FTC Amends GLBA Safeguards Rule To Require Reporting Of Certain Data Breaches

On October 27th, the Federal Trade Commission (the "FTC") announcedthat it approvedan amendment to the Safeguards Rule promulgated under the federal Gramm-Leach-Bliley Act (the "Safeguards Rule") requiring non-bank financial institutions subject to the FTC's jurisdiction to report to the FTC data breaches affecting 500 or more people (the "Amendment").

The Safeguards Rule requires non-bank financial institutions, such as mortgage brokers, motor vehicle dealers, and payday lenders, to develop, implement, and maintain a comprehensive security program to keep customer information safe. In the process of adopting certain amendments to the Safeguards Rule in October 2021, the FTC also sought comment on a proposed supplemental amendment to the Safeguards Rule that would require financial institutions to report certain data breaches and other security events to the FTC. The Amendment is the final version of the 2021 proposed supplemental amendment.