[Federal Register Volume 67, Number 100 (Thursday, May 23, 2002)]
[Rules and Regulations]
[Pages 36484-36494]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 02-12952]



[[Page 36483]]

-----------------------------------------------------------------------

Part VII





Federal Trade Commission





-----------------------------------------------------------------------



16 CFR Part 314



Standards for Safeguarding Customer Information; Final Rule

  Federal Register / Vol. 67 , No. 100 / Thursday, May 23, 2002 / Rules 
and Regulations  

[[Page 36484]]


-----------------------------------------------------------------------

FEDERAL TRADE COMMISSION

16 CFR Part 314

RIN 3084 AA87


Standards for Safeguarding Customer Information

AGENCY: Federal Trade Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Federal Trade Commission (''FTC'' or ''Commission'') is 
issuing a final Safeguards Rule, as required by section 501(b) of the 
Gramm-Leach-Bliley Act (''G-L-B Act'' or ''Act''), to establish 
standards relating to administrative, technical and physical 
information safeguards for financial institutions subject to the 
Commission's jurisdiction. As required by section 501(b), the standards 
are intended to: Ensure the security and confidentiality of customer 
records and information; protect against any anticipated threats or 
hazards to the security or integrity of such records; and protect 
against unauthorized access to or use of such records or information 
that could result in substantial harm or inconvenience to any customer.

EFFECTIVE DATE: This rule is effective on May 23, 2003.

FOR FURTHER INFORMATION CONTACT: Laura D. Berger, Attorney, Division of 
Financial Practices, (202) 326-3224.

SUPPLEMENTARY INFORMATION: The contents of this preamble are listed in 
the following outline:

A. Background
B. Overview of Comments Received
C. Section-by-Section Analysis
D. Paperwork Reduction Act
E. Regulatory Flexibility Act

Section A. Background

    On November 12, 1999, President Clinton signed the G-L-B Act (Pub. 
L. 106-102) into law. The purpose of the Act was to reform and 
modernize the banking industry by eliminating existing barriers between 
banking and commerce. The Act permits banks to engage in a broad range 
of activities, including insurance and securities brokering, with new 
affiliated entities. Subtitle A of Title V of the Act, captioned 
''Disclosure of Nonpublic Personal Information,'' limits the instances 
in which a financial institution may disclose nonpublic personal 
information about a consumer to nonaffiliated third parties, and 
requires a financial institution to disclose certain privacy policies 
and practices with respect to its information sharing with both 
affiliates and nonaffiliated third parties. On May 12, 2000, the 
Commission issued a final rule, Privacy of Consumer Financial 
Information, 16 CFR part 313, which implemented Subtitle A as it 
relates to these requirements (hereinafter ''Privacy Rule'').\1\ The 
Privacy Rule took effect on November 13, 2000, and full compliance was 
required on or before July 1, 2001.
---------------------------------------------------------------------------

    \1\ The rule was published in the Federal Register at 65 FR 
33646 (May 24, 2000).
---------------------------------------------------------------------------

    Subtitle A of Title V also requires the Commission and other 
federal agencies to establish standards for financial institutions 
relating to administrative, technical, and physical safeguards for 
certain information.\2\ See 15 U.S.C. 6801(b), 6805(b)(2). As described 
in the Act, the objectives of these standards are to: (1) Ensure the 
security and confidentiality of customer records and information; (2) 
protect against any anticipated threats or hazards to the security or 
integrity of such records; and (3) protect against unauthorized access 
to or use of such records or information which could result in 
substantial harm or inconvenience to any customer. See 15 U.S.C. 
6801(b)(1)-(3). The Act does not require all of the agencies to 
coordinate in developing their safeguards standards, and does not 
impose a deadline to establish them.\3\ Although the Act permits most 
of the agencies to develop their safeguards standards by issuing 
guidelines, it requires the SEC and the Commission to proceed by 
rule.\4\
---------------------------------------------------------------------------

    \2\ The other agencies responsible for establishing safeguards 
standards are: the Office of the Comptroller of the Currency 
(''OCC''); the Board of Governors of the Federal Reserve System 
(''Board''); the Federal Deposit Insurance Corporation (''FDIC''); 
the Office of Thrift Supervision (''OTS''); the National Credit 
Union Administration (''NCUA''); the Secretary of the Treasury 
(''Treasury''); and the Securities and Exchange Commission 
(''SEC'').
    \3\ By contrast, section 504 of the Act required the Agencies to 
work together to issue consistent and comparable rules to implement 
the Act's privacy provisions.
    \4\ The NCUA and the remaining banking agencies-the OCC, the 
Board, the FDIC, and OTS-have already issued final guidelines that 
are substantively identical. 66 FR 8152 (Jan. 30, 2001); 66 FR 8616 
(Feb. 1, 2001). The SEC also adopted a final safeguards rule as part 
of its Privacy of Consumer Financial Information Final Rule 
(hereinafter ''SEC rule''). See www.sec.gov/rules/final/34-42974.htm 
(June 29, 2000).
---------------------------------------------------------------------------

    On September 7, 2000, the Commission issued for publication in the 
Federal Register a Advanced Notice of Proposed Rulemaking (''the 
ANPR'') on the scope and potential requirements of a Safeguards Rule 
for the financial institutions subject to its jurisdiction.\5\ The 
Commission received thirty comments in response to the ANPR. Based on 
these comments, as well as the safeguards standards already issued by 
the other GLB agencies, the Commission issued a Notice of Proposed 
Rulemaking respecting Standards for Safeguarding Customer Information 
(''the proposal'' or ''the Proposed Rule'') on August 7, 2001.\6\ In 
response to the proposal, the Commission received forty-four comments 
from a variety of interested parties. The Commission now issues a final 
rule governing the safeguarding of customer records and information for 
the financial institutions subject to its jurisdiction (''Safeguards 
Rule'').
---------------------------------------------------------------------------

    \5\ 65 FR 54186.
    \6\ 66 FR 41162. In addition to considering the Banking Agency 
Guidelines, the Commission also considered the Final Report that was 
issued by the Federal Trade Commission Advisory Committee on Online 
Access and Security on May 15, 2000 (''Advisory Committee's Report'' 
or ''ACR''). Although the Advisory Committee's Report addressed 
security only in the online context, the Commission believes that 
its principles have general relevance to information safeguards.
---------------------------------------------------------------------------

    Like the proposal, the Final Rule requires each financial 
institution to develop a written information security program that is 
appropriate to its size and complexity, the nature and scope of its 
activities, and the sensitivity of the customer information at issue. 
As described below, each information security program must include 
certain basic elements to ensure that it addresses the relevant aspects 
of a financial institution's operations and that it keeps pace with 
developments that may have a material impact on its safeguards. In 
developing the Final Rule, the Commission carefully weighed the 
comments, including concerns expressed about the ability of smaller and 
less sophisticated financial institutions to meet the Rule's 
requirements. It also sought to ensure that the Rule mirrored the 
requirements of the guidelines already established by the NCUA and the 
other banking agencies (collectively, ''the Banking Agency 
Guidelines''),\7\ with adjustments as needed to clarify the Rule's 
scope and accommodate the diverse range of entities covered by the 
Commission's Rule. The Commission believes that the Final Rule strikes 
an appropriate balance between allowing flexibility to financial 
institutions and establishing standards for safeguarding customer 
information that are consistent with the Act's goals. As described 
below, the Commission will issue educational materials in connection 
with the Rule in order to assist businesses-and in particular, small 
entities-to comply with its requirements without imposing undue 
burdens.
---------------------------------------------------------------------------

    \7\ See supra n.4.[7]

---------------------------------------------------------------------------

[[Page 36485]]

Section B. Overview of Comments Received

    The comments received were submitted by a variety of interested 
parties: 8 twenty-eight were from trade or other 
associations or companies related to financial or Internet-related 
services; 9 six were from corporations or associations 
related to higher education or the funding of student loans; 
10 five were from individuals; 11 three were from 
information security companies; 12 two were from consumer 
reporting agencies; 13 and one was from a non-profit 
association of consumer agencies.14
---------------------------------------------------------------------------

    \8\ These comments are available on the Commission's Web site, 
at www.ftc.gov.
    \9\ ACA International (''ACA''); America's Community Bankers 
(''ACB''); Associated Credit Bureaus, now renamed the Consumer Data 
Industry Association (''CDIA''); BITS/Financial Services Roundtable 
(''BITS''); Commerce Bankshares, Inc.; Credit Union Nat'l Ass'n 
(''CUNA''); Council of Ins. Agents and Brokers; Debt Buyers Ass'n 
(''DBA''); Ernst & Young LLP (''Ernst & Young''); Financial Planning 
Ass'n (''FPA''); Household Finance Corporation (''Household''); 
Independent Community Bankers of America (''ICB''); Independent Ins. 
Agents of America (''Indep. Ins. Agents''); Intuit Inc. 
(''Intuit''); Information Technology Ass'n of America (''ITAA''); 
MasterCard International (''MasterCard''); Nat'l Ass'n of Indep. 
Insurers (''NAII''); Nat'l Ass'n of Mutual Ins. Cos. (''NAMIC''); 
Nat'l Automotive Dealers Ass'n (''NADA''); Nat'l Retail Federation 
(''NRF''); Navy Federal Credit Union (''NFCU''); Nat'l Indep. 
Automobile Dealers Ass'n (''NIADA''); Navy Federal Financial Group 
(''NFFG''); North American Securities Administrators Ass'n, Inc. 
(''NASAA''); Ohio Credit Union League (''OCUL''); Oracle Corporation 
(''Oracle''); Software & Information Industry Ass'n (''SIIA''); Visa 
USA, Inc. (''Visa'').
    \10\ American Council on Education (''ACE''); Education Finance 
Council and the National Council of Higher Education Loan Programs; 
Nat'l Council of Higher Educ. Loan Programs, Inc.; USA Education, 
Inc. & Student Loan Marketing Ass'n (collectively ''Sallie Mae''); 
Texas Guaranteed Student Loan Corp. (''TGSL''); United Student Aid 
Funds, Inc. (''USA Funds'').
    \11\ Forest Landreth (''Landreth''); Lou Larson (''Larson''); 
Sheila Musgrove (''Musgrove''); David Paas (''Paas''); Norman Post 
(''Post'').
    \12\ Portogo, Inc. (''Portogo''); Tiger Testing; VeriSign, Inc. 
(''VeriSign'').
    \13\ Equifax, Inc (''Equifax''); Experian Information Solutions, 
Inc. (''Experian'').
    \14\ Nat'l Ass'n of Consumer Agency Administrators (''NACAA'').
---------------------------------------------------------------------------

    The majority of commenters supported the proposal overall, citing 
its flexibility \15\ and similarity to the Banking Agency 
Guidelines.\16\ However, as discussed below, commenters expressed 
different views on issues concerning the Rule's scope-in particular, 
whether financial institutions should be responsible for the safeguards 
of their affiliates and service providers and whether the Rule should 
apply to a financial institution that has no customer relationship but 
receives customer information from another financial institution. In 
addition, a number of commenters asked that compliance with alternative 
standards be deemed compliance with the Rule and/or sought to exclude 
certain entities from the Rule's definition of ''service provider.'' 
Finally, numerous commenters urged that the Commission provide guidance 
to businesses-particularly smaller businesses-on how to comply with the 
Rule without incurring undue expense.\17\ As discussed in detail below, 
comments on all of these issues were instrumental in shaping the Final 
Rule.
---------------------------------------------------------------------------

    \15\ See, e.g., Household at 1; Intuit at 2; ITAA at 1; NRF at 
2; Sallie Mae at 2; SIIA at 3; TGSL at 1; Verisign at 2.
    \16\ See, e.g., Visa at 1.
    \17\ See, e.g., ICB at 2; Musgrove at 2; NADA at 2; NIADA at 9; 
Paas at 4-6.
---------------------------------------------------------------------------

    Additional comments, and the Commission's responses thereto, are 
discussed in the following Section-by-Section analysis.

Section C. Section-by-Section Analysis

    Consistent with the proposal, the Safeguards Rule will be part 314 
of 16 CFR, to be entitled ''Standards for Safeguarding Customer 
Information.'' This Part will follow the Privacy Rule, which is 
contained in part 313 of 16 CFR. The following is a section-by-section 
analysis of the Final Rule.

Section 314.1: Purpose and Scope

    Paragraph 314.1(a) states that the Rule is intended to establish 
standards for financial institutions to develop, implement and maintain 
administrative, technical, and physical safeguards to protect the 
security, confidentiality, and integrity of customer information. This 
paragraph also states the statutory authority for the proposed Rule. No 
comments addressed this provision, and the Commission has made no 
changes to it.
    Paragraph 314.1(b) sets forth the scope of the Rule, which applies 
to the handling of customer information by all financial institutions 
over which the FTC has jurisdiction. Because, as noted below, 
''financial institution'' is defined as it is in section 509(3)(A) of 
the Act and the Privacy Rule, the Rule covers a wide range of entities, 
including: non-depository lenders; consumer reporting agencies; debt 
collectors; data processors; courier services; retailers that extend 
credit by issuing credit cards to consumers; personal property or real 
estate appraisers; check-cashing businesses; mortgage brokers, and any 
other entity that meets this definition.\18\ Consistent with the 
proposal, the Safeguards Rule covers any financial institution that is 
handling ''customer information''-i.e., not only financial institutions 
that collect nonpublic personal information from their own customers, 
but also financial institutions that receive customer information from 
other financial institutions.
---------------------------------------------------------------------------

    \18\ Under section 313.3(k)(1) of the Privacy Rule, ''financial 
institution'' means: any institution the business of which is 
engaging in financial activities as described in section 4(k) of the 
Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)). An institution 
that is significantly engaged in financial activities is a financial 
institution.
    Additional examples of financial institutions are provided in 
section 313.3(k)(2) of the Privacy Rule.
---------------------------------------------------------------------------

    Comments were split on whether the Rule should apply to customer 
information that a financial institution receives from another 
financial institution. A number of commenters agreed that such 
recipients should be required to maintain safeguards, citing the added 
protections provided by this requirement.\19\ However, one of these 
commenters expressed concern that a recipient financial institution 
could be subject to multiple safeguards standards or even required to 
prepare multiple written safeguards plans if that financial institution 
also acts as a service provider or is subject to other laws, such as 
the Fair Credit Reporting Act, that impose confidentiality 
requirements.\20\ In addition, some commenters opposed covering 
recipients on the grounds that such coverage is: (1) Beyond the intent 
of section 501(a), which refers to a financial institution's obligation 
to ''its customers;'' (2) unnecessary in light of the Rule's separate 
treatment of service providers and affiliates; and/or (3) too 
burdensome.\21\
---------------------------------------------------------------------------

    \19\ See, e.g., Equifax at 1-2; Intuit at 2; NIADA at 2; TGSL at 
1.
    \20\ Equifax at 2.
    \21\ See, e.g., ACA at 2-3; CDIA at 3; Experian at 2; Mastercard 
at 2-3; NAMIC at 2-3; NRF at 3. In addition, one comment stated that 
numerous financial institutions that do not have customer 
relationships of their own could be swept into the Rule in this 
fashion (Visa at 4). Although no commenters identified the types of 
financial institutions that are likely to be so affected, the 
Commission envisions that such entities could include consumer 
reporting agencies, debt collectors, independent check cashers, 
automated teller machine operators, and other businesses that obtain 
customer information from other financial institutions to process 
customer data, facilitate customer transactions, or carry out 
transactions in a consumer context.
---------------------------------------------------------------------------

    After considering the comments, the Commission has determined that 
covering recipient financial institutions is consistent with the 
purpose and language of the Act. The Commission believes that imposing 
safeguards obligations as to customer information that a financial 
institution receives about another institution's customers is the most 
reasonable reading of the statutory language and clearly furthers the 
express congressional policy to

[[Page 36486]]

respect the privacy of these customers and to protect the security and 
confidentiality of their nonpublic personal information. Covering 
recipients will ensure that all financial institutions over which the 
Commission has jurisdiction safeguard customer information and that 
such safeguards are not lost merely because information is shared with 
a third-party financial institution.\22\ The Commission also believes 
that the Rule's provisions for affiliates and service providers, 
discussed below, are not sufficient to address circumstances where 
information is transferred to another financial institution in the 
absence of a service or affiliate relationship, such as for use in debt 
collection or consumer reporting. Without imposing safeguards in such 
cases, customer information would be insufficiently protected and 
Congressional intent to safeguard such information would be undermined. 
Finally, the flexible requirements of the Rule-which allow the 
safeguards to vary according to the size and complexity of a financial 
institution, the nature and scope of its activities, and the 
sensitivity of any customer information at issue-permit entities to 
develop safeguards appropriate to their operations and should minimize 
any burdens on recipient entities.
---------------------------------------------------------------------------

    \22\ Under the Act, the Commission has jurisdiction over ''any 
other financial institution or other person that is not subject to 
the jurisdiction of any agency or authority.'' 15 U.S.C. Section 
6805(7). Thus, the Commission does not have jurisdiction over any 
financial institution that is subject to another Agency's authority 
by the Act, including national banks, bank holding companies and 
savings associations the deposits of which are insured by the FDIC. 
See id. at Section 6805(a)(1)-(6).
---------------------------------------------------------------------------

    Nevertheless, the Commission recognizes that financial institutions 
covered by its Rule also may simultaneously be subject to the Rule's 
requirements for service providers or affiliates.\23\ For example, 
check printers, data processors, and real property appraisers that 
receive customer information as service providers for a financial 
institution will also be directly subject to the rule because they are 
themselves financial institutions.\24\ However, the obligations the 
Rule creates for financial institutions are entirely consistent with 
the standard it requires them to impose on their affiliate or service 
provider, so that each entity ultimately is required to maintain 
safeguards that are appropriate in light of the relevant circumstances. 
Thus, a financial institution that develops an information safeguards 
program according to the Rule will not be faced with additional or 
conflicting requirements merely because it also received customer 
information as an affiliate or service provider.
---------------------------------------------------------------------------

    \23\ As discussed below, the FTC Rule requires financial 
institutions to ensure the safeguards of their affiliates and take 
steps to oversee their service providers' safeguards. See sections 
314.2(b) and 314.4(d), below. What safeguards would be appropriate 
for an affiliate or service provider depends on the facts and 
circumstances, just as it would for a financial institution that is 
directly covered by the Rule.
    \24\ It should be noted that this potential overlap exists for 
all financial institutions that are affiliates or service providers 
of other financial institutions, not just recipient entities.
---------------------------------------------------------------------------

    As under the proposal, the Safeguards Rule does not cover 
recipients of customer information that are not financial institutions, 
and are also neither affiliates nor service providers as defined by the 
Rule. However, the Commission encourages each financial institution to 
take reasonable steps to assure itself that any third party to which it 
discloses customer information has safeguards that are adequate to 
fulfill any representations made by the financial institution regarding 
the security of customer information or the manner in which it is 
handled by third parties.\25\
---------------------------------------------------------------------------

    \25\ Misrepresentations regarding these issues could violate the 
Privacy Rule and Section 5 of the FTC Act.
---------------------------------------------------------------------------

    In addition, as under the proposal, the Safeguards Rule only 
applies to information about a consumer who is a ''customer'' of a 
financial institution within the meaning of the Rule.\26\ This approach 
is consistent with the Banking Agency Guidelines and the majority of 
comments that addressed this issue.\27\ Although the Commission 
believes that limiting the Rule to information about customers is 
warranted by the plain language of section 501 of the Act, the 
Commission notes, as it did in the proposal, that protecting 
information about consumers may be a part of providing reasonable 
safeguards to ''customer information'' where the two types of 
information cannot be segregated reliably. Further, consistent with its 
mandate under section 5 of the FTC Act, the Commission expects that, as 
with customers, any information that a financial institution provides 
to a consumer will be accurate concerning the extent to which 
safeguards apply to them. Finally, the Commission expects that each 
financial institution will have in place at least the administrative or 
other safeguards necessary to honor any ''opt-out'' requests made by 
consumers under the Privacy Rule.
---------------------------------------------------------------------------

    \26\ The Rule incorporates the definition of ''customer'' set 
forth in section 313(h) of the Privacy Rule. See section 314.2(a).
    \27\ See, e.g., ACA at 4; DBA at 1; Mastercard at 1-2; but see 
Intuit at 3-4; NACAA at 1.
---------------------------------------------------------------------------

    Other comments on the Rule's scope urged that compliance with 
various alternative standards should constitute compliance with the 
Safeguards Rule. Several such commenters urged that the Rule permit 
compliance with another agency's safeguards standard in lieu of the 
FTC's. Specifically, commenters urged that: (1) Compliance with the 
SEC's rule constitute compliance with the FTC Rule, so that state 
investment advisors covered by the FTC Rule would be subject to the 
same standards as federal investment advisors, which are subject to the 
SEC's jurisdiction; \28\ (2) non-federally-insured credit unions be 
permitted to comply with the NCUA's guidelines instead of the FTC's 
Rule, so that they would be subject to the same standards as federally-
insured credit unions, which are under the NCUA's jurisdiction; \29\ 
and (3) compliance with the Banking Agency Guidelines \30\ be deemed 
compliance for service providers that may be engaged by banks as well 
as by entities under the FTC's jurisdiction. In addition, other 
commenters requested that compliance with other laws be deemed 
compliance with the Rule, such as the Fair Credit Reporting Act 
(''FCRA''); \31\ the Health Insurance Portability and Accountability 
Act (''HIPAA''); \32\ and the Fair Debt Collection Practices Act 
(''FDCPA'').\33\
---------------------------------------------------------------------------

    \28\ NASAA at 2.
    \29\ CUNA at 1; OCUL at 3.
    \30\ Indep. Ins. Agents at 2.
    \31\ CDIA at 2-3; NIADA at 3.
    \32\ NIADA at 3.
    \33\ ACA at 4-5.
---------------------------------------------------------------------------

    As discussed above in connection with recipient financial 
institutions and others, the Commission does not intend to impose undue 
burdens on entities that already are subject to comparable safeguards 
requirements. In particular, the Commission envisions that any entity 
that can demonstrate compliance with the Banking Agency Guidelines 
(including the substantively identical NCUA Guidelines) will also 
satisfy the Rule. With respect to other rules and laws that may contain 
some safeguards, the Commission notes that the adoption of safeguards 
in furtherance of such rules or laws will be weighted heavily in 
assessing compliance with the Rule. However, because such other rules 
and laws do not necessarily provide comparable protections in terms of 
the safeguards mandated, data covered, and range of circumstances to 
which protections apply, compliance with such standards will not 
automatically ensure compliance with the Rule. For example, an entity's 
compliance with the FCRA, which limits the purposes for which certain 
financial information may be disclosed, will not guarantee that an

[[Page 36487]]

entity has adopted a comprehensive information security plan as 
described in the Rule.

Section 314.2: Definitions

    This section defines terms used in the Safeguards Rule. As under 
the proposal, paragraph (a) makes clear that, unless otherwise stated, 
terms used in the Safeguards Rule bear the same meaning as in the 
Commission's Privacy Rule. The remaining paragraphs (b)-(d) of this 
section define the terms ''customer information,'' ''information 
security program,'' and ''service provider,'' respectively.
    In addressing this section generally, several commenters expressed 
concern that the definitions would be confusing to the extent that they 
differ from those set forth in the Privacy Rule or the Banking Agency 
Guidelines.\34\ In response, the Commission notes that, the terms used 
in the Rule are consistent with those used in the Privacy Rule, and 
differ from those used in the Guidelines only as needed to clarify the 
Rule's scope and make its terms more understandable and appropriate to 
the diverse range of non-bank financial institutions subject to the 
Commission's jurisdiction. Thus, as described below, the Rule defines 
''customer information'' to include information handled by affiliates. 
Similarly, the Rule omits definitions found in the Guidelines, such as 
''Board of Directors'' or ''subsidiary,'' that are not universally 
applicable to entities that will be subject to the Rule.
---------------------------------------------------------------------------

    \34\ See, e.g., Intuit at 4; NADA at 2; NIADA at 2, 4.
---------------------------------------------------------------------------

    Proposed paragraph (b) defined ''customer information'' as any 
record containing nonpublic personal information, as defined in 
paragraph 313.3(n) of the Privacy Rule, about a customer of a financial 
institution, whether in paper, electronic, or other form, that is 
handled or maintained by or on behalf of a financial institution or its 
affiliates.'' Thus, to the extent that a financial institution shares 
customer information with its affiliates, the proposal required it to 
ensure that the affiliates maintain appropriate safeguards for the 
customer information at issue.
    Commenters expressed varying views on whether a financial 
institution should be responsible for its affiliates' safeguards. Some 
commenters agreed that customer information held by affiliates should 
be protected by the Rule.\35\ However, some commenters requested that 
affiliates that are financial institutions subject to the jurisdiction 
of another agency be permitted to comply with the safeguards standards 
of that agency in lieu of the Commission's Rule.\36\ Finally, several 
commenters stated that the Rule should not cover affiliates at all 
because (1) the Act was not meant to cover any entity that is not a 
financial institution and some affiliates may not be financial 
institutions \37\ or (2) the fact that the Act permits financial 
institutions to disclose nonpublic personal information to affiliates 
without providing any notice or opt out indicates that no affiliates 
were intended to be covered by the Act's safeguards provisions.\38\
    The Commission agrees that section 501 of the Act focuses on the 
obligations of financial institutions. It also notes, however, that the 
purpose of the Act is to protect customer information, and that such 
information easily may be shared with companies that are affiliated and 
under common control with such financial institutions. Therefore, the 
Rule imposes obligations only on financial institutions, but gives them 
duties with respect to customer information shared with their 
affiliates. The Commission does not believe that the unrestricted 
sharing that the Act permits among affiliates-including affiliates that 
are not financial institutions-shows an intent to exclude affiliates 
from safeguards obligations. To the contrary, the free sharing the Act 
permits among affiliates warrants a coordinated and consistent approach 
to security. The Commission notes, however, that the duty to ensure 
appropriate safeguards by affiliates arises only if a financial 
institution shares customer information with its affiliates; therefore 
this obligation can, and need only be, addressed as part of such 
sharing arrangements. In addition, the flexible standards of the Rule 
permit entities to develop safeguards appropriate to their operations 
and the sensitivity of the information at issue and should therefore 
minimize burdens on affiliates. Finally, as noted above, the Commission 
agrees that compliance with the Banking Agency Guidelines should 
satisfy the safeguards standards under the Commission's Rule. 
Therefore, any financial institution that can demonstrate its 
compliance with the Guidelines will not be subject to additional 
requirements merely because it is an affiliate of a financial 
institution that is covered by the Rule.
---------------------------------------------------------------------------

    \35\ Equifax at 2-4; Household at 1-2; NACAA at 1; NIADA at 4; 
SIIA at 2. See also NCHELP at 1.
    \36\ See, e.g., Household at 1-2; NCHELP at 2; OCUL at 2; USA 
Funds at 1. See also Equifax at 2.
    \37\ Mastercard at 4-5. See also NRF at 4.
    \38\ NAMIC at 5-6.
---------------------------------------------------------------------------

    Proposed paragraph (c) defined ''information security program'' as 
''the administrative, technical, or physical safeguards'' that a 
financial institution uses ''to access, collect, process, store, use, 
transmit, dispose of, or otherwise handle customer information.'' This 
definition is virtually identical to the Banking Agency Guidelines' 
definition of ''customer information systems.'' See Banking Agency 
Guidelines, section I.C.2.d. Few comments were received on this 
definition. In response to one commenter who urged that this term 
should better describe all of the ways that ''customer information'' 
can be provided to others, the Commission has added the words 
''distribute'' and ''protect'' to this definition.\39\ At the same 
time, the Commission notes that the words ''otherwise handle'' are 
intended to cover other ways that customer information is dealt with 
that are not specifically mentioned in the definition. Thus, the 
definition is adopted with only the minor changes noted above.
---------------------------------------------------------------------------

    \39\ Equifax at 4.
---------------------------------------------------------------------------

    Proposed paragraph (d) defined the term ''service provider'' to 
mean ''any person or entity that receives, maintains, processes, or 
otherwise is permitted access to customer information through its 
provision of services directly to a financial institution that is 
subject to the rule.'' This definition is virtually identical to the 
definition set forth in the Banking Agency Guidelines. See Banking 
Agency Guidelines, section I.C.2.e. Several commenters urged that this 
definition be amended to exclude particular entities from the 
definition of service providers, namely: (1) Accountants and auditors 
\40\ (2) financial institutions that also provide services to banks, 
and are subject to examination under the Bank Service Company Act 
(BSCA); \41\ (3) any service provider that is also an affiliate of a 
financial institution; \42\ and (4) any service provider that receives 
information under the Privacy Rule's general exceptions in Sections 
313.14 and 313.15, and is therefore permitted access to nonpublic 
personal information without need for a specific agreement concerning 
its reuse and redisclosure.\43\
---------------------------------------------------------------------------

    \40\ Ernst & Young at 1-2.
    \41\ Visa at 4.
    \42\ NIADA at 5.
    \43\ NIADA at 6 (but stating that the Rule's obligations for 
service providers are for the most part consistent with the Privacy 
Rule).
---------------------------------------------------------------------------

    The Commission notes that the Banking Agency Guidelines do not 
contain exceptions to the definition of service provider. Thus, some of 
the recommended exceptions could result

[[Page 36488]]

in disparate treatment of entities performing services for a bank and 
entities performing services for a financial institution under the 
FTC's jurisdiction. In addition, no commenters demonstrated that the 
confidentiality requirements that apply to auditors and accountants (or 
other professionals) would address unauthorized access to information 
by third parties, fraud, or any other security issues contemplated by 
the Rule. Further, given the Rule's flexibility, the Commission is 
aware of no duplicative burdens that will result from application of 
the Rule to auditors, accountants, or other professionals, or to 
service providers to, or affiliates of, banks. Finally, the Commission 
has determined that the Rule should apply to all service providers, 
even those that the Privacy Rule does not require to enter into 
agreements concerning reuse and redisclosure of the relevant 
information. Although the Privacy Rule allows certain service providers 
to receive information without entering into confidentiality 
agreements, these confidentiality provisions do not address the range 
of security issues that are contemplated by the Safeguards Rule.
    Other comments sought minor clarifications of the definition of 
service provider. Specifically, commenters asked (1) whether a student 
loan organization is covered where the tasks it performs-passing along 
updated contact information to schools, lenders, loan servicers, and 
others involved in the funding of student loans-could not be carried 
out by financial institutions directly; \44\ and (2) whether 
subservicers, employees and independent contractors of service 
providers are required to maintain separate safeguards.\45\ These 
concerns are addressed as follows: First, although outsourcing often 
involves functions that may be performed in-house, the Commission sees 
no reason to exclude from the Rule service providers that are 
specifically authorized to perform services that a financial 
institution cannot perform itself. Thus, such entities are covered to 
the extent that they meet the definition. Second, the focus of the 
Rule's service provider provisions is clearly on the original service 
provider-the entity that provides services ''directly to a financial 
institution''- and not on subservicers or employees or independent 
contractors of these service providers. Although the original service 
provider should address the practices of these individuals and entities 
in its own security plan, the Rule does not specifically require these 
individual entities to maintain their own safeguards.
---------------------------------------------------------------------------

    \44\ TGSL at 2.
    \45\ Equifax at 4.
---------------------------------------------------------------------------

    For the reasons discussed, the definition of service provider is 
adopted as proposed.

Section 314.3: Standards for Safeguarding Customer Information

    Proposed paragraph (a) of this section set forth the general 
standard that a financial institution must meet to comply with the 
Rule, namely to ''develop, implement, and maintain a comprehensive 
written information security program that contains administrative, 
technical, and physical safeguards'' that are appropriate to the size 
and complexity of the entity, the nature and scope of its activities, 
and the sensitivity of any customer information at issue. This standard 
is highly flexible, consistent with the comments, the Banking Agency 
Guidelines, and the Advisory Committee's Report, which concluded that a 
business should develop ''a program that has a continuous life cycle 
designed to meet the needs of a particular organization or industry.'' 
\46\ See ACR at 18. Paragraph (a) also requires that each information 
security program include the basic elements set forth in proposed 
section 314.4 of the Rule, and be reasonably designed to meet the 
objectives set forth in section 314.3(b). For the reasons discussed 
below, this standard is adopted with only minor changes.
---------------------------------------------------------------------------

    \46\ The adaptability of the standard according to ''the 
sensitivity of information'' mirrors the Advisory Committee's 
finding that ''different types of data warrant different levels of 
protection.'' Id.
---------------------------------------------------------------------------

    As noted above, commenters were generally supportive of the 
proposed standard, citing both its flexibility and its similarity to 
the Banking Agency Guidelines.\47\ In addition, the numerous commenters 
who addressed whether the information security program should be in 
writing were supportive of this requirement,\48\ stating that such a 
requirement is reasonable \49\ and essential to the effective 
implementation and management of safeguards.\50\ At the same time, two 
commenters suggested that the term ''comprehensive'' be deleted to 
avoid implying that the writing itself should be comprehensive.\51\ One 
commenter urged that the Final Rule explicitly state-as was stated in 
the section-by-section analysis of the Proposed Rule \52\-that the 
writing need not be contained in a single document. In response, the 
Commission has amended the standard slightly, so that each financial 
institution must ''develop, implement, and maintain a comprehensive 
information security program that is written in one or more readily 
accessible parts and contains administrative, technical, and physical 
safeguards'' that are appropriate to the size and complexity of the 
entity, the nature and scope of its activities, and the sensitivity of 
any customer information at issue. See paragraph (a). The Commission 
believes that this standard will ensure a comprehensive, coordinated 
approach to security while emphasizing the flexibility of the writing 
requirement.
---------------------------------------------------------------------------

    \47\ See supra nn.15 and 16, and accompanying text.
    \48\ CDIA at 4; Equifax at 5; Intuit at 4; NFCU at 1; NFFG at 1; 
NCHELP at 3; NASAA at 2.
    \49\ See, e.g., NCHELP at 3.
    \50\ See, e.g., Intuit at 4.
    \51\ CDIA at 4; Equifax at 5.
    \52\ 66 FR at 41165.
---------------------------------------------------------------------------

    One commenter requested that the Rule specify that a financial 
institution need not disclose its information security plan to any 
third party other than law enforcers. In response, the Commission notes 
that the Rule itself creates no obligation for a financial institution 
to disclose its information security program. Moreover, the Privacy 
Rule requires a financial institution to disclose to consumers only the 
most general information about its safeguards. See 16 CFR 313.6(a)(8) 
and (c)(6). However, the Safeguards Rule leaves private parties free to 
negotiate disclosure of any safeguards information that may be relevant 
to the business at hand. Further, neither the G-L-B Act nor the Rule 
provides a shield to disclosure that is sought by law enforcement or 
pursuant to court order, subpoena or other legal process.

Section 314.4: Elements

    This section sets forth the general elements that a financial 
institution must include in its information security program. The 
elements create a framework for developing, implementing, and 
maintaining the required safeguards, but leave each financial 
institution discretion to tailor its information security program to 
its own circumstances. Subject to the changes to paragraphs (d) and (e) 
that are set forth below, these elements are adopted as proposed.
1. Paragraph (a)
    Paragraph (a) requires each financial institution to designate an 
employee or employees to coordinate its information security program in 
order to ensure accountability and achieve adequate safeguards. This 
requirement is similar to the Banking Agency Guidelines'

[[Page 36489]]

requirement that each institution involve and report to its Board of 
Directors (see 66 FR 41166, citing Paragraphs III.A. and III.F., 
respectively), but allows designation of any employee or employees to 
better accommodate entities that are not controlled by Boards of 
Directors. Nearly all commenters on this paragraph expressed support, 
noting the importance of establishing a point of contact and citing the 
provision's flexibility.\53\ However, some commenters requested minor 
changes, namely: (1) That the Rule state that a financial institution 
need not designate an employee for each of its subsidiaries; (2) that 
the words ''as appropriate'' be added to the requirement; and (3) that 
the Rule make clear that financial institutions may outsource 
safeguards procedures.\54\ By contrast, one commenter opposed requiring 
financial institutions to designate any individual employee(s), based 
on a concern that customers might attempt to hold such designee(s) 
individually liable for any breach of security that occurs.\55\
---------------------------------------------------------------------------

    \53\ See, e.g., Intuit at 4; Mastercard at 6-7; NACAA at 1-2; 
NCHELP at 3; Sallie Mae at 3; SIIA at 2; Visa at 2.
    \54\ Sallie Mae at 3; Equifax at 6; NRF at 5, respectively.
    \55\ NIADA at 6.
---------------------------------------------------------------------------

    The Commission recognizes the importance of reserving to financial 
institutions the flexibility to select and designate the employee(s) 
that are needed to ensure accountability and achieve adequate 
safeguards. The Commission is particularly concerned that small 
institutions not be burdened disproportionately by this paragraph (or 
by other requirements) of the Rule. For these reasons, the paragraph 
allows each financial institution to determine which employee(s) to 
designate, including whether to designate additional employees to 
handle different subsidiaries. Further, there is nothing in the Rule to 
prevent a financial institution from outsourcing safeguards functions 
as appropriate, provided that at least one of its own employees is 
designated to see that such functions are properly carried out. At the 
same time, the Commission declines to add the words ''as appropriate'' 
to this paragraph because such language would only repeat the Rule's 
overarching requirement that each financial institution develop, 
implement and maintain ''appropriate'' safeguards. Lastly, the 
Commission notes that this Rule does not address or alter traditional 
principles of corporate liability and, therefore, should neither create 
nor limit individual liability for a financial institution's designated 
employee(s). Thus, paragraph (a) is adopted as proposed.
2. Paragraph (b)
    Proposed paragraph (b) required each financial institution to 
''identify reasonably foreseeable internal and external risks to the 
security, confidentiality, and integrity of customer information that 
could result in the unauthorized disclosure, misuse, alteration, 
destruction or other compromise of such information, and assess the 
sufficiency of any safeguards in place to control these risks.'' The 
proposal further required each financial institution to consider risks 
in each area of its operations, including three areas that the 
Commission believes are particularly relevant to information security: 
(1) Employee training and management; (2) information systems, 
including information processing, storage, transmission and disposal; 
and (3) detecting, preventing and responding to attacks, intrusions, or 
other systems failures. This paragraph is similar to the Banking Agency 
Guidelines requirement to assess risks.\56\
    Commenters who addressed the issue generally supported including a 
risk assessment requirement within the Rule.\57\ Some of these 
commenters supported the paragraph as proposed, stating that its 
benefits are appropriate relative to its burdens, and that it provides 
the proper level of guidance on how risk assessment should be carried 
out.\58\ Commenters that supported the paragraph's general description 
of the types of risks to be considered-including the proposed areas of 
operation-emphasized that the threats to information security are ever 
changing, and therefore can only be described in general terms.\59\ By 
contrast, other commenters urged that the paragraph be made more 
specific in a variety of ways, namely by: (1) Defining specific 
categories of threats and hazards, such as ''risks to physical 
security;'' (2) including more concrete and extensive guidance on how 
small businesses might perform the required assessment; or (3) 
including a procedure by which the FTC will conduct reviews or audits 
of the security practices of financial institutions under its 
jurisdiction.\60\
---------------------------------------------------------------------------

    \56\ See Banking Agency Guidelines, Paragraph III. B.
    \57\ See, e.g., Equifax at 7; Intuit at 5; Mastercard at 7; 
NASAA at 2; NCHELP at 3; Portogo at 1; SIAA at 4; VeriSign at 1.
    \58\ See, e.g., Intuit at 5; Mastercard at 7; SIAA at 2.
    \59\ Oracle at 2; Mastercard at 7.
    \60\ NACAA comment on the ANPR, at 2; Paas at 3; Musgrove at 2, 
respectively.
---------------------------------------------------------------------------

    The Commission notes the importance of providing guidance to 
financial institutions, particularly small businesses, on how to comply 
with this and other aspects of the Rule. The Commission therefore 
intends to issue educational materials to help businesses identify 
risks and comply with the various other provisions of the Rule. Because 
of the ever-changing nature of the relevant risks, however, the 
Commission does not find it appropriate to delineate risks more 
specifically within the Rule. In addition, to retain appropriate 
flexibility, the Commission will rely on its discretion in enforcing 
the Rule, and not describe any particular schedule or methods for 
enforcement.\61\ At the same time, the Commission has amended slightly 
the areas of operation, in order to better describe the activities that 
financial institutions should consider in developing, implementing and 
maintaining their information security programs. Specifically, the 
Commission has added (1) the item ''network and software design'' to 
the examples of information systems a financial institution should 
examine; and (2) the term ''detecting'' to the requirement that each 
financial institution consider means of ''preventing and responding'' 
to attacks, intrusions and other systems failures. In all other 
respects, paragraph (b) is adopted as proposed.
---------------------------------------------------------------------------

    \61\ By contrast to the Banking Agencies, the Commission is not 
authorized to conduct regular audits and review of entities under 
its jurisdiction.
---------------------------------------------------------------------------

3. Paragraph (c)
    Proposed paragraph (c) required each financial institution to 
''design and implement information safeguards to control the risks 
[identified] through risk assessment, and regularly test or otherwise 
monitor the effectiveness of the safeguards' key controls, systems, and 
procedures.'' The proposal further required each financial institution 
to consider its areas of operation in fulfilling this requirement. As 
with proposed paragraph (b), above, commenters generally supported this 
provision, citing its flexibility and the appropriateness of its 
benefits relative to its burdens.\62\ However, one commenter

[[Page 36490]]

asked that the provision be revised to require only such safeguards as 
are ''commercially reasonable,'' \63\ while another urged that the 
paragraph require each financial institution to keep specific written 
records of its particular safeguards procedures, such as its employee 
training activities and records retention schedules, to demonstrate 
compliance with the Rule.\64\
---------------------------------------------------------------------------

    \62\ Intuit at 5; NCHELP at 4; SIIA at 2. In addition, as 
elsewhere, commenters urged that the paragraph include more 
guidance, so that businesses-particularly smaller entities, such as 
sole proprietorships-will better understand what safeguards are 
sufficient to comply with the Rule. See NIADA at 7-8; Paas at 4-5. 
As discussed above, the Commission agrees that educating businesses 
and others is critical to achieving the Rule's objectives, and plans 
to issue educational materials in connection with the Rule.
    \63\ Equifax at 8.
    \64\ Musgrove at 2.
---------------------------------------------------------------------------

    The Commission recognizes that each financial institution must 
focus its limited resources on addressing those risks that are most 
relevant to its operations. However, because the Rule already contains 
flexible standards that take a variety of factors into account, the 
Commission does not believe it is necessary or appropriate to revise 
the Rule to require only such safeguards as are ''commercially 
reasonable.'' At the same time, to preserve flexibility and minimize 
burdens, the Commission declines to revise this paragraph to require 
that financial institutions document specific aspects of their risk 
control activities. For these reasons, paragraph (c) is adopted as 
proposed.
4. Paragraph (d)
    Proposed paragraph (d) required each financial institution to 
oversee its service providers by selecting and retaining service 
providers that are ''capable of maintaining appropriate safeguards'' 
for the customer information at issue (paragraph (d)(1)), and requiring 
its service providers by contract to ''implement and maintain such 
safeguards'' (paragraph(d)(2)). For the reasons discussed below, 
paragraph (d)(1) is revised slightly, while paragraph (d)(2) is adopted 
as proposed.
    Commenters supported requiring oversight of service providers' 
safeguards by financial institutions, particularly when, as one 
coalition of financial services organizations noted, the financial 
services industry increasingly relies on third parties to support core 
functions and online delivery.\65\ However, in commenting on proposed 
paragraph (d)(1), some commenters expressed concern about the ability 
of businesses-particularly smaller entities-to evaluate a service 
provider's capabilities.\66\ At the same time, other commenters 
supported adding to the Rule various standards for financial 
institutions to use in selecting service providers, specifically: (1) 
That financial institutions have ''reason to believe'' their service 
providers are capable of maintaining appropriate safeguards; \67\ (2) 
that they use a ''due diligence'' review, as under the Banking Agency 
guidelines; \68\ or (3) that they select service providers that are 
''capable of maintaining appropriate safeguards.'' \69\
---------------------------------------------------------------------------

    \65\ BITS at 1. See also CDIA at 6; ITAA at 3; VeriSign at 2 
(Rule appropriately places on financial institutions the burden to 
select appropriate service providers).
    \66\ Paas at 5. See also NRF at 5 (expressing concern that Rule 
could make financial institutions strictly liable for safeguards 
breaches by their service providers).
    \67\ NRF at 5; TGSL at 2.
    \68\ Household at 1; ICBA at 1; NIADA at 6.
    \69\ Mastercard at 7.
---------------------------------------------------------------------------

    The Commission agrees that businesses cannot be expected to perform 
unlimited evaluation of their service providers' capabilities. Thus, 
the Commission has amended the provision to state that each financial 
institution must ''take reasonable steps'' to select and retain 
appropriate service providers. This added language more closely 
parallels the Banking Agency Guidelines, as well as the Rule's 
requirement to assess risks that are ''reasonably foreseeable.'' The 
steps that are reasonable under the Rule will depend upon the 
circumstances and the relationship between the financial institution 
and the service provider in question. At a minimum, the Commission 
envisions that each financial institution will (1) take reasonable 
steps to assure itself that its current and potential service providers 
maintain sufficient procedures to detect and respond to security 
breaches, and (2) maintain reasonable procedures to discover and 
respond to widely-known security failures by its current and potential 
service providers.
    Proposed paragraph (d)(2) required financial institutions to enter 
into contracts that require service providers to implement and maintain 
appropriate safeguards. Most comments that addressed this requirement 
supported it.\70\ Nevertheless, as discussed above, some commenters 
urged that certain service providers be exempt from the Rule, or be 
permitted to comply with the safeguards standards of another agency, 
such as their own functional regulator in the case of financial 
institution service providers. These comments already have been 
addressed above. In addition, two commenters urged that the Rule give 
examples of appropriate language or specifically require the inclusion 
of certain clauses in the contract,\71\ while other commenters stated 
that no such specifications are needed or desirable.\72\ The Commission 
believes that financial institutions are well positioned to develop and 
implement appropriate contracts with their service providers. Further, 
keeping the contract provision flexible should allow financial 
institutions and their service providers to develop arrangements that 
do not impose undue or conflicting burdens on service providers that 
may be subject to other standards and/or agreements concerning 
safeguards. Therefore, the Commission declines to include specific 
contract language within the Rule. However, the Commission intends to 
provide education for businesses on how to comply with the Rule, and 
will include general guidance concerning oversight of service providers 
as part of this effort. For these reasons, paragraph (d)(2) is adopted 
as proposed.
---------------------------------------------------------------------------

    \70\ Equifax at 8; Indep. Ins. Agents 3; Intuit at 5; Mastercard 
at 7; NACAA at 2; NCHELP at 4; Navy Federal Financial Group at 1-2; 
NIADA at 7; Sallie Mae at 3; SIIA at 2.
    \71\ NADA at 3; Navy Federal Financial Group at 1-2.
    \72\ Intuit at 5; Sallie Mae at 3.
---------------------------------------------------------------------------

5. Paragraph (e)
    Proposed paragraph (e) required each financial institution to 
''evaluate and adjust [its] information security program in light of 
any material changes to [its] business that may affect [its] 
safeguards.'' The preamble to the proposed section offered examples of 
such material changes, namely changes in technology; changes to its 
operations or business arrangements, such as mergers and acquisitions, 
alliances and joint ventures, outsourcing arrangements, or changes to 
the services provided; new or emerging internal or external threats to 
information security; or any other circumstances that give it reason to 
know that its information security program is vulnerable to attack or 
compromise. See 66 FR 41167. Several commenters supported this 
requirement as proposed.\73\ However, a few commenters recommended 
certain revisions to the paragraph's description of the types of 
changes that may warrant evaluation and adjustment of an entity's 
safeguards. Specifically, one commenter urged that although changes in 
the sensitivity of customer information or the nature of any threats 
will warrant evaluation, changes to a business's internal organization 
may be irrelevant to its safeguards, and therefore should not 
necessitate a review.\74\ Similarly, another commenter urged that the 
paragraph be revised to require that a financial institution ''take 
reasonable steps so that the information security

[[Page 36491]]

program continues to be appropriate'' for the financial 
institution.\75\
---------------------------------------------------------------------------

    \73\ NACAA at 2; NCHELP at 5; SIIA at 2.
    \74\ Intuit at 6.
    \75\ Equifax at 9.
---------------------------------------------------------------------------

    Consistent with the intent of the Proposed Rule, as well as the 
concerns reflected in these comments, the Commission believes that the 
bases for a financial institution to adjust its information security 
program will vary depending on the circumstances and may include a wide 
range of factors. Accordingly, paragraph (e) has been amended to more 
clearly reflect the fact-specific nature of the inquiry and to better 
encompass the broad range of factors that a financial institution 
should consider. Under the revised paragraph, each financial 
institution must evaluate and adjust its information security program 
''in light of the results of the testing and monitoring required by 
paragraph (c); any material changes to [its] operations or business 
arrangements; or any other circumstances that you know or have reason 
to know may have a material impact on [its] information security 
program.'' The Commission believes that the Rule allows a financial 
institution sufficient flexibility as to how to adjust its safeguards, 
and therefore finds it unnecessary to limit the responsibility of 
financial institutions to taking ''reasonable steps'' to make any 
adjustments. Thus, paragraph (e) is adopted with the changes noted 
above.

Section 314.5: Effective Date

    Proposed section 314.5 required each financial institution covered 
by the Rule to implement an information security program not later than 
one year from the date on which a Final Rule is issued. In addition, 
the proposal requested comment on whether the Rule should contain a 
transition period to allow the continuation of existing contracts with 
service providers, even if the contracts would not satisfy the Rule's 
requirements.
    Many commenters supported as adequate an effective date of one year 
from the date on which the Final Rule is issued.\76\ A few commenters 
urged that a longer time be given, such as 18 months,\77\ or that an 
additional year be allowed for businesses-particularly small entities-
to comply.\78\ In addition, all commenters who addressed the issue 
urged that the Rule allow a transition period for service provider 
contracts.\79\ Most of these commenters requested that financial 
institutions be given two years to make service provider contracts 
comply,\80\ while a few commenters sought a slightly longer time.\81\
---------------------------------------------------------------------------

    \76\ See, e.g., Equifax at 10; Intuit at 6; Mastercard at 8; 
NIADA at 8; OCUL at 3; Sallie Mae at 3; SIIA at 2; USA Funds at 1-2.
    \77\ NADA at 2-3; NIADA at 8. See also NFFG at 2 (2 years).
    \78\ ACA at 6-7.
    \79\ See, e.g., CDIA at 5; NIADA at 8; OCUL at 3; SIIA at 2; 
TGSL at 2; Visa at 5.
    \80\ See, e.g., Equifax at 10; NRF at 5; NFFG at 2; OCUL at 3.
    \81\ Sallie Mae at 3; Visa at 5.
---------------------------------------------------------------------------

    Consistent with the majority of comments, the Rule will take effect 
one year from the date on which the Final Rule is published in the 
Federal Register, except that there will be a transition rule for 
contracts between financial institutions and nonaffiliated third party 
service providers. Under the transition Rule, set forth in section 
314.5(b) of the Rule, financial institutions will be given an 
additional year to bring these service provider contracts into 
compliance with the Rule, as long as the contract was in place 30 days 
after the date on which the Final Rule is published in the Federal 
Register. The transition rule parallels the two-year grandfathering of 
service contracts that was permitted under both the Privacy Rule and 
the Banking Agency Guidelines. The Commission believes that the 
effective date and transition rule will provide businesses appropriate 
flexibility in complying with the Rule.

Section D. Paperwork Reduction Act

    The Paperwork Reduction Act (''PRA''), 44 U.S.C. Chapter 35, 
requires federal agencies to seek and obtain OMB approval before 
undertaking a collection of information directed to ten or more 
persons. 44 U.S.C. 3502(3)(a)(i). Under the PRA, a rule creates a 
''collection of information'' where ten or more persons are asked to 
report, provide, disclose, or record information'' in response to 
''identical questions.'' See 44 U.S.C. 3502(3)(A). Applying these 
standards, the Rule does not constitute a ''collection of 
information.'' The Rule calls upon affected financial institutions to 
develop or strengthen their information security programs in order to 
provide reasonable safeguards. Under the Rule, each financial 
institution's safeguards will vary according to its size and 
complexity, the nature and scope of its activities, and the sensitivity 
of the information involved. For example, a financial institution with 
numerous employees would develop and implement employee training and 
management procedures beyond those that would be appropriate or 
reasonable for a sole proprietorship, such as an individual tax 
preparer or mortgage broker. Similarly, a financial institution that 
shares customer information with numerous affiliates would need to take 
steps to ensure that such information remains protected, while a 
financial institution with no affiliates would not need to address this 
issue. Thus, although each financial institution must summarize its 
compliance efforts in one or more written documents, the discretionary 
balancing of factors and circumstances that the Rule allows-including 
the myriad operational differences among businesses that it 
contemplated-does not require entities to answer ''identical 
questions,'' and therefore does not trigger the PRA's requirements. See 
''The Paperwork Reduction Act of 1995: Implementing Guidance for OMB 
Review of Agency Information Collection,'' Office of Information and 
Regulatory Affairs, OMB (August 16, 1999), at 20-21.

Section E. Regulatory Flexibility Act

    In its ANPR, the Commission stated its belief that, under the 
Regulatory Flexibility Act (''RFA''), 5 U.S.C. 604(a), it was not 
required to issue an Initial Regulatory Flexibility Analysis (''IRFA'') 
because the Commission did not expect that the Proposed Rule would have 
a significant economic impact on a substantial number of small entities 
within the meaning of the Act. See 66 FR at 41167. The Commission 
nonetheless issued an IRFA with the Proposed Rule in order to inquire 
into the possible impact of the Proposed Rule on small entities, and to 
provide information to small businesses, as well as other businesses, 
on how to implement the Rule. Id.
    Although the Commission specifically sought comment on the costs to 
small entities of complying with the Rule, no commenters provided 
specific cost information. Some commenters generally praised the 
proposal's flexibility \82\ or noted that given its flexible standards, 
it was appropriate for the Rule to apply equally to businesses of all 
sizes.\83\ However, other commenters suggested that small entities may 
be disproportionately burdened by the Rule because they lack expertise 
(relative to larger entities) in developing, implementing and 
maintaining the required safeguards.\84\ In light of these comments, 
the Commission has carefully considered whether to certify that the 
Rule will not have a significant impact on a

[[Page 36492]]

substantial number of small entities. The Commission continues to 
believe that the Rule's impact will not be substantial in the case of 
most small entities. However, the Commission cannot quantify the impact 
the Rule will have on such entities. Therefore, in the interest of 
thoroughness, the Commission has prepared the following Final 
Regulatory Flexibility Analysis (''FRFA'') with this Final Rule. 5 
U.S.C. 605.
---------------------------------------------------------------------------

    \82\ See, e.g., Household at 1; SIIA at 1; TGSL at 1; VeriSign 
at 1.
    \83\ Intuit at 2; NASAA at 2.
    \84\ See, e.g., NADA at 2; NIADA at 9; Musgrove at 2 (stating 
that small financial institutions may need to hire outside 
consultants to comply with Rule).
---------------------------------------------------------------------------

1. Succinct Statement of the Need for, and Objectives of, the Rule

    The Final Rule is necessary in order to implement section 501(b) of 
the G-L-B Act, which requires the FTC to establish standards for 
financial institutions subject to its jurisdiction relating to 
administrative, technical, and physical standards. According to section 
501(b), these standards must: (1) Insure the security and 
confidentiality of customer records and information; (2) protect 
against any anticipated threats or hazards to the security or integrity 
of such records; and (3) protect against unauthorized access to or use 
of such records or information which could result in substantial harm 
or inconvenience to any customer. These objectives have been discussed 
above in the statement of basis and purpose for the Final Rule.

2. Summary of the Significant Issues Raised by the Public Comments in 
Response to the IRFA; Summary of the Assessment of the Agency of Such 
Issues; and Statement of Any Changes Made in the Rule as a Result of 
Such Comments

    As stated above, no comments were received concerning specific 
costs that will be imposed on small entities by the Rule. However, some 
commenters stated that the Rule and/or certain of its requirements 
would impose high costs on businesses, including small entities.\85\ In 
addition, as stated, a few commenters suggested that small entities may 
be disproportionately burdened by the Rule because they lack expertise 
(relative to larger entities) in developing, implementing and 
maintaining the required safeguards.\86\ Finally, as stated above, many 
commenters urged that the Commission provide guidance on how to comply 
with the Rule to assist entities-particularly smaller businesses-to 
comply without incurring undue expense.\87\ In addition, some 
commenters specifically requested guidance on how to assess risks as 
required by section 314.4(b);\88\ develop, implement and maintain 
safeguards as required by section 314.4(c); \89\ and oversee service 
providers as required by section 314.4(d).
---------------------------------------------------------------------------

    \85\ FPA at 3; Paas at 2; see also OCUL (stating that the NCUA's 
safeguards rule is very burdensome for credit unions); Post at 1 
(stating that Privacy Rule is very burdensome).
    \86\ See supra n. 81.
    \87\ See, e.g., ICB at 2; Musgrove at 2; NADA at 2; NIADA at 9; 
Paas at 4-6.
    \88\ Paas at 3.
    \89\ See NIADA at 7; Paas at 4-5.
---------------------------------------------------------------------------

    The Commission took comments respecting the Rule's impact on small 
entities into account by designing flexible safeguards standards 
(section 313.3(a)). Similarly, the Commission took smaller entities 
into account in allowing each financial institution to decide for 
itself what employees to designate to handle safeguards (section 
314.4(a)), in order to give businesses, particularly smaller entities, 
flexibility in complying with the Rule. Lastly, because some commenters 
expressed concern about the ability of businesses-particularly smaller 
entities-to evaluate a service provider's capabilities,\90\ the 
Commission amended the relevant paragraph to state that each financial 
institution must ''take reasonable steps'' to select and retain 
appropriate service providers.
---------------------------------------------------------------------------

    \90\ Paas at 5; see also NRF at 5 (expressing concern that Rule 
could make financial institutions strictly liable for safeguards 
breaches by their service providers).
---------------------------------------------------------------------------

    In addition to the above changes, the Commission has taken into 
account those comments that stated the importance of educating 
businesses and others on how to implement and maintain information 
safeguards. The Commission agrees that such education is critical to 
achieving the Rule's objectives and to minimizing burdens on 
businesses. Thus, as stated in the Rule's preamble, the Commission 
plans to provide educational materials on or near the date on which 
compliance is required. As part of this effort, the Commission intends 
to perform outreach to inform small entities, such as individual tax 
preparers or other sole proprietors, of the Rule and its requirements.
    In addition to the forthcoming educational materials, the 
Commission has given guidance in the Rule and its Preamble that is 
intended to assist businesses, particularly small entities, to comply 
with the Rule. Specifically, as discussed above, the Commission has 
included within the Rule a brief description of those areas of a 
business' operations that the Commission believes are most relevant to 
information security: (1) Employee training and management; (2) 
information systems, including network and software design, as well as 
information processing, storage, transmission and disposal; and (3) 
detecting, preventing and responding to attacks, intrusions, or other 
systems failures. See section 314.3(b).

3. Description and Estimate of the Number of Small Entities to Which 
the Rule Will Apply or an Explanation of Why No Such Estimate Is 
Available

    As previously discussed in the IRFA accompanying the Proposed Rule, 
it is difficult to estimate accurately the number of small entities 
that are financial institutions subject to the Rule. The definition of 
''financial institution,'' as under the Privacy Rule, includes any 
institution the business of which is engaging in a financial activity, 
as described in section 4(k) of the Bank Holding Company Act, which 
incorporates by reference the activities listed in 12 CFR 225.28 and 12 
CFR 211.5(d), consolidated in 12 CFR 225.86. See 65 FR 14433 (Mar. 17, 
2000).
    The G-L-B Act does not specify the categories of financial 
institutions subject to the Commission's jurisdiction; rather, section 
505(a)(5) vests the Commission with enforcement authority with respect 
to ''any other financial institution or other person that is not 
subject to the jurisdiction of any [other] agency or authority [charged 
with enforcing the statute].'' Financial institutions covered by the 
Rule will include many of the same lenders, financial advisors, loan 
brokers and servicers, collection agencies, financial advisors, tax 
preparers, real estate settlement services, and others that are subject 
to the Privacy Rule. Many of these financial institutions will not be 
subject to the Safeguards Rule to the extent that they do not have any 
''customer information'' within the meaning of the Safeguards Rule. The 
Commission did not receive comments that helped it to identify in any 
comprehensive manner the small entities that will be affected by the 
rule. However, one commenter, the National Association of Automobile 
Dealers Association (''NADA'') submitted 1999 data showing that, at 
that time, 5,292 franchised new automobile dealers had 30 or fewer 
employees; 1,706 had 20 or fewer employees; and 575 had 10 or fewer 
employees.\91\ In addition, the Commission is aware that many small 
businesses, such as individual tax preparers or mortgage brokers, will 
be covered by the Rule.
---------------------------------------------------------------------------

    \91\ NADA at 1.

---------------------------------------------------------------------------

[[Page 36493]]

4. Description of the Projected Reporting, Recordkeeping and Other 
Compliance Requirements of the Rule, Including an Estimate of the 
Classes of Small Entities That Will Be Subject to the Requirement and 
the Type of Professional Skills Necessary for Preparation of the Report 
or Record

    As explained in the Commission's IRFA and the Paperwork Reduction 
Act discussion that appears elsewhere in this document, the Safeguards 
Rule does not impose any specific reporting or recordkeeping 
requirements. Accordingly, compliance with the Rule does not entail 
expenditures for particular types of professional skills that might be 
needed for the preparation of such reports or records.
    The Rule, however, requires each covered institution to develop a 
written information security program covering customer information that 
is appropriate to its size and complexity, the nature and scope of its 
activities, and the sensitivity of the customer information at issue. 
The institution must designate an employee or employees to coordinate 
its safeguards; identify reasonably foreseeable risks and assess the 
effectiveness of any existing safeguards for controlling these risks; 
design and implement a safeguards program and regularly monitor its 
effectiveness; require service providers (by contract) to implement 
appropriate safeguards for the customer information at issue; and 
evaluate and adjust its program to material changes that may affect its 
safeguards, such as new or emerging threats to information security. As 
discussed above, these requirements will apply to institutions of all 
sizes that are subject to the FTC's jurisdiction pursuant to the Rule, 
including small entities, although the Commission did not receive 
comments that would enable a reliable estimate of the number of such 
small entities.
    In light of concerns that compliance with these requirements might 
require the use of professional consulting skills that could be costly, 
the Commission, as explained in its IRFA, fashioned the Rule's 
requirements to be as flexible as possible consistent with the purposes 
of the G-L-B Act, so that entities subject to the Rule, including small 
entities, could simplify their information security program to the same 
extent that their overall operations are simplified. Furthermore, the 
Commission invited comments on the costs of establishing and operating 
an information security program for such entities, particularly any 
costs stemming from the proposed requirements to: (1) Regularly test or 
otherwise monitor the effectiveness of the safeguards' key controls, 
systems, and procedures, and (2) develop a comprehensive information 
security program in written form. In response to comments that raised 
concerns that many businesses would not possess the required resources 
or expertise to fulfill the Rule's requirements, the Commission notes 
that the Rule is not intended to require that entities hire outside 
experts or consultants in order to comply. Further, the Commission has 
noted that it intends to provide educational materials that will assist 
such entities in compliance. In addition, in response to concerns that 
the preparation of a written plan could be burdensome, the Commission 
amended this requirement slightly to emphasize the flexibility of the 
writing requirement and make clear that the writing need not be 
contained in a single document.

5. Description of the Steps the Agency Has Taken To Minimize the 
Significant Economic Impact on Small Entities, Consistent with the 
Stated Objectives of Applicable Statutes, Including a Statement of the 
Factual, Policy, and Legal Reasons for Selecting the Alternative 
Adopted in the Final Rule and Why Each of the Other Significant 
Alternatives to the Rule Considered by the Agency That Affect the 
Impact on Small Entities Was Rejected

    The G-L-B Act requires the FTC to issue a rule that establishes 
standards for safeguarding customer information. The G-L-B Act requires 
that standards be developed for institutions of all sizes. Therefore, 
the Rule applies equally to entities with assets of $100 million or 
less, and not just to larger entities.
    As previously noted, the Commission does not believe the Safeguards 
Rule imposes a significant economic impact on a substantial number of 
small entities. Nonetheless, to the extent that small entities are 
subject to the Rule, it imposes flexible standards that allow each 
institution to develop an information security program that is 
appropriate to its size and the nature of its operations. In this way, 
the impact of the Rule on small entities and any other entities subject 
to the Rule is no greater than necessary to effectuate the purposes and 
objectives of the G-L-B Act, which requires that the Commission adopt a 
rule specifying procedures sufficient to safeguard the privacy of 
customer information protected under the Act. To the extent that 
commenters suggested alternative regulatory approaches-such as that 
compliance with alternative standards be deemed compliance with the 
Rule-that could affect the Rule's impact on small entities, those 
comments and the Commission's responses are discussed above in the 
statement of basis and purpose for the Final Rule.

List of Subjects for 16 CFR Part 314

    Consumer protection, Credit, Data protection, Privacy, Trade 
practices.

Final Rule

    For the reasons set forth in the preamble, the Federal Trade 
Commission amends 16 CFR chapter I, subchapter C, by adding a new part 
314 to read as follows:

PART 314-STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION

Sec.
314.1  Purpose and scope.
314.2  Definitions.
314.3  Standards for safeguarding customer information.
314.4  Elements.
314.5  Effective date.

    Authority: 15 U.S.C. 6801(b), 6805(b)(2).


 314.1  Purpose and scope.

    (a) Purpose. This part, which implements sections 501 and 505(b)(2) 
of the Gramm-Leach-Bliley Act, sets forth standards for developing, 
implementing, and maintaining reasonable administrative, technical, and 
physical safeguards to protect the security, confidentiality, and 
integrity of customer information.
    (b) Scope. This part applies to the handling of customer 
information by all financial institutions over which the Federal Trade 
Commission (''FTC'' or ''Commission'') has jurisdiction. This part 
refers to such entities as ''you.'' This part applies to all customer 
information in your possession, regardless of whether such information 
pertains to individuals with whom you have a customer relationship, or 
pertains to the customers of other financial institutions that have 
provided such information to you.


 314.2  Definitions.

    (a) In general. Except as modified by this part or unless the 
context otherwise requires, the terms used in this part have the same 
meaning as set forth in the Commission's rule governing the Privacy of 
Consumer Financial Information, 16 CFR part 313.
    (b) Customer information means any record containing nonpublic 
personal information as defined in 16 CFR 313.3(n), about a customer of 
a financial institution, whether in paper, electronic, or other form, 
that is handled or maintained by or on behalf of you or your 
affiliates.

[[Page 36494]]

    (c) Information security program means the administrative, 
technical, or physical safeguards you use to access, collect, 
distribute, process, protect, store, use, transmit, dispose of, or 
otherwise handle customer information.
    (d) Service provider means any person or entity that receives, 
maintains, processes, or otherwise is permitted access to customer 
information through its provision of services directly to a financial 
institution that is subject to this part.


 314.3  Standards for safeguarding customer information.

    (a) Information security program. You shall develop, implement, and 
maintain a comprehensive information security program that is written 
in one or more readily accessible parts and contains administrative, 
technical, and physical safeguards that are appropriate to your size 
and complexity, the nature and scope of your activities, and the 
sensitivity of any customer information at issue. Such safeguards shall 
include the elements set forth in  314.4 and shall be 
reasonably designed to achieve the objectives of this part, as set 
forth in paragraph (b) of this section.
    (b) Objectives. The objectives of section 501(b) of the Act, and of 
this part, are to:
    (1) Insure the security and confidentiality of customer 
information;
    (2) Protect against any anticipated threats or hazards to the 
security or integrity of such information; and
    (3) Protect against unauthorized access to or use of such 
information that could result in substantial harm or inconvenience to 
any customer.


 314.4  Elements.

    In order to develop, implement, and maintain your information 
security program, you shall:
    (a) Designate an employee or employees to coordinate your 
information security program.
    (b) Identify reasonably foreseeable internal and external risks to 
the security, confidentiality, and integrity of customer information 
that could result in the unauthorized disclosure, misuse, alteration, 
destruction or other compromise of such information, and assess the 
sufficiency of any safeguards in place to control these risks. At a 
minimum, such a risk assessment should include consideration of risks 
in each relevant area of your operations, including:
    (1) Employee training and management;
    (2) Information systems, including network and software design, as 
well as information processing, storage, transmission and disposal; and
    (3) Detecting, preventing and responding to attacks, intrusions, or 
other systems failures.
    (c) Design and implement information safeguards to control the 
risks you identify through risk assessment, and regularly test or 
otherwise monitor the effectiveness of the safeguards' key controls, 
systems, and procedures.
    (d) Oversee service providers, by:
    (1) Taking reasonable steps to select and retain service providers 
that are capable of maintaining appropriate safeguards for the customer 
information at issue; and
    (2) Requiring your service providers by contract to implement and 
maintain such safeguards.
    (e) Evaluate and adjust your information security program in light 
of the results of the testing and monitoring required by paragraph (c) 
of this section; any material changes to your operations or business 
arrangements; or any other circumstances that you know or have reason 
to know may have a material impact on your information security 
program.


 314.5  Effective date.

    (a) Each financial institution subject to the Commission's 
jurisdiction must implement an information security program pursuant to 
this part no later than May 23, 2003.
    (b) Two-year grandfathering of service contracts. Until May 24, 
2004, a contract you have entered into with a nonaffiliated third party 
to perform services for you or functions on your behalf satisfies the 
provisions of  314.4(d), even if the contract does not include 
a requirement that the service provider maintain appropriate 
safeguards, as long as you entered into the contract not later than 
June 24, 2002.

    By direction of the Commission.

Donald S. Clark,
Secretary.
[FR Doc. 02-12952 Filed 5-22-02; 8:45 am]
BILLING CODE 6750-01-P