FTC Adds New Data Breach Reporting Obligations Under Safeguards Rule

On October 27, 2023, the Federal Trade Commission (FTC) unanimously approved an amendment to the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule to require certain covered financial institutions to report a broad range of data breaches and other unauthorized data disclosures to the FTC. With a broader scope than existing obligations, quick timelines, and potentially public notices, the new rule ushers in a significant change for covered financial institutions' notification obligations.

Under the new rule, certain non-banking financial institutions, such as mortgage brokers, motor vehicle dealers, and payday lenders, must now notify the FTC of any "notification event" impacting 500 or more customers. A "notification event" is broadly defined to mean "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains." The definition makes clear that unauthorized access will be presumed to include unauthorized