What the FTC Revised Safeguards Rule Means for Auto Dealerships

Written by Christopher Magill | Sep 27, 2022 4:00:00 AM

The FTC has issued guidance on the Revised Safeguards Rule for auto dealerships, which in addition to data privacy requirements, includes regulations that require your business to draft and follow a written Information Security program overseen by a designated Qualified Individual.

What Is the GLBA Safeguards Rule?

The FTC recently amended the Standards for Safeguarding Customer Information (“the Safeguards Rule”) to include automobile dealerships. Starting June 9, 2023, any auto dealership who extends or facilitates financing for their customers must comply with FTC guidelines for safeguarding the personal data and information of all consumers.

The guidelines are based on 2003’s Gramm-Leach-Bliley Act, 15 U.S.C. § 6805 which applies to financial institutions. The Gramm-Leach-Bliley Act seeks to protect consumer financial privacy. Its provisions limit when a financial institution may disclose a consumer's nonpublic personal information to nonaffiliated third parties. The law covers a broad range of financial institutions, including many companies not traditionally considered to be financial institutions because they engage in certain financial activities. While the regulations are not new, this is the first time they have been applied specifically to automotive dealerships.

What Are the Safeguards Rule Requirements?

In addition to data privacy requirements, the FTC Safeguards Rule requires your business to draft and follow specific documented policies in a written Information Security program overseen by a designated Qualified Individual. The Qualified Individual is responsible for ensuring the Information Security program is implemented and followed and compliance is reported to your organization’s Board of Directors.

Per the FTC, “Your information security program must be written and it must be appropriate to the size and complexity of your business, the nature and scope of your activities, and the sensitivity of the information at issue. The objectives of your company’s program are:

To ensure the security and confidentiality of customer information
To protect against anticipated threats or hazards to the security or integrity of that information
To protect against unauthorized access to that information that could result in substantial harm or inconvenience to any customer

A Risk Assessment must be performed to identify risks to personal information held by your company. The outcome of this assessment should be used to design the Information Security program and help determine appropriate controls.

What Does an Information Security Program Include?

The GLBA Safeguards Rule checklist to compliance includes 9 specific requirements that need to be included in your company’s information security program, summarized below:

Designate a Qualified Individual to implement and supervise your company’s information security program.
Conduct a risk assessment.
Design and implement safeguards to control the risks identified through your risk assessment, including:

Implement and periodically review access controls
Know what you have and where you have it
Encrypt customer information on your system and when it’s in transit
Assess your apps
Implement multi-factor authentication for anyone accessing customer information on your system
Dispose of customer information securely
Anticipate and evaluate changes to your information system or network.
Maintain a log of authorized users’ activity and keep an eye out for unauthorized access

Regularly monitor and test the effectiveness of your safeguards
Train your staff
Monitor your service providers
Keep your information security program current
Create a written incident response plan
Require your Qualified Individual to report to your Board of Directors

How Do I Get Started?

Creating and implementing an effective Information Security program can be daunting and many auto dealerships don’t know where to start. When it comes to compliance, hiring a consultant to guide you through the process is your best chance of success. If you need help getting started, reach out to Ingalls’ expert consultants who have helped organizations of all sizes evaluate their security practices and design practical, repeatable solutions to meet compliance obligations.

View full post