Subscribe to NetSec News2 min read
What the FTC Revised Safeguards Rule Means for Auto Dealerships
Christopher Magill
Sep 27, 2022 8:45:21 AM
What Is the GLBA Safeguards Rule?
The FTC recently amended the Standards for Safeguarding Customer Information (“the Safeguards Rule”) to include automobile dealerships. Starting June 9, 2023, any auto dealership who extends or facilitates financing for their customers must comply with FTC guidelines for safeguarding the personal data and information of all consumers.
The guidelines are based on 2003’s Gramm-Leach-Bliley Act, 15 U.S.C. § 6805 which applies to financial institutions. The Gramm-Leach-Bliley Act seeks to protect consumer financial privacy. Its provisions limit when a financial institution may disclose a consumer's nonpublic personal information to nonaffiliated third parties. The law covers a broad range of financial institutions, including many companies not traditionally considered to be financial institutions because they engage in certain financial activities. While the regulations are not new, this is the first time they have been applied specifically to automotive dealerships.
What Are the Safeguards Rule Requirements?
In addition to data privacy requirements, the FTC Safeguards Rule requires your business to draft and follow specific documented policies in a written Information Security program overseen by a designated Qualified Individual. The Qualified Individual is responsible for ensuring the Information Security program is implemented and followed and compliance is reported to your organization’s Board of Directors.
Per the FTC, “Your information security program must be written and it must be appropriate to the size and complexity of your business, the nature and scope of your activities, and the sensitivity of the information at issue. The objectives of your company’s program are:
- To ensure the security and confidentiality of customer information
- To protect against anticipated threats or hazards to the security or integrity of that information
- To protect against unauthorized access to that information that could result in substantial harm or inconvenience to any customer
A Risk Assessment must be performed to identify risks to personal information held by your company. The outcome of this assessment should be used to design the Information Security program and help determine appropriate controls.
What Does an Information Security Program Include?
The GLBA Safeguards Rule checklist to compliance includes 9 specific requirements that need to be included in your company’s information security program, summarized below:
- Designate a Qualified Individual to implement and supervise your company’s information security program.
- Conduct a risk assessment.
- Design and implement safeguards to control the risks identified through your risk assessment, including:
- Implement and periodically review access controls
- Know what you have and where you have it
- Encrypt customer information on your system and when it’s in transit
- Assess your apps
- Implement multi-factor authentication for anyone accessing customer information on your system
- Dispose of customer information securely
- Anticipate and evaluate changes to your information system or network.
- Maintain a log of authorized users’ activity and keep an eye out for unauthorized access
- Regularly monitor and test the effectiveness of your safeguards
- Train your staff
- Monitor your service providers
- Keep your information security program current
- Create a written incident response plan
- Require your Qualified Individual to report to your Board of Directors
How Do I Get Started?
Creating and implementing an effective Information Security program can be daunting and many auto dealerships don’t know where to start. When it comes to compliance, hiring a consultant to guide you through the process is your best chance of success. If you need help getting started, reach out to Ingalls’ expert consultants who have helped organizations of all sizes evaluate their security practices and design practical, repeatable solutions to meet compliance obligations.
<CLICK HERE TO GET IN TOUCH WITH OUR TEAM >
