Alert November 13, 2012

FTC Settles with Payday Lending Operation over Violations of the Disposal Rule

The FTC announced that it reached a settlement with companies that own and manage payday loan and check cashing stores for consumer privacy violations, including violations of the Fair Credit Reporting Act’s Disposal Rule. The FCRA requires that persons who maintain or possess “consumer information for a business purpose [ ]must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” According to the FTC complaint, on multiple occasions, documents containing consumers’ personal information were found in unsecured dumpsters near the companies’ stores.

The companies agreed to pay $101,500 to settle the case, which also involved alleged violations of the Gramm-Leach Bliley Act’s Safeguards and Privacy Rules and violations of the FTC Act. In addition to the monetary penalty, the settlement enjoins the companies from further violations and requires the companies to implement data security programs that will be subject to independent third-party testing for 20 years.