On March 15, 2023, the SEC proposed amendments to Regulation S-P that aim to enhance the protection of customer information. The proposed amendments would require broker-dealers, investment companies, registered investment advisers, and transfer agents to provide notice to individuals affected by certain types of data breaches that may put them at risk of identity theft or other harm.
Currently, Regulation S-P requires covered firms to adopt written policies and procedures for the protection of customer records and information, as well as the proper disposal of consumer report information. However, there is no requirement for covered firms to notify customers about data breaches. Under the proposed amendments, covered firms would be required to notify customers of breaches that might put their personal financial data at risk.
The proposed amendments would also require covered institutions to adopt written policies and procedures for an incident response program to address unauthorized access to or use of customer information. Covered institutions would be required to provide notice to individuals whose sensitive customer information was or is reasonably likely to have been accessed or used without authorization, with certain limited exceptions. The notice must be provided as soon as practicable, but not later than 30 days after the covered institution becomes aware of the incident.
The proposed amendments would also broaden and align the scope of the safeguards rule and disposal rule to cover “customer information,” extend the safeguards rule to transfer agents registered with the Commission or another appropriate regulatory agency and expand the existing scope of the disposal rule to include transfer agents registered with another appropriate regulatory agency.
The proposing release will be published in the Federal Register, and the public comment period will remain open until 60 days after the date of publication. SEC Chair Gary Gensler believes that the proposed amendments if adopted would help customers maintain their privacy and protect themselves.
Have a securities law question? Call New York Securities Lawyers at 212-509-6544.
