Well, here is yet another company that had a nasty habit of just throwing papers containing their customers’ personally identifiable information (PII) into publicly accessible trash cans.
On June 24 a Texas judge handed down a civil penalty of $600,000 against Texas EZPawn for tossing their customer PII, including Social Security numbers, bank account information, driver’s license numbers, date of birth, and other identifying information, into their trash cans without first irreversibly and completely shredding the papers. You can see an example of the types of records found in the trash in the court documents.
Oh, and guess what, they had promised their customers they would safeguard the information provided to them. You can also see these promises in the court documents.
Texas EZPawn actually operates in 13 states and has 600 locations with pawn shops and supplies third-party lender loans.
The judgment requires:
- $600,000 penalty
- Texas EZPawn LP and its related businesses to shred or otherwise irreversibly destroy PII on customer records before disposing of them, or to contract with a company that provides such secure disposal services
- Texas EZPawn LP and its related businesses to designate a data security compliance representative, create a written compliance program for the safe handling of consumer information, set up a training program for employees, and iimplement compliance verification procedures yo ensure that all stores are handling customer information properly and complying with state privacy law
The state indicated Texas EZPawn LP and its related businesses violated the Texas Deceptive Trade Practices Act, the Texas Credit Services Organizations Act, and Texas statutes governing identity theft, including the Identity Theft Enforcement and Protection Act.
I’d like to see this company also penalized under the federal FACTA Disposal Rule, and the FTC Act…wonder if that’s coming down the pike?
This would make a great case study within an information security training session about how to prevent privacy breaches through poor disposal practices along with the impact of privacy breaches, poor security practices, and making security promises that are not kept. It would also be good to analyze and pick apart within an awareness communication on this topic to all personnel that handle PII.
Tags: awareness and training, disposal, FACTA, Information Security, IT compliance, personal information privacy, policies and procedures, privacy breach, privacy training, risk management, security training, Texas Credit Services Organizations Act, Texas Deceptive Trade Practices Act, Texas EZPAwn, Texas Identity Theft Enforcement and Protection Act