5
respondent maintains and protects the privacy, security and confidentiality of any
covered information, including, but not limited to, any statement related to a change
in any website or service controlled by respondent that relates to the privacy, security,
and confidentiality of covered information, with all materials relied upon in making
or disseminating such statements;
B. for a period of five (5) years from the date received, all consumer complaints directed
at respondent, or forwarded to respondent by a third party, that relate to the conduct
prohibited by this order and any responses to such complaints;
C. for a period of five (5) years from the date received, any documents, whether
prepared by or on behalf of respondent that contradict, qualify, or call into question
respondent’s compliance with this order; and
D. for a period of five (5) years after the date of preparation of each Assessment required
under Part III of this order, all materials relied upon to prepare the Assessment,
whether prepared by or on behalf of respondent including but not limited to all plans,
reports, studies, reviews, audits, audit trails, policies, training materials, and
assessments, for the compliance period covered by such Assessment.
V.
IT IS FURTHER ORDERED that respondent shall deliver a copy of this order to all
current and future subsidiaries, current and future principals, officers, directors, and managers,
and to all current and future employees, agents, and representatives having responsibilities
relating to the subject matter of this order. Respondent shall deliver this order to such current
subsidiaries and personnel within thirty (30) days after service of this order, and to such future
subsidiaries and personnel within thirty (30) days after the person assumes such position or
responsibilities. For any business entity resulting from any change in structure set forth in Part
VI, delivery shall be at least ten (10) days prior to the change in structure. Respondent must
secure a signed and dated statement acknowledging receipt of this order, within thirty (30) days
of delivery, from all persons receiving a copy of the order pursuant to this section.
VI.
IT IS FURTHER ORDERED that respondent shall notify the Commission at least
thirty (30) days prior to any change in the corporation(s) that may affect compliance obligations
arising under this order, including, but not limited to: a dissolution, assignment, sale, merger, or
other action that would result in the emergence of a successor corporation; the creation or
dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this
order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address.
Provided, however, that, with respect to any proposed change in the corporation(s) about which
respondent learns fewer than thirty (30) days prior to the date such action is to take place,
respondent shall notify the Commission as soon as is practicable after obtaining such knowledge.
Unless otherwise directed by a representative of the Commission, all notices required by this Part