In one of our early Back to Basics Blogs, we wrote about the Safeguards Rule originally adopted by the Federal Trade Commission in 2003. That rule followed the passage of the Gramm-Leach-Bliley Act (GLBA”) and requires consumer finance companies to adopt a policy that insures the security and confidentiality of customer information. It also requires companies to anticipate threats to security and to protect against unauthorized access to information.

Since the adoption of the FTC Safeguards Rule, most every state in the USA has adopted some form of a data breach notification law. These laws expand the requirements imposed on consumer finance companies and others who hold nonpublic personal information as defined in the GLBA.

In general, the laws require holders of nonpublic personal information to implement reasonable security measures, including:

• Designation of an employee or group of employees to coordinate security measures to protect against breach.
• Identification of internal and external risks of breach.
• Adoption of information protection safeguards and assessing the effectiveness of the same.
• Retention of service providers to maintain appropriate safeguards.
• Evaluation and adjustment of security measures from time to time.
• Keeping management apprised.

The laws provide for differing levels of response in the event that nonpublic personal information is or may have been accessed or acquired by any unauthorized entity. Some of these laws also provide for some pretty serious penalties for non-compliance.

It may be appropriate to combine the requirements of state data breach notification law into your Safeguards Policy, since both the laws and the policy are designed to protect nonpublic personal information from unauthorized disclosure and set forth what must be done in the event of a security breach.

Data security breaches are becoming more and more commonplace. The recent news that there was a breach of security potentially affecting ½ billion files of the Marriot Corporation’s Starwood division bears this out. Closer to home, finance companies recently have had their nonpublic personal information potentially compromised in a ransomware attack.

Please Note: If you have not taken a look at your Safeguards Policy in years, there is now even more reason to do so.

Please note: This is the thirty-fourth blog in a series of Back to Basics blogs, in which relevant and resourceful information can be easily accessed by clicking Dentons - Consumer Finance Report.