Breach Notification Requirements Proposed For Banks

In 2005, the Federal Financial Institutions Examination Council (FFIEC) member agencies issued interpretive guidance recommending that financial institutions develop and implement programs designed to address incidents of unauthorized access to sensitive customer information. (See FIL-27-2005). For purposes of this guidance, "sensitive customer information" includes a customer's name, address, or telephone number in conjunction with a Social Security number, driver's license number, account number, credit or debit card number, or a personal identification number or password that would permit access to the customer's account. It also includes any combination of components of customer information that would allow someone to log on to or access the customer's account, such as username and password or password and account number.