Loyola University Chicago School of Law, JD 2020
he Federal Trade Commission (FTC) proposed two amendments to the Privacy Rule and Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA). The Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information security system. This rule went into effect in 2003. The Privacy Rule requires financial institutions to inform customers about its information-sharing practices and allows customers to opt out of having their information shared with certain third parties. This rule went into effect in 2000. Theare intended to further protect consumers’ data from third partiesthe changes could also adversely affect businesses.
The Expansion of Data Privacy Will Likely Protect Consumers
The proposed changes include encryption of all consumer data, implementing access controls to prevent unauthorized uses from accessing consumer information, implementing multifactor authentication to access consumer data, and requiring period reports submitted to the boards of directors to ensure compliance. Andrew Smith, Director of the FTC’s Bureau of Consumer Protection, said, “e are proposing to amend our data security rules for financial institutions to better protect consumers and provide more certainty for business.” The proposals are intended to align with technological advancements. The FTC has said that having access controls is a fundamental requirement of all information security programs and encryption is a necessary protection for customer information.
The FTC’s proposed changes to the Privacy Rule would bring the rules into line with changes implemented by Congress through the Dodd-Frank Act in 2010 and the FAST Act in 2015, which modified the annual privacy notice requirement under the GLBA. Further, the amendments would revise the scope of the Privacy Rule, altering the definition of “financial institution” under the Rule. This would expand the definition to include companies engaged in activities “incidental to financial activities.” his would include “finders” or those who charge a fee to connect consumers looking for a loan to a lender.
The proposed amendments are also designed to ensure that non-bank financial technology entities, fintechs, are subject to the same cyber security requirements as banks are under the FFIEC interagency guidelines. These proposed regulations could impose a new minimum security standard that implicates many businesses, including those outside the coverage of the current Rule.
FTC Commissioners Concerned by the Proposed Changes
Two of the FTC commissioners, Noah Phillips and Christine Wilson, voted against increasing the requirements. They believe that it may not be appropriate to mandate such prescriptive standards for all market participants. Some of the specific proposals are in response to shortcomings in data security enforcement cases and investigations. The ommissioners argue that not all of the shortcomings concern firms covered by the Safeguard and Privacy Rules. Further, these prescriptive standards impose a one-size-fits-all approach, which they believe could be troublesome. Phillips and Wilson also believe that the regulations may be premature. The proposed regulations are based on regulations by the New York State Department of Financial Services that were enacted just two years ago with no data regarding the efficacy of those regulations. They believe it is too early to adopt them at a federal level.
Furthermore, the current regulations are flexible in their approach, determined by the company’s size and complexity. The proposed regulations would move away from that flexibility. Phillips and Wilson believe the expansion could lead to traps for small and innovative businesses. Large companies can more easily absorb regulatory compliance costs than smaller companies. These regulations could potentially decrease competition in the marketplace. Additionally, the prescriptive standards may have unintended consequences of diluting data security measures under the existing Safeguard Rule. Finally, the Commissioners believe that firms, rather than federal regulators, are in a better position of deciding board engagement on data security. The Commissioners are aware that these regulations are merely being proposed currently, but they believe that if these new regulations pass, there may be unplanned negative repercussions.
Overall, the FTC is seeking comment on the proposed amendments for sixty days. Phillips and Wilson are encouraging those in the industry, academia, and civil society with expertise in data privacy to comment and provide evidence on the proposal. Although these regulations protect consumers’ data, they could prove to have negative effects on businesses that must comply with them.