On May 13, 2024, the Federal Trade Commission’s (FTC) Safeguards Rule update (which appears as part of 16 CFR Part 314), will introduce new data breach reporting requirements for entities covered under the Gramm-Leach-Bliley Act (GLBA), including automobile dealerships.
The rule mandates electronic reporting to the FTC within 30 days of discovering a breach involving the information of 500 or more consumers. A breach is defined as the unauthorized acquisition of unencrypted customer information, including instances where encrypted information is accessed along with the encryption key. The rule presumes that unauthorized acquisition has occurred if there is unauthorized access to unencrypted customer information, unless reliable evidence demonstrates that unauthorized acquisition has not taken place or could not reasonably have happened.
The notice to the FTC must include the reporting financial institution’s name and contact information, a description of the data types involved, the breach’s date or duration, the number of affected consumers, and whether law enforcement has advised that public disclosure would impact a criminal investigation or threaten national security. The FTC may publish breach reports, but law enforcement can request a delay if public disclosure would compromise an ongoing investigation or threaten national security.
This FTC reporting rule supplements existing state reporting rules, and compliance with one rule may not necessarily satisfy the requirements of the other. Dealers should promptly and thoroughly assess their legal obligations whenever a data breach is suspected or confirmed.
Questions?
ComplyAuto Webinar May 22nd at 11:00 EDT – Register to learn more about the Data Breach amendment. Starting May 13th, the FTC will begin enforcing a new Safeguards Rule amendment that requires reporting unencrypted data breaches affecting 500 or more customers’ data. The FTC may publicize breaches, which could trigger enforcement investigations.
For more information about this, or our Privacy products, contact us at info@complyauto.com.