Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, 15736-15754 [05-5980]

Agencies

• FEDERAL DEPOSIT INSURANCE CORPORATION
• FEDERAL RESERVE SYSTEM
• Office of the Comptroller of the Currency
• DEPARTMENT OF THE TREASURY
• Office of Thrift Supervision
• Comptroller of the Currency

[Federal Register Volume 70, Number 59 (Tuesday, March 29, 2005)]
[Rules and Regulations]
[Pages 15736-15754]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-5980]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

Office of the Comptroller of the Currency

12 CFR Part 30

[Docket No. 05-07]
RIN 1557-AC92

FEDERAL RESERVE SYSTEM

12 CFR Parts 208 and 225

[Docket No. OP-1155]

FEDERAL DEPOSIT INSURANCE CORPORATION

12 CFR Part 364

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Parts 568 and 570

[No. 2005-11]
RIN 1550-AB97


Interagency Guidance on Response Programs for Unauthorized Access 
to Customer Information and Customer Notice

AGENCIES: Office of the Comptroller of the Currency, Treasury (OCC); 
Board of Governors of the Federal Reserve System (Board); Federal 
Deposit Insurance Corporation (FDIC); Office of Thrift Supervision, 
Treasury (OTS).

ACTION: Interpretive guidance and OTS final rule.

-----------------------------------------------------------------------

SUMMARY: The OCC, Board, FDIC, and OTS (the Agencies) are publishing an 
interpretation of the Gramm-Leach-Bliley Act (GLBA) and the Interagency 
Guidelines Establishing Information Security Standards (Security 
Guidelines).\1\ This interpretive guidance, titled ``Interagency 
Guidance on Response Programs for Unauthorized Access to Customer 
Information and Customer Notice'' (final Guidance), is being published 
as a supplement to the Security Guidelines in the Code of Federal 
Regulations in order to make the interpretation more accessible to 
financial institutions and to the general public. The final Guidance 
will clarify the responsibilities of financial institutions under 
applicable Federal law. OTS is also making a conforming, technical 
change to its Security Procedures Rule.
---------------------------------------------------------------------------

    \1\ This document renames the ``Interagency Guidelines 
Establishing Standards for Safeguarding Customer Information'' as 
the ``Interagency Guidelines Establishing Information Security 
Standards.'' Therefore, all other references in the Agencies' 
regulations to the former title of the Security Guidelines shall be 
read to refer to the new title.

---------------------------------------------------------------------------
DATES: Effective March 29, 2005.

FOR FURTHER INFORMATION CONTACT: OCC: Aida Plaza Carter, Director, Bank 
Information Technology, (202) 874-4740; Amy Friend, Assistant Chief 
Counsel, (202) 874-5200; or Deborah Katz, Senior Counsel, Legislative 
and Regulatory Activities Division, (202) 874-5090, at 250 E Street, 
SW., Washington, DC 20219.
    Board: Donna L. Parker, Supervisory Financial Analyst, Division of 
Banking Supervision & Regulation, (202) 452-2614; or Joshua H. Kaplan, 
Attorney, Legal Division, (202) 452-2249, at 20th and C Streets, NW., 
Washington, DC 20551.
    FDIC: Jeffrey M. Kopchik, Senior Policy Analyst, Division of 
Supervision and Consumer Protection, (202) 898-3872; Kathryn M. 
Weatherby, Examiner Specialist, Division of Supervision and Consumer 
Protection, (202) 898-6793; or Robert A. Patrick, Counsel, Legal 
Division, (202) 898-3757, at 550 17th Street, NW., Washington, DC 
20429.
    OTS: Lewis C. Angel, Program Manager, (202) 906-5645; Glenn Gimble, 
Senior Project Manager, Consumer Protection and Specialized Programs, 
(202) 906-7158; or Richard Bennett, Counsel, Regulations and 
Legislation Division, (202) 906-7409, at 1700 G Street, NW., 
Washington, DC 20552.

SUPPLEMENTARY INFORMATION: The contents of this preamble are listed in 
the following outline:

I. Introduction
II. Overview of Comments Received
III. Overview of Final Guidance
IV. Section-by-Section Analysis of the Comments Received
    A. The ``Background'' Section
    B. The ``Response Program'' Section
    C. The ``Customer Notice'' Section
V. Effective Date
VI. OTS Conforming and Technical Change
VII. Impact of Guidance
VIII. Regulatory Analysis
    A. Paperwork Reduction Act
    B. Regulatory Flexibility Act
    C. Executive Order 12866
    D. Unfunded Mandates Reform Act of 1995

I. Introduction

    The Agencies are jointly issuing final Guidance that interprets the 
requirements of section 501(b) of the GLBA, 15 U.S.C. 6801, and the 
Security Guidelines \2\ to include the development

[[Page 15737]]

and implementation of a response program to address unauthorized access 
to, or use of customer information that could result in substantial 
harm or inconvenience to a customer. The Guidance describes the 
appropriate elements of a financial institution's response program, 
including customer notification procedures.
---------------------------------------------------------------------------

    \2\ 12 CFR part 30, app. B (OCC); 12 CFR part 208, app. D-2, and 
part 225, app. F (Board); 12 CFR part 364, app. B (FDIC); and 12 CFR 
part 570, app. B (OTS). In this Guidance, citations to the Agencies' 
Security Guidelines refer only to the appropriate paragraph number, 
as these numbers are common to each of the Guidelines.
---------------------------------------------------------------------------

    Section 501(b) required the Agencies to establish standards for 
financial institutions relating to administrative, technical, and 
physical safeguards to: (1) Ensure the security and confidentiality of 
customer information; (2) protect against any anticipated threats or 
hazards to the security or integrity of such information; and (3) 
protect against unauthorized access to or use of such information that 
could result in substantial harm or inconvenience to any customer.
    On February 1, 2001, the Agencies issued the Security Guidelines as 
required by section 501(b) (66 FR 8616). Among other things, the 
Security Guidelines direct financial institutions to: (1) Identify 
reasonably foreseeable internal and external threats that could result 
in unauthorized disclosure, misuse, alteration, or destruction of 
customer information or customer information systems; (2) assess the 
likelihood and potential damage of these threats, taking into 
consideration the sensitivity of customer information; and (3) assess 
the sufficiency of policies, procedures, customer information systems, 
and other arrangements in place to control risks.\3\
---------------------------------------------------------------------------

    \3\ Security Guidelines, III.B.2.
---------------------------------------------------------------------------

    To address the need for additional interpretive guidance regarding 
section 501(b) and the Security Guidelines, on August 12, 2003, the 
Agencies published proposed Interagency Guidance on Response Programs 
for Unauthorized Access to Customer Information and Customer Notice 
(proposed Guidance) in the Federal Register (68 FR 47954). This 
proposed Guidance made clear that the Agencies expect a financial 
institution's information security program, required under the Security 
Guidelines, to include a response program.
    The Agencies were interested in the public's views on the proposed 
Guidance and accordingly published it for comment.\4\ The Agencies have 
used these comments to assess the impact of the proposed Guidance, and 
to address the requirements of the Paperwork Reduction Act of 1995 (44 
U.S.C. 3501 et seq.).
---------------------------------------------------------------------------

    \4\ Under the Administrative Procedure Act (APA), an agency may 
dispense with public notice and an opportunity to comment for 
general statements of policy. 5 U.S.C. 553(b)(A). Therefore, notice 
and comment were not required under the APA for this final Guidance. 
OTS has concluded that notice and comment were also not required 
under the APA for its conforming and technical change as discussed 
in part VI of this SUPPLEMENTARY INFORMATION.
---------------------------------------------------------------------------

II. Overview of Comments Received

    The Agencies invited comment on all aspects of the proposed 
Guidance and collectively received 65 comments on the proposed 
Guidance. In some instances, several commenters joined in filing a 
single comment. The commenters included 10 bank holding companies, 
eight financial institution trade associations, 25 financial 
institutions (including three Federal Reserve Banks), five consumer 
groups, three payment systems, three software companies, three non-
financial institution business associations, three service providers, 
two credit unions, a member of Congress, a state office, a compliance 
officer, a security and risk consultant, a trademark protection 
service, and a trade association representing consumer reporting 
agencies.
    Commenters generally agreed that financial institutions should have 
response programs. Indeed, many financial institutions said that they 
have such programs in place. Comments from consumer groups and the 
Congressman commended the Agencies for providing guidance on response 
programs and customer notification. However, most industry commenters 
thought that the proposed Guidance was too prescriptive. These 
commenters stated that the proposed approach would stifle innovation 
and retard the effective evolution of response programs. Industry 
commenters raised concerns that the proposed Guidance would not permit 
a financial institution to assess different situations from its own 
business perspective, specific to its size, operational and system 
structure, and risk tolerances. These industry commenters suggested 
modifying the proposed Guidance to give financial institutions greater 
discretion to determine how to respond to incidents of unauthorized 
access to or use of customer information.
    Two commenters also requested that the Agencies include a 
transition period allowing adequate time for financial institutions to 
implement the final Guidance. Some commenters asked for a transition 
period only for the aspects of the final Guidance that address service 
provider arrangements.

III. Overview of Final Guidance

    The final Guidance states that every financial institution should 
develop and implement a response program designed to address incidents 
of unauthorized access to customer information maintained by the 
institution or its service provider. The final Guidance provides each 
financial institution with greater flexibility to design a risk-based 
response program tailored to the size, complexity and nature of its 
operations.
    The final Guidance continues to highlight customer notice as a key 
feature of an institution's response program. However, in response to 
the comments received, the final Guidance modifies the standard 
describing when notice should be given and provides for a delay at the 
request of law enforcement. It also modifies which customers should be 
given notice, what a notice should contain, and how it should be 
delivered.
    A more detailed discussion of the final Guidance and the manner in 
which it incorporates comments the Agencies received follows.

IV. Section-by-Section Analysis of the Comments Received

A. The ``Background'' Section

Legal Authority
    Section I of the proposed Guidance described the legal authority 
for the Agencies' position that every financial institution should have 
a response program that includes measures to protect customer 
information maintained by the institution or its service providers. The 
proposed Guidance also stated that the Agencies expect customer 
notification to be a component of the response program.
    One commenter questioned the Agencies' legal authority to issue the 
proposed Guidance. This commenter asserted that section 501(b) only 
authorizes the Agencies to establish standards requiring financial 
institutions to safeguard the confidentiality and integrity of customer 
information and to protect that information from unauthorized access, 
but does not authorize standards that would require a response to 
incidents where the security of customer information actually has been 
breached.
    The final Guidance interprets those provisions of the Security 
Guidelines issued under the authority of section 501(b)(3) of the GLBA, 
which states specifically that the standards to be established by the 
Agencies must include various safeguards to protect against not only 
``unauthorized access to,'' but also the ``use of,'' customer

[[Page 15738]]

information that could result in ``substantial harm or inconvenience to 
any customer.'' This language authorizes standards that include 
response programs to address incidents of unauthorized access to 
customer information. A response program is the principal means for a 
financial institution to protect against unauthorized ``use'' of 
customer information that could lead to ``substantial harm or 
inconvenience'' to the institution's customer. For example, customer 
notification is an important tool that enables a customer to take steps 
to prevent identity theft, such as by arranging to have a fraud alert 
placed in his or her credit file. Accordingly, when evaluating the 
adequacy of an institution's information security program required by 
the Security Guidelines, the Agencies will consider whether the 
institution has developed and implemented a response program as 
described in the final Guidance.
Scope of Guidance
    In a number of places throughout the proposed Guidance, the 
Agencies referenced definitions in the Security Guidelines. However, 
the Agencies did not specifically address the scope of the proposed 
Guidance. Commenters had questions and suggestions regarding the scope 
of the proposed Guidance and the meaning of terms used.
Entities and Information Covered
    Some commenters had questions about the entities and information 
covered by the proposed Guidance. One commenter suggested that the 
Agencies clarify that foreign offices, branches, and affiliates of 
United States banks are not subject to the final Guidance. Some 
commenters recommended that the Agencies clarify that the final 
Guidance applies only to unauthorized access to sensitive information 
within the control of the financial institution. One commenter thought 
that the final Guidance should be broad and cover frauds committed 
against bank customers through the Internet, such as through the misuse 
of online corporate identities to defraud online banking customers 
through fake web sites (commonly known as ``phishing''). Several 
commenters requested confirmation in the final Guidance that it applies 
to consumer accounts and not to business and other commercial accounts.
    For greater clarity, the Agencies have revised the Background 
section of the final Guidance to state that the scope and definitions 
of terms used in the Guidance are identical to those in section 501(b) 
of the GLBA and the Security Guidelines which largely cross-reference 
definitions used in the Agencies' Privacy Rules.\5\ Therefore, 
consistent with section 501(b) and the Security Guidelines, this final 
Guidance applies to the entities enumerated in section 505(a) of the 
GLBA.\6\ This final Guidance does not apply to a financial 
institution's foreign offices, branches, or affiliates. However, a 
financial institution subject to the Security Guidelines is responsible 
for the security of its customer information, whether the information 
is maintained within or outside of the United States, such as by a 
service provider located outside of the United States.
---------------------------------------------------------------------------

    \5\ 12 CFR part 40 (OCC); 12 CFR part 216 (Board); 12 CFR part 
332 (FDIC); and 12 CFR part 573 (OTS). In this final Guidance, 
citations to the Agencies' Privacy Rules refer only to the 
appropriate section number that is common to each of these rules.
    \6\ National banks, Federal branches and Federal agencies of 
foreign banks and any subsidiaries of these entities (except 
brokers, dealers, persons providing insurance, investment companies, 
and investment advisers) (OCC); member banks (other than national 
banks), branches and agencies of foreign banks (other than Federal 
branches, Federal agencies, and insured State branches of foreign 
banks), commercial lending companies owned or controlled by foreign 
banks, Edge and Agreement Act Corporations, bank holding companies 
and their nonbank subsidiaries or affiliates (except brokers, 
dealers, persons providing insurance, investment companies, and 
investment advisers) (Board); state non-member banks, insured State 
branches of foreign banks, and any subsidiaries of such entities 
(except brokers, dealers, persons providing insurance, investment 
companies, and investment advisers) (FDIC); and insured savings 
associations and any subsidiaries of such savings associations 
(except brokers, dealers, persons providing insurance, investment 
companies, and investment advisers) (OTS).
---------------------------------------------------------------------------

    This final Guidance also applies to ``customer information,'' 
meaning any record containing ``nonpublic personal information'' (as 
that term is defined in Sec.  ----.3(n) of the Agencies' Privacy Rules) 
about a financial institution's customer, whether in paper, electronic, 
or other form, that is maintained by or on behalf of the 
institution.\7\ Consequently, the final Guidance applies only to 
information that is within the control of the institution and its 
service providers, and would not apply to information directly 
disclosed by a customer to a third party, for example, through a 
fraudulent Web site.
---------------------------------------------------------------------------

    \7\ See Security Guidelines, I.C.2.c.
---------------------------------------------------------------------------

    Moreover, this final Guidance does not apply to information 
involving business or commercial accounts. Instead, the final Guidance 
applies to nonpublic personal information about a ``customer'' within 
the meaning of the Security Guidelines, namely, a consumer who obtains 
a financial product or service from a financial institution to be used 
primarily for personal, family, or household purposes, and who has a 
continuing relationship with the institution.\8\
---------------------------------------------------------------------------

    \8\ See Security Guidelines, I.C.2.b.; Privacy Rules, Sec.  --
--.3(h).
---------------------------------------------------------------------------

Effect of Other Laws
    Several commenters requested that the Agencies explain how the 
final Guidance interacts with additional and possibly conflicting state 
law requirements. Most of these commenters urged that the final 
Guidance expressly preempt state law. By contrast, one commenter asked 
the Agencies to clarify that a financial institution must also comply 
with additional state law requirements. In addition, some commenters 
asked that the final Guidance provide a safe harbor defense against 
class action suits. They suggested that the safe harbor should cover 
any financial institution that takes reasonable steps that regulators 
require to protect customer information, but, nonetheless, experiences 
an event beyond its control that leads to the disclosure of customer 
information.
    These issues do not fall within the scope of this final Guidance. 
The extent to which section 501(b) of the GLBA, the Security 
Guidelines, and any related Agency interpretations, such as this final 
Guidance, preempt state law is governed by Federal law, including the 
procedures set forth in section 507 of GLBA, 15 U.S.C. 6807.\9\ 
Moreover, there is nothing in Title V of the GLBA that authorizes the 
Agencies to provide institutions with a safe harbor defense. Therefore, 
the final Guidance does not address these issues.
---------------------------------------------------------------------------

    \9\ Section 507 provides that state laws that are 
``inconsistent'' with the provisions of Title V, Subtitle A of the 
GLBA are preempted ``only to the extent of the inconsistency.'' 
State laws are ``not inconsistent'' if they offer greater protection 
than Subtitle A, as determined by the Federal Trade Commission, 
after consultation with the agency or authority with jurisdiction 
under section 505(a) of either the person that initiated the 
complaint or that is the subject of the complaint. See 15 U.S.C. 
6807.
---------------------------------------------------------------------------

Organizational Changes in the ``Background'' Section
    For the reasons described earlier, the Background section is 
adopted essentially as proposed, except that the latter part of the 
paragraph on ``Service Providers'' and the entire paragraph on 
``Response Programs'' are incorporated into the introductory discussion 
of section II. The Agencies believe that the Background section is now 
clearer, as it focuses solely on the statutory and regulatory framework 
upon which the final Guidance is based. Comments and changes with 
respect to the paragraphs that were relocated are discussed in the next 
section.

[[Page 15739]]

B. The ``Response Program'' Section

    The Security Guidelines enumerate a number of security measures 
that each financial institution must consider and adopt, if 
appropriate, to control risks stemming from reasonably foreseeable 
internal and external threats to an institution's customer 
information.\10\ The introductory paragraph of section II of the final 
Guidance specifically states that a financial institution should 
implement those security measures designed to prevent unauthorized 
access to or use of customer information, such as by placing access 
controls on customer information systems and conducting background 
checks for employees \11\ who are authorized to access customer 
information. The introductory paragraph also states that every 
financial institution should develop and implement security measures 
designed to address incidents of unauthorized access to customer 
information that occur despite measures to prevent security breaches.
---------------------------------------------------------------------------

    \10\ Security Guidelines, III.B. and III.C.
    \11\ A footnote has been added to this section to make clear 
that institutions should also conduct background checks of employees 
to ensure that the institution does not violate 12 U.S.C. 1829, 
which prohibits an institution from hiring an individual convicted 
of certain criminal offenses or who is subject to a prohibition 
order under 12 U.S.C. 1818(e)(6).
---------------------------------------------------------------------------

    The measures enumerated in the Security Guidelines include 
``response programs that specify actions to be taken when the bank 
suspects or detects that unauthorized individuals have gained access to 
customer information systems, including appropriate reports to 
regulatory and law enforcement agencies.''\12\ Prompt action by both 
the institution and the customer following the unauthorized access to 
customer information is crucial to limit identity theft. As a result, 
every financial institution should develop and implement a response 
program appropriate to the size and complexity of the institution and 
the nature and scope of its activities, designed to address incidents 
of unauthorized access to customer information.
---------------------------------------------------------------------------

    \12\ Security Guidelines, III.C.1.g.
---------------------------------------------------------------------------

    The introductory language in section II of the final Guidance 
states that a response program should be a key part of an institution's 
information security program. It also emphasizes that a financial 
institution's response program should be risk-based and describes the 
components of a response program in a less prescriptive manner.
Service Provider Contracts
    The Background section of the proposed Guidance elaborated on the 
specific provisions that a financial institution's contracts with its 
service providers should contain. The proposed Guidance stated that a 
financial institution's contract with its service provider should 
require the service provider to disclose fully to the institution 
information related to any breach in security resulting in an 
unauthorized intrusion into the institution's customer information 
systems maintained by the service provider. It stated that this 
disclosure would permit an institution to expeditiously implement its 
response program.
    Several commenters on the proposed Guidance agreed that a financial 
institution's contracts with its service providers should require the 
service provider to disclose fully to the institution information 
related to any breach in security resulting in an unauthorized 
intrusion into the institution's customer information systems 
maintained by the service provider. However, many commenters suggested 
modifications to this section.
    The discussion of this aspect of a financial institution's 
contracts with its service providers is in section II of the final 
Guidance. It has been revised as follows in response to the comments 
received.
Timing of Service Provider Notification
    The Agencies received a number of comments regarding the timing of 
a service provider's notice to a financial institution. One commenter 
suggested requiring service providers to report incidents of 
unauthorized access to financial institutions within 24 hours after 
discovery of the incident.
    In response to comments on the timing of a service provider's 
notice to a financial institution, the final Guidance adds that a 
financial institution's contract with its service provider should 
require the service provider to take appropriate action to address 
incidents of unauthorized access to the institution's customer 
information, including by notifying the institution as soon as possible 
of any such incident, to enable the institution to expeditiously 
implement its response program. The Agencies determined that requiring 
notice within 24 hours of an incident may not be practicable or 
appropriate in every situation, particularly where, for example, it 
takes a service provider time to investigate a breach in security. 
Therefore, the final Guidance does not specify a number of hours or 
days by which the service provider must give notice to the financial 
institution.
Existing Contracts With Service Providers
    Some commenters expressed concerns that they would have to rewrite 
their contracts with service providers to require the disclosure 
described in this provision. These commenters asked the Agencies to 
grandfather existing contracts and to apply this provision only 
prospectively to new contracts. Many commenters also suggested that the 
final Guidance contain a transition period to permit financial 
institutions to modify their existing contracts.
    The Agencies have decided not to grandfather existing contracts or 
to add a transition period to the final Guidance because, as stated in 
the proposed Guidance, this disclosure provision is consistent with the 
obligations in the Security Guidelines that relate to service provider 
arrangements and with existing guidance on this topic previously issued 
by the Agencies.\13\ In order to ensure the safeguarding of customer 
information, financial institutions that use service providers likely 
have already arranged to receive notification from the service 
providers when customer information is accessed in an unauthorized 
manner. In light of the comments received, however, the Agencies 
recognize that there are institutions that have not formally included 
such a disclosure requirement in their contracts. Where this is the 
case, the institution should exercise its best efforts to add a 
disclosure requirement to its contracts and any new contracts should 
include such a provision.
---------------------------------------------------------------------------

    \13\ See FFIEC Information Technology Examination Handbook, 
Outsourcing Technology Services Booklet, Jun. 2004; Federal Reserve 
SR Ltr. 00-04, Outsourcing of Information and Transaction 
Processing, Feb. 9, 2000; OCC Bulletin 2001-47, ``Third-party 
Relationships Risk Management Principles,'' Nov. 1, 2001; FDIC FIL 
68-99, Risk Assessment Tools and Practices for Information System 
Security, July 7, 1999; OTS Thrift Bulletin 82a, Third Party 
Arrangements, Sept. 1, 2004.
---------------------------------------------------------------------------

    Thus, the final Guidance adopts the discussion on service provider 
arrangements largely as proposed. To eliminate any ambiguity regarding 
the application of this section to foreign-based service providers, 
however, the final Guidance now makes clear that a covered financial 
institution \14\ should be capable of addressing incidents of 
unauthorized access to customer information in customer information 
systems maintained by its domestic and foreign service providers.\15\
---------------------------------------------------------------------------

    \14\ See footnote 6, supra.
    \15\ See, e.g., FFIEC Information Technology Examination 
Handbook, Outsourcing Technology Services Booklet, Jun. 2004; OCC 
Bulletin 2002-16 (national banks); OTS Thrift Bulletin 82a, Third 
Party Arrangements, Sept. 1, 2004 (savings associations).

---------------------------------------------------------------------------

[[Page 15740]]

Components of a Response Program
    As described earlier, commenters criticized the prescriptive nature 
of proposed section II that described the four components a response 
program should contain. The proposed Guidance instructed institutions 
to design programs to respond to incidents of unauthorized access to 
customer information by: (1) Assessing the situation; (2) notifying 
regulatory and law enforcement agencies; (3) containing and controlling 
the situation; and (4) taking corrective measures. The proposed 
Guidance contained detailed information about each of these four 
components.
    The introductory discussion in this section of the final Guidance 
now makes clear that, as a general matter, an institution's response 
program should be risk-based. It applies this principle by modifying 
the discussion of a number of these components. The Agencies determined 
that the detailed instructions in these components of the proposed 
Guidance, especially in the ``Corrective Measures'' section, would not 
always be relevant or appropriate. Therefore, the final Guidance 
describes, through brief bulleted points, the elements of a response 
program, giving financial institutions greater discretion to address 
incidents of unauthorized access to or use of customer information that 
could result in substantial harm or inconvenience to a customer.
    At a minimum, an institution's response program should contain 
procedures for: (1) Assessing the nature and scope of an incident, and 
identifying what customer information systems and types of customer 
information have been accessed or misused; (2) notifying its primary 
Federal regulator as soon as possible when the institution becomes 
aware of an incident involving unauthorized access to or use of 
sensitive customer information, as defined later in the final Guidance; 
(3) immediately notifying law enforcement in situations involving 
Federal criminal violations requiring immediate attention; (4) taking 
appropriate steps to contain and control the incident to prevent 
further unauthorized access to or use of customer information, such as 
by monitoring, freezing, or closing affected accounts, while preserving 
records and other evidence; and (5) notifying customers when warranted.
    Assess the Situation. The proposed Guidance stated that an 
institution should assess the nature and scope of the incident and 
identify what customer information systems and types of customer 
information have been accessed or misused.
    Some commenters stated that the Agencies should retain this 
provision in the final Guidance. One commenter suggested that an 
institution should focus its entire response program primarily on 
addressing unauthorized access to sensitive customer information.
    The Agencies have concluded that a financial institution's response 
program should begin with a risk assessment that allows an institution 
to establish the nature of any information improperly accessed. This 
will allow the institution to determine whether and how to respond to 
an incident. Accordingly, the Agencies have not changed this provision.
    Notify Regulatory and Law Enforcement Agencies. The proposed 
Guidance provided that an institution should promptly notify its 
primary Federal regulator when it becomes aware of an incident 
involving unauthorized access to or use of customer information that 
could result in substantial harm or inconvenience to customers. In 
addition, the proposed Guidance stated that an institution should file 
a Suspicious Activity Report (SAR), if required, in accordance with the 
applicable SAR regulations \16\ and various Agency issuances.\17\ The 
proposed Guidance stated that, consistent with the Agencies' SAR 
regulations, in situations involving Federal criminal violations 
requiring immediate attention, the institution immediately should 
notify, by telephone, the appropriate law enforcement authorities and 
its primary regulator, in addition to filing a timely SAR. For the sake 
of clarity, the final Guidance discusses notice to regulators and 
notice to law enforcement in two separate bulleted items.
---------------------------------------------------------------------------

    \16\ 12 CFR 21.11 (national banks, Federal branches and 
agencies); 12 CFR 208.62 (State member banks); 12 CFR 211.5(k) (Edge 
and agreement corporations); 12 CFR 211.24(f) (uninsured State 
branches and agencies of foreign banks); 12 CFR 225.4(f) (bank 
holding companies and their nonbank subsidiaries); 12 CFR part 353 
(State non-member banks); and 12 CFR 563.180 (savings associations).
    \17\ For example, national banks must file SARs in connection 
with computer intrusions and other computer crimes. See OCC Bulletin 
2000-14, ``Infrastructure Threats--Intrusion Risks'' (May 15, 2000); 
OCC AL 97-9, ``Reporting Computer Related Crimes'' (November 19, 
1997) (general guidance still applicable though instructions for new 
SAR form published in 65 FR 1229, 1230 (January 7, 2000)). See also 
OCC AL 2001-4, Identity Theft and Pretext Calling, April 30, 2001; 
Federal Reserve SR 01-11, Identity Theft and Pretext Calling, Apr. 
26, 2001; SR 97-28, Guidance Concerning Reporting of Computer 
Related Crimes by Financial Institutions, Nov. 6, 1997; FDIC FIL 48-
2000, Suspicious Activity Reports, July 14, 2000; FIL 47-97, 
Preparation of Suspicious Activity Reports, May 6, 1997; OTS CEO 
Memorandum 139, Identity Theft and Pretext Calling, May 4, 2001; 
https://www.ots.treas.gov/BSA (for the latest SAR form and filing 
instructions required by OTS as of July 1, 2003).
---------------------------------------------------------------------------

Standard for Notice to Regulators
    The provision regarding notice to regulators in the proposed 
Guidance prompted numerous comments. Many commenters suggested that the 
Agencies adopt a narrow standard for notifying regulators. These 
commenters were concerned that notice to regulators, provided under the 
circumstances described in the proposed Guidance, would be unduly 
burdensome for institutions, service providers, and regulators, alike.
    Some of these commenters suggested that the Agencies adopt the same 
standard for notifying regulators and customers. These commenters 
recommended that notification occur when an institution becomes aware 
of an incident involving unauthorized access to or use of ``sensitive 
customer information,'' a defined term in the proposed Guidance that 
specified a subset of customer information deemed by the Agencies as 
most likely to be misused.
    Other commenters recommended that the Agencies narrow this 
provision so that a financial institution would inform a regulator only 
in connection with an incident that poses a significant risk of 
substantial harm to a significant number of its customers, or only in a 
situation where substantial harm to customers has occurred or is likely 
to occur, instead of when it could occur.
    Other commenters who advocated the adoption of a narrower standard 
asked the Agencies to take the position that filing a SAR constitutes 
sufficient notice and that notification of other regulatory and law 
enforcement agencies is at the sole discretion of the institution. One 
commenter stated that it is difficult to imagine any scenario that 
would trigger the response program without requiring a SAR filing. Some 
commenters asserted that if the Agencies believe a lower threshold is 
advisable for security breaches, the Agencies should amend the SAR 
regulations.
    By contrast, some commenters recommended that the standard for 
notification of regulators remain broad. One commenter advocated that 
any event that triggers an internal investigation by the institution 
should require notice to the appropriate regulator. Another commenter 
similarly suggested that notification of all security events to Federal 
regulators is critical, not only those involving unauthorized access to 
or use of customer information

[[Page 15741]]

that could result in substantial harm or inconvenience to its 
customers.
    The Agencies have concluded that the standard for notification to 
regulators should provide an early warning to allow an institution's 
regulator to assess the effectiveness of an institution's response 
plan, and, where appropriate, to direct that notice be given to 
customers if the institution has not already done so. Thus, the 
standard in the final Guidance states that an institution should notify 
its primary Federal regulator as soon as possible when the institution 
becomes aware of an incident involving unauthorized access to or use of 
``sensitive customer information.''
    ``Sensitive customer information'' is defined in section III of the 
final Guidance and means a customer's name, address, or telephone 
number, in conjunction with the customer's social security number, 
driver's license number, account number, credit or debit card number, 
or a personal identification number or password that would permit 
access to the customer's account. ``Sensitive customer information'' 
also includes any combination of components of customer information 
that would allow someone to log onto or access the customer's account, 
such as user name and password or password and account number.
    This standard is narrower than that in the proposed Guidance 
because a financial institution will need to notify its regulator only 
if it becomes aware of an incident involving ``sensitive customer 
information.'' Therefore, under the final Guidance, there will be fewer 
occasions when a financial institution should need to notify its 
regulators. However, under this standard, a financial institution will 
need to notify its regulator at the time that the institution initiates 
its investigation to determine the likelihood that the information has 
been or will be misused, so that the regulator will be able to take 
appropriate action, if necessary.
Method of Providing Notice to Regulators
    Commenters on the proposed Guidance also questioned how a financial 
institution should provide notice to its regulator. One commenter 
suggested that the Agencies should standardize the notice that 
financial institutions provide to their regulators. The commenter 
suggested that the Agencies use these notices to track institutions' 
compliance with the Security Guidelines, gather comprehensive details 
regarding each incident, and track other statistical data regarding 
security. The statistical data could include the number of security 
incidents reported annually and the number of times the incidents 
warranted customer notice.
    The Agencies do not wish to create another SAR-like process that 
requires the completion of detailed forms. Instead, the Agencies 
contemplate that a financial institution will notify regulators as 
quickly as possible, by telephone, or in some other expeditious manner 
when the institution becomes aware of an incident involving 
unauthorized access to or use of sensitive customer information. The 
Agencies believe that the extent to which they will gather statistics 
on security incidents and customer notice is beyond the scope of the 
final Guidance. Whether or not an Agency will track the number of 
incidents reported is left to the discretion of individual Agencies.
Notice to Regulators by Service Providers
    Commenters on the proposed Guidance questioned whether a financial 
institution or its service provider should give notice to a regulator 
when a security incident involves an unauthorized intrusion into the 
institution's customer information systems maintained by the service 
provider. One commenter noted that if a security event occurs at a 
large service provider, regulators could receive thousands of notices 
from institutions relating to the same event. The commenter suggested 
that if a service provider is examined by one of the Agencies the most 
efficient means of providing regulatory notice of such a security event 
would be to allow the servicer to notify its primary Agency contact. 
The primary Agency contact then could disseminate the information to 
the other regulatory agencies as appropriate.
    The Agencies believe that it is the responsibility of the financial 
institution and not the service provider to notify the institution's 
regulator. Therefore, the final Guidance states that a financial 
institution should notify its primary Federal regulator as soon as 
possible when the institution becomes aware of an incident involving 
unauthorized access to or use of sensitive customer information. 
Nonetheless, a security incident at a service provider could have an 
impact on multiple financial institutions that are supervised by 
different Federal regulators. Therefore, in the interest of efficiency 
and burden reduction, the last paragraph in section II of the final 
Guidance makes clear that an institution may authorize or contract with 
its service provider to notify the institution's regulator on the 
institution's behalf when a security incident involves an unauthorized 
intrusion into the institution's customer information systems 
maintained by the service provider.
Notice to Law Enforcement
    Some commenters took issue with the provision in the proposed 
Guidance regarding notification of law enforcement by telephone. One 
commenter asked the Agencies to clarify how notification of law 
enforcement by telephone would work since in many cases it is unclear 
what telephone number should be used. This commenter maintained that 
size and sophistication of law enforcement authorities may differ from 
state to state and this requirement may create confusion and 
unwarranted action by the law enforcement authority.
    The final Guidance adopts this provision as proposed. The Agencies 
note that the provision stating that an institution should notify law 
enforcement by telephone in situations involving Federal criminal 
violations requiring immediate attention is consistent with the 
Agencies' existing SAR regulations.\18\
---------------------------------------------------------------------------

    \18\ See footnote 16, supra.
---------------------------------------------------------------------------

    Contain and Control the Situation. The proposed Guidance stated 
that the financial institution should take measures to contain and 
control a security incident to prevent further unauthorized access to 
or use of customer information while preserving records and other 
evidence.\19\ It also stated that, depending upon the particular facts 
and circumstances of the incident, measures in connection with computer 
intrusions could include: (1) Shutting down applications or third party 
connections; (2) reconfiguring firewalls in cases of unauthorized 
electronic intrusion; (3) ensuring that all known vulnerabilities in 
the financial institution's computer systems have been addressed; (4) 
changing computer access codes; (5) modifying physical access controls; 
and (6) placing additional controls on service provider arrangements.
---------------------------------------------------------------------------

    \19\ See FFIEC Information Technology Examination Handbook, 
Information Security Booklet, Dec. 2002, pp. 68-74 available at: 
https://www.ffiec.gov/ffiecinfobase/html_pages/infosec_book_
frame.htm.
---------------------------------------------------------------------------

    Few comments were received on this section. One commenter suggested 
that the Agencies adopt this section unchanged in the final Guidance. 
Another commenter had questions about the meaning of the phrase

[[Page 15742]]

``known vulnerabilities.'' Commenters did, however, note the overlap 
between proposed section II.C., and the corrective measures in proposed 
section II.D., described as ``flagging accounts'' and ``securing 
accounts.''
    The Agencies agree that some sections in the proposed Guidance 
overlapped. Therefore, the Agencies modified this section by 
incorporating concepts from the proposed Corrective Measures component, 
and removing the more specific examples in this section, including the 
terms that confused commenters. This section in the final Guidance 
gives an institution greater discretion to determine the measures it 
will take to contain and control a security incident. It states that 
institutions should take appropriate steps to contain and control the 
incident to prevent further unauthorized access to or use of customer 
information, such as by monitoring, freezing, or closing affected 
accounts, while preserving records and other evidence.
Preserving Evidence
    One commenter stated that the final Guidance should require 
financial institutions, as part of the response process, to have an 
effective computer forensics capability in order to investigate and 
mitigate computer security incidents as discussed in principle fourteen 
of the Basel Committee's ``Risk Management for Electronic Banking'' 
\20\ and the International Organization for Standardization's ISO 
17799.\21\
---------------------------------------------------------------------------

    \20\ https://www.bis.org/publ/bcbs35.htm.
    \21\ https://www.iso.org/iso/en/prods-services/popstds/
informationsecurity.html.
---------------------------------------------------------------------------

    The Agencies note that the final Guidance addresses not only 
computer security incidents, but also all other incidents of 
unauthorized access to customer information. Thus, it is not 
appropriate to include more detail about steps an institution should 
take to investigate and mitigate computer security incidents. However, 
the Agencies believe that institutions should be mindful of industry 
standards when investigating an incident. Therefore, the final Guidance 
contains a reference to forensics by generally noting that an 
institution should take appropriate steps to contain and control an 
incident, while preserving records and other evidence.
    Corrective Measures. The proposed Guidance stated that once a 
financial institution understands the scope of the incident and has 
taken steps to contain and control the situation, it should take 
measures to address and mitigate the harm to individual customers. It 
then described three corrective measures that a financial institution 
should include as a part of its response program in order to 
effectively address and mitigate harm to individual customers: (1) 
Flagging accounts; (2) securing accounts; and (3) notifying customers. 
The Agencies removed the first two corrective measures for the reasons 
that follow.
    Flagging and Securing Accounts. The first corrective measure in the 
proposed Guidance directed financial institutions to ``flag accounts.'' 
It stated that an institution should immediately begin identifying and 
monitoring the accounts of those customers whose information may have 
been accessed or misused. It also stated that an institution should 
provide staff with instructions regarding the recording and reporting 
of any unusual activity, and if indicated given the facts of a 
particular incident, implement controls to prevent the unauthorized 
withdrawal or transfer of funds from customer accounts.
    The second corrective measure directed institutions to ``secure 
accounts.'' The proposed Guidance stated that when a checking, savings, 
or other deposit account number, debit or credit card account number, 
personal identification number (PIN), password, or other unique 
identifier has been accessed or misused, the financial institution 
should secure the account and all other accounts and services that can 
be accessed using the same account number or name and password 
combination. The proposed Guidance stated that accounts should be 
secured until such time as the financial institution and the customer 
agree on a course of action.
    Commenters were critical of these proposed measures. Several 
commenters asserted that the final Guidance should not prescribe 
responses to security incidents with this level of detail. Other 
commenters recommended that if the Agencies chose to retain references 
to ``flagging'' or ``securing'' accounts, they should include the words 
``where appropriate'' in order to give institutions the flexibility to 
choose the most effective solutions to problems.
    Commenters also stated that the decision to flag accounts, the 
nature of that flag, and the duration of the flag, should be left to an 
individual financial institution's risk-based procedures developed 
under the Security Guidelines. These commenters asked the Agencies to 
recognize that regular, ongoing fraud prevention and detection methods 
employed by an institution may be sufficient.
    Commenters representing small institutions stated that they do not 
have the technology or other resources to monitor individual accounts. 
They stated that the financial impact of having to monitor accounts for 
unusual activity would be enormous, as each institution would have to 
purchase expensive technology, hire more personnel, or both. These 
commenters asked the Agencies to provide institutions with the 
flexibility to close an account if the institution detects unusual 
activity.
    With respect to ``securing accounts,'' several commenters stated 
that if ``secure'' means close or freeze, either action would be 
extreme and would have significant adverse consequences for customers. 
Other commenters stated that the requirement that the institution and 
the customer ``agree on a course of action'' is unrealistic, unworkable 
and should be eliminated. Some commenters explained that if a customer 
is traveling and the financial institution cannot contact the customer 
to obtain the customer's consent, freezing or closing a customer's 
account could strand the customer with no means of taking care of 
expenses. They stated that, in the typical case, the institution would 
monitor such an account for suspicious transactions.
    As described earlier, the Agencies are adopting an approach in the 
final Guidance that is more flexible and risk-based than that in the 
proposed Guidance. The final Guidance incorporates the general concepts 
described in the first two corrective measures into the brief bullets 
describing components of a response program enumerated in section II.C. 
Therefore, the first and second corrective measures no longer appear in 
the final Guidance.
    Customer Notice and Assistance. The third corrective measure in the 
proposed Guidance was titled ``Customer Notice and Assistance.'' This 
proposed measure stated that a financial institution should notify and 
offer assistance to customers whose information was the subject of an 
incident of unauthorized access or use under the circumstances 
described in section III of the proposed Guidance. The proposed 
Guidance also described which customers should be notified. In 
addition, this corrective measure contained provisions discussing 
delivery and contents of the customer notice.
    The final Guidance now states that an institution's response 
program should contain procedures for notifying customers when 
warranted. For clarity's sake, the discussion of which customers should 
be notified, and the delivery and contents of customer notice, is now 
in new section III, titled ``Customer

[[Page 15743]]

Notice.'' Comments and changes with respect to the paragraphs that were 
relocated are discussed under the section titled ``Customer Notice'' 
that follows.
Responsibility for Notice to Customers
    Some commenters were confused by the discussion in the proposed 
Guidance stating that a financial institution's contract with its 
service provider should require the service provider to disclose fully 
to the institution information related to any breach in security 
resulting in an unauthorized intrusion into the institution's customer 
information systems maintained by the service provider. Commenters 
stated that this provision appears to create an obligation for both 
financial institutions and their service providers to provide notice of 
security incidents to the institution's customers. These commenters 
recommended that the service provider notify its financial institution 
customer so that the financial institution could provide appropriate 
notice to its customers. Thus, customers would avoid receiving multiple 
notices relating to a single security incident.
    Other commenters asserted that a financial institution should not 
have to notify its customers if an incident has occurred because of the 
negligence of its service provider. These commenters recommended that 
in this situation, the service provider should be responsible for 
providing notice to the financial institution's customers.
    As discussed above in connection with notice to regulators, the 
Agencies believe that it is the responsibility of the institution, and 
not of the service provider, to notify the institution's customers in 
connection with an unauthorized intrusion into an institution's 
customer information systems maintained by the service provider. The 
responsibility to notify customers remains with the institution whether 
the incident is inadvertent or due to the service provider's 
negligence. The Agencies note that the costs of providing notice to the 
institution's customers as a result of negligence on the part of the 
service provider may be addressed in the financial institution's 
contract with its service provider.
    The last paragraph in section II of the final Guidance, therefore, 
states that it is the responsibility of the financial institution to 
notify the institution's customers. It also states that the institution 
may authorize or contract with its service provider to notify customers 
on the institution's behalf, when a security incident involves an 
unauthorized intrusion into the institution's customer information 
systems maintained by the service provider.

C. The ``Customer Notice'' Section

    Section III of the proposed Guidance described the standard for 
providing notice to customers and defined the term ``sensitive customer 
information'' used in that standard. This section also gave examples of 
circumstances when a financial institution should give notice and when 
the Agencies do not expect a financial institution to give notice. It 
also discussed contents of the notice and proper delivery.
    Section III of the final Guidance similarly describes the standard 
for providing notice to customers and defines both the terms 
``sensitive customer information'' and ``affected customers.'' It also 
discusses the contents of the notice and proper delivery.
Standard for Providing Notice
    A key feature of the proposed Guidance was the description of when 
a financial institution should provide customer notice. The proposed 
Guidance stated that an institution should notify affected customers 
whenever it becomes aware of unauthorized access to ``sensitive 
customer information'' unless the institution, after an appropriate 
investigation, reasonably concludes that misuse of the information is 
unlikely to occur and takes appropriate steps to safeguard the 
interests of affected customers, including by monitoring affected 
customers' accounts for unusual or suspicious activity.
    The Agencies believed that this proposed standard would strike a 
balance between notification to customers every time the mere 
possibility of misuse of customer information arises from unauthorized 
access and a situation where the financial institution knows with 
certainty that information is being misused. However, the Agencies 
specifically requested comment on whether this is the appropriate 
standard and invited commenters to offer alternative thresholds for 
customer notification.
    Some commenters stated that the proposed standard was reasonable 
and sufficiently flexible. However, many commenters recommended that 
the Agencies provide financial institutions with greater discretion to 
determine when a financial institution should notify its customers. 
Some of these commenters asserted that a financial institution should 
not have to give notice unless the institution believes it ``to be 
reasonably likely,'' or if circumstances indicated ``a significant 
risk'' that the information will be misused.
    Commenters maintained that because the proposed standard states 
that a financial institution should give notice when fraud or identity 
theft is merely possible, notification under these circumstances would 
needlessly alarm customers where little likelihood of harm exists. 
Commenters claimed that, eventually, frequent notices in non-
threatening situations would be perceived by customers as routine and 
commonplace, and therefore reduce their effectiveness.
    The Agencies believe that articulating as part of the guidance a 
standard that sets forth when notice to customers is warranted is both 
helpful and appropriate. However, the Agencies agree with commenters 
and are concerned that the proposed threshold inappropriately required 
institutions to prove a negative proposition, namely, that misuse of 
the information accessed is unlikely to occur. In addition, the 
Agencies do not want customers of financial institutions to receive 
notices that would not be useful to them. Therefore, the Agencies have 
revised the standard for customer notification.
    The final Guidance provides that when an institution becomes aware 
of an incident of unauthorized access to sensitive customer 
information, the institution should conduct a reasonable investigation 
to determine promptly the likelihood that the information has been or 
will be misused. If the institution determines that misuse of the 
information has occurred or is reasonably possible, it should notify 
affected customers as soon as possible.
    An investigation is an integral part of the standard in the final 
Guidance. A financial institution should not forego conducting an 
investigation to avoid reaching a conclusion regarding the likelihood 
that customer information has been or will be misused and cannot 
unreasonably limit the scope of the investigation. However, the 
Agencies acknowledge that a full-scale investigation may not be 
necessary in all cases, such as where the facts readily indicate that 
information will or will not be misused.
Monitoring for Suspicious Activity
    The proposed Guidance stated that an institution need not notify 
customers if it reasonably concludes that misuse of the information is 
unlikely to occur and takes appropriate steps to safeguard the 
interests of affected customers, including by monitoring affected 
customers' accounts for unusual or

[[Page 15744]]

suspicious activity. A number of comments addressed the standard in the 
proposed Guidance on monitoring affected customers' accounts for 
unusual or suspicious activity.
    Some commenters stated that the final Guidance should grant 
institutions the discretion to monitor the affected customer accounts 
for a period of time and to the extent warranted by the particular 
circumstances. Some commenters suggested that monitoring occur during 
the investigation. One commenter noted that an institution's 
investigation may reveal that monitoring is unnecessary. One commenter 
noted that monitoring the customer's accounts at the institution may 
not protect the customer, because unauthorized access to customer 
information may result in identity theft beyond the accounts held at 
the specific financial institution.
    The Agencies agree that under certain circumstances, monitoring may 
be unnecessary, for example when, on the basis of a reasonable 
investigation, an institution determines that information was not 
misused. The Agencies also agree that the monitoring requirement may 
not protect the customer. Indeed, an identity thief with unauthorized 
access to certain sensitive customer information likely will open 
accounts at other financial institutions in the customer's name. 
Accordingly, the Agencies conclude that monitoring under the 
circumstances described in the standard for notice would be burdensome 
for financial institutions without a commensurate benefit to customers. 
For these reasons, the Agencies have removed the reference to 
monitoring in the final Guidance.
Timing of Notice
    The proposed Guidance did not include specific language on the 
timing of notice to customers and the Agencies received many comments 
on this issue. Some commenters requested clarification of the time 
frame for customer notice. One commenter recommended that the Agencies 
adopt the approach in the proposed Guidance because it did not set 
forth any circumstances that may delay notification of the affected 
customers. Yet another commenter maintained that, in light of a 
customer's need to act expeditiously against identity theft, an outside 
limit of 48 hours after the financial institution learns of the breach 
is a reasonable and timely requirement for notice to customers. Many 
commenters, however, recommended that the Agencies make clear that an 
institution may take the time it reasonably needs to conduct an 
investigation to assess the risk resulting from a security incident.
    The Agencies have responded to these various comments on the timing 
of notice by providing that a financial institution notify an affected 
customer ``as soon as possible'' after concluding that misuse of the 
customer's information has occurred or is reasonably possible. As the 
scope and timing of a financial institution's investigation is dictated 
by the facts and circumstances of a particular case, the Agencies have 
not designated a specific number of hours or days by which financial 
institutions should provide notice to customers. The Agencies believe 
that doing so may inhibit an institution's ability to investigate 
adequately a particular incident or may result in notice that is not 
timely.
Delay for Law Enforcement Investigation
    The proposed Guidance did not address delay of notice to customers 
while a law enforcement investigation is conducted. Many commenters 
recommended permitting an institution to delay notification to 
customers to avoid compromising a law enforcement investigation. These 
commenters noted that the California Database Protection Act of 2003 
(CDPA) requires notification of California residents whose unencrypted 
personal information was, or is reasonably believed to have been, 
acquired by an unauthorized person.\22\ However, the CDPA permits a 
delay in notification if a law enforcement agency determines that the 
notification will impede a criminal investigation.\23\ Another 
commenter suggested that an institution should not have to obtain a 
formal determination from a law enforcement agency before it is able to 
delay notice.
---------------------------------------------------------------------------

    \22\ See CAL. CIV. CODE Sec.  1798.82 (West 2005).
    \23\ See CAL. CIV. CODE Sec.  1798.82(c) (West 2005).
---------------------------------------------------------------------------

    The Agencies