Facsimile: (202) 326-3062 

E-mail: lstack@ftc.gov: kparsons@ftc.gov: kblodgett@ftc.gov 

DAVID M. NEWMAN (Calif. Bar No. 54218) 

Federal Trade Commission 

901 Market Street, Suite 570 

San Franciseo, CA 94103 

Telephone: 415-848-5100 

Facsimile: 415-848-5184 

E-mail: dnewman@ftc.gov 

Counsel for Plaintiff 

Federal Trade Commission 

UNITED STATES DISTRICT COURT 

DISTRICT OF NEVADA 

FEDERAL TRADE COMMISSION, 

Plaintiff, 

v. 

GREGORY NAVONE, 

Defendant. 

) 

) ) 

) ) 

) 

) 

) 

) 

Case No. 2:08-CV-01842 

STIPULATED FINAL ORDER FOR 

PA YMENT OF CIVIL PENAL TIES, 

PERMANENT INJUNCTION, 

AND OTHER EQUITABLE RELIEF 

On December 30,2008, Plaintiff, the Federal Trade Commission ("Commission"), filed 

its Complaint in the instant action against Defendant Gregory Navone for civil penalties, 

injunctive relief, and other equitable relief ("Complaint'"). The Complaint alleges that the 

Defendant has engaged in acts or practices in violation of Section 5(a) of the Federal Trade 

Commission Act ("FTC Act"), 15 U.s.c. § 45( a) and Section 628 of the Fair Credit Reporting 
Other Equitable Relief ("Order") in settlement of the Complaint, and request that the Court enter 

this Order to resolve all matters of dispute in this action. 

NOW. THEREFORE, the parties having requested the Court to enter this Order, and the 

Court having considered the Order and being fully advised of all matters in this case, it is hereby 

ORDERED, ADJUDGED, AND DECREED as follows: 

FINDINGS 

I. This Court has subject matter jurisdiction over this matter under 28 U.S.c. 

§§ 1331, 1 337(a), 1345, and 1355, and under 15 U.S.c. §§ 53(b), 56(a), and 168Is(a). 

2. Venue in the United States District Court for the District of Nevada is proper 

under 15 U.s.c. § 53(b) and under 28 U.S.c. §§ 1391 (b)-(c) and 1395(a). 

3. The acts and practices of Defendant are in or affecting commerce, as "commerce" 

is defined in Section 4 of the FTC Act, 15 U.S.c. § 44. 

4. The Complaint states claims upon which relief may be granted against Defendant 

15 

Sections 621(a) and 628 of the FCRA 15 U.s.c. §§ 168Is(a) and 1681w, and the Disposal Rule. 

5. Defendant has stipulated to the entry of this Order freely and without coercion, 

and acknowledges that he has read the provisions of the Order and is prepared to abide by them. 

6. By agreeing to the entry of this Order, Defendant does not admit to the allegations 

set forth in the Complaint, other than the jurisdictional facts, and Defendant's consent to entry of 

Page 2 of 17 
Commission, its employees, its representatives, or its agents. 

8. The parties agree that each shall bear its own costs and attorneys' fees incurred in 

connection with this action. Defendant agrees that the entry of this Order does not entitle him to 

seek or to obtain attorneys' fees under the Equal Justice Act, 28 U .S.c. § 2412, as amended by 

Pub. L. 104-12], 110 Stat. 847, 863-64 (1996), and he further waives any rights to attorneys' 

fees that may arise under said provision of law. 

9. Entry of this Order is in the public interest. 

DEFINITIONS 

For purposes of this Order, the following definitions shall apply: 

1. "Fair Credit Reporting Act" or "FCRN' refers to 15 U .S.c. § 1681-1681 x, as 

amended. 

2. The terms "person," "consumer," and "consumer report" mean as defined in 

Sections 603(b), (c), and (d), respectively, of the FCRA, 15 U.S.c. §§ 168Ia(b), 168Ia(c), and 

3. "Personal information" means individually identifiable information from or about 

a consumer including, but not limited to: (a) a first and last name; (b) a home or other physical 

address, including street name and name of city or town; (c) a telephone number; (d) an email 

address or other online contact information, such as an instant messaging user identifier or a 

screen name, that reveals a consumer's email address; (e) date of birth; (t) a Social Security 

Page 3 of 17 
that identifies an individual consumer: or (k) any other information from or about an individual 

consumer that is combined with (a) through (j) above. 

4. "Disposal Rule" means the rule regarding the Disposal of Consumer Report 

Information and Records ("Disposal Rule"), 16 C.F .R. § 682.1 et seq. 

5. "Consumer information" means as defined in the Disposal Rule, 16 C.F.R. 

§ 682.1 (b), i.e .. "any record about an individual, whether in paper, electronic, or other form, that 

is a consumer report or is derived from a consumer report. Consumer information also means a 

compilation of such records. Consumer information does not include information that does not 

identify individuals, such as aggregate information or blind data." 

6. "Commerce" means as defined in Section 4 of the Federal Trade Commission 

Act. 15 U.s.c. § 44. 

ORDER 

I. CIVIL PENALTY 

IT IS ORDERED 

A. Defendant is ordered to pay a civil penalty of $35,000 (thirty-five thousand 

dollars), pursuant to Section 621(a) of the FCRA, 15 U.S.C. § 1681s(a). 

B. Prior to the execution of this Order, Defendant transferred the amount specified in 

Paragraph A of this Section I to his undersigned former counsel, Richard McKnight, who has 

held and shall continue to hold the sum in escrow for no purpose other than payment to the 

Page 4 of 17 
pursuant to this Section I to the fullest extent permitted by law. Defendant shall make no claim 

to or demand return of these funds, directly or indirectly, through counselor otherwise. 

D. The amount paid pursuant to this Section] represents a civil penalty owed to the 

United States Government, is not compensation for actual pecuniary loss, and, therefore, is not 

subject to discharge under the Bankruptcy Code pursuant to 11 U.S.c. §523(a)(7). Defendant 

agrees that the facts as alleged in the Complaint filed in this action shall be taken as true, without 

further proof, for the sole purpose of any subsequent civil litigation filed by or on behalf of the 

Commission to enforce its rights to any payment pursuant to this Order. 

ll. PROmBITED BUSINESS ACTIVITIES 

IT IS FURTHER ORDERED that: 

A. Defendant and his agents, servants, and employees and all persons in active 

concert or participation with anyone or more of them, whether acting directly or through any 

sole proprietorship, partnership, limited liability company, corporation, subsidiary, branch, 

are hereby permanently restrained and enjoined from: 

1. Misrepresenting in any manner, expressly or by implication, the extent to 

which the privacy, confidentiality, or integrity of any personal information collected from or 

about consumers is maintained or protected; and 

Page 5 of 17 
B. In the event that the statutory section or Rule identified in paragraph A(2) is 

hereafter amended or modified, compliance with that statutory section or Rule as so amended or 

modified shall not be a violation of this Order. 

III. REQUIRED INFORMATION SECURITY PROGRAM 

IT IS FURTHER ORDERED that Defendant, for himself and for any business entity 

that he controls, directly or indirectly, if he or such business entity collects, maintains, or stores 

personal information from or about consumers, shall, no later than the date of entry of this Order, 

establish and implement, and thereafter maintain, a comprehensive information security program 

that is designed to protect the security, confidentiality, and integrity of personal information 

collected from or about consumers. Such program, the content and implementation of which 

must be fully documented in writing, shall contain administrative, technical, and physical 

safeguards appropriate to Defendant or the entity's size and complexity, the nature and scope of 

Defendant or the entity's activities, and the sensitivity of the personal information collected from 

A. The designation of an employee or employees to coordinate and be accountable 

for the information security program. 

B. The identification of material internal and external risks to the security, 

confidentiality, and integrity of personal information that could result in the unauthorized 

disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and 

Page 6 of 17 
and disposal; and (3) prevention, detection, and response to attacks, intrusions, or other system 

failures. 

C. The design and implementation of reasonable safeguards to control the risks 

identified through risk assessment, and regular testing and monitoring of the effectiveness of the 

safeguards' key controls, systems, and procedures. 

D. The development and use of reasonable steps to select and retain service 

providers capable of appropriately safeguarding personal information received from Defendant 

or the entity, and requiring service providers by contract to implement and maintain appropriate 

safeguards. 

E. The evaluation and adjustment of the information security program in light of the 

results of the testing and monitoring required by Paragraph C of this Section III, any material 

changes to operations or business arrangements, or any other circumstances that Defendant or 

the entity knows or has reason to know may have a material impact on the effectiveness of the 

IV. ASSESSMENT REQUIREMENTS 

IT IS FURTHER ORDERED that: 

A. In connection with his compliance with Sections II(A)(2) and III of this Order, 

Defendant, for himself and for any business entity that he controls, directly or indirectly, ifhe or 

such business entity collects, maintains, or stores personal information from or about consumers, 

Page 7 of 17 
from or about consumers is limited to a first and last name; a home or other physical address, 

including street name and name of city or town; a telephone number; and/or an email address or 

other online contact information, such as an instant messaging user identifier or a screen name, 

that reveals a consumer's email address (,'directory information"). ]f Defendant, for himself, 

collects, maintains or stores personal information from or about a consumer other than directory 

information, Defendant is required to obtain Assessments as described in this Section IV with 

respect to that personal information and any directory information from or about the same 

consumer only. The reporting period for the Assessments shall cover: (1) the first one hundred 

and eighty (180) days after entry of the Order for the initial Assessment; and (2) each one-year 

period thereafter for ten (10) years after entry of the Order for the annual Assessments. Each 

Assessment shall: 

I. Set forth the specific administrative, technical, and physical safeguards 

implemented and maintained during the reporting period; 

2. Explain how such safeguards are appropriate to Defendant's or the entity's 

size and complexity, the nature and scope of the Defendant's or the entity's activities, and the 

sensitivity of the personal information collected from or about consumers; 

3. Explain how the safeguards that have been implemented meet or exceed 

the protections required by Section 628 of the FCRA, the Disposal Rule, and Section III of this 

Order; and 

Page 8 of 17 
B. Each Assessment shall be prepared and completed within sixty (60) days after the 

end of the reporting period to which the Assessment applies by: a person qualified as a Certified 

Information System Security Professional (CISSP) or as a Certified Information Systems 

Auditor (CISA); a person holding Global Information Assurance Certification (GIAC) from the 

SysAdmin, Audit, Network, Security (SANS) Institute; or a similarly qualified person or 

organization approved by the Associate Director for Enforcement, Bureau of Consumer 

Protection, Federal Trade Commission. 

C. Defendant shall provide the initial Assessment to the Associate Director for 

Enforcement, Federal Trade Commission, 600 Pennsylvania Avenue, NW, Room NJ-2122, 

Washington, D.C. 20580, within ten (10) business days after the Assessment has been prepared. 

All subsequent annual Assessments shall be retained by the individual or the entity to which the 

Assessment pertains until three (3) years after completion of the final Assessment and provided 

to the Associate Director of Enforcement upon request within ten (10) business days of receipt of 

such request 

Page 9 of 17 
Commission, Defendant shall submit additional written reports, which are true and accurate and 

sworn to under penalty of perjury; produce documents for inspection and copying; appear for 

deposition; provide entry during normal business hours to any business location in Defendant's 

possession or direct or indirect control to inspect the business operation; and provide entry 

during normal business hours to any other location possessed or directly or indirectly controlled 

by Defendant where consumer personal information is maintained to inspect the location. 

B. In addition, the Commission is authorized to use all other lawful means, 

including, but not limited to: 

1. Obtaining discovery from any person, without further leave of Court, 

using the procedures prescribed by Fed. R. Civ. P. 30, 31,33,34,36,45,69; and 

2. Posing as consumers and suppliers to Defendant, his employees, or any 

other entity managed or controlled in whole or in part by Defendant, without the necessity of 

identification or prior notice. 

C Defendant shall permit representatives of the Commission to interview any 

employer, consultant, independent contractor, representative, agent, officer or employee who has 

agreed to such an interview, relating in any way to any conduct subject to this Order. The person 

interviewed may have counsel present. 

Provided, however, that nothing in this Order shall limit the Commission's lawful use of 

compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C §§ 49, 57b-l, to 

Page 10 of 17 
IT IS FURTHER ORDERED that, in order that compliance with the provisions of this 

Order may be monitored: 

A. For a period of five (5) years from the date of entry of this Order, 

I. Defendant shall notify the Commission of the following: 

(a) Any changes in Defendant's residence, mailing addresses. and/or 

telephone numbers, within ten (l0) days of the date of such change: 

(b) Any changes in Defendant's employment status (including selfemployment), and any changes in his ownership in any business entity, within ten (10) days of 

the date of such change. Such notice shall include: the name and address of each business that 

Defendant is affiliated with, employed by, creates or forms, incorporates, or performs services 

for; a detailed description of the nature of the business; and a detailed description of Defendant's 

duties and responsibilities in connection with the business or employment; and 

(c) Any changes in Defendant's name or use of any aliases or 

fictitious names, including "doing business as" names. 

2. Defendant shall notify the Commission of any changes in the structure of 

any business entity that Defendant directly or indirectly controls, or has an ownership interest in, 

that may affect compliance obligations arising under this Order, including but not limited to: 

incorporation or other organization; a dissolution, assignment, sale, merger, or other action; the 

creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices 

Page II of 17 
such knowledge. 

B. One hundred eighty (180) days after the date of entry of this Order and annually 

thereafter for a period of five (5) years, Defendant shall provide a written report to the 

Commission, which is true and accurate and sworn to under penalty of perjury, setting forth in 

detail the manner and form in which he has complied and is complying with this Order. This 

report shall include, but not be limited to: 

1. Defendant's then-current residence address, mailing addresses, and 

telephone numbers; 

2. Defendant's then-current employment status (including self-employment), 

including the name, addresses, and telephone numbers of each business that Defendant is 

affiliated with, employed by, or performs services for; a detailed description of the nature of the 

business: and a detailed description of Defendant's duties and responsibilities in connection with 

the business or employment; 

3. A copy of each acknowledgment of receipt of this Order obtained 

pursuant to Section VIII of this Order; and 

4. Any other changes required to be reported under Paragraph A of this 

Section VI. 

C. Defendant shall notify the Commission of the filing of a bankruptcy petition by 

Defendant within fifteen (15) days of filing. 

Page 12 of 17 
Federal Trade Commission 

600 Pennsylvania Avenue, N.W., Room NJ-2122 

Washington, D.C. 20580 

RE: FTC v. Gregory Navone 

Provided that. in lieu of overnight courier, Defendant may send such reports or notifications by 

first-class mail, but only if Defendant contemporaneously sends an electronic version of such 

report or notification to the Commission at: 

E For purposes of the compliance reporting and monitoring required by this Order, 

the Commission is authorized to communicate directly with Defendant. 

VII. RECORD KEEPING 

IT IS FURTHER ORDERED that Defendant (for himself and for any business entity 

that he controls, directly or indirectly, if such business entity collects, maintains, or stores 

personal information from or about consumers), and any agents, employees, officers, 

corporations, successors, and assigns, and those persons in active concert or participation with 

them who receive actual notice of this Order by personal service or otherwise, are hereby 

restrained and enjoined from failing to create and retain the following records: 

A. F or a period of eight (8) years from the date of entry of this Order: 

I. All documents that contradict, qualify, or call into question compliance 

with this Order; 

2. All consumer complaints (whether received in written or electronic form, 

directly, indirectly or through any third party), and all responses to such complaints, whether in 

Page 13 of 17 
respect on the collection, maintenance, or storage of consumer reports or other personal 

information from or about consumers; and 

4. All records and documents necessary to demonstrate full compliance with 

each provision of this Order, including but not limited to, copies of acknowledgments of receipt 

of this Order required by Sections VIII and IX, and all reports submitted to the Commission 

pursuant to Section VI. 

B. F or a period of three (3) years after the date of preparation of each Assessment 

required under Section IV of this Order, all materials, whether prepared by or on behalf of 

Defendant, relied upon to prepare the Assessment, including but not limited to all plans, reports, 

studies, reviews, audits, audit trails, policies, training materials, work papers, and assessments, 

and any other materials relating to compliance with Section III of this Order for the compliance 

period covered by such Assessment. 

VITI. DISTRIBUTION OF ORDER BY DEFENDANT 

IT IS FURTHER ORDERED that for a period of three (3) years from the date of entry 

of this order, Defendant shall deliver copies of this Order as directed below: 

A. For any business entity that Defendant controls, directly or indirectly, which 

collects, maintains, or stores personal information from or about consumers, Defendant must 

deliver a copy of this Order to (1) all of its principals, officers, directors, and managers, (2) all 

employees, agents, and representatives of that business who have supervisory responsibilities 

Page 14 of 17 
in structure set forth in Section VI(A)(2) of this Order, delivery shall be at least ten (10) days 

prior to the change in structure. 

B. For any business that collects, maintains, or stores personal information from or 

about consumers, where Defendant is not a controlling person of the business but he otherwise 

has responsibility, in whole or in part, for developing or overseeing the implementation of 

policies and procedures to protect the privacy, security, confidentiality, and integrity of personal 

information collected from or about consumers by the business, including in connection with its 

disposal, Defendant must deliver a copy of this Order to all principals and managers of such 

business before engaging in such conduct. 

C. Defendant must secure a signed and dated statement acknowledging receipt of the 

Order, within thirty (30) days of delivery, from all persons receiving a copy of the Order 

pursuant to this Section VIII. 

IX. ACKNOWLEDGMENT OF RECEIPT OF ORDER BY DEFENDANT 

IT IS FURTHER ORDERED that Defendant, within five (5) business days of receipt of 

this Order as entered by the Court, must submit to the Commission a truthful sworn statement 

acknowledging receipt of this Order. 

X. RETENTION OF JURISDICTION 

IT IS FURTHER ORDERED that this Court shall retain jurisdiction of this matter for 

purposes of construction, modification, and enforcement of this Order. 

Page] 5 of 17 
December 29, 2009 

Kent J. Dawson 

VNITED STATES DISTRICT JUDGE 

DATED: 

_ ______ _ 

ST1PULA TED & AGREED TO: 

Date: 

Kan i B. Parsons Katrina A. Blodgett 

David M. Newman 

Attorneys for Plaintiff Federal Trade Commission 

I / Gregory N 0 

.. Defendant 

Matthew Q. Callister 'I 

Attorney for Defendant Gregory Navone 

Page 16 of 17 
Page 17 of 17