Ascension Data & Analytics, LLC, a mortgage analytics company, settled FTC allegations that it violated the Gramm-Leach-Bliley Act's Safeguards Rule by failing to ensure its vendor adequately protected consumer data. The vendor stored sensitive mortgage information in plain text on a cloud server, leading to unauthorized access. Ascension must implement a data security program, undergo biennial assessments, and report future breaches.
Ascension must implement a comprehensive data security program, undergo biennial independent assessments of its data security program, have a senior executive certify annual compliance, and report any future data breaches to the FTC within 10 days.
In-house legal teams should review all vendor, data processing, and service agreements where the vendor handles sensitive consumer financial data (e.g., mortgage information). Focus on clauses requiring data security measures, vendor oversight rights, audit provisions, breach notification obligations, and indemnification for data incidents. Specific changes may include: (1) mandating compliance with the GLBA Safeguards Rule; (2) requiring vendors to implement and document an information security program; (3) granting the company explicit rights to audit vendor security practices; (4) obligating vendors to report security incidents promptly; and (5) including contractual remedies for failures to protect data, such as termination rights or liability for breach-related costs.
Entity
Ascension Data & Analytics, LLC
Also known as: Ascension Data & Analytics
Industry
Financial ServicesOfficial Press Release
https://www.ftc.gov/news-events/news/press-releases/2020/12/mortgage-analytics-company-settles-ftc-allegations-it-failed-ensure-vendor-was-adequately-protecting
1923126ascensioncomplaint
https://www.ftc.gov/system/files/documents/cases/1923126ascensioncomplaint.pdf
1923126ascensionacco
https://www.ftc.gov/system/files/documents/cases/1923126ascensionacco.pdf
Federal Trade Commission Enforcement Page
https://www.ftc.gov/enforcement
"Texas-based Ascension Data & Analytics, LLC"
"Gramm-Leach-Bliley Act’s Safeguards Rule"
"stored the contents of the documents on a cloud-based server in plain text, without any protections to block unauthorized access"
The FTC settled with Ascension Data & Analytics, LLC for violating the Gramm-Leach-Bliley Act's Safeguards Rule by failing to ensure its vendor properly protected consumer data. The company must strengthen its security safeguards and increase oversight of vendors. No monetary penalty was imposed.
The FTC filed a complaint alleging that GovAssist LLC, Entry LLC, and Scott Zuckerman used deceptive paid search ads, misleading service and pricing claims, and fake reviews to deceive consumers seeking passport services. The complaint alleges violations of the FTC Act, the Impersonation Rule, and the Gramm-Leach-Bliley Act; the case will be decided by the court, and no penalty or remedy is reported as imposed.
The FTC issued its annual report to Congress describing fraud trends affecting older adults and the agency’s enforcement, education, and outreach efforts. The report is not a specific privacy enforcement action and announces no penalty or remedy.
The FTC referred a complaint against REPS & Company Inc. and company executives, alleging they bypassed ticket-issuer security controls and purchasing limits to acquire millions of tickets for resale. The complaint was filed by the Department of Justice, and the case will be decided by the court; the press release does not report a penalty or other remedy imposed.
$106.8M
A federal court entered a $106.8 million default judgment against corporate defendants in an alleged debt-relief scheme that impersonated banks and government entities and targeted seniors and veterans. The judgment permanently bans the defendants from the debt-relief industry and imposes additional prohibitions, including on impersonation, telemarketing, and misrepresentations.
The FTC sued Digital Forensics Corporation LLC and affiliated defendants, alleging they misled sextortion victims with promises of investigative and monitoring services that often were not provided, and used fake positive reviews. A federal court granted the FTC’s request to temporarily halt the defendants’ activities; the complaint remains for the court to decide.