violation of this order. II.

IT IS FURTHER ORDERED that, in connection with their compliance with the Safeguards Rule, respondents shall obtain an assessment and report (an “Assessment”) from a qualified, objective, independent third-party professional, using procedures VOLUME 139 Complaint and standards generally accepted in the profession, within one hundred and eighty (180) days after service of the order, and biennially thereafter for ten (10) years after service of the order, that:

A. sets forth the specific administrative, technical, and physical safeguards that respondents have implemented and maintained during the reporting period; B. explains how such safeguards are appropriate to Nationwide’s size and complexity, the nature and scope of Nationwide’s activities, and the sensitivity of the personal information collected from or about consumers; C. explains how the safeguards that have been implemented meet or exceed the protections required by the Safeguards Rule; and D. certifies that respondents’ security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of personal information is protected and, for biennial reports, has so operated throughout the reporting period. Each assessment shall be prepared by a person qualified as a Certified Information System Security Professional (CISSP) or as a Certified Information Systems Auditor (CISA); a person holding Global Information Assurance Certification (GIAC) from the SysAdmin, Audit, Network, Security Institute (SANS); or by a similarly qualified person or organization approved by the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission.

Respondents shall provide the first Assessment, as well as all plans, reports, studies, reviews, policies, training materials, and assessments, whether prepared by or on behalf of respondents, relied upon to prepare such Assessment to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade NATIONWIDE MORTGAGE GROUP, INC., ET AL. 253 Complaint Commission, Washington, D.C. 20580, within ten (10) days after the Assessment has been prepared. Respondents shall retain all subsequent biennial Assessments until the order is terminated and shall retain all materials relied upon in preparing each such Assessment, as listed above, for a period of three (3) years after the date of the preparation of such Assessment. Respondents shall provide such subsequent Assessments and related materials to the Associate Director of Enforcement within ten (10) days of request. III.

IT IS FURTHER ORDERED that respondents shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities with respect to the subject matter of this order. Respondent shall deliver this order to such current personnel within thirty (30) days after the date of service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities.

IV.

IT IS FURTHER ORDERED that respondent John D. Eubank, for a period of ten (10) years, after the date of issuance of this order, shall notify the Commission of the discontinuance of his current business or employment, or of his affiliation with any new business or employment. The notice shall include respondent John D. Eubank’s new business address and telephone number and a description of the nature of the business or employment and his duties and responsibilities. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VOLUME 139 Complaint V.

IT IS FURTHER ORDERED that respondents shall notify the Commission at least thirty (30) days prior to any change in the corporation that may affect compliance obligations arising under this order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which respondents learn less than thirty (30) days prior to the date such action is to take place, respondents shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VI.

IT IS FURTHER ORDERED that respondents shall within one hundred eighty (180) days after service of this order, and at such other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which they have complied with this order. This report shall include a copy of the initial Assessment required by Part II of this order.

VII.

This order will terminate twenty (20) years from the date of its issuance, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; NATIONWIDE MORTGAGE GROUP, INC., ET AL. 255 Complaint provided, however, that the filing of such a complaint will not affect the duration of:

A. Any Part in this order that terminates in less than twenty (20) years;

B. This order's application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the respondents did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal. THEREFORE, the Federal Trade Commission this ninth day of November, 2004, has issued this complaint against respondents.

VOLUME 139 Decision and Order DECISION AND ORDER The Federal Trade Commission having heretofore issued its Complaint charging Respondents named in the caption hereof with violation of the Federal Trade Commission’s Standards for Safeguarding Customer Information Rule (“Safeguards Rule”), 16 C.F.R. Part 314, and the Federal Trade Commission’s Privacy of Consumer Financial Information Rule (“Privacy Rule”), 16 C.F.R. Part 313, each issued pursuant to Title V of the Gramm-Leach- Bliley Act, 15 U.S.C. § 6801 et seq., and Section 5(a)(1) of the Federal Trade Commission Act, 15 U.S.C. § 45(a)(1), and Respondents having been served with a copy of that Complaint, together with a notice of contemplated relief; and Respondents, their attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), an admission by Respondents of all the jurisdictional facts set forth in the Complaint, a statement that the signing of said Consent Agreement is for settlement purposes only and does not constitute an admission by Respondents that the law has been violated as alleged in such Complaint, or that the facts as alleged in such Complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission's Rules; and The Secretary of the Commission having thereafter withdrawn this matter from adjudication in accordance with Section 3.25(c) of its Rules, 16 C.F.R. § 3.25(c) (2005); and The Commission having considered the matter and having thereupon accepted the executed Consent Agreement and placed such Consent Agreement on the public record for a period of thirty (30) days, now in further conformity with the procedure described in Section 3.25(f) of its Rules, the Commission hereby makes the following jurisdictional findings and enters the following Order:

NATIONWIDE MORTGAGE GROUP, INC., ET AL. 257 Decision and Order 1. Respondent Nationwide Mortgage Group, Inc. is a corporation with its principal office or place of business at 10301 Democracy Lane, Fairfax, Virginia, 22030. 2. Respondent John D. Eubank is President and owner of Nationwide. His principal office or place of business is the same as that of Nationwide.

3. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of Respondents, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this order, the following definitions shall apply: 1. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44.

2. Unless otherwise specified, “respondents” shall mean Nationwide Mortgage Group, Inc., its successors and assigns and its officers; John D. Eubank, President and owner of Nationwide; and each of the above’s agents, representatives, and employees. 3. All other terms are synonymous in meaning and equal in scope to the usage of such terms in the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq.

I.

IT IS ORDERED that respondents shall not, directly or through any corporation, subsidiary, division, Web site, or other device, violate any provision of the Gramm-Leach-Bliley Act’s (“GLB Act”) Standards for Safeguarding Customer Information Rule VOLUME 139 Decision and Order (“Safeguards Rule”), 16 C.F.R. Part 314, or the Gramm-Leach- Bliley Privacy of Consumer Financial Information Rule (“Privacy Rule”), 16 C.F.R. Part 313.

In the event the Safeguards Rule or Privacy Rule is hereafter amended or modified, respondents’ compliance with these Rules as so amended or modified shall not be a violation of this order. II.

IT IS FURTHER ORDERED that, in connection with its compliance with the Safeguards Rule, respondents shall obtain an assessment and report (an “Assessment”) from a qualified, objective, independent third-party professional, using procedures and standards generally accepted in the profession, within one hundred and eighty (180) days after service of the order, and biennially thereafter for ten (10) years after service of the order, that:

A. sets forth the specific administrative, technical, and physical safeguards that respondents have implemented and maintained during the reporting period; B. explains how such safeguards are appropriate to Nationwide’s size and complexity, the nature and scope of Nationwide’s activities, and the sensitivity of the personal information collected from or about consumers; C. explains how the safeguards that have been implemented meet or exceed the protections required by the Safeguards Rule; and D. certifies that respondents’ security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of personal information is protected and, for biennial reports, has so operated throughout the reporting period. NATIONWIDE MORTGAGE GROUP, INC., ET AL. 259 Decision and Order Each assessment shall be prepared by a person qualified as a Certified Information System Security Professional (CISSP) or as a Certified Information Systems Auditor (CISA); a person holding Global Information Assurance Certification (GIAC) from the SysAdmin, Audit, Network, Security Institute (SANS); or by a similarly qualified person or organization approved by the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission.

Respondents shall provide the first Assessment, as well as all plans, reports, studies, reviews, policies, training materials, and assessments, whether prepared by or on behalf of respondents, relied upon to prepare such Assessment to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580, within ten (10) days after the Assessment has been prepared. Respondents shall retain all subsequent biennial Assessments until the order is terminated and shall retain all materials relied upon in preparing each such Assessment, as listed above, for a period of three (3) years after the date of the preparation of such Assessment. Respondents shall provide such subsequent Assessments and related materials to the Associate Director of Enforcement within ten (10) days of request. III.

IT IS FURTHER ORDERED that respondents shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having responsibilities with respect to the subject matter of this order. Respondent shall deliver this order to such current personnel within thirty (30) days after the date of service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities.

VOLUME 139 Decision and Order IV.

IT IS FURTHER ORDERED that respondent John D. Eubank, for a period of ten (10) years, after the date of issuance of this order, shall notify the Commission of the discontinuance of his current business or employment, or of his affiliation with any new business or employment. The notice shall include respondent John D. Eubank’s new business address and telephone number and a description of the nature of the business or employment and his duties and responsibilities. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

V.

IT IS FURTHER ORDERED that respondents shall notify the Commission at least thirty (30) days prior to any change in the corporation that may affect compliance obligations arising under this order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which respondents learn less than thirty (30) days prior to the date such action is to take place, respondents shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VI.

IT IS FURTHER ORDERED that respondents shall within one hundred eighty (180) days after service of this order, and at such NATIONWIDE MORTGAGE GROUP, INC., ET AL. 261 Decision and Order other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which they have complied with this order. This report shall include a copy of the initial Assessment required by Part II of this order.

VII.

This order will terminate on April 12, 2025, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Part in this order that terminates in less than twenty (20) years;

B. This order's application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the respondents did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

VOLUME 139 Analysis Analysis of Proposed Consent Order to Aid Public Comment The Federal Trade Commission (“Commission”) has accepted a consent agreement, subject to final approval, from Nationwide Mortgage Group, Inc., and John D. Eubank (collectively “Nationwide”). Nationwide is a mortgage broker with headquarters in Fairfax, Virginia. Nationwide collects sensitive customer information, including customer names, social security numbers, credit histories, bank account numbers, and income tax returns, and is a “financial institution” subject to the Gramm- Leach-Bliley Act’s Standards for Safeguarding Customer Information Rule, 16 C.F.R. Part 314 (“Safeguards Rule”) and Privacy of Consumer Financial Information Rule, 16 C.F.R. Part 313 (“Privacy Rule”).

The proposed consent agreement has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. This matter concerns Nationwide’s alleged violations of the Safeguards and Privacy Rules. The Safeguards Rule, which became effective on May 23, 2003, requires financial institutions to implement reasonable policies and procedures to ensure the security and confidentiality of customer information, including: • Designating one or more employees to coordinate the information security program;

• Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and assessing the sufficiency of any safeguards in place to control those risks;

NATIONWIDE MORTGAGE GROUP, INC., ET AL. 263 Analysis • Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards= key controls, systems, and procedures; • Overseeing service providers, and requiring them by contract to protect the security and confidentiality of customer information; and • Evaluating and adjusting the information security program in light of the results of testing and monitoring, changes to the business operation, and other relevant circumstances. The Privacy Rule, which became effective on July 1, 2001, requires financial institutions to provide customers with clear and conspicuous notices that explain the financial institution’s information collection and sharing practices and allow customers to opt out of having their information shared with certain nonaffiliated third parties.

The Commission’s administrative complaint, issued on November 9, 2004, charges that Nationwide engaged in violations of the Safeguards Rule, specifically by: (1) failing to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information; (2) failing to implement information safeguards to control the risks to customer information and failing to regularly test or monitor them; (3) failing to develop, implement, and maintain a comprehensive written information security program; and (4) failing to designate one or more employees to coordinate the information security program. The complaint also alleges that Nationwide failed to provide its customers with the notice required by the Privacy Rule.

The proposed order contains provisions designed to prevent Nationwide from engaging in future practices similar to those alleged in the complaint. Specifically, Part I of the proposed order prohibits Nationwide from violating the Safeguards Rule or the Privacy Rule. Part II of the proposed order requires that Nationwide obtain, within 180 days after being served with the VOLUME 139 Analysis final order approved by the Commission, and on a biennial basis thereafter for a period of ten (10) years, an assessment and report from a qualified, objective, independent third-party professional, certifying that: (1) Nationwide has in place a security program that provides protections that meet or exceed the protections required by the Safeguards Rule, and (2) Nationwide’s security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of consumers’ personal information has been protected. This provision is substantially similar to comparable provisions obtained in prior Commission orders under Section 5 of the FTC Act. See In the Matter of Petco Animal Supplies Inc., FTC File No. 032-3221 (consent order) (Placed on the public record on Nov. 17, 2004); In the Matter of MTS, Inc., doing business as Tower Records/Books/Video, et al., FTC Docket No. C-4110 (consent order) (Issued May 28, 2004); In the Matter of Guess?, Inc., and Guess.com, Inc., FTC Docket No. C-4091 (consent order) (Issued July 30, 2003); and In the Matter of Microsoft Corporation, FTC Docket No. C-4069 (consent order) (Issued Dec. 20, 2002).

Part II of the proposed order also requires Nationwide to retain documents relating to compliance. For the assessments and supporting documents, Nationwide must retain the documents for three years after the date that each assessment is prepared. Parts III through VI of the proposed order are reporting and compliance provisions. Part III requires dissemination of the order now and in the future to all employees and other persons having responsibilities with respect to the subject matter of the order. Part IV requires Mr. Eubank to notify the FTC, for a period of ten years, if he discontinues his current business or becomes affiliated with a new one. Part V ensures notification to the FTC of changes in corporate status. Part VI mandates that Nationwide submit compliance reports to the FTC. Part VII is a provision “sunsetting” the order after twenty (20) years, with certain exceptions.

NATIONWIDE MORTGAGE GROUP, INC., ET AL. 265 Analysis The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed order or to modify its terms in any way.

VOLUME 139 Complaint