FTC Moves to Safeguard Personal Financial Information

Reprinted from CCH FOCUS.

s mandated by the Gramm-Leach-Bliley Act, security standards for customer financial information have been proposed by the Federal Trade Commission. The reach of these safeguards is wide, including traditional and non-traditional financial institutions such as: non-depository lenders, consumer reporting agencies, data processors, courier services, retailers that extend credit by issuing credit cards to consumers, personal property or real estate appraisers, check-cashing businesses, mortgage brokers, financial advisors, loan brokers and servicers, collection agencies, tax preparers, real estate settlement services and other entities under the Commission’s jurisdiction that are significantly engaged in financial activities.

Under provisions of the Gramm-Leach-Bliley Act, institutions were required by July 1, 2001, to notify customers about their privacy practices and allow consumers to “opt out” of having their nonpublic personal information disclosed to nonaffiliated third parties. The GLB Act’s security provisions require the FTC along with the other regulatory agencies to establish standards for financial institutions on administrative, technical and physical safeguards for customer information. The objectives of these standards are to:

ensure the security and confidentiality of customer records;
protect against any anticipated threats or hazards to the security or integrity of such records; and
protect against unauthorized access to, or use of, such records or information that could result in substantial harm or inconvenience to any customer.

To ensure that the standards for safeguarding are flexible, the proposed rule provides that each information security program be appropriate to the size and complexity of the financial institution, the nature and scope of its activities and the sensitivity of the customer information. The proposed rule also would require “certain basic elements that the Commission believes are important to information security.” Each financial institution would be required to:

designate an employee or employees to coordinate its information safeguard program;
assess risks in each area of its operations;
design and implement an information security program to control these risks;
require service providers, by contract, to implement appropriate safeguards for customer information; and
adapt its program in light of material changes to its business that may affect its safeguards.

The FTC said that keeping the rule’s requirements flexible would allow smaller businesses to implement appropriate programs without setting too low a target for more sophisticated operations.

Comments on the proposal must be received not later than October 9, 2001.