Protecting Consumer Data in Sale of Debt Portfolio

BY: J.P. MCGUIRE BOYD, JR. & ROBERT D. PERROW

On February 5, 2015, the Federal Trade Commission sent a letter to the Consumer Financial Protection Bureau (“CFPB”) describing its consumer protection efforts in 2014 in the area of debt collection.  As reflected in the letter, one of the FTC’s main concerns in 2014 was the security of consumer data in the purchase and sale of consumer debt.  This concern was shown in two FTC enforcement actions. 

In FTC v. Bayview Solutions, LLC and in FTC v. Cornerstone and Company, the FTC obtained preliminary injunctions against debt sellers who allegedly posted on a website unencrypted Excel spreadsheets containing sensitive data for over 70,000 consumers in an effort to sell debt portfolios.  According to the FTC, the spreadsheets were accessed more than 500 times by unknown visitors to the website. The preliminary injunctions obtained by the FTC require the defendants to remove the consumer data from the website, adopt appropriate data security safeguards, and notify affected consumers of the disclosures. A copy of the FTC’s February 5, 2015 letter is available here.