The agency said the processors did not do enough to protect their employees.