PLS Group is the owner of the PLS Loan Stores. FTC alleged, among other charges, that the company failed to protect consumer information in a manner that was consistent with the company’s written data security and privacy policies. In particular, the company did not shred or destroy consumer records, including Social Security numbers and credit reports, before disposing of them in unsecured dumpsters outside the stores. Is the group liable for its failure to protect private consumer data?