According to the FTC complaint, GMR failed to adequately verify that its data service provider implemented reasonable and appropriate security measures to protect the personal information stored on the provider’s network and computers. Moreover, the FTC faulted GMR for failures in contracting with its data service provider. The FTC alleged that GMR failed to: