Effective Date Set For New FTC Financial Data Security Requirements

An FTC final rule to strengthen data security measures to further protect consumer financial data goes into effect on January 10, 2022. Certain provisions are extended until December 9, 2022 to allow financial institutions more time to modify their information security programs to comply with the new requirements. The final rule was published in the Federal Register.

The FTC final rule amends the agency's Standards for Safeguarding Customer Information. As previously covered, the amendments include:

• imposing additional requirements for an information security program, including access controls, encryption, and authentication protocols; and
• increasing the potential for individual liability for breaches at financial institutions by (i) designating a single individual chief information security officer responsible for the security program and (ii) requiring periodic reports by that individual to the firm's directors.