Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information

Federal RegisterJun 3, 2024

Ask Donna

What actually matters in this document.

Text

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 240, 248, 270, and 275

[Release Nos. 34-100155; IA-6604; IC-35193; File No. S7-05-23]

RIN 3235-AN26

Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information

AGENCY:

Securities and Exchange Commission.

ACTION:

Final rule.

SUMMARY:

The Securities and Exchange Commission (“Commission” or “SEC”) is adopting rule amendments that will require brokers and dealers (or “broker-dealers”), investment companies, investment advisers registered with the Commission (“registered investment advisers”), funding portals, and transfer agents registered with the Commission or another appropriate regulatory agency (“ARA”) as defined in the Securities Exchange Act of 1934 (“transfer agents”) to adopt written policies and procedures for incident response programs to address unauthorized access to or use of customer information, including procedures for providing timely notification to individuals affected by an incident involving sensitive customer information with details about the incident and information designed to help affected individuals respond appropriately. In addition, the amendments extend the application of requirements to safeguard customer records and information to transfer agents; broaden the scope of information covered by the requirements for safeguarding customer records and information and for properly disposing of consumer report information; impose requirements to maintain written records documenting compliance with the amended rules; and conform annual privacy notice delivery provisions to the terms of an exception provided by a statutory amendment to the Gramm-Leach-Bliley Act (“GLBA”).

DATES:

Effective date:

This rule is effective August 2, 2024.

Compliance date:

The applicable compliance dates are discussed in section II.F of this rule.

FOR FURTHER INFORMATION CONTACT:

Emily Hellman, James Wintering, Special Counsels; Edward Schellhorn, Branch Chief; Devin Ryan, Assistant Director; John Fahey, Deputy Chief Counsel; Emily Westerberg Russell, Chief Counsel; Office of Chief Counsel, Division of Trading and Markets, (202) 551-5550; Kevin Schopp, Senior Special Counsel; Moshe Rothman, Assistant Director; Office of Clearance and Settlement, Division of Trading and Markets, (202) 551-5550, Susan Ali and Andrew Deglin, Counsels; Michael Khalil and Y. Rachel Kuo, Senior Counsels; Blair Burnett and Bradley Gude, Branch Chiefs; or Brian McLaughlin Johnson, Assistant Director, Investment Company Regulation Office, Division of Investment Management, (202) 551-6792, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION:

The Commission is adopting amendments to 17 CFR 248.1 through 248.100 (“Regulation S-P”) under Title V of the GLBA [15 U.S.C. 6801 through 6827], the Fair Credit Reporting Act (“FCRA”) [15 U.S.C. 1681 through 1681x], the Securities Exchange Act of 1934 (“Exchange Act”) [15 U.S.C. 78a

et seq.

], the Investment Company Act of 1940 (“Investment Company Act”) [15 U.S.C. 80a-1

et seq.

], and the Investment Advisers Act of 1940 (“Investment Advisers Act”) [15 U.S.C. 80b-1

et seq.

Table of Contents

I. Introduction and Background

II. Discussion

A. Incident Response Program Including Customer Notification

1. Assessment

2. Containment and Control

3. Notice to Affected Individuals

4. Service Providers

B. Scope of Safeguards Rule and Disposal Rule

1. Scope of Information Protected

2. Extending the Scope of the Safeguards Rule and the Disposal Rule To Cover All Transfer Agents

3. Maintaining the Current Regulatory Framework for Notice-Registered Broker-Dealers

C. Recordkeeping

D. Exception From Requirement To Deliver Annual Privacy Notice

E. Existing Staff No-Action Letters and Other Staff Statements

F. Compliance Period

III. Other Matters

IV. Economic Analysis

A. Introduction

B. Broad Economic Considerations

C. Baseline

1. Safeguarding Customer Information: Risks and Practices

2. Regulations and Guidelines

3. Market Structure

D. Benefits and Costs of the Final Rule Amendments

1. Written Policies and Procedures

2. Extending the Scope of the Safeguards Rule and the Disposal Rule

3. Recordkeeping

4. Exception From Annual Notice Delivery Requirement

E. Effects on Efficiency, Competition, and Capital Formation

F. Reasonable Alternatives Considered

1. Reasonable Assurances From Service Providers

2. Lower Threshold for Customer Notice

3. Encryption Safe Harbor

4. Longer Customer Notification Deadlines

5. Broader National Security and Public Safety Delay in Customer Notification

V. Paperwork Reduction Act

A. Introduction

B. Amendments to the Safeguards Rule and Disposal Rule

VI. Final Regulatory Flexibility Act Analysis

A. Need for, and Objectives of, the Final Amendments

B. Significant Issues Raised by Public Comments

C. Small Entities Subject to Final Amendments

D. Projected Reporting, Recordkeeping, and Other Compliance Requirements

E. Agency Action To Minimize Effect on Small Entities

Statutory Authority

I. Introduction and Background

Regulation S-P is a set of privacy rules adopted pursuant to the GLBA and the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”) that govern the treatment of nonpublic personal information about consumers by certain financial institutions.

The Commission is adopting rule amendments that are designed to modernize and enhance the protections that Regulation S-P provides by addressing the expanded use of technology and corresponding risks that have emerged since the Commission originally adopted Regulation S-P in 2000. The amendments in particular update the requirements of the “safeguards” and “disposal” rules. The safeguards rule requires brokers, dealers, investment companies,

and registered investment advisers to adopt written policies and procedures that address administrative, technical, and physical safeguards to protect customer records and information.

The disposal rule, which applies to transfer agents

registered with the Commission in addition to the institutions covered by the safeguards rule, requires proper disposal of consumer report information.

In addition, under Regulation Crowdfunding, funding portals must comply with the requirements of Regulation S-P as they apply to brokers.

Thus, funding portals will also be required to comply with the applicable amendments to Regulation S-P adopted in this release.

See

17 CFR 248.1.

Regulation S-P applies to investment companies as the term is defined in section 3 of the Investment Company Act (15 U.S.C. 80a-3), whether or not the investment company is registered with the Commission.

See

17 CFR 248.3(r). Thus, a business development company, which is an investment company but is not required to register as such with the Commission, is subject to Regulation S-P. Similarly, employees' securities companies—including those that are not required to register under the Investment Company Act—are investment companies and are, therefore, subject to Regulation S-P. By contrast, issuers that are excluded from the definition of investment company—such as private funds that are able to rely on section 3(c)(1) or 3(c)(7) of the Investment Company Act—are not subject to Regulation S-P.

17 CFR 248.30(a). References in this release to “rule 248.30” are to 17 CFR 248.30.

Rule 248.30(b).

See

17 CFR 227.403(b). Accordingly, unless otherwise stated (for example,

see infra

sections IV and V), references in this release to “brokers” or “broker-dealers” include funding portals.

The final Regulation S-P amendments are needed to provide enhanced protection of customer or consumer information and help ensure that customers of covered institutions receive timely and consistent notifications in the event of unauthorized access to or use of their information.

In evaluating amendments to Regulation S-P, we have considered developments in how firms obtain, share, and maintain individuals' personal information since the Commission originally adopted Regulation S-P, which correspond with an increasing risk of harm to individuals.

This environment of expanded risks and the importance of reducing or mitigating the potential for harm also supports our amendments to Regulation S-P.

See

Proposing Release at section II.A.4.

See, e.g.,

Federal Bureau of Investigation, 2022 internet Crime Report (Mar. 27, 2023), at 7-8,

available at: https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf

(stating that the FBI's internet Crime Complaint Center received 800,944 complaints in 2022 (an increase from 351,937 complaints in 2018). The complaints included 58,859 related to personal data breaches (an increase from 50,642 breaches in 2018)); the Financial Industry Regulatory Authority (“FINRA”),

2022 Report on FINRA's Examination and Risk Monitoring Program: Cybersecurity and Technology Governance

(Feb. 2022),

available at: https://www.finra.org/rules-guidance/guidance/reports/2022-finras-examination-and-risk-monitoring-program

(noting increased number and sophistication of cybersecurity attacks and reminding firms of their obligations to oversee, monitor, and supervise cybersecurity programs and controls of third-party vendors); Office of Compliance Inspections and Examinations (now the Division of Examinations) (“EXAMS”), Risk Alert,

Cybersecurity: Safeguarding Client Accounts against Credential Compromise

(Sept. 15, 2020),

available at https://www.sec.gov/files/Risk%20Alert%20-%20Credential%20Compromise.pdf

(describing increasingly sophisticated methods used by attackers to gain access to customer accounts and firm systems). This Risk Alert, and any other Commission staff statements represent the views of the staff. They are not a rule, regulation, or statement of the Commission. Furthermore, the Commission has neither approved nor disapproved their content. These staff statements, like all staff statements, have no legal force or effect. They do not alter or amend applicable law; and they create no new or additional obligations for any person.

In March 2023, the Commission proposed amendments to Regulation S-P.

In particular, the proposed amendments would amend the safeguards rule to require any broker or dealer, investment company, registered investment adviser, or transfer agent (collectively, “covered institutions”) to develop, implement, and maintain written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. The proposal included a further requirement that, as part of this incident response program, covered institutions would provide notices to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization as soon as practicable, but not later than 30 days, after becoming aware that the incident occurred or is reasonably likely to have occurred. The proposed notice requirement included provisions that addressed the use of service providers by covered institutions and included a provision that would permit covered institutions to delay providing notice after receiving a written request from the United States Attorney General (“Attorney General”) that this notice poses a substantial risk to national security.

See

Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Securities Exchange Act Release No. 97141 (Mar. 15, 2023) [88 FR 20616 (Apr. 6, 2023)] (“Proposing Release” or “proposal”). The Commission voted to issue the Proposing Release on Mar. 15, 2023. The release was posted on the Commission website that day, and comment letters were received beginning the same day. The comment period closed on June 5, 2023. We have considered all comments received since Mar. 15, 2023.

The Commission also proposed other amendments to Regulation S-P to enhance the protection of customers' nonpublic personal information. The proposed amendments included provisions to expand the scope of the protections of the safeguards and disposal rules, including extending the safeguards rule to transfer agents. The proposed amendments also included requirements for covered institutions to maintain written records documenting compliance with the proposed amended rules. Finally, the Commission proposed amendments to conform annual privacy notice delivery provisions to the terms of an exception provided by a statutory amendment to the GLBA.

The Commission received comment letters on the proposal from a variety of commenters, including financial services firms and their service providers, law firms, investor advocacy groups, professional and trade associations, public policy research institutes, academics, and interested individuals.

Most individual and public interest group commenters and some industry groups generally supported the proposed amendments.

A few commenters urged the Commission to consider taking additional steps to strengthen the proposed requirements, for example, by shortening the period for customer notification.

Many industry commenters expressed concern with specific elements of the proposed amendments, however, suggesting that these amendments would pose operational difficulties.

The comment letters on the proposal are available at

https://www.sec.gov/comments/s7-05-23/s70523.htm

See, e.g.,

Comment Letter of the Investment Adviser Association (June 5, 2023) (“IAA Comment Letter 1”); Comment Letter of the Investment Company Institute (May 23, 2023) (“ICI Comment Letter 1”); Comment Letter of Better Markets (June 5, 2023) (“Better Markets Comment Letter”); Comment Letter of North American Securities Administrators Association (May 22, 2023) (“NASAA Comment Letter”). Some commenters suggested more tailored requirements for smaller covered institutions.

See, e.g.,

IAA Comment Letter 1; Comment Letter of the Securities Transfer Association (June 2, 2023) (“STA Comment Letter 2”); Comment Letter of the Committee of Annuity Insurers (June 5, 2023) (“CAI Comment Letter”). As discussed in more detail below, the final amendments apply to all covered institutions because entities of all sizes are vulnerable to the types of data security breach incidents we are trying to address.

See infra

section VI.

See, e.g.,

Better Markets Comment Letter.

See, e.g.,

Comment Letter of the Securities Industry and Financial Markets Association, et al. (June 5, 2023) (“SIFMA Comment Letter 2”); Comment Letter of the Financial Services Institute (May 22, 2023) (“FSI Comment Letter”); Comment Letter of Federated Hermes, Inc. (June 6, 2023) (“Federated Comment Letter”).

Comments on specific aspects of the proposed amendments focused on a few key themes. First, commenters urged the Commission to take a more holistic regulatory approach to harmonize the proposed amendments with other Commission rules and proposals to avoid creating redundant, overlapping, or conflicting obligations for covered institutions.

We have modified the

rule from the proposal to address comments.

See, e.g.,

IAA Comment Letter 1; ICI Comment Letter 1; Comment Letter of Nasdaq Stock Market LLC (June 2, 2023) (“Nasdaq Comment Letter”). Commenters also raised these concerns about other proposed rulemakings that the Commission has not adopted.

See, e.g.,

Comment Letter of the Investment Adviser Association (June 17, 2023) (“IAA Comment Letter 2”); ICI Comment Letter 1. Other commenters requested more specific guidance regarding how the various policies and procedure requirements in other Commission proposals would interact with each other.

See, e.g.,

CAI Comment Letter; SIFMA Comment Letter 2; IAA Comment Letter 2. To the extent that those

proposals are adopted, the baseline in those subsequent rulemakings will reflect the existing regulatory requirements at that time.

Since the publication of the proposing release, the Commission adopted new rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incidents by public companies that are subject to the reporting requirements of the Securities Exchange Act of 1934 (“Public Company Cybersecurity Rules”).

See

Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Securities Act Release No. 11216 (July 26, 2023) [88 FR 51896 (Aug. 4, 2023)].

For example, covered institutions may be required to adopt written policies and procedures on similar issues under other provisions of the Federal securities laws.

A covered institution can, however, adopt a single set of policies and procedures covering Regulation S-P and other rules, provided that the policies and procedures meet the requirements of each rule.

Additionally, we have changed the proposed requirement to delay providing customer notices when that notice poses a substantial risk to national security or public safety in order to align with a similar provision contained in the Public Company Cybersecurity Rules.

See, e.g.,

15 U.S.C. 80b-4a (requiring each adviser registered with the Commission to have written policies and procedures reasonably designed to prevent misuse of material non-public information by the adviser or persons associated with the adviser); 17 CFR 270.38a-1(a)(1) (requiring investment companies to adopt compliance policies and procedures); 275.206(4)-7(a) (requiring investment advisers to adopt compliance policies and procedures); and Regulation S-ID, 17 CFR part 248, subpart C (requiring financial institutions subject to the Commission's jurisdiction with covered accounts to develop and implement a written identity theft prevention program that is designed to detect, prevent, and mitigate identity theft in connection with covered accounts, which must include, among other things, policies and procedures to respond appropriately to any red flags that are detected pursuant to the program).

Two commenters addressed the proposal's application to dually-registered investment advisers and broker-dealers or firms operating both business models (collectively, “dual registrants”). One of these commenters stated that the proposed amendments to Regulation S-P allow for streamlining of process because they would apply uniformly to broker-dealers and investment advisers. FSI Comment Letter. The other commenter addressed collectively other Commission cyber proposals and the proposed amendments to Regulation S-P. The commenter stated that these proposals collectively would involve significant burden for a dual registrant to bring both broker-dealer and investment adviser entities into compliance, urging the Commission to provide an extended compliance period for all of the proposed rules to provide time for dual registrants to come into compliance and “identify some synergies that might make compliance more effective and economical.” Cambridge Comment Letter. As one of these commenters stated, Regulation S-P's requirements apply uniformly to broker-dealers and advisers, although each covered institution—including a dual registrant—will have to tailor its policies and procedures to its business.

See infra

section II.A.3.d(2).

Commenters also questioned the need for the proposed amendments in light of existing State laws that also address data breaches and raised concerns about differences between the proposed amendments and State regulatory requirements. One commenter stated that the proposed amendments were not needed because existing State laws already require firms to provide notice to individuals in the event of a data breach.

Some commenters stated that parts of the proposed amendments would conflict with certain provisions of State laws,

while other commenters stated that parts of the proposed amendments would duplicate existing State laws.

See

CAI Comment Letter.

See, e.g.,

IAA Comment Letter 1; Letter from Computershare (June 5, 2023) (“Computershare Comment Letter”); SIFMA Comment Letter 2.

See, e.g.,

CAI Comment Letter.

As discussed more fully later in this section, while we recognize that existing State laws require covered institutions to notify State residents of data breaches in some cases, State laws are not consistent on this point and exclude some entities from certain requirements.

The final amendments will require notification to all customers of a covered institution affected by a data breach (regardless of State residency), in order to provide timely and consistent disclosure of important information to help affected customers respond to a data breach.

To that end, the final amendments will enhance investor protection in a number of ways, including by covering a broader scope of customer information than many States;

providing for a 30-day notification deadline that is shorter than the timing currently mandated by many States (including States that have no deadline or those allowing for various notification delays);

and providing for a more robust notification trigger than in many States.

See infra

section IV.C.2.

With respect to the interaction of the final rule with State law, Section 15(i)(1) of the Exchange Act (15 U.S.C. 78o(i)(1)) provides that no law, rule, regulation, or order, or other administrative action of any State or political subdivision thereof shall establish capital, custody, margin, financial responsibility, making and keeping records, bonding, or financial or operational reporting requirements for brokers, dealers, municipal securities dealers, government securities brokers, or government securities dealers that differ from, or are in addition to, the requirements in those areas established under the Exchange Act.

See infra

section IV.D.1.b(3).

See infra

section IV.D.1.b(2).

See infra

section IV.D.1.b(4).

Commenters also raised concerns with differences between the proposed amendments and other Federal regulators' safeguarding standards that also include a requirement for a data breach response plan or program.

The GLBA and FACT Act oblige us to adopt regulations, to the extent possible, that are consistent and comparable with those adopted by the Banking Agencies, the Consumer Financial Protection Bureau (“CFPB”), and the FTC.

Accordingly, the Commission has also been mindful of the need to set standards for safeguarding customer records and information that are consistent and comparable with the corresponding standards set by these agencies in developing the amendments.

To this end, we have modified the final amendments from the proposal to promote greater consistency with other applicable Federal safeguard standards to the extent they do not affect the investor protection purposes of this rulemaking, as discussed in more detail below. For example, the final amendments require covered institutions to ensure that their service providers provide notification as soon

as possible, but no later than 72 hours after becoming aware that an applicable breach has occurred, which is informed by the 72-hour deadline that is required under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”).

The Federal Trade Commission (“FTC”) in 2021 amended its Safeguards Rule (16 CFR part 314 (“FTC Safeguards Rule”)) by, among other things, adding a requirement for financial institutions under the FTC's GLBA jurisdiction to establish a written incident response plan designed to respond to information security events.

See

FTC, Standards for Safeguarding Customer Information, 86 FR 70272 (Dec. 9, 2021). As amended, the FTC's rule requires that a response plan address security events materially affecting the confidentiality, integrity, or availability of customer information in the financial institution's control, and that the plan include specified elements that would include procedures for satisfying an institution's independent obligation to perform notification as required by State law.

See id.

at n.295. The “Banking Agencies” include the Office of the Comptroller of the Currency (“OCC”), the Board of Governors of the Federal Reserve System (“FRB”), the Federal Deposit Insurance Corporation (“FDIC”), and the former Office of Thrift Supervision. In 2005, the Banking Agencies and the National Credit Union Administration (“NCUA”) jointly issued guidance on responding to incidents of unauthorized access to or use of customer information.

See

Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, 70 FR 15736 (Mar. 29, 2005) (“Banking Agencies' Incident Response Guidance”). The Banking Agencies' Incident Response Guidance provides, among other things, that when an institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to determine promptly the likelihood that the information has been or will be misused. If the institution determines that misuse of the information has occurred or is reasonably possible, it should notify affected customers as soon as possible.

See generally

15 U.S.C. 6804(a) (directing the agencies authorized to prescribe regulations under title V of the GLBA to assure to the extent possible that their regulations are consistent and comparable); 15 U.S.C. 1681w(a)(2)(A) (directing the agencies with enforcement authority set forth in 15 U.S.C. 1681s to consult and coordinate so that, to the extent possible, their regulations are consistent and comparable).

See

Proposing Release at the text following n.37.

See

final rule 248.30(a)(5)(i);

see also infra

footnote 245 and accompanying text (discussing how a 72-hour reporting deadline would align with other regulatory standards). Under CIRCIA, the 72-hour reporting deadline is for entities to report cyber incidents to the Cybersecurity and Infrastructure Security Agency (“CISA”).

We recognize, however, that there are some areas of divergence between the final amendments and other Federal regulators' GLBA safeguarding standards, and we discuss the basis for each provision of the final rules below, including cases where the amendments differ from analogous requirements under State law or other Federal regulations.

Among the changes being adopted, we are revising as proposed the requirements of 17 CFR 248.17 (“rule 248.17”) to refer to determinations made by the CFPB rather than the FTC, consistent with changes made to section 507 of the GLBA by the Dodd-Frank Wall Street Reform and Consumer Protection Act.

See

Public Law 111-203, sec. 1041, 124 Stat. 1376 (2010). Upon its adoption, rule 248.17 essentially restated the then-current text of section 507 of the GLBA, and as such, referenced determinations made by the FTC.

See

Privacy of Consumer Financial Information (Regulation S-P), Exchange Act Release No. 42974 (June 22, 2000) [65 FR 40334 (June 29, 2000)].

Many commenters also urged the Commission to coordinate with other Federal agencies, particularly on reporting deadlines.

For example, a number of commenters suggested that the Commission coordinate with CISA as it develops regulations pursuant to CIRCIA.

We have consulted and coordinated with CISA and, consistent with the requirements of the GLBA and other statutory requirements,

other relevant agencies and their representatives for the purpose of ensuring, to the extent possible, that the amendments are consistent and comparable with the regulations prescribed by other relevant agencies.

See, e.g.,

Comment Letter of Amazon Web Services (June 5, 2023) (“AWS Comment Letter”); Comment Letter of Google Cloud (June 5, 2023) (“Google Comment Letter”); and Nasdaq Comment Letter.

See, e.g.,

SIFMA Comment Letter 2; Cambridge Comment Letter; Google Comment Letter. CISA has provided a notice of proposed rulemaking that would implement the CIRCIA requirements but they have not yet been adopted.

See also

Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements, 89 FR 23644 (Apr. 4, 2024).

See

Exchange Act Section 17A(d)(3)(A), 15 U.S.C. 78q-1(d)(3)(A) (providing that “[w]ith respect to any clearing agency or transfer agent for which the Commission is not the appropriate regulatory agency, the Commission and the appropriate regulatory agency for such clearing agency or transfer agent shall consult and cooperate with each other . . .”).

See

15 U.S.C. 6804(a)(2). The relevant agencies include the OCC, FRB, FDIC, CFPB, FTC, CISA, Commodity Futures Trading Commission (“CFTC”), Department of Justice (“DOJ”), and the National Association of Insurance Commissioners.

We are adopting amendments to Regulation S-P substantially as proposed, with some changes in response to comments. The principal elements of the final amendments, as discussed in more detail below, are as follows:

•

Incident Response Program.

The final safeguards rule requires covered institutions to develop, implement, and maintain written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. The final amendments will require that a response program include procedures to assess the nature and scope of any incident and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use.

•

Notification Requirement.

The response program procedures in the final amendments also includes a requirement that covered institutions provide a notification to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice will not be required if a covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. Under the final amendments, a customer notice must be clear and conspicuous and provided by a means designed to ensure that each affected individual can reasonably be expected to receive it. This notice must be provided as soon as reasonably practicable, but not later than 30 days, after the covered institution becomes aware that unauthorized access to or use of customer information has, or is reasonably likely to have, occurred. As discussed in more detail below, the final amendments will permit covered institutions to delay providing notice after the Commission receives a written request from the Attorney General that this notice poses a substantial risk to national security or public safety.

See infra

section II.A.3.d(2).

•

Service Providers.

The final amendments to the safeguards rule include new provisions that address the use of service providers by covered institutions. Under these provisions, covered institutions will be required to establish, maintain, and enforce written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring of service providers, including to ensure that affected individuals receive any required notices. The final amendments make clear that while covered institutions may use service providers to provide any required notice, covered institutions will retain the obligation to ensure that affected individuals are notified in accordance with the notice requirements.

•

Scope.

The final amendments will more closely align the information protected under the safeguards rule and the disposal rule by applying the protections of both rules to “customer information,” a newly defined term. The final amendments will also broaden the group of customers whose information is protected under both rules. Also, transfer agents will be required to comply with the safeguards rule.

•

Recordkeeping and Annual Notice Amendments.

The final amendments will add requirements for covered institutions, other than funding portals,

to make and maintain written records documenting compliance with the requirements of the safeguards rule and the disposal rule. Further, the final amendments amend the existing requirement to provide annual privacy notices to codify a statutory exception.

As discussed below, funding portals are already subject to recordkeeping requirements with regard to documenting their compliance with Regulation S-P, which are not being amended by these final amendments.

See infra

footnote 385 and accompanying discussion.

II. Discussion

Since Regulation S-P was first adopted in 2000, evolving digital communications and information storage tools and other technologies have made it easier for firms to obtain, share, and maintain individuals' personal information. This increases the risk of customers' information being accessed or used without authorization, for example in a cyberattack or if customer information is improperly disposed of or stolen. In particular, as a frequently-targeted industry, the financial sector has observed increased exposure to cyberattacks that threaten not only the financial firms themselves, but also their customers, especially considering that customer records and other information that covered

institutions possess can be particularly sensitive.

The final amendments will modernize and enhance the protections that Regulation S-P already provides to address this changed landscape.

See infra

section IV.C.1.

A. Incident Response Program Including Customer Notification

As set forth in the proposal, security incidents may result in, among other things, misuse, exposure or theft of a customer's nonpublic personal information, and potentially leave affected individuals vulnerable to having their information further compromised. Threat actors can use customer information to cause harm in a number of ways, such as by stealing customer identities to sell to other threat actors on the dark web, publishing customer information on the dark web, using customer identities to carry out fraud themselves, or taking over a customer's account for malevolent purposes.

To help protect against harms that may result from a security incident involving customer information, the Commission proposed and is adopting amendments to the safeguards rule largely as proposed, with certain modifications to the notification requirement as discussed further below.

The amendments will require that covered institutions' safeguards policies and procedures include an incident response program for unauthorized access to or use of customer information, including customer notification procedures.

The amendments will require the incident response program to be reasonably designed to detect, respond to, and recover from both unauthorized access to and unauthorized use of customer information (for the purposes of this release, an “incident”).

Any instance of unauthorized access to or use of customer information will trigger a covered institution's incident response program. The amendments will also require that the response program include procedures for notifying affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

See

infra

section II.A.3.

See

final rule 248.30(a)(3). For clarity, when the amendments to the safeguards rule refer to “unauthorized access to or use”, the word “unauthorized” modifies both “access” and “use.”

See

final rule 248.30(a)(3).

See also infra

section II.B.1 for a discussion of “customer information.”

See

final rule 248.30(d)(9) for the definition of “sensitive customer information.”

See also infra

section II.A.3.b, which includes a discussion of “sensitive customer information.” Notice must be provided unless a covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information that occurred at the covered institution or one of its service providers that is not itself a covered institution, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

In this regard, requiring covered institutions to have incident response programs will help mitigate the risk of harm to affected individuals stemming from incidents where a customer's information has been accessed or used without authorization. For example, incident response programs will help covered institutions to be better prepared to respond to such incidents, and providing notice to affected individuals will aid those individuals in taking protective measures that could mitigate harm that might otherwise result from unauthorized access to or use of their information. Further, a reasonably designed incident response program will help facilitate more consistent and systematic responses to customer information security incidents and help avoid inadequate responses based on a covered institution's initial impressions of the scope of the information involved in the compromise. Requiring the incident response program to address any incident involving customer information can help a covered institution better contain and control these incidents and facilitate a prompt recovery.

As proposed, the amendments will require that a covered institution's incident response program include policies and procedures containing certain general elements but will not prescribe specific steps a covered institution must undertake when carrying out incident response activities, thereby enabling covered institutions to create policies and procedures best suited to their particular circumstances. Specifically, a covered institution's incident response program will be required to have written policies and procedures to:

(i) Assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization;

See

final rule 248.30(a)(3)(i). The term “customer information systems” would mean the information resources owned or used by a covered institution, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of customer information to maintain or support the covered institution's operations.

See

final rule 248.30(d)(6).

(ii) Take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information;

and

See

final rule 248.30(a)(3)(ii).

(iii) Notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization in accordance with the notification obligations discussed below,

unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

See

infra

section II.A.3.

See

final rule 248.30(a)(3)(iii).

The Commission received multiple comments regarding the proposed requirement for an incident response program generally.

One commenter supported requiring the incident response program and appreciated its similarity to the Banking Agencies' Incident Response Guidance.

Another commenter stated that there should not be a one-size-fits-all approach to incident response programs, stating that an adviser should have discretion to determine how the incident response program should be implemented, and requested that any final rule make clear that specific steps for incident response are not required.

Moreover, this commenter requested that the final rule expressly indicate that in developing their programs, advisers should employ a principles- and risk-based approach.

This commenter also opposed the addition of any requirement in the policies and procedures for an adviser to designate an employee with specific qualifications and experience (or hire a similarly qualified third party) to coordinate its incident response program.

Comments for specific components of the incident response program are discussed in more depth separately.

See infra

sections II.A.1-4.

See

ICI Comment Letter 1;

See also

17 CFR 270.38a-1, 275.206(4)-7.

2. Containment and Control

The final amendments will require that the response program have procedures for taking appropriate steps to contain and control a security incident, in order to prevent further unauthorized access to or use of customer information.

We did not receive comments discussing the containment and control portion of the incident response program and are adopting as proposed.

See

final rule 248.30(a)(3)(ii). These proposed requirements are consistent with the components of a response program as set forth in the Banking Agencies' Incident Response Guidance.

See

Banking Agencies' Incident Response Guidance at 15752.

Although no comments discussed only the containment and control requirements, multiple comments discussed the incident response program generally, which includes the containment and control requirement. These comments are discussed in section II.A.

As set forth in the proposal, the objective of containment and control is to prevent additional damage from unauthorized activity and to reduce the immediate impact of an incident by removing the source of the unauthorized activity.

Strategies for containing and controlling an incident vary depending upon the type of incident and may include, for example, isolating

compromised systems or enhancing the monitoring of intruder activities, searching for additional compromised systems, changing system administrator passwords, rotating private keys, and changing or disabling default user accounts and passwords, among other interventions. Because incident response may involve making complex judgment calls, such as deciding when to shut down or disconnect a system, developing and implementing written containment and control policies and procedures will provide a framework to help facilitate improved decision making at covered institutions during potentially high-pressure incident response situations. Further, covered institutions generally should consider reviewing and updating the containment and control procedures periodically to ensure that the procedures remain reasonably designed.

See

Proposing Release at Section II.A.2. For a further discussion of the purposes and practices of such containment measures,

see generally

CISA Incident Response Playbook, at 14;

see also

Federal Financial Institutions Examination Council (“FFIEC”), Information Technology Examination Handbook—Information Security (Sept. 2016), at 52,

available at https://ithandbook.ffiec.gov/media/274793/ffiec_itbooklet_informationsecurity.pdf

See also

17 CFR 270.38a-1, 275.206(4)-7.

3. Notice to Affected Individuals

As part of their incident response programs, covered institutions will be required under the final amendments to provide a clear and conspicuous notice to affected individuals under certain circumstances.

We are adopting this requirement substantially as proposed, with some changes in response to comments.

See

final rule 248.30(a)(4).

We are adopting as proposed, a requirement for a covered institution to notify each affected individual whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, unless the covered institution has determined, after a reasonable investigation of the incident, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. The covered institution will be required to provide a clear and conspicuous notice to each affected individual by a means designed to ensure that the individual can reasonably be expected to receive actual notice in writing. Also as proposed, the final amendments require the notice to be provided as soon as practicable, but not later than 30 days, after the covered institution becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. Lastly, in a modification from the proposal, the final amendments provide for an incrementally longer period of time than the proposal for a covered institution to delay providing notice to affected individuals in cases where the Attorney General has determined that providing the notice would pose a substantial risk to national security or public safety. These requirements are discussed in detail below.

a. Standard for Providing Notice and Identification of Affected Individuals

We are adopting as proposed a requirement for a covered institution to provide notice to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, it determines that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

The final amendments reflect a presumption of notification: a covered institution must provide a notice unless it determines notification is not required following a reasonable investigation. Also as proposed, if an incident of unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, but a covered institution is unable to identify which specific individuals' sensitive customer information has been accessed or used without authorization, the final amendments require the covered institution to provide notice to all individuals whose sensitive customer information resides in the customer information system that was, or was reasonably likely to have been, accessed without authorization (“affected individuals”).

Final rule 248.30(a)(4)(i).

Final rule 248.30(a)(4)(ii). This proposed provision was not intended to require notification of customers whose sensitive customer information resided in the affected customer information system if the covered institution has reasonably determined that such customers' sensitive customer information was not accessed or used without authorization. Accordingly, we have modified the final rule to reflect this intended result.

See infra

footnote 102 and accompanying text.

While the incident response program is generally required to address information security incidents involving any form of customer information,

notification is only required when there has been unauthorized access to or use of sensitive customer information, a subset of customer information, because it presents increased risks to affected individuals.

This notice standard is designed to give affected individuals an opportunity to mitigate the risk of substantial harm or inconvenience arising from an information security incident that potentially implicates their sensitive customer information by affording them an opportunity to take timely responsive actions, such as monitoring credit reports for unauthorized activity, placing fraud alerts on relevant accounts, or changing passwords used to access accounts. At the same time, the final amendments provide a mechanism for covered institutions to avoid making unnecessary notifications in cases where, following a reasonable investigation, the institution determines that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience to the affected individual.

See infra

section II.B.1.

See infra

section II.A.3.b. Additionally, customer information that is not disposed of properly could trigger the requirement to notify affected individuals under final rule 248.30(a)(4)(i). For example, a covered institution whose employee leaves un-shredded customer files containing sensitive customer information in a dumpster accessible to the public would be required to notify affected customers, unless the institution has determined that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

See infra

section II.A.3.c.

Whether an investigation is reasonable will depend on the particular facts and circumstances of the unauthorized access or use. For example, unauthorized access or use that is the result of intentional intrusion by a threat actor may warrant more extensive investigation than inadvertent unauthorized access or use by an employee. The investigation may occur in parallel with an initial assessment and scoping of the incident and may build upon information generated from those activities. The scope of the investigation generally should be refined by using available data and the results of ongoing incident response activities. Information related to the nature and scope of the incident may be relevant to determining the extent of the investigation, such as whether the incident is the result of internal unauthorized access or use of sensitive customer information or an external intrusion, the duration of the incident, what accounts have been compromised and at what privilege level, and whether and what type of customer information may have been copied, transferred, or retrieved without authorization.

For example, depending on the nature of the incident, it may be necessary to consider how a malicious intruder might use the underlying information based on current trends in identity theft.

A covered institution cannot avoid its notification obligations in cases where

an investigation's results are inconclusive. Instead, the notification requirement is excused only where a reasonable investigation supports a determination that sensitive customer information has not been and is not reasonably likely to be used in a manner that would result in substantial harm or inconvenience. Thus, in a case where a threat actor has gained access to a customer information system that stores sensitive customer information, and the covered institution lacks information indicating that any particular individual's sensitive customer information stored in that customer information system was or was not used in a manner that would result in substantial harm or inconvenience, a covered institution will be required to provide notice to affected individuals even though it may not have a sufficient basis to determine whether the breach would result in substantial harm or inconvenience.

Pursuant to the amendments, as proposed and adopted, for any determination that a covered institution makes that notice is not required, covered institutions other than funding portals will be required to maintain a record of the investigation and basis for its determination.

See

final rule 248.30(a)(4)(ii).

See infra

section II.C;

see also infra

footnote 385.

As further described below,

a number of commenters supported the proposal's requirement for covered institutions to provide notices promptly, emphasizing the importance of ensuring that customers receive timely notification when their sensitive customer information is reasonably likely to have been subject to unauthorized access or use so they have an opportunity to effectively respond to the incident.

One commenter stated that timeliness is key because any delay will impact consumers' ability to take steps to protect themselves from identify theft, account compromise, and other downstream impacts resulting from the initial harm of the unauthorized access or use.

According to this commenter, a breach notification regime is fundamentally deficient if it does not empower consumers with the information and tools necessary to take action to protect themselves or understand what risks they may face as a result of a breach.

See infra

section II.A.3.d.

See, e.g.,

Better Markets Comment Letter; EPIC Comment Letter; NASAA Comment Letter; ICI Comment Letter 1; Nasdaq Comment Letter.

See

EPIC Comment Letter;

see also

Better Markets Comment Letter (customers whose information has been exposed need appropriate and timely notifications to decide for themselves whether and how to address the breach to avoid being “victimized twice”: first when the breach occurs, and then again when “bad actors use the information to steal their identity, drain their bank accounts, or run up their credit cards”).

See

EPIC Comment Letter.

Several commenters proposed alternative notification standards, some expanding the circumstances requiring customer notification, and others suggesting a narrower notification regime.

One commenter suggested we require notification for any incident of unauthorized access to or use of sensitive information, regardless of the risk of harm or inconvenience.

According to this commenter, customers should always be notified when their sensitive information is accessed or used without authorization, which would allow customers to determine for themselves whether they believe there is a risk of substantial harm or inconvenience that should prompt action on their part. Similarly, another commenter suggested that the notification standard should be expanded from a “reasonably likelihood” standard to a “reasonably possible” standard with regard to whether an individual's sensitive customer information was accessed or used without authorization.

This commenter stated that this change was necessary to protect against the possibility that a covered institution might conclude it lacked sufficient information to find the reasonably likely standard satisfied if, for example, it knows it has been hacked but is unable to determine the scope of the hack. According to these commenters, the seemingly higher threshold proposed by the Commission, coupled with their belief that businesses want to avoid making disclosures that could incur liability or lose customers, leaves open the potential that customers will not be notified of some information security compromises that could threaten their investments.

One commenter suggested that, in addition to requiring notifications to affected individuals, the rules should be modified to also require that covered institutions provide notice to the Commission whenever they are providing notice to affected individuals.

See, e.g.,

Better Markets Comment Letter, NASAA Comment Letter (proposing more expansive standards); SIFMA Comment Letter 2, CAI Comment Letter, IAA Comment Letter 1 (proposing narrower standards).

See

Better Markets Comment Letter.

See

NASAA Comment Letter.

See

Better Markets Comment Letter; NASAA Comment Letter;

see also

EPIC Comment Letter (“EPIC agrees that businesses have a natural tendency to want to avoid making disclosures that could incur liability or lose customers”).

See

Better Markets Comment Letter.

By contrast, with regard to narrowing the standard, some commenters suggested eliminating the presumption of notification altogether, such that covered institutions would have a notification obligation only after having affirmatively determined, following an investigation, a likelihood of a breach or resulting harm to customers.

These commenters suggested that eliminating the notification presumption, and allowing for the completion of an investigation, would provide covered institutions with additional time to respond to and mitigate an incident as opposed to spending time deliberating over notification obligations, and would allow for more informed notifications. These commenters also suggested that this approach would be more consistent with certain State law regimes that only require notification where an investigation shows a risk of harm and the Banking Agencies' Incident Response Guidance.

To address the concern that lengthy investigations might unduly delay customer notifications, one commenter suggested revising the rule to separately require covered institutions “to conduct a prompt investigation of potential incidents,” which the commenter stated would better align with certain existing State law standards while still providing a mechanism for timely notifications.

See, e.g.,

SIFMA Comment Letter 2 (notification should only be required if the covered institution makes an affirmative finding of substantial harm or inconvenience); CAI Comment Letter (proposing revised notification trigger to no later than 30 days from a determination that actual or reasonably likely unauthorized access to sensitive customer information has occurred); ACLI Comment Letter (suggesting trigger should instead be only after the completion of a reasonable investigation and conclusion of the incident response process).

The Banking Agencies' Incident Response Guidance advises that a covered institution should provide notice to affected customers if, following the conclusion of a reasonable investigation, it has determined that misuse of sensitive customer information has occurred or is reasonably possible.

See

Banking Agencies' Incident Response Guidance.

See also

section II.A.3.d(1) (responding to commenters' concerns that the proposed notification timing requirements provide an insufficient amount of time for covered institutions to conduct a reasonable investigation of a data breach incident and prepare and send notices to affected individuals).

See

CAI Comment Letter.

We considered the alternative approaches suggested by commenters but determined that adopting the standard as proposed strikes an appropriate balance in accommodating the relevant competing concerns. The suggestions to expand the circumstances requiring notification (either by requiring notification regardless of the risk of harm, or by expanding notification to include cases where it is “reasonably possible” that an

individual's sensitive customer information was accessed or used without authorization) raise over-notification concerns, particularly given that the adopted standard already has a presumption towards notification.

We also disagree that the “reasonably likely” standard would allow a covered institution that knows it suffered a breach to avoid providing notice simply by pointing to a lack of information about the scope of the breach as the commenter recommending this approach suggested.

To the contrary, under the proposed and final amendments, if it is reasonably likely that a malicious actor gained access to a covered institution's information system containing sensitive customer information but the scope of the breach is unclear (

i.e.,

the covered institution is unable to determine which specific individuals' sensitive customer information has been accessed or used without authorization and cannot make the determinations required under the rule to avoid sending notices), the covered institution would be required to provide notice to each individual whose sensitive customer information resides in the customer information system.

In addition, providing notice of every incident, regardless of the risk of harm to affected individuals or the need to take protective measures, could diminish the impact and effectiveness of the notice in a situation where enhanced vigilance is necessary. Utilizing a “reasonably possible” standard raises similar concerns, as it could require covered institutions to provide notice in situations where it is possible, but not reasonably likely, that sensitive customer information was compromised. This could result in over-notification where, for example, a customer's sensitive information ultimately was not accessed or used without authorization, but it was not possible to rule out that possibility at the time of the incident or in the course of a reasonable investigation during the 30-day period for notices.

See supra

footnotes 78-80 and accompanying text.

See

NASAA Comment Letter.

See

final rule 248.30(a)(4)(i) and (ii).

Additionally, we are not adopting a commenter's recommendation that the Commission require covered institutions to provide notices to the Commission when they are required to send notices to affected individuals, as one commenter suggested.

A primary reason for these amendments was to require a reasonably designed incident response program, including policies and procedures for assessment, control and containment, and customer notification, in order to mitigate the potential harm to individuals whose sensitive information is exposed or compromised in a data breach.

Providing timely notices to affected individuals accomplishes this goal without the need for covered institutions also to provide copies of the notice to the Commission.

See

Better Markets Comment Letter.

Proposing Release at section I.

Conversely, the narrower alternative standards suggested by commenters (

i.e.,

that covered institutions have a notification obligation only after an investigation, and only if they affirmatively determine a likelihood of a breach or resulting harm to customers) could result in an unreasonable risk of significant delays in providing notice and in notification not being provided to affected individuals. A principal purpose of these amendments is to provide a notification regime that allows affected individuals to take actions to avoid or mitigate the risk of substantial harm or inconvenience.

If customer notification of a potential breach was delayed to allow a covered institution to complete an investigation that comes to a definitive conclusion about the precise details of the breach, even if done promptly, it would frustrate this goal by postponing (or potentially limiting or foreclosing) the ability of affected individuals to take mitigating actions pending the conclusion of that investigation. For these same reasons, we were not persuaded by those commenters who suggested that we should allow for the completion of an investigation in order to align with the Banking Agencies' Incident Response Guidance. After considering the comments, we continue to believe the notification standard we proposed (and are adopting in the final amendments) is necessary to enable affected individuals to make their own determinations on needed self-protections regarding the incident.

See

Proposing Release at nn.97-98 and accompanying text.

See

Proposing Release at n.100 (discussing reasons for divergence from Banking Agencies' Incident Response Guidance);

see also infra

sections II.A.3.b, II.A.3.e, II.A.4, II.B.2, and IV.C (also discussing the Banking Agencies' Incident Response Guidance).

Regarding commenters' concerns about harmonizing Regulation S-P with State law requirements, State law notification standards vary widely such that broad harmonization would be impracticable, and a benefit of the final amendments is that they provide a consistent minimum Federal notification standard to protect affected individuals in an environment of enhanced risk. This will, for example, provide additional protections for customers in States whose laws do not mandate notification without an affirmative determination of harm or provide an outside time by which notification must be provided.

This standard will protect all customers, regardless of their State of residence and reduce the potential confusion that could result from customers in one State receiving notice of an incident while customers in another State do not. Moreover, to the extent a covered institution will have a notification obligation under both the final amendments and a similar State law, a covered institution may be able to provide one notice to satisfy notification obligations under both the final amendments and the State law, provided that the notice includes all information required under both the final amendments and the State law, which may reduce the number of notices an individual receives.

See

Proposing Release at nn.107-108 and accompanying text (discussing variation in State laws);

see also infra

section IV.C.2 for a fuller discussion of State law variations, and

infra

section IV.D.1.b(2) discussing timing of State law notification regimes.

See also infra

section IV.C.2.a(2) (discussing States that excuse covered entities from individual notification under State law if the entities comply with the notification requirements of another regulator).

Relatedly, some commenters suggested eliminating or narrowing the concept of “affected individuals” entitled to notification in situations where a covered institution is unable to identify which specific individuals' sensitive customer information has been accessed or used without authorization. Instead of the proposed requirement that the covered institution must provide notice to all individuals whose sensitive customer information resides in the customer information system that was, or was reasonably likely to have been, accessed or used without authorization, commenters urged narrowing notification to individuals whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization based on the covered institution's reasonable investigation.

These commenters stated that, by requiring a covered institution to provide all affected individuals notice prior to the conclusion of an investigation and particularized determination, the proposed notification standard could result in the over-notification of individuals whose sensitive customer information may not have been accessed but was residing on a system that was compromised.

For example, one commenter posited a situation where a threat actor was able to compromise an employee's email account through a phishing email, and access documents accessible through that account's shared file server. According to this commenter, if the covered institution were unable to determine which files containing personal information actually were accessed, the institution would be required to provide notice in connection with millions of records, even though the “vast majority of files and data on that file server would not have been accessible to the employee or to the threat actor.”

These commenters stated that the resulting over-notification could, in turn, desensitize or unnecessarily disturb individuals whose information was not actually compromised, and might increase costs and litigation and reputational risks for the covered institution, its service providers, or other financial institutions whose contracts reside on the system.

See, e.g.,

IAA Comment Letter 1 (suggesting the rule's affected individuals' provision be modified to remove the reference to situations where an institution is unable to identify which specific individual's sensitive customer information has been accessed or used without authorization, as well as the presumption that affected individuals include individuals whose sensitive customer information resides in the breached customer information system); CAI Comment Letter (suggesting the provision be revised to remove the requirement to notify all individuals whose

information is on an affected system, and instead require the institution to notify individuals whose information it reasonably believes was, or reasonably could have been, subject to unauthorized access based on the finding of its investigation).

See, e.g.,

CAI Comment Letter; Computershare Comment Letter; IAA Comment Letter 1.

CAI Comment Letter.

See also infra

section IV.D.1.b.(4) (discussing reputational costs).

For similar reasons to those discussed above,

we were not persuaded by commenter suggestions to narrow the scope of affected individuals entitled to notification in cases where a breach has or is reasonably likely to have occurred, but the covered institution is unable to identify which specific individuals' sensitive customer information has been accessed or used without authorization.

Because of the potential that customers might be adversely affected by the breach, covered institutions should be required to provide notice to affected individuals in these circumstances so they may make their own determination as to whether to take remedial actions.

See supra

footnotes 90-93 and accompanying text.

See supra

footnotes 94-97 and accompanying text.

Contrary to the concerns expressed by some commenters, under the proposed and final amendments, a covered institution would not need to provide notice in connection with files or data residing on a system where it knows that information was not used or accessed.

100

Rather, a covered institution is only required to provide notification to an affected individual where her sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

101

Additionally, a covered institution need not provide notice where, after a reasonable investigation of the facts and circumstances of the incident, it has determined that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. To address these commenters' concerns, in a change from the proposal, the final amendments explicitly provide that, in cases where a covered institution reasonably determines that a specific individual's sensitive customer information that resides in the customer information system was not accessed or used without authorization, the covered institution need not provide notice to that individual.

102

Thus, a covered institution would not have an obligation to provide notice to an affected individual whose files happened to reside on a breached information system if it was able to reasonably conclude that those files were not subject to unauthorized use or access.

100

See supra

footnote 96 and accompanying text.

101

See

final rule 248.30(a)(4)(i).

102

See

final rule 248.30(a)(4)(ii).

The notification standard should help to improve security outcomes by incentivizing covered institutions to conduct more thorough investigations after an incident occurs because the rule does not permit a covered institution to rebut the presumption of notification without conducting a reasonable investigation. Further, the rule's requirement that a covered institution provide notice to all affected individuals where it is unable to identify which specific individuals' sensitive customer information has been accessed or used without authorization should incentivize covered institutions to establish procedures (for themselves and their service providers) that provide robust protections for sensitive customer information. For example, it may encourage covered institutions to employ a principle of least privilege, so that users' access rights to sensitive customer information on a particular information system are limited to the information strictly required to do their jobs.

103

Protections that limit the scope of any breaches reduce the investigation and notification costs (and as a consequence, the potential harm) resulting from a breach.

103

See, e.g., Defend Privileges and Accounts,

National Security Agency Cybersecurity Information (“Least privilege is the restriction of privileges to only those accounts that require them to perform their duties, while limiting accounts to only those privileges that are truly necessary. Doing this reduces the exposure of those privileges to a smaller, more easily manageable set of accounts. Local administrative accounts and accounts for software program management and installation are particularly powerful, but have small scopes of control and should be restricted as much as possible”) (available at

https://media.defense.gov/2019/Sep/09/2002180330/-1/-1/0/Defend%20Privileges%20and%20Accounts%20-%20Copy.pdf

For a covered institution's customer notification procedures to remain reasonably designed to notify each affected individual whose sensitive customer information was reasonably likely to have been compromised, as required by the final amendments, the covered institution's policies and procedures generally should be designed to include revisiting notification determinations whenever the covered institution becomes aware of new facts that are potentially relevant to the determination.

104

For example, if at the time of the incident, a covered institution determines that risk of use in a manner that would result in substantial harm or inconvenience is not reasonably likely based on the use of encryption in accordance with industry standards, but subsequently the encryption is compromised or it is discovered that the decryption key was also obtained by the threat actor, the covered institution generally should revisit its determination.

104

See

final rule 248.30(a)(3).

As discussed in more detail below, the scope of the final amendments will apply to customer information in a covered institution's possession or that is handled or maintained on the covered institution's behalf, regardless of whether such information pertains to (a) individuals with whom the covered institution has a customer relationship or (b) to the customers of other financial institutions where such information has been provided to the covered institution.

105

Some commenters expressed concern that, as a result of this scope, covered institutions would be required to provide notification to customers of other institutions with whom they do not have a preexisting

relationship.

106

One of these commenters suggested that it was unclear how a third-party service provider's notice to a covered institution of a breach would affect that covered institution's obligations.

107

Additionally, some commenters addressed circumstances where multiple covered institutions would all be required to notify affected individuals concerning the same incident, asserting that requiring all covered institutions involved to provide notices to customers would be burdensome, duplicative, and confusing to customers.

108

105

See infra

section II.B.1.

106

See

ACLI Comment Letter; Federated Hermes Comment Letter; ICI Comment Letter; SIFMA Comment Letter 2.

107

See

ACLI Comment Letter.

108

See

CAI Comment Letter; Computershare Comment Letter.

Where a covered institution experiences an incident involving sensitive customer information related to the customers of another covered institution, commenters generally suggested that the covered institution that has the customer relationship with the customer whose information was affected should be responsible for providing the required notice.

109

These commenters asserted that this would be more efficient because, if the covered institution that experienced the incident did not have a customer relationship with an affected individual, that covered institution might not have contact information for the individual necessary to send a notice.

109

See

SIFMA Comment Letter 2; ACLI Comment Letter; Federated Hermes Comment Letter; CAI Comment Letter. Two of these commenters suggested that the covered institution with the customer relationship may make arrangements with other institutions to provide the notice on its behalf. SIFMA Comment Letter 2; ACLI Comment Letter.

After considering comments, we are modifying the proposal to avoid requiring multiple covered institutions to notify the same affected individuals about a given incident. In an effort to minimize duplicative notices, rather than requiring the covered institution with the customer relationship to send the notice as some commenters suggested, the final amendments only require a covered institution to provide notice where unauthorized access to or use of sensitive customer information has occurred at the covered institution or one of its service providers that is not itself a covered institution.

110

That covered institution will have information about the incident itself that is necessary to properly inform affected individuals. Thus, in response to the commenter question about the relationship between a covered institution's receipt of a breach notification from a third party service provider and the covered institution's own obligations,

111

where a service provider (that is not itself a covered institution) provides notice to a covered institution that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider,

112

that covered institution will be required to initiate its incident response program under the final amendments

113

and thereafter, if applicable, provide notice to affected individuals.

114

While we appreciate, as offered by commenters,

115

that a covered institution may not have access to the contact information for some customers, it can coordinate with the covered institution that has a customer relationship to receive contact information as needed for the notices.

116

110

Final rule 248.30(a)(4). If a covered institution is acting as a service provider, in addition to its own obligations under rule 248.30, it must provide notification to the other covered institution as required by the policies and procedures required in rule 248.30(a)(5)(i).

111

See

ACLI Comment Letter.

112

See

final rule 248.30(a)(5)(i)(B).

113

See id.; see also infra

Section II.A.4.a.

114

See

final rule 248.30(a)(4)(iii). As described above, a covered institution need not provide notice where, after a reasonable investigation of the facts and circumstances of the incident, it has determined that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.

See

final rule 248.30(a)(4)(i).

115

See

ACLI Comment Letter, SIFMA Comment Letter 2.

116

Further, as discussed below, a covered instituition will be permitted to enter into a written agreement with its service provider to notify affected individuals on its behalf in accordance with the notice requirements.

See

final rule 248.30(a)(5)(ii);

see also

section II.A.3.d(2) (discussing the national security and public safety delay to the notification timing requirements).

A few commenters expressed support for the proposed notification timing requirements.

159

As described above, these commenters viewed timeliness as important because any delay in notification could impact individuals' ability to take steps to protect themselves from the downstream impacts resulting from the unauthorized access to or use of their sensitive customer information.

160

One commenter asserted that 30 days after becoming aware of an incident is more than an ample amount of time for covered institutions to determine the scope of the compromised information and compile a list of affected customers that must be notified.

161

Accordingly, this commenter suggested that the Commission should shorten the outside notification date from 30 days after becoming aware of a data security incident to 14 days, asserting that the longer an instance of identity theft goes undetected, the greater the damage that usually follows.

159

EPIC Comment Letter; Better Markets Comment Letter.

160

See supra

section II.A.3.a.

161

Better Markets Comment Letter.

In contrast, some commenters objected to the proposed notification timing requirements because, in their view, it provided an insufficient amount of time to notify affected individuals.

162

These commenters emphasized the logistical tasks associated with responding to an information breach, asserting that in some cases it would be impossible to accomplish these steps within 30 days.

163

Commenters expressed that these steps often include remediating the security incident directly, conducting a risk assessment and investigation to determine what information may have been affected, obtaining the information needed to make notification to affected individuals, arranging identity protection services for affected individuals, and generating and delivering the notifications to affected individuals, all while simultaneously engaging in extensive communication with and oversight from senior management, the board of directors, and external parties (such as outside counsel, expert consultants, and regulators).

164

162

See, e.g.,

SIFMA Comment Letter 2; IAA Comment Letter 1; FSI Comment Letter; NASDAQ Comment Letter; CAI Comment Letter.

163

For example, one commenter offered the example of a ransomware attack that successfully shuts down systems and requires significant remediation to recover backup systems, as well as rebuilding and redeploying essential systems prior to conducting a forensic investigation to determine the scope of data subject to unauthorized access or use.

See

CAI Comment Letter. According to this commenter, it would be practically impossible to accomplish these tasks within 30 days of becoming aware of a possible issue, as required under the proposed rules.

164

See, e.g.,

CAI Comment Letter, NASDAQ Comment Letter; IAA Comment Letter 1.

Some commenters also suggested that the proposed timing requirements would lead to covered institutions delivering unnecessary or incomplete notifications to customers, which would have the result of confusing or desensitizing customers to such notifications.

165

Similarly, commenters expressed that requiring a covered institution to notify affected individuals before the covered institution has had time to fully assess an incident could result in incorrect or incomplete conclusions being drawn and

disclosed.

166

One commenter suggested, for this reason, that notices would be subject to continuous revision during an ongoing investigation.

167

Accordingly, commenters stated that the Commission should revise the proposal to allow more time for covered institutions to provide notices to affected individuals, asserting that premature, incomplete, or frequent notifications would ultimately mislead and confuse customers rather than provide clarity about an incident.

168

165

See, e.g.,

ACLI Comment Letter; AWS Comment Letter, NASDAQ Comment Letter.

166

NASDAQ Comment Letter; AWS Comment Letter.

167

AWS Comment Letter.

168

ACLI Comment Letter; AWS Comment Letter, NASDAQ Comment Letter.

Several commenters suggested alternatives to the proposed timing requirements.

169

For instance, a few commenters urged the Commission to expand the 30-day outside date to 45 or 60 days, stating that this modification would allow more time for a proper investigation and notification process.

170

In addition, a couple of commenters suggested that the rule should not specify a number of days at all.

171

One of these commenters stated that simply requiring a covered institution to notify affected individuals as soon as possible after the conclusion of an investigation, without including an outside date timeframe, would permit appropriate notification in both simple cases—where notification in less than 30 days may be appropriate—and more complex cases—where it may take significantly longer to identify the appropriate notice population and prepare and deliver notifications.

172

169

See, e.g.,

IAA Comment Letter 1; FSI Comment Letter; Cambridge Comment Letter; Federated Comment Letter; SIFMA Comment Letter 2.

170

See

FSI Comment Letter; Cambridge Comment Letter; IAA Comment Letter 1.

171

Federated Comment Letter; SIFMA Comment Letter 2.

172

SIFMA Comment Letter 2.

Some commenters suggested that the trigger for notification should be the completion of a reasonable investigation and conclusion of the incident response process following the actual or reasonably likely unauthorized access to or use of sensitive customer information, rather than the proposal's trigger of a covered institution “becoming aware” of a breach of customer information.

173

These commenters stated this alternative would allow covered institutions sufficient time to engage in system and data analysis to determine what data was impacted and what individuals were affected. Moreover, some commenters stated that their suggested alternatives would harmonize the rule's approach to timing with existing data breach requirements and guidance, such as the Banking Agencies' Incident Response Guidance and some current State laws.

174

Lastly, one commenter urged that the 30-day outside timeframe to provide notices should run from the time that the covered institution determines that an incident involved “sensitive customer information,” rather than “customer information” as proposed.

175

173

See

SIFMA Comment Letter 2; ACLI Comment Letter;

see also

CAI Comment Letter (suggesting that a revised rule could require covered institutions to conduct a prompt investigation of potential incidents to address concerns about lengthy investigations unduly delaying customer notification.).

174

See

FSI Comment Letter; SIFMA Comment Letter 2 (suggesting conforming to Banking Agencies' Incident Response Guidance which does not mandate specific number of days to provide notices);

see also

IAA Comment Letter 1 (stating that “over half of state data breach notification laws do not specify a number of days to report a breach and a majority of those states that do require notification allow for 45-60 days for reporting”).

175

IAA Comment Letter 1 (suggesting that referring to “customer information,” rather than “sensitive customer information,” in this part of the proposed rule was an inadvertent omission).

After considering comments and alternatives suggested by commenters, we are adopting the final amendments as proposed. We considered the concern raised by commenters that it may be logistically challenging for covered institutions to provide notice to affected individuals within the proposed rule's notification timing requirements, particularly for more complex data breach incidents.

176

We recognize that modifying the timing trigger in the rule to start after a covered institution has completed an investigation that comes to a definitive conclusion about the precise details of the breach, as suggested by some commenters, could avoid over-notification in cases where a covered institution is able to determine that a given individual's customer information ultimately was not affected after a lengthy investigation. We agree with commenters, however, that timeliness is important in the context of a breach of sensitive customer information because delay in notification would impact the ability of affected individuals to take measures to protect themselves. Accordingly, the final amendments maintain the proposed timing trigger of after the covered institution “becomes aware” that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

177

176

See, e.g.,

CAI Comment Letter; ACLI Comment Letter.

177

While this “becoming aware” standard differs from the reporting trigger in the Public Company Cybersecurity Rules (which require public disclosure of public issuer cybersecurity incidents four business days from when an issuer determines that a cybersecurity incident that it has experienced is material), that difference is attributable to the different purposes underlying the rules. The Public Company Cybersecurity Rules were designed to inform investment and voting decisions and to reduce information asymmetry and mispricing in the market, and therefore tie public disclosure to an issuer making a determination that information about an incident would be material, meaning there would be a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision. As we stated in that release, “we reiterate, consistent with the standard set out in the cases addressing materiality in the securities laws, that information is material if `there is a substantial likelihood that a reasonable shareholder would consider it important' in making an investment decision, or if it would have `significantly altered the “total mix” of information made available.' ”

See

Public Company Cybersecurity Rules. By contrast, the notice provisions under these final rules do not require covered institutions to make a materiality determination, and balance the need for timely notifications with a regime that allows for reasonable investigations to avoid over-notification by allowing covered institutions up to 30 days to conduct a reasonable investigation after becoming aware of an incident. In light of this 30-day window, and the fact that covered institutions are not required to make a materiality determination, there is less need for a trigger based on a determination standard, and greater risk of harm to affected individuals if customer notification were further delayed by requiring that a covered institution come to a determination before triggering the 30-day notification window.

In addition, the final amendments adopt the proposed 30-day outside date. We disagree that the rule should not include a specified notification deadline, as such an approach would diminish the goal of providing customers (regardless of State residency) with early and consistent notification of data breaches so that they may take remedial action because many States do not have any specific deadline for sending notices or provide deadlines exceeding 30 days.

178

See infra

section IV.D.1.b(2).

We understand that there are a number of steps a covered institution may have to take after becoming aware of a data breach incident to determine if it has met the standard for providing notice. In the context of the final amendments, 30 days should be sufficient to conduct an initial assessment and notify affected individuals. While a covered institution may still be working towards remediating the breach after the 30-day timeframe, the final amendments require a covered institution to notify affected customers within the 30-day timeframe so that affected individuals may take measures to protect themselves. The final amendments remove the specific requirement in the proposal that the notice describe what has been done to protect the sensitive customer information from further

unauthorized access or use.

179

This change will help address some of the timing and logistical concerns raised by commenters because the process of preparing the requisite notices will be less time intensive, such that, once a covered institution has made its initial assessment of the incident and determined the universe of affected individuals, it should possess the information necessary to provide the requisite notices.

179

See

final rule 248.30(a)(4)(iv);

infra

section II.A.3.e. (discussing in more detail the modification to the notice content requirements).

In addition, with regard to the commenter concern that it may be logistically challenging to provide a notice within the rule's timing requirements in cases where a ransomware attack has denied the covered institution access to its systems,

180

that comment does not account for the fact that, under the proposed and final amendments, covered institutions will now be required to have an incident response program that includes policies and procedures to, among other things, assess the nature and scope of any qualifying incidents, identify customer information systems and types of customer information that may have been accessed or used without authorization, and respond to and recover from those incidents.

181

Thus, as proposed, consistent with the final amendments, covered institutions will need to anticipate and prepare for the possibility that they may be denied access to a particular system (such as in the ransomware example offered by one commenter) and have procedures in place for complying with the notice requirements when applicable.

180

See

CAI Comment Letter.

181

See supra

section II.A; final rule 248.30(a).

Consistent with the proposal, the final amendments will require that covered institutions provide notices “as soon as practicable,” but not more than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The amount of time that would constitute “as soon as practicable” may vary based on several factors, such as the time required to assess, contain, and control the incident.

182

The requirement to notify affected individuals as soon as practicable but not more than 30 days in the final amendments is consistent with the purposes of the GLBA and reflects the importance of expeditious notification. The amendments are designed to help ensure that customers receive notification in a timely manner. It would be contrary to this policy goal for a covered institution to unduly delay notification to customers, for example by delaying notice until it has definitively concluded that a data breach incident has occurred, because this could result in excessively delayed notifications that could unnecessarily hinder affected customers from engaging their own remedial measures to protect their data. A covered institution should act promptly and must not delay its initial assessment of the available details of the incident as delaying notices could deprive customers of the ability to take prompt action to protect themselves.

182

For example, an incident of unauthorized access by a single employee to a limited set of sensitive customer information may take only a few days to assess, remediate, and investigate. In those circumstances a covered institution generally should provide notices to affected individuals at the conclusion of those tasks and as soon as the notices have been prepared.

See

Proposing Release at n.133.

The 30-day outside timeframe under both the proposed and final rules begins following an incident involving customer information. This is consistent with the scope of the incident response program, which is required to address unauthorized access to or use of customer information. The outside timeframe does not begin from the time that the covered institution determines that an incident involved “sensitive customer information,” as suggested by one commenter.

183

The commenter's suggested modification would likely delay notification as compared to the final rule because covered institutions could take considerable time to determine that an incident involved sensitive customer information before the outside timeframe would begin and this could further delay any potential notice to affected individuals.

183

IAA Comment Letter 1.

(2) National Security and Public Safety Delay

The final amendments will allow covered institutions to delay providing notice if the Attorney General determines that the notice required under the final amendments poses a substantial risk to national security or public safety, and notifies the Commission of such determination in writing, in which case the covered institution may delay such notice for a time period specified by the Attorney General, up to 30 days following the date when such notice was otherwise required to be provided.

184

Previously referred to as the “law enforcement exception” in the proposal, the national security and public safety delay has been expanded to incorporate risks related to public safety in addition to national security. In a modification of the proposal, in which the Attorney General would have informed only the covered institution in cases where this delay is granted, in the final amendments the Attorney General will instead inform the Commission, in writing, if the Attorney General determines that the notice poses a substantial risk to national security or public safety. This modification is designed to ensure that the Commission receives information related to a delay in notice in an efficient and timely manner. We have consulted with the Department of Justice to establish an interagency communication process to allow for the Attorney General's determination to be communicated to the Commission in a timely manner. The Department of Justice will notify the covered institution that communication to the Commission has been made so that the covered institution may delay providing the notice.

184

See

final rule 248.30(a)(4)(iii).

In another change from the proposal, the notice may be delayed for an additional period of up to 30 days if the Attorney General determines that the notice continues to pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing. In a further change in response to comments, in extraordinary circumstances, notice may be delayed for a final additional period of up to 60 days if the Attorney General determines that notice continues to pose a substantial risk to national security and notifies the Commission of such determination in writing. Beyond the final 60-day delay, if the Attorney General indicates that further delay is necessary, the Commission will consider additional requests for delay and may grant such delay through a Commission exemptive order or other action. By contrast, the proposed rules would have allowed a covered institution to delay notice only for an aggregate period of 30 days following a written request from the Attorney General to the covered institution, upon the expiration of which the covered institution would have been required to provide notice immediately. The modification to the proposed rule is designed to respond to concerns raised by commenters.

185

The final amendments will align more closely with the Public Company Cybersecurity Rules on this point by incorporating a similar scope and timing for its national security and public safety delay.

One commenter stated that a delay in notifying affected individuals for law enforcement activity may cause harm to

customers whose personal information has been exposed.

186

In addition, this commenter asserted that notifying affected individuals would not impede a law enforcement investigation of the data security incident.

186

Better Markets Comment Letter.

Other commenters, however, urged the Commission to expand the proposed law enforcement exception because, in their view, the proposed exception was too narrowly drawn.

187

Several of these commenters expressed concern that requests by local or State police, or even other Federal agencies, would not be sufficient to delay notification under the proposed rule.

188

Some commenters stated concerns about the feasibility and process of reaching out to the Attorney General to request a delay in support of expanding the exception to permit other law enforcement agencies to direct a covered institution to delay a notice.

189

Commenters also expressed particular concern around competing requirements, noting that many State regulations include a more permissive delay and that covered institutions, in an effort to comply with the proposed exception, may be put into the difficult and unnecessary position of being subject to conflicting requirements from the Commission and a State law enforcement entity.

190

Further, commenters articulated that the proposed exception is excessively narrow because it only accommodates law enforcement actions that address concerns that rise to the level of “national security.”

191

187

See, e.g.,

IAA Comment Letter 1; SIFMA Comment Letter 2; NASDAQ Comment Letter; CAI Comment Letter; FII Comment Letter.

188

See, e.g.,

CAI Comment Letter; ICI Comment Letter 1; FII Comment Letter; SIFMA Comment Letter 2 (suggesting that the proposed law enforcement exception should also contemplate foreign law enforcement and include cooperation with international authorities).

189

See

ICI Comment Letter; SIFMA Comment Letter 2.

190

See, e.g.,

ICI Comment Letter 1; NASDAQ Comment Letter; FII Comment Letter; IAA Comment Letter 1 (viewing the proposed exception as creating broader security risks for clients and advisers and forcing an adviser to choose between disregarding a law enforcement request or violating the rule).

191

CAI Comment Letter; ICI Comment Letter 1; SIFMA Comment Letter 2.

In addition to concerns regarding the scope of the proposed law enforcement exception, several commenters opposed the length of time that a covered institution would be permitted to delay notice under the proposed rule.

192

These commenters suggested that there should be no outside time limitation on the proposed law enforcement exception, asserting that the judgment of any law enforcement agency investigating a breach should be an adequate and respected basis for delaying a regulatory notice regarding such breach. Commenters urged the Commission to expand the scope and timing requirements of the proposed law enforcement exception, expressing that they failed to understand the public purpose that would be served by ignoring the request of a law enforcement agency to delay notification.

193

192

See, e.g.,

IAA Comment Letter 1; ICI Comment Letter 1; NASDAQ Comment Letter; SIFMA Comment Letter 2; CAI Comment Letter.

193

See, e.g.,

IAA Comment Letter 1; NASDAQ Comment Letter;

see also

SIFMA Comment Letter 2 (stating its view that only for a limited number of cases would delay be requested or mandated by other government entities, or court orders, so notification delays would not become routine or be otherwise abused).

In response to commenters' concerns, we have broadened both the scope and timing requirements of the delay in the final amendments. The final amendments will allow covered institutions to delay notice in cases where disclosure would pose a substantial risk to national security or public safety, contingent on a written notification by the Attorney General to the Commission.

194

This provision has been expanded to incorporate risks related to public safety, and not just national security, as proposed. This expansion allows for notice delay in scenarios where there may be significant risk of harm from disclosure; however, there may not be a substantial risk to national security. This modification should make the provision sufficiently expansive to protect against significant risks of harm from disclosure—such as the risk of alerting malicious actors targeting critical infrastructure that their activities have been discovered—while also helping to ensure that individuals are not unduly denied timely access to information about the unauthorized access to or use of their sensitive customer information.

194

A covered institution requesting that the Attorney General determine that notification under the rule would pose a substantial risk to national security or public safety does not change the covered institution's obligation to provide notice to affected customers within the timing required under the final amendments. This is because the rule permits a delay only upon the Attorney General making that determination and communicating it to the Commission in writing.

With respect to commenters who recommended that other Federal agencies, State and local law enforcement agencies, and foreign law enforcement authorities also be permitted to trigger a delay or suggested that the perceived limited nature of this delay would cause conflict with State authorities, the rule does not preclude any such entity from requesting that the Attorney General determine that the disclosure poses a substantial risk to national security or public safety and communicate that determination to the Commission. Designating a single law enforcement agency as the point of contact for both the covered institution and the Commission on such delays is critical to ensuring that the rule is administrable. Some commenters stated concerns about the feasibility and process of reaching out to the Attorney General to request a delay, urging the Commission to expand the delay to apply to requests made by other law enforcement agencies in addition to the Attorney General. The FBI, in coordination with the Department of Justice, has since provided guidance on how firms can request disclosure delays for national security or public safety reasons in connection with the Public Company Cybersecurity Rules.

195

To the extent needed, further guidance may be issued on how other law enforcement agencies may contact the Department of Justice to request a delay.

195

See

FBI Guidance to Victims of Cyber Incidents on SEC Reporting Requirements, available at:

https://www.fbi.gov/investigate/cyber/fbi-guidance-to-victims-of-cyber-incidents-on-sec-reporting-requirements.

The final amendments also will expand the amount of time that a covered institution can delay notice under this provision. However, we are not persuaded, as some commenters suggested, that the rules should not incorporate a timing component at all because such an approach would diminish the goal of providing customers (regardless of State residency) with timely and consistent notification of data breaches so that they may take remedial action. This includes permitting, in extraordinary circumstances, a delay for a final additional period of up to 60 days—following two previous 30-day extensions—if the Attorney General determines that disclosure continues to pose a substantial risk to national security and notifies the Commission of such determination in writing. We are providing for this additional delay period in the final amendments, beyond what was originally proposed, and in addition to the two 30-day delays that may precede it, in recognition that, in extraordinary circumstances, national security concerns may justify additional delay beyond that warranted by public safety concerns, due to the relatively more critical nature of national security concerns.

196

Beyond the final 60-day

delay, if the Attorney General indicates to the Commission in writing that further delay is necessary, the covered institution can request an additional delay that the Commission may grant through exemptive order or other action. These modifications acknowledge that additional time beyond that proposed may be necessary, as called for by commenters, while balancing national security and public safety concerns against affected individuals' informational needs.

196

Under the proposal, in contrast, the covered institution could delay a notice if the Attorney General informed the covered institution, in writing, that the notice poses a substantial risk to

national security. The proposal provided that the covered institution could delay such a notice for a time period specified by the Attorney General, but not for longer than 15 days, plus an additional period of up to 15 days if the Attorney General determines that the notice continues to pose a substantial risk to national security.

e. Notice Contents and Format

The final amendments, consistent with the proposal, require that notices include key information with details about the incident, the breached data, and how affected individuals can respond to the breach to protect themselves. This requirement is designed to help ensure that covered institutions provide basic information to affected individuals that will help them avoid or mitigate substantial harm or inconvenience. In a modification from the proposal, however, the final amendments will not require the notice to “[d]escribe what has been done to protect the sensitive customer information from further unauthorized access or use.”

Some of the information required by the final amendment, including information regarding a description of the incident, and the type of sensitive customer information accessed or used without authorization, will provide affected individuals with basic information to help them understand the scope of the incident and its potential ramifications. As proposed, the final amendments will require covered institutions to include contact information sufficient to permit an affected individual to contact the covered institution to inquire about the incident, including a telephone number (which should be a toll-free number if available), an email address or equivalent method or means, a postal address, and the name of a specific office to contact for further information and assistance, so that affected individuals can easily seek additional information from the covered institution. All of this information may help affected individuals assess the risk posed by the incident and whether to take additional measures to protect against harm from unauthorized access or use of their information.

Similarly, as proposed, the final amendments will require information regarding the date of the incident, the estimated date of the incident, or the date range within which the incident occurred, if such information is reasonably possible to determine at the time the notice is provided. This requirement reflects the reality that a covered institution may have difficulty determining a precise date range for certain incidents because it may only discover an incident well after an initial time of access.

197

See

Proposing Release at n.142.

In addition, as proposed, the final amendments will require that covered institutions include certain information to assist affected individuals in evaluating how they should respond to the incident. Specifically, if the affected individual has an account with the covered institution, the final amendments will require the notice to recommend that the customer review account statements and immediately report any suspicious activity to the covered institution. The final amendments will also require the notice to explain what a fraud alert is and how an affected individual may place a fraud alert in credit reports. Further, the final amendments will require that the notice recommend that the affected individual periodically obtain credit reports from each nationwide credit reporting company and that the individual have information relating to fraudulent transactions deleted. The notice must also explain how a credit report can be obtained free of charge. Lastly, the final amendments require that notices include information regarding FTC and usa.gov guidance on steps an affected individual can take to protect against identity theft, a statement encouraging the individual to report any incidents of identity theft to the FTC, and the FTC's website address. These specific requirements are designed to give affected individuals resources and additional information to help them evaluate how they should respond to the incident.

As proposed, under the final rules covered institutions will be required to provide the information specified in the final amendments in each required notice. While we recognize that relevant information may vary based on the facts and circumstances of the incident, customers will benefit from the same minimum set of basic information in all notices. Accordingly, the final amendments will permit covered institutions to include additional information but will not permit omission of the prescribed information. In addition, the final amendments will require covered institutions to provide notice in a clear and conspicuous manner and by means designed to ensure that the customer can reasonably be expected to receive actual notice in writing.

198

Pursuant to 17 CFR 248.3, notices will therefore be required to be reasonably understandable and designed to call attention to the nature and significance of the information required to be provided in the notice.

199

To the extent that a covered institution includes information in the notice that is not required to be provided to customers under the final amendments or provides notice contemporaneously with other disclosures, the covered institution will still be required to ensure that the notice is designed to call attention to the important information required to be provided under the final amendments; the inclusion of any additional information in the notice may not prevent the required information from being presented in a clear and conspicuous manner. The requirement to provide notices in writing, further, will ensure that customers receive the information in a format appropriate for receiving important information, with accommodation for those customers who agree to receive the information electronically.

200

These requirements are designed to help ensure that customers are provided informative notifications and alerted to their importance.

198

See

final rule 248.30(a)(4)(i);

see also

17 CFR 248.9(a) (delivery requirements for privacy and opt out notices) and 17 CFR 248.3(c)(1) (defining “clear and conspicuous”).

199

See

17 CFR 248.3(c)(2) (providing examples explaining what is meant by the terms “reasonably understandable” and “designed to call attention”).

200

This requirement to provide notice “in writing” could be satisfied either through paper or, for customers who agree to receive information electronically, though electronic means consistent with existing Commission guidance on electronic delivery of documents.

See

Use of Electronic Media by Broker Dealers, Transfer Agents, and Investment Advisers for Delivery of Information; Additional Examples Under the Securities Act of 1933, Securities Exchange Act of 1934, and Investment Company Act of 1940 [61 FR 24644 (May 15, 1996)]; Use of Electronic Media, [65 FR 25843 (May 4, 2000)].

Several commenters broadly supported the proposed notice contents and format requirements.

201

One commenter stated that the provision will lead to notices that contain important information in a clear and conspicuous manner, which will allow affected individuals to assess the risk of the incident paired with guidance on

potential protective measures to take.

202

Another commenter agreed with the proposed approach of requiring notices to contain certain information but not prescribing the specific format for the notices, asserting that this approach will “make it easier for covered institutions to fulfill all their notice obligations under Federal and State laws with as few notice documents as possible (ideally through a single notice to all affected customers nationwide).”

203

201

See, e.g.,

Better Markets Comment Letter, IAA Comment Letter 1; NASAA Comment Letter.

202

Better Markets Comment Letter (stating that the provision “avoids some common problems with the content of many data breach notifications, such as confusing language, a lack of details, and insufficient attention to the practical steps customers should take in response.”).

203

See

NASAA Comment Letter (stating that “[b]eing prescriptive here could potentially create inconsistencies with current or future State notice laws, which in turn could cause covered institutions to feel compelled to deliver entirely duplicative notices to customers simply for reasons of form. Customers should not be burdened in this way, and the Reg. S-P Proposal rightly takes this into account.”).

Conversely, a few commenters opposed certain aspects of the notice content and format requirements.

204

One commenter expressed concern related to the proposed requirement for covered institutions to include in the notice specific efforts they have taken to protect the sensitive customer information from further unauthorized access or use.

205

This commenter articulated that this information could be extremely useful to threat actors and not particularly useful to affected individuals.

206

Another commenter urged the Commission to remove the requirement for covered institutions to provide “the date of the incident, the estimated date of the incident, or the date range,” asserting that this specific information is not required by the Banking Agencies' Incident Response Guidance and should not be included in an amended Regulation S-P.

207

In addition, two commenters suggested that the final amendments should provide more flexibility for covered institutions to determine the manner and method in which they should be contacted by affected individuals inquiring about an incident.

208

Lastly, one commenter urged the Commission to consider whether it should require specific notice obligations at all, asserting that Federal notice would simply add another layer on top of existing State data breach notice requirements and would offer limited benefits to affected individuals.

209

204

See, e.g.,

CAI Comment Letter; ICI Comment Letter 1; IAA Comment Letter.

205

IAA Comment Letter 1.

206

Id.

(further stating that in many cases “the adviser will have already remediated the vulnerability, making the information even less relevant to a client's decision.”).

207

ICI Comment Letter 1.

208

CAI Comment Letter; SIFMA Comment Letter 2 (asserting that the rule should not require each of a telephone number, an email address, a postal address and a specific office contact, but rather should allow covered institutions to choose one or more of those contact options based on how the covered institution normally interacts with its customers).

209

See

CAI Comment Letter;

see also

NASDAQ Comment Letter (asserting that covered institutions “should be permitted to comply with various State and Federal cybersecurity notification obligations with a single streamlined form.”).

After considering comments, we are removing the specific requirement in the proposal that the notice “[d]escribe what has been done to protect the sensitive customer information from further unauthorized access or use.” We agree that this information has the potential to advantage threat actors and does not provide actionable information for affected individuals. Accordingly, the provision has been removed from the final amendments, which should reduce the perceived risk of providing a roadmap for threat actors compared with the proposal. Covered institutions may, however, voluntarily disclose details related to the incident's remediation status.

The final amendments do not modify the proposed requirement for covered institutions to provide information about the date of the incident, as suggested by one commenter.

210

Providing this information to affected individuals, to the extent the information is reasonably possible to determine, can help affected individuals identify the point in time in which their sensitive customer information was compromised, thus providing critical details that affected individuals can use to take targeted protective measures (

e.g.,

review account statements) to mitigate the potential harm that could result from the unauthorized access to or use of their sensitive customer information. For this reason, we disagree with the commenter that stated firms should not be required to provide this information in their notice.

210

ICI Comment Letter 1.

Similarly, the final amendments do not modify the requirement for notices to include the prescribed contact information sufficient to permit an affected individual to contact the covered institution to inquire about the incident. We understand that covered institutions communicate with their customers using many different methods and formats. However, providing a telephone number, an email address or equivalent method or means (

e.g.,

an online submission form), a postal address, and the name of a specific office to contact, is designed to provide sufficient optionality for affected individuals, who may have differing preferences and aptitudes in their use of contact methods.

211

Nothing in this requirement, however, prevents a covered institution from choosing to provide additional contact methods.

211

In addition, the final rule's requirement to provide contact information sufficient to permit an affected individual to inquire about the incident does not preclude a covered institution from providing the contact information of a third-party service provider that has been engaged by the covered institution to provide specialized information or assistance about the unauthorized access or use of sensitive customer information on the covered institution's behalf.

See

CAI Comment Letter (asserting that it is current business practice for companies to hire vendors who provide specialized breach response call centers to handle consumer inquiries).

Lastly, the final amendments do not prescribe a specific format for the notice to affected customers. We agree with the commenter that asserted that such flexibility will make it easier for covered institutions to provide notices that meet the requirements of the final amendments while also meeting the requirements of other notice obligations, such as certain State requirements, and thereby mitigates commenter concerns about the potential for more than one notice covering a given incident.

4. Service Providers

The final amendments require that each covered institution's incident response program include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence on and monitoring, of service providers, including to ensure that the covered institution satisfies the customer notification requirements set forth in paragraph (a)(4) of the final amendments.

212

In a modification from the proposal, rather than requiring written policies and procedures requiring the covered institution to enter into a written contract with its service providers to take certain appropriate measures, the policies and procedures required by the final amendments must be reasonably designed to ensure service providers take appropriate measures to: (A) protect against unauthorized access to or use of customer information; and (B) provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider.

213

In a modification from the proposal, upon receipt of such notification, a covered institution must initiate its incident response program pursuant to paragraph (a)(3) of this section.

214

The final amendments thus modify the proposal by removing the written contract requirement and shifting the notification deadline for the service provider's notification of the covered institution from 48 to 72 hours, while retaining the notice trigger of the service provider “becoming aware of” a breach in security resulting in unauthorized access to a customer information system maintained by the service provider.

215

212

See

final rule 248.30(a)(5)(i).

213

See id.

In the proposal, the covered institution's written contract with its service

provider would have needed to require the service providers to take appropriate measures designed to protect against unauthorized access to or use of customer information, including notification to the covered institution as soon as possible, but no later than 48 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system maintained by the service provider to enable the covered institution to implement its response program.

See

proposed rule 248.30(b)(5)(i).

214

See id.

As discussed further below, this modification responds to comments by incorporating into rule text the Commission's intention that covered institutions would “expeditiously” implement their incident response program following the receipt of such notification from a service provider, as discussed in the Proposing Release.

See infra

footnote 223 and accompanying discussion on clarifying modifications.

See also

Proposing Release at Section II.A.3.

215

See

final rule 248.30(a)(5)(i).

However, the Commission is adopting as proposed final amendments that provide that a covered institution, as part of its incident response program, may enter into a written agreement with its service provider to notify affected individuals on the covered institution's behalf in accordance with paragraph (a)(4) of the final amendments.

216

In a modification from the proposal, the final amendments provide that even where a covered institution uses a service provider in accordance with paragraphs (a)(5)(i) and (ii)

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.