Federal Register / Vol. 89, No. 198 / Friday, October 11, 2024 / Notices 82609 

A. Federal Reserve Bank of St. Louis 

(Holly A. Rieser, Senior Manager) P.O. 

Box 442, St. Louis, Missouri 63166– 

2034. Comments can also be sent 

electronically to 

Comments.applications@stls.frb.org: 

1. The Gary Canada Family Trust and 

the Bradley S. Canada 2020 Trust, 

Bradley S. Canada, as trustee for both 

Trusts, all of Little Rock, Arkansas; and 

Gary R. Canada, Sr., England, Arkansas; 

as a group acting in concert, to retain 

voting shares of MHBC Investments 

Limited Partnership I, LLLP, and 

thereby indirectly retain voting shares of 

Canada Bancshares, Inc., and the Bank 

of England, all of England, Arkansas. 

Board of Governors of the Federal Reserve 

System. 

Michele Taylor Fennell, 

Associate Secretary of the Board. 

[FR Doc. 2024–23634 Filed 10–10–24; 8:45 am] 

BILLING CODE P 

FEDERAL RESERVE SYSTEM 

Formations of, Acquisitions by, and 

Mergers of Bank Holding Companies 

The companies listed in this notice 

have applied to the Board for approval, 

pursuant to the Bank Holding Company 

Act of 1956 (12 U.S.C. 1841 et seq.) 

(BHC Act), Regulation Y (12 CFR part 

225), and all other applicable statutes 

and regulations to become a bank 

holding company and/or to acquire the 

assets or the ownership of, control of, or 

the power to vote shares of a bank or 

bank holding company and all of the 

banks and nonbanking companies 

owned by the bank holding company, 

including the companies listed below. 

The public portions of the 

applications listed below, as well as 

other related filings required by the 

Board, if any, are available for 

immediate inspection at the Federal 

Reserve Bank(s) indicated below and at 

the offices of the Board of Governors. 

This information may also be obtained 

on an expedited basis, upon request, by 

contacting the appropriate Federal 

Reserve Bank and from the Board’s 

Freedom of Information Office at 

https://www.federalreserve.gov/foia/ 

request.htm. Interested persons may 

express their views in writing on the 

standards enumerated in the BHC Act 

(12 U.S.C. 1842(c)). 

Comments received are subject to 

public disclosure. In general, comments 

received will be made available without 

change and will not be modified to 

remove personal or business 

information including confidential, 

contact, or other identifying 

information. Comments should not 

include any information such as 

confidential information that would not 

be appropriate for public disclosure. 

Comments regarding each of these 

applications must be received at the 

Reserve Bank indicated or the offices of 

the Board of Governors, Ann E. 

Misback, Secretary of the Board, 20th 

Street and Constitution Avenue NW, 

Washington DC 20551–0001, not later 

than November 12, 2024. 

A. Federal Reserve Bank of 

Minneapolis (Mark Rauzi, Vice 

President), 90 Hennepin Avenue, 

Minneapolis, Minnesota 55480–0291. 

Comments can also be sent 

electronically to MA@mpls.frb.org: 

1. Bravera Holdings Corp., Dickinson, 

North Dakota; to acquire Vision Bank 

Holdings, Inc., and thereby indirectly 

acquire VISIONBank, both of Fargo, 

North Dakota. In addition, Bravera 

Acquisition Corp., Dickinson, North 

Dakota, an interim subsidiary, to merge 

with Vision Bank Holdings, Inc., 

whereby Bravera Acquisition Corp. will 

be the surviving entity and a whollyowned subsidiary of Bravera Holdings 

Corp. for a moment in time. Following 

the interim holding company merger, 

Bravera Acquisition Corp. will be 

merged with and into Bravera Holdings 

Corp., with Bravera Holdings Corp. 

being the surviving entity. 

Board of Governors of the Federal Reserve 

System. 

Michele Taylor Fennell, 

Associate Secretary of the Board. 

[FR Doc. 2024–23635 Filed 10–10–24; 8:45 am] 

BILLING CODE P 

FEDERAL RESERVE SYSTEM 

Notice of Proposals To Engage in or 

To Acquire Companies Engaged in 

Permissible Nonbanking Activities 

The companies listed in this notice 

have given notice under section 4 of the 

Bank Holding Company Act (12 U.S.C. 

1843) (BHC Act) and Regulation Y, (12 

CFR part 225) to engage de novo, or to 

acquire or control voting securities or 

assets of a company, including the 

companies listed below, that engages 

either directly or through a subsidiary or 

other company, in a nonbanking activity 

that is listed in § 225.28 of Regulation Y 

(12 CFR 225.28) or that the Board has 

determined by Order to be closely 

related to banking and permissible for 

bank holding companies. Unless 

otherwise noted, these activities will be 

conducted throughout the United States. 

The public portions of the 

applications listed below, as well as 

other related filings required by the 

Board, if any, are available for 

immediate inspection at the Federal 

Reserve Bank(s) indicated below and at 

the offices of the Board of Governors. 

This information may also be obtained 

on an expedited basis, upon request, by 

contacting the appropriate Federal 

Reserve Bank and from the Board’s 

Freedom of Information Office at 

https://www.federalreserve.gov/foia/ 

request.htm. Interested persons may 

express their views in writing on the 

question whether the proposal complies 

with the standards of section 4 of the 

BHC Act. 

Comments received are subject to 

public disclosure. In general, comments 

received will be made available without 

change and will not be modified to 

remove personal or business 

information including confidential, 

contact, or other identifying 

information. Comments should not 

include any information such as 

confidential information that would not 

be appropriate for public disclosure. 

Unless otherwise noted, comments 

regarding the applications must be 

received at the Reserve Bank indicated 

or the offices of the Board of Governors, 

Ann E. Misback, Secretary of the Board, 

20th Street and Constitution Avenue 

NW, Washington, DC 20551–0001, not 

later than November 12, 2024. 

A. Federal Reserve Bank of New York 

(Bank Applications Officer) 33 Liberty 

Street, New York, New York 10045– 

0001. Comments can also be sent 

electronically to 

Comments.applications@ny.frb.org: 

1. Grasshopper Bancorp, Inc., New 

York, New York; through its subsidiary 

bank, Grasshopper Bank, National 

Association, also of New York, New 

York, to acquire Auto Club Trust, FSB, 

Dearborn, Michigan, and thereby engage 

in operating a savings association 

pursuant to section 225.28(b)(4)(ii) of 

the Board’s Regulation Y. 

Board of Governors of the Federal Reserve 

System. 

Michele Taylor Fennell, 

Associate Secretary of the Board. 

[FR Doc. 2024–23510 Filed 10–10–24; 8:45 am] 

BILLING CODE P 

FEDERAL TRADE COMMISSION 

[File No. 192 3022] 

Marriott International, Inc.; Analysis of 

Proposed Consent Order To Aid Public 

Comment 

AGENCY: Federal Trade Commission. 

ACTION: Proposed consent agreement; 

request for comment. 


ddrumheller on DSK120RN23PROD with NOTICES1
82610 Federal Register / Vol. 89, No. 198 / Friday, October 11, 2024 / Notices 

SUMMARY: The consent agreement in this 

matter settles alleged violations of 

Federal law prohibiting unfair or 

deceptive acts or practices. The attached 

Analysis of Proposed Consent Order to 

Aid Public Comment describes both the 

allegations in the complaint and the 

terms of the consent order—embodied 

in the consent agreement—that would 

settle these allegations. 

DATES: Comments must be received on 

or before November 12, 2024. 

ADDRESSES: Interested parties may file 

comments online or on paper by 

following the instructions in the 

Request for Comment part of the 

SUPPLEMENTARY INFORMATION section 

below. Please write ‘‘Marriott and 

Starwood; File No. 192 3022’’ on your 

comment and file your comment online 

at https://www.regulations.gov by 

following the instructions on the webbased form. If you prefer to file your 

comment on paper, please mail your 

comment to the following address: 

Federal Trade Commission, Office of the 

Secretary, 600 Pennsylvania Avenue 

NW, Mail Stop H–144 (Annex L), 

Washington, DC 20580. 

FOR FURTHER INFORMATION CONTACT: 

Katherine McCarron, Attorney, Division 

of Privacy and Identity Protection, 

Bureau of Consumer Protection, Federal 

Trade Commission, 600 Pennsylvania 

Avenue NW, Washington, DC 20580, 

kmccarron@ftc.gov, (202–326–2333). 

SUPPLEMENTARY INFORMATION: Pursuant 

to section 6(f) of the Federal Trade 

Commission Act, 15 U.S.C. 46(f), and 

FTC Rule § 2.34, 16 CFR 2.34, notice is 

hereby given that the above-captioned 

consent agreement containing a consent 

order to cease and desist, having been 

filed with and accepted, subject to final 

approval, by the Commission, has been 

placed on the public record for a period 

of 30 days. The following Analysis to 

Aid Public Comment describes the 

terms of the consent agreement and the 

allegations in the complaint. An 

electronic copy of the full text of the 

consent agreement package can be 

obtained at https://www.ftc.gov/newsevents/commission-actions. 

You can file a comment online or on 

paper. For the Commission to consider 

your comment, we must receive it on or 

before November 12, 2024. Write 

‘‘Marriott and Starwood; File No. 192 

3022’’ on your comment. Your 

comment—including your name and 

your State—will be placed on the public 

record of this proceeding, including, to 

the extent practicable, on the https://

www.regulations.gov website. 

Because of heightened security 

screening, postal mail addressed to the 

Commission will be subject to delay. We 

strongly encourage you to submit your 

comments online through the https://

www.regulations.gov website. If you 

prefer to file your comment on paper, 

write ‘‘Marriott and Starwood; File No. 

192 3022’’ on your comment and on the 

envelope, and mail your comment to the 

following address: Federal Trade 

Commission, Office of the Secretary, 

600 Pennsylvania Avenue NW, Mail 

Stop H–144 (Annex L), Washington, DC 

20580. 

Because your comment will be placed 

on the publicly accessible website at 

https://www.regulations.gov, you are 

solely responsible for making sure your 

comment does not include any sensitive 

or confidential information. In 

particular, your comment should not 

include sensitive personal information, 

such as your or anyone else’s Social 

Security number; date of birth; driver’s 

license number or other State 

identification number, or foreign 

country equivalent; passport number; 

financial account number; or credit or 

debit card number. You are also solely 

responsible for making sure your 

comment does not include sensitive 

health information, such as medical 

records or other individually 

identifiable health information. In 

addition, your comment should not 

include any ‘‘trade secret or any 

commercial or financial information 

which . . . is privileged or 

confidential’’—as provided by section 

6(f) of the FTC Act, 15 U.S.C. 46(f), and 

FTC Rule § 4.10(a)(2), 16 CFR 

4.10(a)(2)—including competitively 

sensitive information such as costs, 

sales statistics, inventories, formulas, 

patterns, devices, manufacturing 

processes, or customer names. 

Comments containing material for 

which confidential treatment is 

requested must be filed in paper form, 

must be clearly labeled ‘‘Confidential,’’ 

and must comply with FTC Rule 

§ 4.9(c). In particular, the written 

request for confidential treatment that 

accompanies the comment must include 

the factual and legal basis for the 

request and must identify the specific 

portions of the comment to be withheld 

from the public record. See FTC Rule 

§ 4.9(c). Your comment will be kept 

confidential only if the General Counsel 

grants your request in accordance with 

the law and the public interest. Once 

your comment has been posted on the 

https://www.regulations.gov website—as 

legally required by FTC Rule § 4.9(b)— 

we cannot redact or remove your 

comment from that website, unless you 

submit a confidentiality request that 

meets the requirements for such 

treatment under FTC Rule § 4.9(c), and 

the General Counsel grants that request. 

Visit the FTC website at https://

www.ftc.gov to read this document and 

the news release describing the 

proposed settlement. The FTC Act and 

other laws the Commission administers 

permit the collection of public 

comments to consider and use in this 

proceeding, as appropriate. The 

Commission will consider all timely 

and responsive public comments it 

receives on or before November 12, 

2024. For information on the 

Commission’s privacy policy, including 

routine uses permitted by the Privacy 

Act, see https://www.ftc.gov/siteinformation/privacy-policy. 

Analysis of Proposed Consent Order To 

Aid Public Comment 

The Federal Trade Commission (the 

‘‘Commission’’) has accepted, subject to 

final approval, an agreement containing 

consent order from Marriott 

International, Inc. (‘‘Marriott’’) and 

Starwood Hotels & Resorts Worldwide, 

LLC (‘‘Starwood’’ or collectively, 

‘‘Respondents’’). The proposed consent 

order (‘‘Proposed Order’’) has been 

placed on the public record for 30 days 

for receipt of comments from interested 

persons. Comments received during this 

period will become part of the public 

record. After 30 days, the Commission 

will again review the agreement, along 

with any comments received, and will 

decide whether it should withdraw from 

the agreement and take appropriate 

action or make final the Proposed Order. 

Marriott is a multinational hospitality 

company that manages and franchises 

hotels and related lodging facilities, 

including 30 brands and more than 

7,000 properties throughout the United 

States and across 131 countries and 

territories. On or about November 16, 

2015, Marriott announced that it would 

acquire Starwood, and on or about 

September 23, 2016, Starwood became a 

wholly owned subsidiary of Marriott. 

With the acquisition of Starwood, 

Marriott became the largest hotel chain 

in the world at that time, with more 

than 1.1 million hotel rooms, 

accounting for one out of every fifteen 

hotel rooms worldwide. 

After Marriott’s acquisition of 

Starwood, Marriott took control of 

Starwood’s computer network and has 

been responsible for establishing, 

reviewing, and implementing the 

information security practices for both 

Marriott and Starwood. Additionally, 

Marriott commenced a two-year process 

to integrate some Starwood systems into 

the Marriott network. Marriott fully 

integrated those Starwood systems into 

its own network by December 2018. 

According to the FTC’s Complaint, 

Respondents suffered at least three 


ddrumheller on DSK120RN23PROD with NOTICES1
Federal Register / Vol. 89, No. 198 / Friday, October 11, 2024 / Notices 82611 

distinct data security breaches over the 

course of several years. Starwood 

informed customers of the first breach 

just four days after the announcement of 

Marriott’s acquisition of Starwood. This 

breach allowed intruders to compromise 

Starwood’s point-of-sale systems and 

gain access to more than 40,000 

customer payment cards over the course 

of 14 months. 

The second breach began on or 

around July 28, 2014, and involved a 

breach of a Starwood guest reservation 

database. This breach went undetected 

for four years—during which Marriott 

had responsibility for Starwood’s 

information security practices and 

network following the acquisition. 

Forensic examiners, retained by 

Marriott in September 2018, identified 

similar failures that resulted in the first 

breach, including: inadequate firewall 

controls, unencrypted payment card 

information stored outside of the secure 

cardholder data environment, lack of 

multifactor authentication, and 

inadequate monitoring and logging 

practices. As a result of the second 

breach, intruders compromised the 

personal information of 339 million 

Starwood guest records and 5.25 million 

unencrypted passport numbers 

worldwide. Additional compromised 

information from the Starwood guest 

reservation database included: names, 

dates of birth, payment card numbers, 

addresses, email addresses, telephone 

numbers, usernames, Starwood loyalty 

numbers, and partner loyalty program 

numbers. 

As to the third breach, Marriott 

announced in March 2020 that 

malicious actors had compromised the 

credentials of employees at a Marriottfranchised property to gain access to 

Marriott’s own network The intruders 

began accessing and exporting 

consumers’ personal information 

without detection from September 

2018—the same month that Marriott 

became aware of the second breach—to 

December 2018 and resumed in January 

2020 and continued until they were 

ultimately discovered in February 2020. 

The intruders were able to access more 

than 5.2 million guest records, 

including 1.8 million records related to 

U.S. consumers, that contained 

significant amounts of personal 

information, including: names, mailing 

addresses, email addresses, phone 

numbers, affiliated companies, gender, 

month and day of birth, Marriott loyalty 

account information, partner loyalty 

program numbers, and hotel stay and 

room preferences. Marriott’s internal 

investigation confirmed that the 

malicious actors’ main purpose for 

searching, accessing, and exporting 

guest records was to identify loyalty 

accounts with sufficient loyalty points 

to be either used or redeemed, including 

for booking stays at hotel properties. 

The Commission’s proposed twocount complaint alleges that 

Respondents violated section 5(a) of the 

FTC Act by: (1) deceiving customers by 

representing in each of their privacy 

policies that they used reasonable and 

appropriate safeguards to protect 

consumers’ personal and financial 

information; and (2) failing to employ 

reasonable security measures to protect 

consumers’ personal information. With 

respect to these counts, the proposed 

complaint alleges that Respondents: 

• failed to implement appropriate 

password controls, which resulted in 

employees often using default, blank or 

weak passwords; 

• failed to patch outdated software 

and systems in a timely manner; 

• failed to adequately monitor and log 

network environments, limiting the 

ability to detect malicious actors and 

distinguish between authorized and 

unauthorized activity; 

• failed to implement appropriate 

access controls; 

• failed to implement appropriate 

firewall controls; 

• failed to implement appropriate 

network segmentation to prevent 

attackers from moving freely across its 

networks and databases; and 

• failed to apply adequate multifactor 

authentication to protect sensitive 

information. 

The proposed complaint alleges, with 

respect to the second count above, that 

Respondents’ failure to employ 

reasonable security measures to protect 

consumers’ personal information 

caused, or is likely to cause, substantial 

injury to consumers that is not 

outweighed by countervailing benefits 

to consumers or competition and is not 

reasonably avoidable by consumers 

themselves. Such practices constitute 

unfair acts or practices under section 5 

of the FTC Act. 

The Proposed Order contains 

injunctive relief designed to prevent 

Respondents from engaging in the same 

or similar acts or practices in the future. 

Part I prohibits Respondents from 

misrepresenting in any manner, 

expressly or by implication: (1) 

Respondents’ collection, maintenance, 

use, deletion, or disclose consumers’ 

personal information; and (2) the extent 

to which Respondents protect the 

privacy, security, availability, 

confidentiality, or integrity of 

consumers’ personal information. Part II 

requires that Respondents establish, 

implement, and document a 

comprehensive information security 

program. The program must include 

specific safeguards tailored to 

Respondents’ previous data security 

shortcomings. 

Parts III–VI require Respondents to 

obtain initial and biennial information 

security assessments by an independent, 

third-party professional for 20 years 

(part III), cooperate with the 

independent assessor (part IV), provide 

the Commission with a certification of 

compliance with the Order from 

Respondents’ CEO (part V), and submit 

reports to the Commission if they suffer 

additional data incidents (part VI). 

Part VII requires Respondents to 

provide a Clear and Conspicuous 

method by which U.S. consumers can 

request that Respondents review the 

deletion of personal information 

associated with an email address and/or 

Loyalty Rewards Program account 

number. Part VIII requires Respondents 

to provide a link on their website and 

mobile app where all U.S. consumers 

may request deletion of Personal 

Information associated with an email 

address and/or Loyalty Rewards 

Program account number. 

Parts IX–XII are reporting and 

compliance provisions, which include 

recordkeeping requirements and 

provisions requiring Respondents to 

provide information or documents 

necessary for the Commission to 

monitor compliance. Part XIII states that 

the Proposed Order will remain in effect 

for 20 years, with certain exceptions. 

The purpose of this analysis is to 

facilitate public comment on the 

Proposed Order, and it is not intended 

to constitute an official interpretation of 

the complaint or Proposed Order, or to 

modify the Proposed Order’s terms in 

any way. 

By direction of the Commission, 

Commissioners Holyoak and Ferguson 

recused. 

April J. Tabor, 

Secretary. 

[FR Doc. 2024–23283 Filed 10–10–24; 8:45 am] 

BILLING CODE 6750–01–P 

GENERAL SERVICES 

ADMINISTRATION 

[Notice—C0A–2024–01; Docket No. 2024– 

0002; Sequence No 43] 

Office of Human Resources 

Management; SES Performance 

Review Board 

AGENCY: Office of Human Resources 

Management (OHRM), General Services 

Administration (GSA). 

ACTION: Notice. 


ddrumheller on DSK120RN23PROD with NOTICES1