Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information

Federal RegisterApr 6, 2023

Ask Donna

What actually matters in this document.

Text

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 240, 248, 270, and 275

[Release Nos. 34-97141; IA-6262; IC-34854; File No. S7-05-23]

RIN 3235-AN26

Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information

AGENCY:

Securities and Exchange Commission.

ACTION:

Proposed rule.

SUMMARY:

The Securities and Exchange Commission (“Commission” or “SEC”) is proposing rule amendments that would require brokers and dealers (or “broker-dealers”), investment companies, and investment advisers registered with the Commission (“registered investment advisers”) to adopt written policies and procedures for incident response programs to address unauthorized access to or use of customer information, including procedures for providing timely notification to individuals affected by an incident involving sensitive customer information with details about the incident and information designed to help affected individuals respond appropriately. The Commission also is proposing to broaden the scope of information covered by amending requirements for safeguarding customer records and information, and for properly disposing of consumer report information. In addition, the proposed amendments would extend the application of the safeguards provisions to transfer agents. The proposed amendments would also include requirements to maintain written records documenting compliance with the proposed amended rules. Finally, the proposed amendments would conform annual privacy notice delivery provisions to the terms of an exception provided by a statutory amendment to the Gramm-Leach-Bliley Act (“GLBA”).

DATES:

Comments should be received on or before June 5, 2023.

ADDRESSES:

Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's internet comment form (

http://www.sec.gov/rules/submitcomments.htm

); or

• Send an email to

rule-comments@sec.gov.

Please include File Number S7-05-23 on the subject line.

Paper Comments

• Send paper comments to Secretary, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549-1090.

All submissions should refer to File Number S7-05-23. The file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method of submission. The Commission will post all comments on the Commission's website (

http://www.sec.gov/rules/proposed.shtml

). Comments are also available for website viewing and printing in the Commission's Public Reference Room, 100 F Street NE, Washington, DC 20549, on official business days between the hours of 10 a.m. and 3 p.m. Operating conditions may limit access to the Commission's public reference room. All comments received will be posted without change; the Commission does not edit personal identifying information from submissions. You should submit only information that you wish to make available publicly.

Studies, memoranda, or other substantive items may be added by the Commission or staff to the comment file during this rulemaking. A notification of the inclusion in the comment file of any such materials will be made available on the Commission's website. To ensure direct electronic receipt of such notifications, sign up through the “Stay Connected” option at

www.sec.gov

to receive notifications by email.

FOR FURTHER INFORMATION CONTACT:

Susan Poklemba, Brice Prince, or James Wintering, Special Counsels; Edward Schellhorn, Branch Chief; Devin Ryan, Assistant Director; John Fahey, Deputy Chief Counsel; Emily Westerberg Russell, Chief Counsel; Office of Chief Counsel, Division of Trading and Markets, (202) 551-5550; Jessica Leonardo or Taylor Evenson, Senior Counsels; Aaron Ellias, Acting Branch Chief; Marc Mehrespand, Branch Chief; Thoreau Bartmann, Co-Chief Counsel, Chief Counsel's Office, Division of Investment Management, (202) 551-6792, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION:

The Commission is proposing for public comment amendments to 17 CFR 248 (“Regulation S-P”)

under Title V of the GLBA [15 U.S.C. 6801-6827], the Fair Credit Reporting Act (“FCRA”) [15 U.S.C. 1681-1681x], the Securities Exchange Act of 1934 (“Exchange Act”) [15 U.S.C. 78a

et seq.

], the Investment Company Act of 1940 (“Investment Company Act”) [15 U.S.C. 80a-1

et seq.

], and the Investment Advisers Act of 1940 (“Investment Advisers Act”) [15 U.S.C. 80b-1

et seq.

Unless otherwise noted, all references below to rules contained in Regulation S-P are to Part 248 of Chapter 17 of the Code of Federal Regulations (“CFR”).

Table of Contents

I. Introduction

A. Background

B. 2008 Proposal

C. Overview of the Proposal

II. Discussion

A. Incident Response Program Including Customer Notification

1. Assessment

2. Containment and Control

3. Service Providers

4. Notice to Affected Individuals

B. Remote Work Arrangement Considerations

C. Scope of Information Protected Under the Safeguards Rule and Disposal Rule

1. Definition of Customer Information

2. Safeguards Rule and Disposal Rule Coverage of Customer Information

3. Extending the Scope of the Safeguards Rule and the Disposal Rule To Cover All Transfer Agents

4. Maintaining the Current Regulatory Framework for Notice-Registered Broker-Dealers

D. Recordkeeping

E. Exception From the Annual Notice Delivery Requirement

1. Current Regulation S-P Requirements for Privacy Notices

2. Proposed Amendment

F. Request for Comment on Limited Information Disclosure When Personnel Leave Their Firms

G. Other Current Commission Rule Proposals

1. Covered Institutions Subject to the Regulation SCI Proposal and the Exchange Act Cybersecurity Proposal

2. Investment Management Cybersecurity

H. Existing Staff No-Action Letters and Other Staff Statements

I. Proposed Compliance Date

III. Economic Analysis

A. Introduction

B. Broad Economic Considerations

C. Baseline

1. Safeguarding Customer Information—Risks and Practices

2. Regulation

3. Market Structure

D. Benefits and Costs of the Proposed Rule Amendments

1. Response Program

2. Extend Scope of Customer Safeguards to Transfer Agents

3. Recordkeeping

4. Exception From Annual Notice Delivery Requirement

E. Effects on Efficiency, Competition, and Capital Formation

F. Reasonable Alternatives Considered

1. Reasonable Assurances From Service Providers

2. Lower Threshold for Customer Notice

3. Encryption Safe Harbor

4. Longer Customer Notification Deadlines

5. Broader Law Enforcement Exception From Notification Requirements

G. Request for Comment on Economic Analysis

IV. Paperwork Reduction Act

A. Introduction

B. Amendments to the Safeguards Rule and Disposal Rule

C. Request for Comment

V. Initial Regulatory Flexibility Act Analysis

A. Reason for and Objectives of the Proposed Action

B. Legal Basis

C. Small Entities Subject to Proposed Rule Amendments

D. Projected Reporting, Recordkeeping, and Other Compliance Requirements

E. Duplicative, Overlapping, or Conflicting Federal Rules

F. Significant Alternatives

G. Request for Comment

VI. Consideration of Impact on the Economy Statutory Authority

I. Introduction

The Commission adopted Regulation S-P in 2000.

Regulation S-P's provisions include, among other requirements, rule 248.30(a) (“safeguards rule”), which requires brokers, dealers, investment companies,

and registered investment advisers to adopt written policies and procedures for administrative, technical, and physical safeguards to protect customer records and information.

Another provision of Regulation S-P, rule 248.30(b) (“disposal rule”), which applies to transfer agents registered with the Commission in addition to the institutions covered by the safeguards rule, requires proper disposal of consumer report information.

Since Regulation S-P was adopted, evolving digital communications and information storage tools and other technologies have made it easier for firms to obtain, share, and maintain individuals' personal information. This evolution also has changed or exacerbated the risks of unauthorized access to or use of personal information,

thus increasing the risk of potential harm to individuals whose information is not protected against unauthorized access or use.

See

Privacy of Consumer Financial Information (Regulation S-P), Exchange Act Release No. 42974 (June 22, 2000) [65 FR 40334 (June 29, 2000)] (“Reg. S-P Release”). Regulation S-P is codified at 17 CFR Part 248, Subpart A.

Regulation S-P applies to investment companies as the term is defined in section 3 of the Investment Company Act (15 U.S.C. 80a-3), whether or not the investment company is registered with the Commission.

See

17 CFR 248.3(r). Thus, a business development company, which is an investment company but is not required to register as such with the Commission, is subject to Regulation S-P. Similarly, employees' securities companies—including those that are not required to register under the Investment Company Act—are investment companies and are, therefore, subject to Regulation S-P. By contrast, issuers that are excluded from the definition of investment company—such as private funds that are able to rely on section 3(c)(1) or 3(c)(7) of the Investment Company Act—would not be subject to Regulation S-P.

See

17 CFR 248.30(a).

See

17 CFR 248.30(b). In this release, institutions to which Regulation S-P currently applies, or to which the proposed amendments would apply, are sometimes referred to as “covered institutions.” The term, “covered institution” is sometimes used in this release to refer to institutions to as “you” in Regulation S-P.

Unauthorized use differs from unauthorized access in that a person making unauthorized use of customer information may or many not be authorized to access it. CF.

Van Buren

United States,

141 S. Ct. 1648, 1652 (2021) (discussing how a person can access a computer without authorization or exceed authorized access). As described in more detail below, covered institutions would have to provide notice to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

See, e.g.,

Federal Bureau of Investigation, 2021 Internet Crime Report (Mar. 22, 2022), at 7-8,

available at https://www.ic3.gov/Media/PDF/AnnualReport/2021_IC3Report.pdf

(stating that the FBI's internet Crime Complaint Center received 847,376 complaints in 2021 (an increase of approximately 181% from 2017). The complaints included 51,629 related to identity theft and 51,829 related to personal data breaches (increases of approximately 193% and 68% from 2017, respectively)); the Financial Industry Regulatory Authority (“FINRA”),

2021 Report on FINRA's Examination and Risk Monitoring Program: Cybersecurity and Technology Governance

(Feb. 2021),

available at https://www.finra.org/sites/default/files/2021-02/2021-report-finras-examination-risk-monitoring-program.pdf

(noting increased cybersecurity or technology-related incidents at firms); Office of Compliance Inspections and Examinations (now the Division of Examinations) (“EXAMS”), Risk Alert,

Cybersecurity: Safeguarding Client Accounts against Credential Compromise

(Sept. 15, 2020),

available at https://www.sec.gov/files/Risk%20Alert%20-%20Credential%20Compromise.pdf

(describing increasingly sophisticated methods used by attackers to gain access to customer accounts and firm systems). This Risk Alert, and any other Commission staff statements represent the views of the staff. They are not a rule, regulation, or statement of the Commission. Furthermore, the Commission has neither approved nor disapproved their content. These staff statements, like all staff statements, have no legal force or effect: they do not alter or amend applicable law; and they create no new or additional obligations for any person.

This environment of expanded risks supports our proposing updates to the requirements of Regulation S-P. Currently, the safeguards rule addresses protecting customer information against unauthorized access or use, but it does not include a requirement to notify affected individuals in the event of a data breach. In assessing firm and industry compliance with these requirements, Commission staff typically focus on information security controls, including whether firms have taken appropriate measures to safeguard customer accounts and to respond to data breaches.

Commission staff have observed a number of practices with respect to the information safeguards requirements of Regulation S-P and have provided observations on several occasions to assist firms in improving their practices.

Although many firms have improved their programs for safeguarding customer records and information in light of these observations, nonetheless we are concerned that some firms may not maintain plans for addressing incidents of unauthorized access to or use of data.

We also are concerned the incident response programs that firms have implemented may be insufficient to respond to evolving threats or may not include well-designed plans for customer notification.

See

EXAMS,

2022 Examination Priorities, available at https://www.sec.gov/files/2022-exam-priorities.pdf;

EXAMS,

Investment Adviser and Broker-Dealer Compliance Issues Related to Regulation S-P—Privacy Notices and Safeguard Policies

(Apr. 16, 2019) (“Reg. S-P Risk Alert”),

available at https://www.sec.gov/files/OCIE%20Risk%20Alert%20-%20Regulation%20S-P.pdf.

See

Reg. S-P Risk Alert,

supra

note 8 (noting that examples of the most common deficiencies or weaknesses observed by EXAMS staff included that broker-dealer and investment adviser written incident response plans did not address, among other things, actions required to address a cybersecurity incident and assessments of system vulnerabilities); EXAMS,

Observations from Cybersecurity Examinations

(Aug. 7, 2017) (“Observations Risk Alert”),

available at https://www.sec.gov/files/observations-from-cybersecurity-examinations.pdf.

See

Reg. S-P Risk Alert,

supra

note 8; Observations Risk Alert,

supra

note 9 (noting that some firms lacked plans for addressing access incidents).

See

Reg. S-P Risk Alert,

supra

note 8. Although broker-dealers are subject to self-regulatory organization (“SRO”) rules requiring written supervisory procedures and written business continuity plans addressing subjects including data back-up and recovery, SRO rules do not require notification to customers whose information is compromised.

See, e.g.,

FINRA Rule 3110 (Supervision) (requiring members to establish, maintain, and enforce written procedures to supervise the types of business in which they engage and the activities of their associated persons that are reasonably designed to achieve compliance with applicable securities laws and regulations, and with applicable FINRA rules), and FINRA Rule 4370 (Business Continuity Plans and Emergency Contact Information) (requiring members to create and maintain a written business continuity plan identifying procedures relating to an emergency or significant business disruption that must address specified topics including data back-up and recovery).

We therefore preliminarily believe specifically requiring a reasonably designed incident response program, including policies and procedures for assessment, control and containment, and customer notification, could help reduce or mitigate the potential for harm to individuals whose sensitive information is exposed or compromised in a data breach. Requiring firms to adopt incident response programs to address unauthorized access to or use of customer information, including

customer notification and recordkeeping requirements, would enhance protections for customer information. The advance planning required under an incident response program should improve an institution's preparedness and the effectiveness of its response to data breaches while still being consistent with the requirements for safeguarding standards articulated in the GLBA.

The GLBA's requirements for standards for safeguarding customer records and information are described in the Background section below.

See infra

section I.A.

In certain instances, some types of customer notification plans may already be required by existing state laws mandating customer notifications. While all 50 states have enacted laws in recent years requiring firms to notify individuals of data breaches, standards differ by state, with some states imposing heightened notification requirements relative to other states.

Currently, broker-dealers, investment companies, and registered investment advisers respond to data breaches according to applicable state laws. For example, states differ in the types of information that, if accessed or used without authorization, may trigger a notification requirement.

States also differ regarding a firm's duty to investigate a data breach when determining whether notice is required, deadlines to deliver notice, and the information required to be included in a notice, among other matters.

As a result, a firm's notification obligations arising from a single data breach may vary such that customers in one state may receive notice while customers of the same institution in another state may not receive notice or may receive less information. In reviewing these state laws, we determined that certain aspects of these provisions would be appropriately adopted as components of a Federal minimum standard for customer notification, which would help affected customers understand how to respond to a data breach to protect themselves from potential harm that could result.

Upon its adoption, rule 248.17 essentially restated the then-current text of section 507 of the GLBA, and as such, referenced determinations made by the Federal Trade Commission.

See

Reg. S-P Release,

supra

note 2. The proposal would, however, update rule 248.17 to instead reference determinations made by the Consumer Financial Protection Bureau, consistent with changes made to section 507 of the GLBA by the Dodd-Frank Wall Street Reform and Consumer Protection Act.

See

Public Law 111-203, sec. 1041, 124 Stat. 1376 (2010).

For example, some states may require a firm to notify individuals when a data breach includes biometric information, while others do not.

Compare

Cal. Civil Code sec. 1798.29 (notice to California residents of a data breach generally required when a resident's personal information was or is reasonably believed to have been acquired by an unauthorized person; “personal information” is defined to mean an individual's first or last name in combination with one of a list of specified elements, which includes certain unique biometric data)

with

Ala. Stat. secs. 8-38-2, 8-38-4, 8-38-5 (notice of a data breach to Alabama residents is generally required when sensitive personally identifying information has been acquired by an unauthorized person and is reasonably likely to cause substantial harm to the resident to whom the information relates; “sensitive personally identifying information” is defined as the resident's first or last name in combination with one of a list of specified elements, which does not include biometric information).

See infra

sections II.A.4 and III.C.2.a.

Our proposal would afford certain individuals greater protections by, for example, defining “sensitive customer information” more broadly than the current definitions used by at least 12 states, thereby requiring customers in those states to receive notice for a broader range of personal information included in a breach.

Additionally, the 30-day notification deadline proposed in this release is shorter than the timing currently mandated by 15 states, and would also offer enhanced protections to individuals in 32 states with laws that do not include a notification deadline as well as those in states that mandate or permit delayed notifications for law enforcement purposes.

A standardized notification deadline ensures timely notice to affected customers and would enhance their ability to take action quickly to protect themselves against the consequences of a breach. Further, consistent with 22 state laws, this proposal would require customer notification unless, after investigation, the covered institution finds no risk of harm.

Twenty-one states currently have a presumption against notifying customers of a breach, and only require notice if, after investigation, the covered institution finds risk of harm.

In addition, in the 11 states where state customer notification laws do not apply to entities subject to or in compliance with the GLBA, the proposal would help ensure customers of such institutions receive notice of a breach.

As discussed more fully below, establishing a federal minimum standard would protect individuals in an environment of enhanced risk.

See infra

section II.C.1.

See infra

section II.A.4.e.

See infra

section II.A.4.a.

See id.

The effect of any inconsistency between the proposed customer notification and state law requirements may, however, be mitigated because many states offer safe harbors from their notification laws for entities that are subject to or in compliance with requirements under Federal regulations. In particular, as noted, 11 states offer safe harbors for entities subject to or in compliance with the GLBA, while others offer safe harbors for compliance with the notification requirements of the entity's “primary federal regulator.”

See, e.g.,

Del. Code Ann. tit. 6 section 12B-103 (providing that a person regulated by the GLBA and maintaining procedures for security breaches pursuant to the law established by its Federal regulator is deemed to be in compliance with the Delaware notification requirements if the person notifies affected Delaware residents in accordance with those procedures).

See infra

note 106 and accompanying text.

There are compelling reasons to revisit other aspects of the current safeguards regime as well. As noted above, the safeguards rule currently applies to broker-dealers, investment companies, and registered investment advisers. The safeguards rule does not currently apply to transfer agents, even though they also obtain, share, and maintain personal information on behalf of securityholders who hold securities in registered form (

i.e.,

in their own name rather than indirectly through a broker). Securityholders whose personal information is maintained by transfer agents could be harmed by the unauthorized access or use of such information in the same manner as customers of broker-dealers, investment companies, and registered investment advisers, yet such securityholders are not currently protected by the safeguards rule. The Commission preliminarily believes that extending the safeguards rule to cover transfer agents is necessary to ensure that there is a Federal minimum standard for the notification of securityholders who are affected by a data breach that leads to the unauthorized access or use of their information, regardless of whether that data breach occurs at a broker-dealer, investment company, registered investment adviser, or transfer agent.

See infra

section II.C.3.

In addition, the safeguards rule currently requires only that institutions protect their own customers' information. This potentially overlooks information a broker-dealer, investment company, or registered investment adviser may have received from another financial institution about that financial institution's customers,

such as

nonpublic personal information from an introducing broker or dealer that clears transactions for its customers through a clearing broker on a fully disclosed basis.

Applying the safeguards rule and the disposal rule to customer information that a covered institution receives from other financial institutions would better protect individuals by ensuring customer information safeguards are not lost when a third-party financial institution shares that information with a covered institution.

Finally, applying the safeguards rule and the disposal rule to a broader set of information should enhance the security and confidentiality of customers' personal information.

Under section 501(b) of the GLBA, the standards to be established by the Commission must, among other things, “protect against unauthorized access to or use of” customer records or information “which could result in substantial harm or inconvenience to

any

customer.”

See

15 U.S.C. 6801(b)(3) (emphasis added). We agree with the Federal Trade Commission (“FTC”) that applying the safeguards rule to cover customer information that a financial institution receives pertaining to another institution's customers is consistent with the purpose and language of the GLBA. Further, the Commission agrees with the FTC that this approach is the most reasonable reading of the statutory language and clearly

furthers the express congressional policy to respect the privacy of these customers and to protect the security and confidentiality of their nonpublic personal information.

See

FTC,

Standards for Safeguarding Customer Information,

67 FR 36484, 36485-86 (May 23, 2002);

See also infra

section II.C.4 further detailing the current regulatory framework for notice-registered broker-dealers under the safeguards rule and the disposal rule.

See

17 CFR 248.30(b)(2)(i).

See

17 CFR 248.30(b).

The GLBA and FACT Act oblige us to adopt regulations, to the extent possible, that are consistent and comparable with those adopted by the Banking Agencies and the FTC.

Accordingly, in determining the scope of the proposed amendments contemplated in this proposal, including for example, the definitions of “customer information” and “sensitive customer information” described below, we are mindful of the need to set standards for safeguarding customer records and information that are consistent and comparable with the corresponding standards set by the Banking Agencies and the FTC.

See generally

15 U.S.C. 6804(a) (directing the agencies authorized to prescribe regulations under title V of the GLBA to assure to the extent possible that their regulations are consistent and comparable); 15 U.S.C. 1681w(a)(2)(A) (directing the agencies with enforcement authority set forth in 15 U.S.C. 1681s to consult and coordinate so that, to the extent possible, their regulations are consistent and comparable). The “Banking Agencies” include the Office of the Comptroller of the Currency (“OCC”), the Board of Governors of the Federal Reserve System (“FRB”), the Federal Deposit Insurance Corporation (“FDIC”), and the former Office of Thrift Supervision.

B. 2008 Proposal

In 2008, the Commission proposed amendments to Regulation S-P primarily to help prevent information security breaches in the securities industry and to improve responsiveness when such breaches occur, with the goal of better protecting investors from identity theft and other misuse of what the proposal would have defined as “personal information.”

The 2008 Proposal would have set out specific standards for safeguarding customer records and information, including requirements for procedures to respond to incidents of unauthorized access to or use of personal information. Those requirements would have included procedures for notifying the Commission (or a broker-dealer's designated examining authority

) of data breach incidents, and procedures for notifying individuals of incidents of unauthorized access to or misuse of sensitive personal information, if the misuse had occurred or was reasonably possible. The 2008 Proposal also would have amended the safeguards rule and the disposal rule so that both would have protected “personal information,” which would have included any record containing either “nonpublic personal information” or “consumer report information.”

In addition, the 2008 Proposal would have extended the safeguards rule to apply to transfer agents registered with the Commission, and would have extended the disposal rule to apply to natural persons who are associated persons of a broker or dealer, supervised persons of a registered investment adviser, and associated persons of any transfer agent registered with the Commission. The 2008 Proposal would have further required brokers, dealers, investment companies, registered investment advisers, and transfer agents registered with the Commission to maintain and preserve written records of their policies and procedures required under the disposal and safeguards rules and compliance with those policies and procedures.

See

Part 248—Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer information, Exchange Act Release No. 57427 (Mar. 4, 2008) [73 FR 13692, 13693-94 (Mar. 13, 2008)] (“2008 Proposal”). The amendments to Regulation S-P referenced in the 2008 Proposal have not been adopted.

A broker-dealer's designated examining authority is the SRO of which the broker-dealer is a member, or, if the broker-dealer is a member of more than one SRO, the SRO designated by the Commission pursuant to 17 CFR 240.17d-1 as responsible for examination of the member for compliance with applicable financial responsibility rules (including the Commission's customer account protection rules at 17 CFR 240.15c3-3).

See

2008 Proposal,

supra

note 38, at n.44.

The 2008 Proposal would have made both the safeguards rule and the disposal rule, as amended, applicable to “personal information,” which would have been defined to include any record containing either “nonpublic personal information” or “consumer report information” that is identified with any consumer, or with any employee, investor, or securityholder who is a natural person, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of a covered institution.

See

2008 Proposal,

supra

note 38, at 73 FR 13700.

The Commission received over 400 comment letters in response to the 2008 Proposal.

The current proposal to amend Regulation S-P has been informed by comments received on the 2008 Proposal. Most commenters supported requirements for comprehensive information security programs that are consistent and comparable to the rules and guidance of other Federal financial regulators.

Many commenters, however, objected to changes in the scope of information and entities covered by the proposed amendments.

Many commenters opposed or suggested modifying the proposed amendments' information security breach response provisions.

Comments were mixed on the proposed exception for disclosures relating to transfers of representatives from one broker-dealer or registered investment adviser to another.

Comments on the proposal, including comments referenced in this Release are available on the Commission website at

http://www.sec.gov/comments/s7-06-08/s70608.shtml.

Approximately 328 of the comments received contained substantially the same content.

See

example of Letter Type A available at

https://www.sec.gov/comments/s7-06-08/s70608typea.htm.

See, e.g.,

Letter from Alan E. Sorcher, Managing Director and Associate General Counsel, Securities Industry and Financial Markets Association (May 12, 2008) (“SIFMA Letter”); Letter from Tamara K. Salmon, Senior Associate Counsel, Investment Company Institute (May 2, 2008) (“ICI Letter”); Letter from Marcia E. Asquith, Senior Vice President and Corporate Secretary, Financial Industry Regulatory Authority (May 12, 2008) (“FINRA Letter”).

See, e.g.,

SIFMA Letter; Letter from Charles V. Rossi, President, The Securities Transfer Association, Inc. (May 9, 2008) (“STA Letter”).

See, e.g.,

SIFMA Letter; ICI Letter; Letter from Karen L. Barr, General Counsel, Investment Adviser Association (May 12, 2008) (“IAA Letter”); Letter from Sarah Miller, General Counsel, ABA Securities Association (May 22, 2008) (“ABASA Letter”).

See, e.g.,

SIFMA Letter; IAA Letter (both in support); Letter from Julius L. Loeser, Chief Regulatory and Compliance Counsel, Comerica Securities, Inc. (May 9, 2008) (“Comerica Letter”); Letter from Steven French, President, MemberMap LLC (May 11, 2008) (“MemberMap Letter”) (both opposed).

C. Overview of the Proposal

There are no Commission rules at this time expressly requiring broker-dealers, investment companies, or registered investment advisers to have policies and procedures for responding to data breach incidents or to notify customers of those breaches.

As noted above, advance planning would be part of creating a reasonably designed incident response program, and its prompt implementation following a breach (including notification to affected individuals), is important in limiting potential harmful impacts to individuals. While we recognize that state laws require covered institutions to notify state residents of data breaches, those laws are not consistent and exclude some entities from certain requirements. Accordingly, a Federal minimum standard would provide notification to all customers of a covered institution affected by a data breach (regardless of state residency) and provide consistent disclosure of important information to help affected customers respond to a data breach. Other Federal regulators' GLBA safeguarding standards also include a requirement for a data breach response plan or program.

As noted above, there are no SRO rules requiring notification to customers whose information has been compromised.

See supra

note 11. The Commission has pending proposals to address cybersecurity risk with respect to investment advisers, investment companies, and public companies. The Commission encourages commenters to review those proposals to determine whether it might affect their comments on this proposing release.

See infra

note 55.

The FTC recently amended its Safeguards Rule by, among other things, adding a requirement for financial institutions under the FTC's GLBA jurisdiction to establish a written incident response plan designed to respond to information security events.

See

FTC, Standards for Safeguarding Customer Information, 86 FR 70272 (Dec. 9, 2021) (“FTC Safeguards Release”). As amended, the FTC's rule requires that a response plan address security events materially affecting the confidentiality, integrity, or availability of customer information in the financial institution's control, and that the plan include specified elements that would include procedures for satisfying an institution's independent obligation to perform notification as required by state law.

See

FTC Safeguards Release, at 70297-98, n.295. Earlier, the Banking Agencies and the National Credit Union Administration (“NCUA”) jointly issued guidance on responding to incidents of unauthorized access to or use of customer information.

See

Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, 70 FR 15736, 15743 (Mar. 29, 2005) (“Banking Agencies' Incident Response Guidance”). The Banking Agencies' Incident Response Guidance provides, among other things, that when an institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to determine promptly the likelihood that the information has been or will be misused. If the institution determines that misuse of the information has occurred or is reasonably possible, it should notify affected customers as soon as possible.

The Commission is proposing amendments to Regulation S-P's safeguards rule. The proposed amendments would require covered institutions to develop, implement, and maintain written policies and

procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.

The amendments would require that a response program include procedures to assess the nature and scope of any incident and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use.

See

proposed rule 248.30(b).

See

proposed rule 248.30(b)(3).

The proposed response program procedures also would have to include notification to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

Notice would not be required if a covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

Under the proposed amendments, a customer notice must be clear and conspicuous and provided by a means designed to ensure that each affected individual can reasonably be expected to receive it.

A covered institution would be required to provide notice as soon as practicable, but not later than 30 days, that the incident occurred or is reasonably likely to have occurred.

To the extent a covered institution would have a notification obligation under both the proposed rules and a similar state law, a covered institution should be able to provide one notice to satisfy notification obligations under both the proposed rules and the state law, provided it included all information required under both the proposed rules and the state law.

See

proposed rule 248.30(b)(4).

See

proposed rule 248.30(e)(9) for the definition of “sensitive customer information.”

See also infra

section II.A.4, which includes a discussion of “sensitive customer information.”

See id.

See

proposed rule 248.30(b)(4)(i).

See

proposed rule 248.30(b)(4)(iii).

We are not aware of any laws that would require the sending of multiple customer notices.

The Commission also is proposing amendments to Regulation S-P to enhance the protection of customers' nonpublic personal information. These proposed amendments would more closely align the information protected under the safeguards rule and the disposal rule by applying the protections of both rules to “customer information,” a newly defined term. We also propose to broaden the group of customers whose information is protected under both rules. Additionally, we propose to bring all transfer agents within the scope of the safeguards rule.

The proposal is not inconsistent with other recent cybersecurity-related rulemaking proposals.

Additionally, as described in greater detail below,

the Commission is also proposing rules and rule amendments related to cybersecurity risk and related disclosures as well as Regulation SCI.

We encourage commenters to review those other cybersecurity-related rulemaking proposals to determine whether those proposals might affect comments on this proposing release.

See

Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies, Securities Act Release No. 11028 (Feb. 9, 2022) [87 FR 13524 (Mar. 9, 2022)] (“Investment Management Cybersecurity Proposal”);

See also infra

section II.C.1 for a discussion of “customer information.”

See

proposed rule 248.30(e)(9) for the definition of “sensitive customer information.”

See also infra

section II.A.4, which includes a discussion of “sensitive customer information.” Notice would have to be provided unless a covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

In this regard, requiring covered institutions to have this type of incident response program could help mitigate the risk of harm to affected individuals stemming from such incidents. For example, having a response program should help covered institutions to be better prepared to respond to incidents, and providing notice to affected individuals should aid those individuals in taking protective measures that could mitigate harm that might otherwise result from unauthorized access to or use of their information. Further, a reasonably designed response program will help facilitate more consistent and systematic responses to customer information security incidents, and help avoid inadequate responses based on a covered institution's initial impressions of the scope of the information involved in the compromise. In addition, requiring the response program to address any incident involving customer information can help a covered institution better contain and control these incidents and facilitate a prompt recovery.

The amendments would require that a covered institution's response program include policies and procedures containing certain general elements, but would not prescribe specific steps a covered institution must take when carrying out incident response activities. Instead, covered institutions may tailor their policies and procedures to their individual facts and circumstances. We recognize that given the number and varying characteristics (

e.g.,

size, business, and complexity) of covered institutions, each such institution needs to be able to tailor its incident response program procedures based on its individual facts and circumstances. The proposed amendments therefore are intended to give covered institutions the flexibility to address the general elements in the response program based on the size and complexity of the institution and the nature and scope of its activities.

Specifically, a covered institution's incident response program would be required to have written policies and procedures to:

(i) assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization;

See

proposed rule 248.30(b)(3)(i). The term “customer information systems” would mean the information resources owned or used by a covered institution, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of customer information to maintain or support the covered institution's operations.

See

proposed rule 248.30(e)(6).

(ii) take appropriate steps to contain and control the incident to prevent

further unauthorized access to or use of customer information;

and

See

proposed rule 248.30(b)(3)(ii).

(iii) notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization in accordance with the notification obligations discussed below, unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

See

proposed rule 248.30(b)(3)(iii).

The proposed response program is designed to further the objectives of the safeguards rule, particularly protecting against unauthorized access to or use of customer information. We have also proposed rules that would more broadly address general cybersecurity risks, with which the response program proposed in Regulation S-P is not inconsistent, as discussed in more detail below.

Our recent proposals would require investment advisers, investment companies, and certain market entities

to adopt and implement written policies and procedures that require measures to detect, respond to, and recover from a cybersecurity incident.

The Investment Management Cybersecurity Proposal, including the cybersecurity response measures, is more broadly focused on investment advisers and investment companies and their operations. Among other objectives, the proposed measures would include policies and procedures reasonably designed to ensure the protection of adviser (or fund) information systems and adviser (or fund) information residing therein.

Similarly, the Exchange Act Cybersecurity Proposal, which includes cybersecurity response measures, is more broadly focused on Market Entities and their operations, and would include policies and procedures reasonably designed to ensure the protection of the Market Entities' information systems and the information residing on those systems.

See infra

section II.G.1-II.G.2, which addresses areas that are related between the Regulation SCI Proposal and the Exchange Act Cybersecurity Proposal, as well as with the Investment Management Cybersecurity Proposal, respectively.

The Exchange Act Cybersecurity Proposal rules would be applicable to “Market Entities” including: broker-dealers; clearing agencies; major security-based swap participants; the Municipal Securities Rulemaking Board; national securities exchanges; national securities associations (

i.e.,

FINRA); security-based swap data repositories; security-based swap dealers; and transfer agents (collectively, “Covered Entities”) as well as broker-dealers that are non-Covered Entities.

See

Exchange Act Cybersecurity Proposal,

supra

note 57.

See

Investment Management Cybersecurity Proposal,

supra

note 55; Exchange Act Cybersecurity Proposal,

supra

note 57.

See

Investment Management Cybersecurity Proposal,

supra

note 55, at 13589 for definitions of “fund information system” and “fund information.”

The response program proposed in Regulation S-P, however, is narrowly focused and the required incident response policies and procedures should be specifically tailored to address unauthorized access to or use of customer information, including procedures for assessing the nature and scope of such incidents and identifying the customer information and customer information systems that may have been accessed or used without authorization, as well as taking steps to contain and control the incident to prevent further unauthorized access to or use of customer information. Given the risk of harm posed to customers and other affected individuals by incidents involving customer information, it is important that covered institutions' policies and procedures be reasonably designed to implement an incident response under these circumstances.

We request comment on the proposed rule's requirement that covered institutions' policies and procedures include an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including the following:

1. What best practices have commenters developed or become aware of with respect to the types of measures that can be implemented as part of an incident response program? Are there any measures commenters have found to be ineffective or relatively less effective? To the contrary, are there any measures that commenters have found to be effective, or relatively more effective?

2. Should we require the response program procedures to set forth a specific timeframe for implementing incident response activities under Regulation S-P? For example, should the procedures state that incident response activities, such as assessment and containment, should commence promptly, or immediately, once an incident has been discovered?

3. Are the proposed elements for the incident response program appropriate? Should we modify the proposed elements? For instance, should the rule prescribe more specific steps for incident response within the framework of the procedures, such as detailing the steps that an institution should take to assess the nature and scope of an incident, or to contain and control an incident? If so, please describe the steps and explain why they should be included. Alternatively, should the requirements for the incident response program be less prescriptive and more principles-based? If so, please describe how and why the requirements should be modified.

4. Are there additional or different elements that should be included in an incident response program? For example, should the rule require procedures for taking corrective measures in response to an incident, such as securing accounts associated with the customer information at issue? Should the rule require procedures for monitoring customer information and customer information systems for unauthorized access to or use of those systems, and data loss as it relates to those systems? Should the rule require procedures for identifying the titles and roles of individuals or departments (

e.g.,

managers, directors, and officers) who should be responsible for overseeing, implementing, and executing the incident response program, as well as procedures to determine compliance? If additional or different elements should be added, please describe the element, and explain why it should be included in the response program.

5. Is the scope of the incident response program appropriate? For example, is the scope of the incident response program reasonably aligned with the vulnerability of the customer information at issue?

• Should the incident response program be more limited in scope, so that it would only address incidents that involve unauthorized access to or use of a subset of customer information (

e.g.,

sensitive customer information)? If so, please explain the subset of customer information that should require an incident response program.

• Alternatively, should the incident response program be more expansive in scope, so that it would cover additional activity beyond unauthorized access to or use of customer information? For example, should the incident response program address cybersecurity incident response and recovery at large (

i.e.,

should the rule require covered institutions to have a response program reasonably designed to detect, respond to, and recover from a cybersecurity incident)?

1. Assessment

The Commission is proposing to require that the incident response program include procedures for: (1)

assessing the nature and scope of any incident involving unauthorized access to or use of customer information, and (2) identifying the customer information systems and types of customer information that may have been accessed or used without authorization.

For example, a covered institution's assessment may include gathering information about the type of access, the extent to which systems or other assets have been affected, the level of privilege attained by any unauthorized persons, the operational or informational impact of the breach, and whether any data has been lost or exfiltrated.

Examining a range of data sources could shed light on the incident timeline, and assessing affected systems and networks could help to identify additional anomalous activity that might be adversarial behavior.

See

proposed rule 248.30(b)(3)(i). The proposed requirements related to assessing the nature and scope of a security incident are consistent with the components of a response program as set forth in the Banking Agencies' Incident Response Guidance.

See

Banking Agencies' Incident Response Guidance,

supra

note 47, at 15752.

See

Cybersecurity and Infrastructure Security Agency (“CISA”), Cybersecurity Incident & Vulnerability Response Playbooks (Nov. 2021), at 10-13 (“CISA Incident Response Playbook”),

available at https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf.

While the CISA Incident Response Playbook specifically provides Federal agencies with a standard set of procedures to respond to incidents impacting “Federal Civilian Executive Branch” networks, it may also be useful for the purpose of strengthening cybersecurity response practices and operational procedures for public and private sector entities in addition to the Federal government.

See

CISA, Press Release,

CISA Releases Incident and Vulnerability Response Playbooks to Strengthen Cybersecurity for Federal Civilian Agencies

(Nov. 16, 2021),

available at https://www.cisa.gov/news/2021/11/16/cisa-releases-incident-and-vulnerability-response-playbooks-strengthen.

A list of the Federal Civilian Executive Branch agencies identified by CISA is available at

https://www.cisa.gov/agencies.

The National Institute for Standards and Technology (“NIST”) defines “exfiltration” as “the unauthorized transfer of information from a system.”

See

NIST Special Publication 800-53, Revision 5,

Security and Privacy Controls for Information Systems and Organizations,

Appendix A at 402 (Sept. 2020)

available at https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf.

See

CISA Incident Response Playbook,

supra

note 75, at 10-13. NIST defines “adversary” as “[a]n entity that is not authorized to access or modify information, or who works to defeat any protections afforded the information.”

See

NIST Special Publication 800-107,

Recommendation for Applications Using Approved Hash Algorithms,

Section 3.1 Terms and Definitions, at 3 (Aug. 2012),

available at https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-107r1.pdf.

The assessment requirement is designed to require a covered institution to identify both the customer information systems and types of customer information that may have been accessed or used without authorization during the incident, as well as the specific customers affected, which would be necessary to fulfill the obligation to notify affected individuals. Covered institutions generally should evaluate and adjust their assessment procedures periodically, regardless of any specific regulatory requirement, to ensure they remain reasonably designed to accomplish their goals. In addition, assessment should help facilitate the evaluation of whether sensitive customer information has been accessed or used without authorization, which informs whether notice would have to be provided, as discussed below. A covered institution's assessment may also be useful for collecting other information that is required to populate the notice, such as identifying the date or estimated date of the incident, among other details. Information developed during the assessment process may also help covered institutions develop a contextual understanding of the circumstances surrounding an incident, as well as enhance their technical understanding of the incident, which should be helpful in guiding incident response activities such as containment and control measures. The assessment process may also be helpful for identifying and evaluating existing vulnerabilities that could benefit from remediation in order to prevent such vulnerabilities from being exploited in the future.

We request comment on the proposed rule's requirements related to assessing the nature and scope of any incident involving unauthorized access to or use of customer information, including the following:

6. Should we provide additional examples for consideration in assessing the nature and scope of an incident, beyond the examples provided above (

e.g.,

type of access, the extent to which systems or other assets have been affected, the level of privilege attained by any unauthorized persons, the operational or informational impact of the breach, and whether any data has been lost or exfiltrated)?

7. Should we require that the assessment include the specific components referenced in the above question?

8. Should we require any specific training for personnel performing assessments of security incidents? Should the training have to encompass security updates and training sufficient to address relevant security risks?

9. Various rules applicable to certain entities require, among other things, the review, testing, verification, and/or amendment of policies and procedures at regular intervals.

Should we specifically require covered institutions to evaluate and adjust, as appropriate, the assessment procedures periodically in this rule? If so, how frequently should the evaluation occur? Should we require any testing (such as a practice exercise) of a covered institution's assessment process?

See e.g.,

Rule 38a-1(a)(3) under the Investment Company Act; FINRA Rule 3120 (Supervisory Control System) and FINRA Rule 3130 (Annual Certification of Compliance and Supervisory Processes).

10. Would covered institutions expect to use third parties to conduct these assessments? If so, to what extent and in what manner? Should there be any additional or specific requirements for third parties that conduct assessments? Why or why not?

2. Containment and Control

The Commission is proposing to require that the response program have procedures for taking appropriate steps to contain and control a security incident, to prevent further unauthorized access to or use of customer information.

The objective of containment and control is to prevent additional damage from unauthorized activity and to reduce the immediate impact of an incident by removing the source of the unauthorized activity.

Covered institutions generally should evaluate and revise their containment and control procedures periodically, regardless of any specific regulatory requirement, to ensure they remain reasonably designed to accomplish their goals. Strategies for containing and controlling an incident vary depending upon the type of incident and may include, for example, isolating compromised systems or enhancing the monitoring of intruder activities, searching for additional compromised systems, changing system administrator passwords, rotating private keys, and changing or disabling default user accounts and passwords, among other interventions. Some standards advise that after ensuring that all means of persistent access into the network have been accounted for, and any intrusive

activity has been sufficiently contained, the artifacts of the incident should also be eliminated (

e.g.,

by removing malicious code or re-imaging infected systems) and vulnerabilities or other conditions that were exploited to gain unauthorized access should be mitigated.

See

proposed rule 248.30(b)(3)(ii). These proposed requirements are consistent with the components of a response program as set forth in the Banking Agencies' Incident Response Guidance.

See

Banking Agencies' Incident Response Guidance,

supra

note 47, at 15752.

For a further discussion of the purposes and practices of such containment measures,

see generally

CISA Incident Response Playbook,

supra

note 76, at 14;

See also infra

note 547.

21. The proposed rule would require policies and procedures requiring a covered institution, by contract, to require that its service providers take appropriate measures designed to protect against unauthorized access to or use of customer information, including notification to a covered institution in the event of certain types of breaches in security. Are there any contexts in which a written contract may be more feasible than others? Rather than using a contractual approach to implement this requirement that a covered institution take the required appropriate measures, should the rule require policies and procedures that require due diligence of or some type of reasonable assurances from its service providers? What should reasonable assurances include? For example, should they cover notification to the covered institution as soon as possible in the event of any breach in security resulting in unauthorized access to a customer information system maintained by the service provider to enable the covered institution to implement its response program? Are there other reasonable assurances we should require? Alternatively, should we only require disclosure of whether a covered institution has or does not have a written contract with service providers?

22. Should there be a written contract requirement for certain service providers and not others? For example, should the rule identify a sub-set of service providers as critical service providers and require a written agreement in those circumstances only, and if so, what service providers should be included?

23. Are there other methods that we should permit or require covered institutions to use to help ensure that service providers take appropriate measures that are designed to protect against unauthorized access to or use of customer information (for example, a security certification or representation)? Should we have different requirements for smaller covered institutions?

24. The proposed rule would require policies and procedures requiring a covered institution, by contract, to require its service providers to provide notification to a covered institution as soon as possible, but no later than 48 hours after becoming aware of a breach, in the event of any breach in security resulting in unauthorized access to a customer information system maintained by the service provider. Is “as soon as possible, but no later than 48 hours after becoming aware of a breach” an appropriate timeframe for service providers to provide notification to a covered institution after such a breach occurs? Why or why not? Should we use a different timeframe such as “as soon as practicable”?

25. Is it appropriate to permit covered institutions to delegate providing notice to service providers? If service providers are permitted to provide notice on behalf of covered institutions, should there be additional or specific requirements for a service provider that provides notification on behalf of a covered institution? If so, please describe those requirements and why they should be included.

26. The proposed rule would set forth that as part of its incident response program, a covered institution may enter into a written agreement with its service provider for the service provider to notify affected individuals on its behalf (

i.e.,

to delegate the notice functions required under the rule to service providers while remaining responsible for the notice obligation). Should we set forth that a covered institution may enter into a written agreement with its service provider for other potentially delegated functions as discussed in this proposal? For example, should we set forth that a covered institution may enter into a written agreement for delegating the performance of a reasonable investigation (

e.g.,

to determine whether sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience) to a service provider? Should we set forth that a covered institution may enter into a written agreement for delegating the performance of assessment activities, or containment and control activities, to a service provider? Additionally, is it appropriate for a service provider to assist with these functions, with the responsibility remaining with the covered institution? Why or why not?

27. To what extent do service providers sub-delegate functions provided in this proposal to third parties? If so, how should the rule address sub-delegations between service providers and third parties?

4. Notice to Affected Individuals

Under the proposed amendments, a covered institution must notify each affected individual whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, unless the covered institution has determined, after a reasonable investigation of the incident, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. The covered institution must provide a clear and conspicuous notice to each affected individual by a means designed to ensure that the individual can reasonably be expected to receive actual notice in writing. The notice must be provided as soon as practicable, but not later than 30 days, after the covered institution becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

a. Standard for Providing Notice

The proposed amendments would create an affirmative requirement for a covered institution to provide notice to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

These notices would be designed to give affected individuals an opportunity to respond to and remediate issues arising from an information security incident, such as monitoring credit reports for unauthorized activity, placing fraud alerts on relevant accounts, or changing passwords used to access accounts.

Such measures, when taken in a timely fashion, may help affected individuals avoid or mitigate the risk of substantial harm or inconvenience (“harm risk”),

and in an environment of expanded risk of cyber incidents,

taking such actions may be particularly important to protect individuals. Conversely, giving covered institutions greater discretion to determine whether and when to provide notices could jeopardize affected

individuals' ability to evaluate the risk of harm posed by an incident and choose how to respond to and remediate it.

See

proposed rule 248.30(b)(3)(iii). As noted above, a covered institution could delegate its responsibility for providing notice to an affected individual to a service provider, by contract, but the covered institution would remain responsible for any failure to provide a notice as required by the proposed rules.

See infra

section II.A.

Affected individuals include individuals with whom the covered institution has a customer relationship, or are individuals that are customers of other financial institutions whose information has been provided to the covered institution, and whose sensitive information was, or is reasonably likely to have been, accessed or used without authorization.

See infra

note 127.

See infra

section II.A.4.e (Timing Requirements);

See also infra

section II.A.4.d (discussing the identification of affected individuals in such circumstances).

For any determination that a covered institution makes that notice is not required, the covered institution generally should maintain a record of the investigation and basis for its determination.

104

Whether an investigation qualifies as reasonable would depend on the particular facts and circumstances of the unauthorized access or use. For example, unauthorized access that is the result of intentional intrusion by a bad actor may warrant more extensive investigation than inadvertent unauthorized access by an employee. The investigation may occur in parallel with an initial assessment and scoping of the incident and may build upon information generated from those activities, and the scope of the investigation may be refined by using available data and the results of ongoing incident response activities. Information related to the nature and scope of the incident may be relevant to determining the extent of the investigation, such as whether the incident is the result of internal unauthorized access or an external intrusion, the duration of the incident, what accounts have been compromised and at what privilege level, and whether and what type of customer information may have been copied, transferred, or retrieved without authorization.

105

104

Proposed rules 248.30(d), 240.17a-4, 240.17ad-7, 270.31a-1, 270.31a-2, and 275.204-2;

see infra

section II.C. The Commission's proposal includes an amendment to a CFR designation in order to ensure regulatory text conforms more consistently with section 2.13 of the Document Drafting Handbook.

See

Office of the Federal Register, Document Drafting Handbook (Aug. 2018 Edition, Revision 1.4, dated January 7, 2022),

available at https://www.archives.gov/files/federal-register/write/handbook/ddh.pdf.

In particular, the proposal is to amend the CFR section designation for Rule 17Ad-7 (17 CFR 240.17Ad-7) to replace the uppercase letter with the corresponding lowercase letter, such that the rule would be redesignated as Rule 17ad-7 (17 CFR 240.17ad-7).

105

For example, depending on the nature of the incident, it may be necessary to consider how a malicious intruder might use the underlying information in light of current trends in identity theft.

As discussed above, while some state laws currently include similar standards for providing notifications, the proposed rules would impose a minimum standard to help ensure all individuals would presumptively receive notifications.

106

Twenty-one states only require notice if, after an investigation, the institution finds that a risk of harm exists, and in eleven states, customer notification laws do not apply to entities subject to or in compliance with the GLBA.

107

We preliminarily believe that setting a minimum standard based on an affirmative presumption of notification appropriately balances the need for transparency (

i.e.,

the need for affected individuals to be informed so that they can take steps to protect themselves, including for example, by placing fraud alerts in credit reports) with concerns that the volume of notices that individuals would receive could erode their efficacy or lead to complacency by affected individuals. Notice of every incident could diminish the impact and effectiveness of the notice in a situation where enhanced vigilance is necessary.

108

Covered institutions likely would be able to send a single notice that complies with multiple regulatory requirements, which may reduce the number of notices an individual

receives. In addition, the proposed standard would help to improve security outcomes in general by incentivizing covered institutions to conduct more thorough investigations after an incident occurs, because a reasonable investigation provides the only means to rebut the presumption of notification. Reasonably designed policies and procedures generally should include that a covered institution would revisit a determination whether a notification is required based on its investigation if new facts come to light. For example, if a covered institution determines that risk of use in a manner that would result in substantial harm or inconvenience is not reasonably likely based on the use of encryption in accordance with industry standards at the time of the incident, but subsequently the encryption is compromised or it is discovered that the decryption key was also obtained by the threat actor, the covered institution generally should consider revisiting its determination.

106

A risk of harm provision under a particular state's rules may either (i) require a notice only after an entity performs a required analysis to determine that there is a reasonable likelihood of harm, or (ii) require notice unless a permitted analysis determines that there is no reasonable likelihood of harm. This latter approach is a stricter standard imposed by 22 states and is consistent with the standard we are proposing.

See

National Conference of State Legislatures, Security Breach Notification Laws, (“NCSL Security Breach Notification Law Resource”),

available at https://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx.

107

See

NCSL Security Breach Notification Law Resource,

supra

note 106.

108

Eight states do not have risk of harm provisions, including California and Texas.

See

NCSL Security Breach Notification Law Resource,

supra

note 106. In these states, notices must generally be provided in all cases of a breach.

We request comment on the proposed standard for notification to affected individuals, including the following:

28. The proposed standard requires providing notice to affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Is the proposed standard for providing notification sufficiently clear? Is a standard of “reasonably likely” appropriate? Should the trigger for notification be a determination by a covered institution that the risk of unauthorized access or use of sensitive customer information has occurred or is “reasonably possible” which would suggest a more expansive standard than “likely”?

29. A covered institution can rebut the presumption of notification if it determines that, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. Is this standard “not reasonably likely to be” for rebutting the presumption to notify the appropriate standard? Should the standard be “not reasonably possible”?

30. Should customer notification be required for any incident of unauthorized access to or use of sensitive customer information regardless of the risk of use in a manner that would result in substantial harm or inconvenience? Is there a risk that the volume of notices received under such a standard would inure affected individuals to notices of potentially harmful incidents and result in their not taking protective actions?

31. Do covered institutions expect to be able to perform reasonable investigations in order to rebut the notification presumption? Why or why not? Would it be helpful to include specific requirements for a reasonable investigation? Are there other factors that would influence whether a covered institution decides to conduct a reasonable investigation or notify individuals? If additional clarity would assist covered institutions in making these determinations, please explain.

32. Should we require a covered institution to revisit a determination that notification is not required based on its investigation if new facts come to light? If yes, should the rule provide specific requirements for a covered institution to revisit its determination?

33. Should we incorporate any additional aspects of the protections offered to individuals under state laws into the proposed rules? Alternatively, should any components of the proposal that offer additional protections to individuals beyond some states' laws be omitted? Please explain.

34. Under what scenarios would a covered institution be unable to comply with both the proposed rules and applicable state laws? Please explain.

35. Should the proposed rules be modified in order to help ensure covered institutions would not need to provide multiple notices in order to satisfy obligations under the proposed rules and similar state laws?

b. Definition of “Sensitive Customer Information”

We propose to define the term “sensitive customer information” to mean “any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information.”

109

This definition is intended to cover the types of information that could most likely be used in a manner that would result in substantial harm or inconvenience, such as to commit fraud, including identify theft.

110

We do not believe that notification would be appropriate if unauthorized access to customer information is not reasonably likely to cause a harm risk because a customer is unlikely to need to take protective measures. Moreover, the large volume of notices that individuals might receive in the event of unauthorized access to such customer information could erode their efficacy. Accordingly, the proposed definition is limited to information that, if compromised, could create a “reasonably likely risk of substantial harm or inconvenience.”

111

109

See

proposed rule 248.30(e)(9)(i). Our proposed definition is limited to information identified with customers of financial institutions.

See

proposed rule 248.30(e)(5)(i);

infra

section II.C.1. Information subject to the safeguards rule, including the incident response program and customer notice requirements would be information pertaining to a covered institution's customers and to customers of other financial institutions that the other institutions have provided to the covered institution.

See

proposed rule 248.30(a);

infra

section II.C.1.

110

See supra

note 6 and accompanying text (noting increased risks of unauthorized access and use of personal information).

111

See

proposed rule 248.30(e)(9)(i).

The definition also provides examples of the types of information included within the definition of “sensitive customer information.”

112

These examples include certain customer information identified with an individual that, without any other identifying information, could create a substantial risk of harm or inconvenience to an individual identified with the information.

113

For example, Social Security numbers alone, without any other information linked to the individual, would be sensitive because they have been used in “Social Security number-only” or “synthetic” identity theft. In this type of identity theft, a Social Security number,

combined with identifying information of another real or fictional person, is used to create a new (or “synthetic”) identity, which then may allow the malicious actor to, among other things, open new financial accounts.

114

A similar sensitivity exists with other types of identifying information that can be used alone to authenticate an individual's identity. A biometric record of a fingerprint or iris image would present a significant threat of account fraud, identity theft, or other substantial harm or inconvenience if the image is used to authenticate a customer of a financial institution.

112

See

proposed rule 248.30(e)(9)(ii). While the information cited in these examples is sensitive customer information, when that information is encrypted, it would not necessarily be sensitive customer information. That cipher text (

i.e.,

the data rendered in a format not understood by people or machines without an encryption key) may be analyzed as such (rather than as the decrypted sensitive customer information,

e.g.,

a Social Security number referenced in the examples provided in 248.30(e)(9)(ii)(A)(1)-(4) or in 248.30(e)(9)(ii)(B), and be determined not to be sensitive customer information). And as discussed

infra

note 119, a covered institution could consider the strength of the encryption and the security of the associated decryption key as factors in determining whether information is sensitive customer information. Accordingly, in certain circumstances, information that is an encrypted representation of, for example, a customer's Social Security number may not be sensitive customer information under the proposed definition.

113

In this respect, our proposed definition is broader than the definition of “sensitive customer information” provided in the Banking Agencies' Incident Response Guidance. That definition includes a customer's name, address, or telephone number, only in conjunction with other pieces of information that would permit access to a customer account. Our proposed definition would also be broader than similar definitions of personal information used in some state statutes to determine the scope of information that, when subject to breaches, requires notification.

See infra

note 103 and accompanying text.

114

See, e.g., generally

Michael Kan,

More Crooks Tapping “Synthetic Identity Fraud” to Commit Financial Crimes,

PCMag (June 8, 2022),

available at https://www.pcmag.com/news/more-crooks-tapping-synthetic-identity-fraud-to-commit-financial-crimes

(describing recent increased frequency of synthetic identity fraud).

The proposed definition also provides examples of combinations of identifying information and authenticating information that could create a harm risk to an individual identified with the information. These examples include information identifying a customer, such as a name or online user name, in combination with authenticating information such as a partial Social Security number, access code, or mother's maiden name. A mother's maiden name, for example, in combination with other identifying information, would present a harm risk because it may be so widely used for authentication purposes, even if the maiden name is not used as a password or security question at the covered institution. For these reasons, we are proposing that covered institutions should notify customers if this sensitive information is compromised.

115

While some states currently define the scope of personal information incurring a notification obligation in ways that generally align with our proposed definition of “sensitive customer information,” at least 12 states generally do not include information we propose to include, such as identifying information that, in combination with authenticating information, would create a substantial risk of harm or inconvenience.

See

NCSL Security Breach Notification Law Resource,

supra

note 106.

In determining whether the compromise of customer information could create a reasonably likely harm risk to an individual identified with the information, a covered institution could consider encryption as a factor.

116

Most states except encrypted information in certain circumstances, including, for example, where the covered institution can determine that the encryption offers certain levels of protection or the decryption key has not also been compromised.

117

116

We also considered a safe harbor from the definition of sensitive customer information for encrypted information.

See infra

section III.F.

117

See e.g.,

R.I. Gen. Laws sec. 11-49.3-3(a) (defining a security breach as unauthorized access to or acquisition of certain “unencrypted, computerized data information,” and defining “encrypted” as data transformed “through the use of a one hundred twenty-eight (128) bit or higher algorithmic process into a form in which there is a low probability of assigning meaning without use of a confidential process or key” unless the data was “acquired in combination with any key, security code, or password that would permit access to the encrypted data.”).