Federal Register / Vol. 74, No. 89 / Monday, May 11, 2009 / Notices 21805 

1 The comment must be accompanied by an 

explicit request for confidential treatment, 

including the factual and legal basis for the request, 

and must identify the specific portions of the 

comment to be withheld from the public record. 

The request will be granted or denied by the 

Commission’s General Counsel, consistent with 

applicable law and the public interest. See FTC 

Rule 4.9(c), 16 CFR 4.9(c). 

FEDERAL TRADE COMMISSION 

[File No. 072 3108] 

James B. Nutter & Company; Analysis 

of Proposed Consent Order to Aid 

Public Comment 

AGENCY: Federal Trade Commission. 

ACTION: Proposed Consent Agreement. 

SUMMARY: The consent agreement in this 

matter settles alleged violations of 

federal law prohibiting unfair or 

deceptive acts or practices or unfair 

methods of competition. The attached 

Analysis to Aid Public Comment 

describes both the allegations in the 

complaint and the terms of the consent 

order—embodied in the consent 

agreement—that would settle these 

allegations. 

DATES: Comments must be received on 

or before June 8, 2009. 

ADDRESSES: Interested parties are 

invited to submit written comments 

electronically or in paper form. 

Comments should refer to ‘‘Nutter, File 

No. 072 3108’’ to facilitate the 

organization of comments. Please note 

that your comment—including your 

name and your state—will be placed on 

the public record of this proceeding, 

including on the publicly accessible 

FTC website, at (http://www.ftc.gov/os/ 

publiccomments.shtm). 

Because comments will be made 

public, they should not include any 

sensitive personal information, such as 

an individual’s Social Security Number; 

date of birth; driver’s license number or 

other state identification number, or 

foreign country equivalent; passport 

number; financial account number; or 

credit or debit card number. Comments 

also should not include any sensitive 

health information, such as medical 

records or other individually 

identifiable health information. In 

addition, comments should not include 

any ‘‘[t]rade secret or any commercial or 

financial information which is obtained 

from any person and which is privileged 

or confidential. . . .,’’ as provided in 

Section 6(f) of the FTC Act, 15 U.S.C. 

46(f), and Commission Rule 4.10(a)(2), 

16 CFR 4.10(a)(2). Comments containing 

material for which confidential 

treatment is requested must be filed in 

paper form, must be clearly labeled 

‘‘Confidential,’’ and must comply with 

FTC Rule 4.9(c), 16 CFR 4.9(c).1

Because paper mail addressed to the 

FTC is subject to delay due to 

heightened security screening, please 

consider submitting your comments in 

electronic form. Comments filed in 

electronic form should be submitted by 

using the following weblink: (https:// 

secure.commentworks.com/ftc-nutter) 

(and following the instructions on the 

web-based form). To ensure that the 

Commission considers an electronic 

comment, you must file it on the webbased form at the weblink: (https:// 

secure.commentworks.com/ftc-nutter). If 

this Notice appears at (http:// 

www.regulations.gov/search/index.jsp), 

you may also file an electronic comment 

through that website. The Commission 

will consider all comments that 

regulations.gov forwards to it. You may 

also visit the FTC website at http:// 

www.ftc.gov/ to read the Notice and the 

news release describing it. 

A comment filed in paper form 

should include the ‘‘Nutter, File No. 072 

3108’’ reference both in the text and on 

the envelope, and should be mailed or 

delivered to the following address: 

Federal Trade Commission, Office of the 

Secretary, Room H-135 (Annex D), 600 

Pennsylvania Avenue, NW, Washington, 

DC 20580. The FTC is requesting that 

any comment filed in paper form be sent 

by courier or overnight service, if 

possible, because U.S. postal mail in the 

Washington area and at the Commission 

is subject to delay due to heightened 

security precautions. 

The Federal Trade Commission Act 

(‘‘FTC Act’’) and other laws the 

Commission administers permit the 

collection of public comments to 

consider and use in this proceeding as 

appropriate. The Commission will 

consider all timely and responsive 

public comments that it receives, 

whether filed in paper or electronic 

form. Comments received will be 

available to the public on the FTC 

website, to the extent practicable, at 

(http://www.ftc.gov/os/ 

publiccomments.shtm). As a matter of 

discretion, the Commission makes every 

effort to remove home contact 

information for individuals from the 

public comments it receives before 

placing those comments on the FTC 

website. More information, including 

routine uses permitted by the Privacy 

Act, may be found in the FTC’s privacy 

policy, at (http://www.ftc.gov/ftc/ 

privacy.shtm). 

FOR FURTHER INFORMATION CONTACT: 

Alain Sheer or Loretta H. Garrison, 

Bureau of Consumer Protection, 600 

Pennsylvania Avenue, NW, Washington, 

D.C. 20580, (202) 326-3321 or (202) 326- 

3043. 

SUPPLEMENTARY INFORMATION: Pursuant 

to section 6(f) of the Federal Trade 

Commission Act, 38 Stat. 721, 15 U.S.C. 

46(f), and § 2.34 the Commission Rules 

of Practice, 16 CFR 2.34, notice is 

hereby given that the above-captioned 

consent agreement containing a consent 

order to cease and desist, having been 

filed with and accepted, subject to final 

approval, by the Commission, has been 

placed on the public record for a period 

of thirty (30) days. The following 

Analysis to Aid Public Comment 

describes the terms of the consent 

agreement, and the allegations in the 

complaint. An electronic copy of the 

full text of the consent agreement 

package can be obtained from the FTC 

Home Page (for May 5, 2009), on the 

World Wide Web, at (http:// 

www.ftc.gov/os/actions.shtm). A paper 

copy can be obtained from the FTC 

Public Reference Room, Room 130-H, 

600 Pennsylvania Avenue, NW, 

Washington, D.C. 20580, either in 

person or by calling (202) 326-2222. 

Public comments are invited, and may 

be filed with the Commission in either 

paper or electronic form. All comments 

should be filed as prescribed in the 

ADDRESSES section above, and must be 

received on or before the date specified 

in the DATES section. 

Analysis of Agreement Containing 

Consent Order to Aid Public Comment 

The Federal Trade Commission has 

accepted, subject to final approval, a 

consent agreement from James B. Nutter 

& Company (‘‘JBN’’). 

The proposed consent order has been 

placed on the public record for thirty 

(30) days for receipt of comments by 

interested persons. Comments received 

during this period will become part of 

the public record. After thirty (30) days, 

the Commission will again review the 

agreement and the comments received, 

and will decide whether it should 

withdraw from the agreement and take 

appropriate action or make final the 

agreement’s proposed order. 

The Commission’s proposed 

complaint alleges that JBN is in the 

business of making and servicing 

mortgage loans throughout the United 

states. In doing so, JBN routinely obtains 

information from or about its customers, 

including, but not limited to, name; 

address; Social Security number; 

financial information; employment 

history; credit scores; and information 

contained in credit reports. 

The complaint further alleges that JBN 

engaged in a number of practices that, 

taken together, failed to provide 

reasonable and appropriate security for 

21806 Federal Register / Vol. 74, No. 89 / Monday, May 11, 2009 / Notices 

sensitive information from consumers 

and employees, in violation of the 

Gramm-Leach-Bliley (‘‘GLB’’) Act 

Safeguards Rule. In particular, JBN: (1) 

did not develop, implement, and 

maintain a comprehensive written 

information security program; (2) did 

not implement reasonable policies and 

procedures in areas such as employee 

training; (3) stored personal information 

in clear text on its computer network; 

(4) did not employ sufficient measures 

to prevent or detect unauthorized access 

to personal information on its computer 

network or to conduct security 

investigations; (5) did not assess risks to 

personal information it collected and 

stored on its computer network and in 

paper files; and (6) provided back-up 

tapes containing personal information 

in clear text to a third party service 

provider but did not require the service 

provider by contract to protect the 

security and confidentiality of the 

information. 

According to the complaint, JBN’s 

practices violated the Safeguards Rule 

by, among other things, failing to: (1) 

develop, implement, and maintain a 

comprehensive written information 

security program; (2) identify reasonably 

foreseeable internal and external risks to 

the security, confidentiality, and 

integrity of customer information; (3) 

design and implement information 

safeguards to control the risks to 

customer information and regularly test 

and monitor them; (4) investigate, 

evaluate, and adjust the information 

security program in light of known or 

identified risks; and (5) oversee service 

providers and require them by contract 

to implement safeguards to protect 

respondent’s customer information. 

In addition, the proposed complaint 

alleges that JBN disseminated privacy 

notices that did not comply with the 

GLB Privacy Rule. In particular: (1) JBN 

began providing notices in 2004 even 

though under the Rule notices were to 

be provided starting on July 1, 2001; and 

(2) the notices it provided did not: set 

out its security practices; accurately 

describe that customer information 

would be disclosed to third parties; or 

accurately inform customers that they 

could exercise their opt-out rights at any 

time during the course of their loans. 

The proposed order applies to 

personal information from or about 

consumers that JBN collects in 

connection with its lending business. 

The proposed order contains provisions 

designed to prevent the company from 

engaging in the future in practices 

similar to those alleged in the 

complaint. 

Part I of the proposed order requires 

JBN to establish and maintain a 

comprehensive information security 

program that is reasonably designed to 

protect the security, confidentiality, and 

integrity of such information (whether 

in paper or electronic format) from or 

about consumers. The security program 

must contain administrative, technical, 

and physical safeguards appropriate to 

JBN’s size and complexity, the nature 

and scope of its activities, and the 

sensitivity of the information collected 

from or about consumers and 

employees. Specifically, the order 

requires JBN to: 

∑ Designate an employee or 

employees to coordinate and be 

accountable for the information security 

program. 

∑ Identify material internal and 

external risks to the security, 

confidentiality, and integrity of 

customer information that could result 

in the unauthorized disclosure, misuse, 

loss, alteration, destruction, or other 

compromise of such information, and 

assess the sufficiency of any safeguards 

in place to control these risks. 

∑ Design and implement reasonable 

safeguards to control the risks identified 

through risk assessment, and regularly 

test or monitor the effectiveness of the 

safeguards’ key controls, systems, and 

procedures. 

∑ Develop and use reasonable steps to 

select and retain service providers 

capable of appropriately safeguarding 

personal information they receive from 

JBN and require service providers by 

contract to implement and maintain 

appropriate safeguards. 

∑ Evaluate and adjust its information 

security programs in light of the results 

of testing and monitoring, any material 

changes to operations or business 

arrangements, or any other 

circumstances that it knows or has 

reason to know may have material 

impact on its information security 

program. 

Part II of the order prohibits JBN from 

violating any provision of the GLB 

Safeguards Rule and Privacy Rule. 

Part III of the proposed order requires 

JBN to obtain within one year, and on 

a biennial basis thereafter for a period 

of ten (10) years, an assessment and 

report from a qualified, objective, 

independent third-party professional, 

certifying, among other things, that: (1) 

it has in place a security program that 

provides protections that meet or exceed 

the protections required by Part I of the 

proposed order; and (2) its security 

program is operating with sufficient 

effectiveness to provide reasonable 

assurance that the security, 

confidentiality, and integrity of 

sensitive consumer and employee 

information has been protected. 

Parts IV through VIII of the proposed 

order are reporting and compliance 

provisions. Part IV requires JBN to 

retain documents relating to its 

compliance with the order. For most 

records, the order requires that the 

documents be retained for a five-year 

period. For the third-party assessments 

and supporting documents, JBN must 

retain the documents for a period of 

three years after the date that each 

assessment is prepared. Part V requires 

dissemination of the order now and in 

the future to persons with 

responsibilities relating to the subject 

matter of the order. Part VI ensures 

notification to the FTC of changes in 

company status. Part VII mandates that 

JBN submit a compliance report to the 

FTC within 60 days, and periodically 

thereafter as requested. Part VIII is a 

provision ‘‘sunsetting’’ the order after 

twenty (20) years, with certain 

exceptions. 

The purpose of this analysis is to 

facilitate public comment on the 

proposed order. It is not intended to 

constitute an official interpretation of 

the proposed order or to modify its 

terms in any way. By direction of the 

Commission. 

Donald S. Clark 

Secretary. 

[FR Doc. E9–10959 Filed 5–8–09: 8:45 am] 

BILLING CODE: 6750–01–S 

DEPARTMENT OF DEFENSE 

GENERAL SERVICES 

ADMINISTRATION 

NATIONAL AERONAUTICS AND 

SPACE ADMINISTRATION 

[OMB Control No. 9000–0055] 

Federal Acquisition Regulation; 

Submission for OMB Review; Freight 

Classification Description 

AGENCIES: Department of Defense (DOD), 

General Services Administration (GSA), 

and National Aeronautics and Space 

Administration (NASA). 

ACTION: Notice of request for public 

comments regarding an extension to an 

existing OMB clearance. 

SUMMARY: Under the provisions of the 

Paperwork Reduction Act of 1995 (44 

U.S.C. Chapter 35), the Federal 

Acquisition Regulation (FAR), 

Regulatory Secretariat (VPR) will be 

submitting to the Office of Management 

and Budget (OMB) a request to review 

and approve an extension of a currently 

approved information collection 

requirement concerning Freight