Dive Brief:
- The Securities and Exchange Commission will soon require certain financial institutions to notify individuals within 30 days of determining their personal information was compromised in a breach.
- “Over the last 24 years, the nature, scale and impact of data breaches has transformed substantially,” SEC Chair Gary Gensler said Thursday in a statement. “The basic idea for covered firms is if you’ve got a breach, then you’ve got to notify. That’s good for investors.”
- The adopted amendments to Regulation S-P, which apply to broker-dealers, funding portals, investment companies, registered investment advisers and transfer agents, also requires covered entities to develop and implement formal policies and procedures for incident response.
Dive Insight:
Notices to customers impacted by breaches must include details about the incident, the compromised data and how people can help protect themselves, according to the SEC.
The data breach disclosure rule for some financial institutions comes less than a year after the SEC adopted rules requiring publicly traded companies to disclose security incidents within four business days of determining their materiality.
Since those rules took effect, multiple large enterprises have disclosed security incidents, including Microsoft, First American Financial, Hewlett Packard Enterprise, loanDepot, and UnitedHealth Group.
The regulations are part of a government-wide push to increase the pace of data breach disclosures and promptly alert individuals to potential exposure. The Federal Trade Commission amended rules last week to require nonbanking financial institutions to notify the agency of a security breach impacting at least 500 customers’ data within 30 days.
The SEC rule change will take effect 60 days after the amendment is published in the Federal Register. Larger entities will have 18 months to comply and enforcement will begin for smaller companies in two years.
