Dumpster Diving Leads to FTC Sanctions

A company in Kansas City, the Nations Title Agency Inc., have been accused that they have not taken appropriate measures to insure the protection of confidential data by the Federal Trade Commission. The initial investigation began when someone tipped off a local television station that the Nations Title Agency was discarding pertinent information in the dumpsters.

The Kansas City reporter then decided to go dumpster diving in the agencies dumpster. The reporter found a noteworthy amount of documents that contained personal identity information. The Federal Trade Commission was notified and began their own investigation. The information they found was dreadful. In April 2004, the Nations Title Agency’s computer system was hacked and in February 2005, another dumpster dive was underway. In this dive, thrown away loan closing documents were found along with other important papers.

Because of the problems the Title Company was having with safeguarding their materials, they had to read a settlement with the Federal Trade Commission. They had to 1) designate an information security officer, 2) implement an information security program, 3) 20 years of bi-annual audits to ensure compliance with the program, 4) the president of the company must notify the Federal Trade Commission of any job changes during the next 10 years.

When it comes to securing Visa and MasterCard data, the PCI sets the standards for how the information should be stored. Compliance is required of all of the entities storing, processing, or transmitting data. Any bank that wants information about the card holder must comply with the PCI and are accountable for guaranteeing the compliance of all of the merchants for any payment channels they may go through. Merchants must abide to 12 basic security requirements and sub requirements. Some of the requirements are: install and maintain a working firewall to protect data, keep security patches up to date, protect stored data, encrypt data sent across public networks, assign unique ID to each person with computer access and many more requirements.

It is the merchant’s responsibility for ensuring that their use of the materials is compliant with the rules and regulations. Any merchant that does not adhere to the regulations, Visa may impose a mandatory fine of $500,000 and may even bar the merchant from accepting Visa Credit Cards.