" '" u rn
. . . . . . . . . . Q ) o " ' d . . . . .
"0 "rn c::c:l .......
. . . . . . , r : : . . . . . Q , ; I . . . . .
O"t:l Q,lcG CI.l
§ . ; ; ; . . . e " 5 .
...... e':l Lnctl Q)
1 836-081-0111(1), which requires insurance producers to implement and thereby 2 implicitly develop, implement and maintain a comprehensive written information
3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26
security program. The program must include administrative, technical and physical safeguards for the protection of customer information. The administrative, technical and physical safeguards included in the information security program are required to be appropriate to the size and complexity of the licensee and the nature and scope of its activities.
Members of the public seeking to purchase an insurance product from
Brooke Auto or Brooke Corporation were required to submit an application. To complete the application, Brooke Auto and Brooke Corporation solicited and obtained such information as the customer's name, residential address, Social Security number, bank account number, driver license number, vehicle license number, credit card number and card expiration date.
On or before April 28, 2009, Spruill discarded over 1,000 insurance
business records and/or other documents related to insurance transactions of Brooke Auto and Brooke Corporation into an unlocked garbage dumpster behind the NE 181st Avenue offices of Brooke Auto. Approximately 50 of the discarded documents bore a customer name, address and full unredacted Social Security number. Approximately 66 other discarded documents bore a customer's name and unredacted driver license
.data, including license number. Approximately 900 more of the discarded documents were merchant copies of customer credit card receipts which bore the name and signature of the customer along with the full unredacted credit card number and the card expiration date. Spruill failed to shred or otherwise make the documents unreadable. The dumpster into which the documents were placed was not locked and was accessible to the public.