FTC Amends Safeguards Rule To Add A Breach Notification Requirement

The Federal Trade Commission (FTC) has approved an amendment to the Safeguards Rule that would require nonbanking financial institutions to report any notification events to the agency. A notification event is defined as the unauthorized acquisition of unencrypted customer information involving at least 500 customers. The notice must be provided as soon as possible, and no later than 30 days after discovery. The notice must be made electronically on a form to be posted on the FTC's website. The breach notification requirement becomes effective 180 days after publication of the rule in the Federal Register.

The notice to the FTC must include the following information:

• Name and contact information of the reporting financial institution.