Insights / articlesInsights
Insights / articles

Alert

FTC’s Final Rule Requires Reporting of Data Breaches by Non-Bank Financial Institutions

Read Time: 2 mins
On October 27, 2023, the Federal Trade Commission (FTC) issued a final rule (Final Rule) to amend the Standards for Safeguarding Customer Information (Safeguards Rule). This amendment will require non-bank financial institutions, such as mortgage brokers, motor vehicle dealers, and payday lenders, to report certain data breaches and other security events to the FTC.

The Final Rule will require non-bank financial institutions to report to the FTC any notification event where unencrypted customer information involving 500 or more consumers is acquired without authorization. The notification must be made to the FTC as soon as possible but no later than 30 days after discovering the security breach. The FTC has noted that the Final Rule is based on the reporting requirement in the New York Department of Financial Services cybersecurity regulations, 23 NYCRR 500. The prior version of the Final Rule, published in the Federal Register on December 9, 2021, did not include a reporting requirement. The Final Rule will become effective 180 days after publication in the Federal Register.

According to The Final Rule, the notice is required to be made electronically on a form to be located on the FTC’s website, including the following information:

  • The name and contact information of the reporting financial institution
  • A description of the types of information impacted
  • If the information is possible to determine the date or date range
  • The number of consumers affected or potentially affected
  • A general description
  • Whether any law enforcement official has provided a written determination that notifying the public of the breach would impede a criminal investigation or cause damage to national security
  • A means for the FTC to contact the law enforcement official

Because the amendment to the Safeguards Rule will require financial institutions to notify the FTC as soon as possible, no later than 30 days, after a security breach involving unencrypted customer information of at least 500 consumers, clients should ensure that they are equipped to identify and report such security breaches promptly to the FTC within the 30-day timeframe.

Insights

Presentation

Lipinski and Tallman to Present at NCHER 2024 Annual Meeting

June 4-5, 2024

Members of McGlinchey’s Financial Institutions Compliance team will participate in multiple sessions during the upcoming National Council of Higher Education Resources (NCHER) Annual Conference in Clearwater, Florida.

Alert

The Final Countdown: President Biden Signs Potential TikTok Ban into Law

April 25, 2024

On April 24, 2024, President Biden signed a sweeping foreign aid package into law. Tucked into the law is a slightly amended version of the “Protecting Americans from Foreign Adversary Controlled Applications Act” (the Act), which will force TikTok’s parent company, ByteDance, to sell TikTok or have it banned in the U.S.

News Release

Julia Berry Lopez Joins McGlinchey in Albany

January 8, 2024

McGlinchey Stafford announces the addition of Julia Berry Lopez to the firm’s Albany office. Practicing in the Financial Institutions Compliance practice, Julia supports financial institutions in remaining compliant with the varying regulatory regimes under which they operate. Julia is one of the 50 attorneys McGlinchey welcomed in 2023, as part of a focused recruitment initiativeMore

Deep Dive into Consumer Finance

GLBA or FCRA? Data Sharing Between Affiliates and Non-Affiliates

March 17, 2023

When an entity shares data outside of its organization, the following questions often arise: Does the FCRA or GLBA (or both) apply to the specific type of data sharing? And how do these laws impact my company’s financial privacy notice? The answer to these questions comes down to the relationship between the Gramm-Leach-Bliley Act (GLBA,More

Published Article

FTC’s Proposed Dealer Trade Rules Sets Sights on “Add-on” Product Sales

August 12, 2022

On July 13, 2022, the FTC’s proposed Motor Vehicle Dealers Trade Regulation Rule, was published in the Federal Register. The FTC’s stated purpose of the proposed rule is to "protect consumers and honest dealers by making the car-buying process more clear and competitive". More specifically, the FTC believes consumers do not know the true cost of the vehicle they purchase and finance, and that consumers unknowingly purchase or are tricked into purchasing Add-on products without knowing its costs, benefits, that the Add-on products are optional, or that they are even purchasing Add-ons for the vehicle at all.