Digital Media and Data Privacy Law Blog

by David Smyth, Securities Enforcement Attorney

On October 31^st, the Federal Trade Commission sued St. Petersburg, Florida-based debt broker Bayview Solutions and two of its principals for posting the debt portfolios of 28,000 consumers online, including their bank account numbers and other identifying information. The “facts” that follow come from the FTC’s complaint. They may not be true!

Bayview’s Business

Bayview buys and sells portfolios of charged-off consumer debt for eventual collection by third-party debt collectors. One means of its business is through websites that provide a venue for debt sellers and buyers to identify one another and exchange information about portfolios they seek to trade. According to the FTC, one particular website Bayview uses is publicly accessible  and is not password-protected.  This website invites visitors to become members, but visitors can view and download its contents without becoming members.

Generally, sellers post summary information about the portfolios they’re offering, such as the number of individual debts in the portfolio, as well as the type, total face value, and general age of the debt, and the number of collection agencies that have tried to collect.  In some instances, sellers also post sample portions of their portfolios, but redact personal identifiers. Then buyers can contact the sellers for more information. So, as the FTC points out, sellers can market their portfolios on the site without disclosing consumers’ sensitive information. But that’s not how it always went. 

The Compromised Information

Instead, the FTC says that Bayview and owner Aron Tomko sales associate Jonathan Ortiz on at least 21 occasions have offered their debt portfolios for sale by posting them in the form of unencrypted, unprotected Excel spreadsheets.

Since July 16^th of this year, they have posted at least 21 portfolios containing the unencrypted, unmasked, sensitive personal information of more than 28,000 consumers. Whoops. In addition to information about the consumer’s alleged debt, the information on the unprotected Excel spreadsheets has included the consumer’s first name; date of birth; city; state; email address; employer name; bank name; full bank account number; and bank routing number; and driver’s license. Though the defendants have partially redacted the consumers’ last names, street addresses, or telephone numbers, the FTC contends that information is easily discerned based on other disclosed information.

Perhaps worst from the FTC’s perspective, it alleges the consumers at issue would be unlikely to know that Bayview has and is openly disclosing their information, so they’re not in a position to protect themselves. The FTC claims Bayview could have averted the public disclosure of this sensitive information at virtually no cost by redacting it from the Excel spreadsheets, encrypting it, password-protecting it, or by offering to make it available through other secure means.

The Law

Many consumers have likely had their data compromised and thought, Man, that’s not fair. The FTC agrees! The Commission finds this sort of thing to be “unfair . . . acts or practices in or affecting commerce” in violation of Section 5 of the FTC Act. And if those unfair acts cause “substantial injury to consumers,” the FTC may be cued up to take action.

My Take

If the facts alleged are true, Bayview could have protected this information (and thus itself) better than it did. But in reading the complaint, one doesn’t get the feeling that the FTC loves Bayview’s underlying business of trading debt based on payday loans, “small, short-term, high-interest loans marketed to financially-strapped consumers.” Those who are in that business should be especially careful not to give law enforcement special reasons to attack what would be otherwise legitimate operations.