FTC Amends Safeguards Rule to Require Reporting of Information Breaches | Troutman Pepper

On October 27, the Federal Commerce Fee (FTC) introduced a remaining rule amending the Requirements for Safeguarding Buyer Info (Safeguards Rule) beneath the Gramm-Leach-Bliley Act. The Safeguards Rule requires nonbanking monetary establishments to develop, implement, and keep a complete data safety program to maintain their clients’ data protected. The modification would require monetary establishments to inform the FTC no later than 30 days after discovery of a safety breach involving the knowledge of 500 or extra customers. The modification will go into impact 180 days after publication of the ultimate rule within the Federal Register.

Particularly, the modification applies to “notification occasions,” that are outlined because the “acquisition of unencrypted buyer data with out the authorization of the person to which the knowledge pertains.” Notably, the FTC remaining rule requires notification the place buyer data has been acquired, fairly than when misuse is taken into account possible, though the FTC agrees that notification shouldn’t be required when hurt to customers is rendered extraordinarily unlikely as a result of the client data is encrypted. Though the FTC obtained public feedback advocating for the inclusion of a “threat of hurt” to customers evaluation, the FTC believes that figuring out whether or not acquisition has occurred simplifies the requirement and can allow monetary establishments to extra speedily decide whether or not a notification occasion has occurred.

If a notification occasion includes the knowledge of 500 or extra customers, the lined entity should notify the FTC “as quickly as attainable, and no later than 30 days after discovery of the occasion” utilizing a kind on the FTC’s web site. The FTC will deem a monetary establishment to have data of a notification occasion if such occasion is understood to any individual, apart from the individual committing the breach, who’s the monetary establishment’s worker, officer, or different agent.

The discover should embody:

• The identify and call data of the reporting monetary establishment;
• An outline of the kinds of data concerned;
• If attainable, the date or date vary of the notification occasion;
• The variety of customers affected or probably affected;
• A common description of the notification occasion; and
• If relevant, whether or not any legislation enforcement official has offered the monetary establishment with a written willpower that notifying the general public of the breach would impede a prison investigation or trigger harm to nationwide safety, and the contact data for the legislation enforcement official.

This can be a supplemental rulemaking to the Safeguards Rule updates beforehand finalized on December 9, 2021.

4 Fast Steps to Take Now:

1. Incident Response Plan. Replace your incident response plan according to the necessities of the modification and its 30-day interval to inform the FTC.
2. Service supplier agreements and safety evaluation questionnaires. Replace service supplier contracts, statements of labor, and safety diligence evaluation questionnaires to verify service suppliers of monetary establishments (together with nonbanking monetary establishments): (i) have developed, carried out, and maintained a complete data safety program round clients’ data; and (ii) are required to promptly notify their monetary establishment clients on condition that the 30-day notification clock begins when the triggering occasion is understood not simply by an organization officer or worker, but in addition by an agent, together with service suppliers.
3. Replace coaching to verify the up to date incident response plan, service supplier contracting processes, and new modification necessities are defined.
4. Replace/conduct cyber simulation tabletop coaching workouts that embody FTC notification questions and third-party service supplier safety incident situations to additional present publicity and observe to the brand new modification.

Troutman Pepper will proceed to observe necessary developments involving the FTC and the Safeguards Rule and can present additional updates as they grow to be obtainable.