Ascension Data & Analytics, LLC, a mortgage analytics company, settled FTC allegations that it violated the Gramm-Leach-Bliley Act's Safeguards Rule by failing to ensure its vendor adequately protected consumer data. The vendor stored sensitive mortgage information in plain text on a cloud server, leading to unauthorized access. Ascension must implement a data security program, undergo biennial assessments, and report future breaches.
Ascension must implement a comprehensive data security program, undergo biennial independent assessments of its data security program, have a senior executive certify annual compliance, and report any future data breaches to the FTC within 10 days.
In-house legal teams should review all vendor, data processing, and service agreements where the vendor handles sensitive consumer financial data (e.g., mortgage information). Focus on clauses requiring data security measures, vendor oversight rights, audit provisions, breach notification obligations, and indemnification for data incidents. Specific changes may include: (1) mandating compliance with the GLBA Safeguards Rule; (2) requiring vendors to implement and document an information security program; (3) granting the company explicit rights to audit vendor security practices; (4) obligating vendors to report security incidents promptly; and (5) including contractual remedies for failures to protect data, such as termination rights or liability for breach-related costs.
Entity
Ascension Data & Analytics, LLC
Also known as: Ascension Data & Analytics
Industry
Financial ServicesOfficial Press Release
https://www.ftc.gov/news-events/news/press-releases/2020/12/mortgage-analytics-company-settles-ftc-allegations-it-failed-ensure-vendor-was-adequately-protecting
1923126ascensioncomplaint
https://www.ftc.gov/system/files/documents/cases/1923126ascensioncomplaint.pdf
1923126ascensionacco
https://www.ftc.gov/system/files/documents/cases/1923126ascensionacco.pdf
Federal Trade Commission Enforcement Page
https://www.ftc.gov/enforcement
"Texas-based Ascension Data & Analytics, LLC"
"Gramm-Leach-Bliley Act’s Safeguards Rule"
"stored the contents of the documents on a cloud-based server in plain text, without any protections to block unauthorized access"
The FTC settled with Ascension Data & Analytics, LLC for violating the Gramm-Leach-Bliley Act's Safeguards Rule by failing to ensure its vendor properly protected consumer data. The company must strengthen its security safeguards and increase oversight of vendors. No monetary penalty was imposed.
The FTC referred a complaint against REPS & Company Inc. and company executives, alleging they bypassed ticket-issuer security controls and purchasing limits to acquire millions of tickets for resale. The complaint was filed by the Department of Justice, and the case will be decided by the court; the press release does not report a penalty or other remedy imposed.
The FTC sued Digital Forensics Corporation LLC and affiliated defendants, alleging they misled sextortion victims with promises of investigative and monitoring services that often were not provided, and used fake positive reviews. A federal court granted the FTC’s request to temporarily halt the defendants’ activities; the complaint remains for the court to decide.
The FTC alleged that Greenway Auto Group advertised vehicle prices thousands of dollars below the amounts consumers actually paid and used mailers falsely suggesting recipients had won cash prizes. Greenway agreed to an order requiring transparent pricing and prohibiting deceptive prize mailers and other misrepresentations; the press release does not state a monetary penalty.
The FTC sent warning letters to 24 large healthcare services companies, cautioning that incomplete, inaccurate, or untimely pricing information for scheduled medical care may be unfair or deceptive. The letters urge recipients to review their price-disclosure practices and take corrective action; they announce no fine or formal order.
$1.9M
The FTC alleged that Premier Franchising Group LLC and Franchise Fastlane LLC made deceptive and unsubstantiated claims about the Premier Martial Arts franchise opportunity and violated the Franchise Rule. The proposed settlements require the companies to pay a combined $1.85 million to compensate franchisees, prohibit certain misrepresentations, and require Franchise Rule compliance; certain franchisees may also cancel their agreements without penalty.