The Federal Trade Commission (FTC) issued a Final Rule on October 27, 2021, amending the Standards for Safeguarding Customer Information, known as “the Safeguards Rule,” under the Gramm-Leach-Bliley Act, which is applicable to a broad range of non-banking financial institutions. The FTC approved the Amendment by a vote of 3-2. The FTC’s press release states that the “updated Safeguards Rule requires non-banking financial institutions, such as mortgage brokers, motor vehicle dealers, and payday lenders, to develop, implement, and maintain a comprehensive security system to keep their customers’ information safe.”
The amendment includes “five main modifications to the existing Rule.” According to the summary of the Final Rule, the modifications include:
“First, it adds provisions designed to provide covered financial institutions with more guidance on how to develop and implement specific aspects of an overall information security program, such as access controls, authentication, and encryption. Second, it adds provisions designed to improve the accountability of financial institutions’ information security programs, such as by requiring periodic reports to boards of directors or governing bodies. Third, it exempts financial institutions that collect less customer information from certain requirements. Fourth, it expands the definition of “financial institution” to include entities engaged in activities that the Federal Reserve Board determines to be incidental to financial activities. This change adds “finders”–companies that bring together buyers and sellers of a product or service–within the scope of the Rule. Finally, the Final Rule defines several terms and provides related examples in the Rule itself rather than incorporate them by reference from the Privacy of Consumer Financial Information Rule, 16 CFR part 313.”
The Final Rule is 145 pages long and outlines details of the security measures that must be taken by financial institutions to safeguard consumers’ financial information “from cyberattacks and other threats.” Most of the requirements codify basic elements of an information security program that are generally accepted in the cybersecurity industry. Nonetheless, the Final Rule gives the FTC the ability to commence enforcement actions and deliver fines and penalties in the event the provisions are not followed by regulated entities, so merit attention and consideration.