Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

The Federal Trade Commission (FTC) has approved an<a> </a><a href="https://www.ftc.gov/system/files/ftc_gov/pdf/p145407_safeguards_rule.pdf" target="_blank" rel="noreferrer noopener">amendment</a> to its Safeguards Rule that requires non-banking financial institutions to report certain data breaches and other security events to the agency. This data breach notification obligation is separate and distinct from the <a href="https://www.thompsonhine.com/insights/sec-finalizes-rules-requiring-mandatory-cybersecurity-disclosure/" target="_blank" rel="noreferrer noopener">cybersecurity and risk management rule</a> recently promulgated by the Securities and Exchange Commission (SEC), which requires certain publicly traded companies to make public disclosures related to security incidents impacting their business. <a>The FTC and SEC regulations present organizations with an important opportunity to reassess their data security incident plans to ensure they align with evolving information security threats and new data breach notification obligations.</a>

contentpilot/introduction

core/heading

The <a>FTC’s Safeguards Rule </a>requires non-banking financial institutions (e.g., mortgage brokers, motor vehicle dealers, and payday lenders) to develop, implement, and maintain a comprehensive information security program to protect the confidentiality and security of their customers’ personal information. In <a href="https://www.ftc.gov/news-events/news/press-releases/2021/10/ftc-strengthens-security-safeguards-consumer-financial-information-following-widespread-data" target="_blank" rel="noreferrer noopener">October 2021</a>, the FTC finalized changes to the Safeguards Rule that provide more concrete guidance for businesses and reflect core data security principles that all covered companies need to implement and maintain.

core/paragraph

The Safeguards Rule amendment applies to financial institutions that are subject to the FTC’s jurisdiction and are not subject to the enforcement authority of another regulator under the <a>Gramm-Leach-Bliley Act,</a> which defines “financial institution” as an entity that engages in an activity that is “financial in nature” or “incidental” to such financial activities.

New Reporting Requirements for Notification Events

Pursuant to the new <a>Safeguards Rule </a>amendment, covered financial institutions must report each “notification event” that involves at least 500 customers to the FTC. A “notification event” is defined as the “acquisition of unencrypted customer information without the authorization of the individual to which the information pertains.” In turn, customer information is considered “unencrypted” for purposes of the rule if the “encryption key was accessed by an unauthorized person” and “[u]nauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information.”

A covered financial institution must notify the FTC as soon as possible, and no later than 30 days after discovery of a notification event. The rule treats a notification event as discovered as of the first day the event is known by an employee, officer, or other agent of the company who did not commit the breach. In explaining this requirement, the FTC clarifies that discovery includes circumstances when an “employee, officer, or other agent of the financial institution <a>accesses customer information without authorization</a>,” and that event “is known to another employee, officer, or other agent of the financial institution.” Therefore, the reporting requirement considers security incidents that implicates the actions of internal and external actors.

As is common in other federal and state data breach notification requirements, a covered entity must disclose the notification event to the FTC via an online webform available on the <a href="https://www.ftc.gov" target="_blank" rel="noreferrer noopener">FTC’s website</a>. This disclosure must include:

core/list

According to the new Safeguards Rule amendment, “[a] law enforcement official may request an initial delay of up to 30 days following the date when notice was provided” to the FTC by the impacted organization. This delay may be extended for an additional period of up to 60 days if the law enforcement official seeks such an extension in writing. Additional delay may be permitted only if the FTC staff determines that public disclosure of a security event continues to impede a criminal investigation or cause damage to national security.

<a></a><a>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</a>

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2023/10/Privacy-Cybersecurity-Update-FTC-Amends-Safeguards-Rule-and-Data-Breach-Notification-Obligations.pdf

FTC Amends Safeguards Rule and Data Breach Notification Obligations

Services