FTC Adopts Data Breach Notification Obligations For Non-Banking Financial Institutions

On October 27, 2023, the Federal Trade Commission ("FTC") adopted an amendment to the FTC's Safeguards Rule that will require non-banking financial institutions to notify the FTC within thirty days of discovering a data breach involving the nonpublic personal information of at least 500 consumers. The amendment takes effect 180 days after publication in the Federal Register, which suggests an effective date in mid-2024.

Regulatory Context

The Gramm-Leach-Bliley Act ("GLBA") imposes certain privacy and data security obligations on covered "financial institutions."¹ Under the GLBA, financial institutions are broadly defined to include any institutions engaging in activities that are financial in nature or incidental to such financial activity.² For banking (typically depository) financial institutions, the GLBA provides enforcement authority to the federal banking regulators (the Federal Deposit Insurance Corporation, Federal Reserve, Office of the Comptroller of