1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

LAURA B. STACK (DC Bar No. 455708)

Federal Trade Commission

600 Pennsylvania Avenue, NW, NJ-3158

Washington, DC 20580

Telephone: (202) 326-2209

Facsimile: (202) 326-3062

E-mail: lstack@ftc.gov

Counsel for Plaintiff

Federal Trade Commission

UNITED STATES DISTRICT COURT

DISTRICT OF NEVADA

 

FEDERAL TRADE COMMISSION, )

) CV-SPlaintiff, )

v. ) COMPLAINT FOR CIVIL PENALTIES, 

) INJUNCTION, AND OTHER

GREGORY NAVONE, ) EQUITABLE RELIEF

)

Defendant. )

 )

Plaintiff, the Federal Trade Commission (“FTC” or “Commission”), for its Complaint,

alleges:

1. Plaintiff brings this action under Sections 5(a), 13(b), and 16(a) of the Federal

Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 45(a), 53(b), and 56(a), and Section 621(a) of

the Fair Credit Reporting Act (“FCRA”), 15 U.S.C. § 1681s(a), to obtain monetary civil

penalties and permanent injunctive and other equitable relief from Defendant for engaging in

acts or practices in violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a); Section 628 of

the FCRA, 15 U.S.C. § 1681w; and the rule regarding the Disposal of Consumer Report

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 1 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25 Page 2 of 9

Information and Records (“Disposal Rule”), 16 C.F.R. § 682.1 et seq., issued pursuant to Section

628 of the FCRA, 15 U.S.C. § 1681w. 

JURISDICTION AND VENUE

2. This Court has subject matter jurisdiction over this matter under 28 U.S.C.

§§ 1331, 1337(a), 1345, and 1355, and under 15 U.S.C. §§ 53(b), 56(a), and 1681s(a).

3. Venue in the United States District Court for the District of Nevada is proper

under 15 U.S.C. § 53(b) and under 28 U.S.C. §§ 1391(b)-(c) and 1395(a).

THE PARTIES

4. Plaintiff, the FTC, is an independent agency of the United States Government

created by the FTC Act, 15 U.S.C. §§ 41 - 58. The FTC is charged, inter alia, with enforcement

of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a), which prohibits unfair and deceptive acts or

practices in or affecting commerce. The FTC is also charged with enforcement of the FCRA, 15

U.S.C. §§ 1681a - 1681x. Pursuant to the FCRA, the FTC promulgated and enforces the

Disposal Rule, 16 C.F.R. Part 682, which requires proper disposal of consumer report

information and records. The FTC is authorized to initiate federal district court proceedings, by

its own attorneys, to enjoin violations of the FTC Act, the FCRA, and the Disposal Rule, and to

secure such equitable relief as may be appropriate in each case. 15 U.S.C. §§ 53(b), 1681s(a). 

The FTC is also authorized to initiate federal district court proceedings, by its own attorneys, to

recover civil penalties for violations of the FCRA and the Disposal Rule, if the Attorney General

fails to initiate such litigation within 45 days after receipt of notice from the FTC of its intention

to initiate such litigation. 15 U.S.C. §§ 56(a), 1681s(a). With respect to the instant proceeding,

the Attorney General received such notice from the FTC and declined to initiate the proceeding.

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 2 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25 Page 3 of 9

5. Defendant Gregory Navone is an individual residing in Las Vegas, Nevada. At

all times relevant to this action, Defendant has resided in and transacted business in this district. 

COMMERCE

6. The acts and practices of Defendant alleged in this Complaint have been in or

affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 15 U.S.C. § 44.

DEFENDANT’S COURSE OF CONDUCT

7. Since 1987, Defendant has owned and/or directed numerous businesses,

including, but not limited to, First Interstate Mortgage Corporation (“FIM”) and Nevada One

Corporation (doing business as Nevada One Mortgage) (“Nevada One”). Defendant was the sole

owner of FIM and its sole director, president, treasurer, and secretary from FIM’s incorporation

in approximately April 2003 until its dissolution in approximately August 2008. Defendant

owned and was president, treasurer, and secretary of Nevada One from approximately March

2000 until at least December 2003. During their periods of operation, FIM and Nevada One

were mortgage brokerage companies that provided real estate financing services, including, but

not limited to, assisting customers in locating mortgage lenders; accepting, receiving, and

processing loan applications; and compiling documentation demonstrating customer

creditworthiness. Individually, or in concert with others, Defendant formulated, directed,

controlled, and participated in the policies, acts, or practices of FIM and Nevada One, including

the acts or practices alleged in this Complaint. 

8. Most of the companies that Defendant has owned or directed since 1987,

including FIM and Nevada One, are no longer operational or are currently operated by someone

other than Defendant; collectively, such companies are hereinafter referred to as “former

companies.” In operating FIM, Nevada One, and several of his other former companies,

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 3 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25 Page 4 of 9

Defendant collected and maintained sensitive consumer information concerning the companies’ 

customers, including, but not limited to, consumer names, addresses, dates of birth, Social

Security numbers, bank and credit card account numbers, income histories, credit histories, and

mortgage information, as well as information contained in mortgage loan applications, tax

returns, bank statements, purchase contracts, and consumer reports, as defined in the FCRA. 

9. In operating FIM and Nevada One, Defendant disseminated or caused to be

disseminated to consumers written statements regarding each company’s privacy and data

security practices, including, but not limited to, the following statement:

We take our responsibility to protect the privacy and confidentiality of customer

information very seriously. We maintain physical, electronic, and procedural

safeguards that comply with federal standards to store and secure information

about you from unauthorized access, alteration and destruction. . . . From time to

time, we enter into agreements with other companies to provide services to us or

make products and services available to you. Under these agreements, the

company may receive information about you but they must safeguard this

information and they may not use it for any other purposes. 

10. Contrary to these statements, Defendant engaged in a number of practices that,

taken together, failed to provide reasonable and appropriate security for sensitive consumer

information collected, handled and/or maintained by FIM and Nevada One. 

11. Among other things, in connection with his operation of FIM and Nevada One,

Defendant failed to: 1) implement policies and procedures in key areas, including the physical

and electronic security of sensitive consumer information; the proper collection, handling, and

disposal of sensitive consumer information; and employee training regarding such matters; and

2) provide reasonable oversight of the handling of sensitive consumer information by service

providers, such as third parties contracted to process loan applications, including by

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 4 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25 Page 5 of 9

contractually requiring such service providers to maintain appropriate safeguards for such

information. 

12. Defendant also has personally maintained sensitive consumer information

collected by Nevada One and his other former companies. Defendant has maintained this

sensitive consumer information, which includes consumer reports and information derived from

consumer reports, in an insecure manner in boxes in the garages of two successive residences

occupied by Defendant. 

13. With respect to the sensitive consumer information that Defendant has maintained

in his garages, Defendant has engaged in a number of practices that, taken together, constitute

failures to take reasonable measures to protect consumer reports, or information derived from

consumer reports, against unauthorized access or use in connection with their disposal. Among

other things, Defendant has failed to 1) implement and monitor policies and procedures requiring

the information to be disposed of in a manner that ensures that the information cannot

practicably be read or reconstructed; 2) ensure that employees or third parties assigned to collect

or transport the information for disposal are qualified to do so and have received appropriate

guidance or training; 3) alert such employees or third parties to the sensitive nature of the

information, or instruct them to take precautions with respect to the information; and 4) oversee

the collection and transport of the information for disposal, or otherwise confirm that the

information is disposed of in a manner that ensures that the information cannot practicably be

read or reconstructed. 

14. On December 20, 2006, approximately forty boxes of intact documents that

Defendant had stored in his garage were found in a publicly-accessible dumpster outside of an

office building in Las Vegas, Nevada, which housed a company owned and operated by

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 5 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25 Page 6 of 9

Defendant. These documents included tax returns, mortgage applications, bank statements,

photocopies of credit cards and drivers’ licenses, at least 230 consumer reports, and other

documents containing sensitive consumer information that had been collected by Nevada One

and some of Defendant’s other former companies.

VIOLATIONS OF THE FTC ACT 

COUNT I

15. Through the means described in paragraph 8, Defendant, through FIM and

Nevada One, represented, expressly or by implication, that FIM and Nevada One implemented

reasonable and appropriate measures to protect sensitive consumer information from

unauthorized access.

16. In truth and in fact, as described in paragraphs 9-13, FIM and Nevada One did not

implement reasonable and appropriate measures to protect sensitive consumer information from

unauthorized access. Therefore, the representation set forth in paragraph 14 was false or

misleading and constitutes a deceptive act or practice in violation of Section 5(a) of the FTC Act,

15 U.S.C. § 45(a).

COUNT II

17. Through the means described in paragraph 8, Defendant, through FIM and

Nevada One, represented, expressly or by implication, that FIM and Nevada One had entered

into agreements with service providers that required such companies to safeguard information

received about FIM’s and Nevada One’s customers and to use it only for purposes of providing

services to FIM or Nevada One.

18. In truth and in fact, as described in paragraph 10, FIM and Nevada One did not

enter into agreements requiring service providers to safeguard information about FIM and

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 6 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25 Page 7 of 9

Nevada One customers and to use such information only for purposes of providing services to

FIM or Nevada One. Therefore, the representation set forth in paragraph 16 was false or

misleading and constitutes a deceptive act or practice in violation of Section 5(a) of the FTC Act,

15 U.S.C.§ 45(a).

VIOLATIONS OF THE FCRA AND THE DISPOSAL RULE

COUNT III

19. Section 628(a) of the FCRA, 15 U.S.C. § 1681w, requires the Commission to

issue regulations requiring “any person that maintains or otherwise possesses consumer

information, or any compilation of consumer information, derived from consumer reports for a

business purpose to properly dispose of any such information or compilation.” Pursuant to this

directive, the Commission promulgated the Disposal Rule, 16 C.F.R. § 682.1 et seq., which took

effect on June 1, 2005. The Disposal Rule requires any person that maintains or otherwise

possesses consumer information derived from consumer reports for a business purpose to take

reasonable measures to protect against unauthorized access to or use of the information in

connection with its disposal. 16 C.F.R. § 682.3. 

20. Section 621 of the FCRA, 15 U.S.C. § 1681s, authorizes the Commission to use

all of its functions and powers under the FTC Act to enforce compliance with the FCRA by all

persons subject thereto except to the extent that enforcement specifically is committed to some

other governmental agency, irrespective of whether the person is engaged in commerce or meets

any other jurisdictional tests set forth by the FTC Act.

21. Defendant is a “person” as that term is defined in the FCRA, 15 U.S.C.

§ 1681a(b), and the Disposal Rule, 16 C.F.R § 682.1. 

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 7 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25 Page 8 of 9

22. At all times relevant to this action, Defendant has maintained and possessed

“consumer information” derived from “consumer reports,” as those terms are defined in the

FCRA, 15 U.S.C. § 1681a(d), and the Disposal Rule, 16 C.F.R. § 682.1(b), for a business

purpose. 

23. Through the acts and practices described in paragraphs 9-13, Defendant has failed

to take reasonable measures to protect against unauthorized access to or use of consumer

information derived from consumer reports in connection with its disposal, in violation of

Section 628 of the FCRA, 15 U.S.C. § 1681w, and Section 682.3(a) of the Disposal Rule, 16

C.F.R. § 682.3(a). 

24. Pursuant to Section 621(a)(1) of the FCRA, 15 U.S.C. § 1681s(a)(1), Defendant’s

violations of the FCRA and Disposal Rule constitute unfair or deceptive acts or practices in

violation of Section 5(a) of the FTC Act, 15 U.S.C. § 45(a).

25. The acts and practices described in paragraphs 9-13 constitute a pattern or

practice of knowing violations, as set forth in Section 621(a)(2)(A) of the FCRA, 15 U.S.C.

§ 1681s(a)(2)(A).

THIS COURT’S POWER TO GRANT RELIEF

26. Section 621(a)(2)(A) of the FCRA, 15 U.S.C. § 1681s(a)(2)(A), authorizes the

Court to award monetary civil penalties of not more than $2,500 for each knowing violation of

the FCRA that constitutes a pattern or practice of violations of the statute.

27. Each instance in which Defendant has failed to comply with Section 628 of the

FCRA, 15 U.S.C. § 1681w, and the Disposal Rule, 16 C.F.R. § 682.1 et seq., constitutes a

separate violation of the FCRA for the purpose of assessing monetary civil penalties under

Section 621(a)(2)(A) of the FCRA, 15 U.S.C. § 1681s(a)(2)(A).

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 8 of 9
1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25 Page 9 of 9

28. Under Section 13(b) of the FTC Act, 15 U.S.C. § 53(b), this Court is authorized

to issue injunctive and such other and further equitable and ancillary relief as it may deem

appropriate in the enforcement of the FCRA and the FTC Act, to prevent and remedy any

violation of any provision of law enforced by the Commission. 

PRAYER FOR INJUNCTIVE AND MONETARY RELIEF

WHEREFORE, Plaintiff requests that this Court, pursuant to 15 U.S.C. §§ 45(a)(1), 53(b), and

1681s(a), and pursuant to the Court’s own equitable powers:

(1) Enter judgment against Defendant and in favor of Plaintiff for each violation

alleged in this Complaint;

(2) Enter a permanent injunction to prevent future violations of the FCRA, the

Disposal Rule, and the FTC Act by Defendant;

(3) Award Plaintiff monetary civil penalties from Defendant for each violation of the

FCRA alleged in this Complaint; 

(4) Order Defendant to pay the costs of bringing this action; and

(5) Award Plaintiff such additional relief as the Court may deem just and proper. 

Dated: December 29, 2008 Respectfully submitted,

WILLIAM BLUMENTHAL

General Counsel

 /s/ 

LAURA B. STACK

Federal Trade Commission

Case 2:08-cv-01842 Document 1 Filed 12/30/2008 Page 9 of 9