Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, 47688-47789 [2024-11116]

Download as PDF 47688 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations SECURITIES AND EXCHANGE COMMISSION 17 CFR Parts 240, 248, 270, and 275 [Release Nos. 34–100155; IA–6604; IC– 35193; File No. S7–05–23] RIN 3235–AN26 Regulation S–P: Privacy of Consumer Financial Information and Safeguarding Customer Information Securities and Exchange Commission. ACTION: Final rule. AGENCY: The Securities and Exchange Commission (‘‘Commission’’ or ‘‘SEC’’) is adopting rule amendments that will require brokers and dealers (or ‘‘brokerdealers’’), investment companies, investment advisers registered with the Commission (‘‘registered investment advisers’’), funding portals, and transfer agents registered with the Commission or another appropriate regulatory agency (‘‘ARA’’) as defined in the Securities Exchange Act of 1934 (‘‘transfer agents’’) to adopt written policies and procedures for incident response programs to address unauthorized access to or use of customer information, including procedures for providing timely notification to individuals affected by an incident involving sensitive customer information with details about the incident and information designed to help affected individuals respond appropriately. In addition, the amendments extend the application of requirements to safeguard customer records and information to transfer agents; broaden the scope of information covered by the requirements for safeguarding customer records and information and for properly disposing of consumer report information; impose requirements to maintain written records documenting compliance with the amended rules; and conform annual privacy notice delivery provisions to the terms of an exception provided by a statutory amendment to the GrammLeach-Bliley Act (‘‘GLBA’’). DATES: Effective date: This rule is effective August 2, 2024. Compliance date: The applicable compliance dates are discussed in section II.F of this rule. FOR FURTHER INFORMATION CONTACT: Emily Hellman, James Wintering, Special Counsels; Edward Schellhorn, Branch Chief; Devin Ryan, Assistant Director; John Fahey, Deputy Chief Counsel; Emily Westerberg Russell, Chief Counsel; Office of Chief Counsel, lotter on DSK11XQN23PROD with RULES2 SUMMARY: VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Division of Trading and Markets, (202) 551–5550; Kevin Schopp, Senior Special Counsel; Moshe Rothman, Assistant Director; Office of Clearance and Settlement, Division of Trading and Markets, (202) 551–5550, Susan Ali and Andrew Deglin, Counsels; Michael Khalil and Y. Rachel Kuo, Senior Counsels; Blair Burnett and Bradley Gude, Branch Chiefs; or Brian McLaughlin Johnson, Assistant Director, Investment Company Regulation Office, Division of Investment Management, (202) 551–6792, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549. SUPPLEMENTARY INFORMATION: The Commission is adopting amendments to 17 CFR 248.1 through 248.100 (‘‘Regulation S–P’’) under Title V of the GLBA [15 U.S.C. 6801 through 6827], the Fair Credit Reporting Act (‘‘FCRA’’) [15 U.S.C. 1681 through 1681x], the Securities Exchange Act of 1934 (‘‘Exchange Act’’) [15 U.S.C. 78a et seq.], the Investment Company Act of 1940 (‘‘Investment Company Act’’) [15 U.S.C. 80a–1 et seq.], and the Investment Advisers Act of 1940 (‘‘Investment Advisers Act’’) [15 U.S.C. 80b–1 et seq.]. Table of Contents I. Introduction and Background II. Discussion A. Incident Response Program Including Customer Notification 1. Assessment 2. Containment and Control 3. Notice to Affected Individuals 4. Service Providers B. Scope of Safeguards Rule and Disposal Rule 1. Scope of Information Protected 2. Extending the Scope of the Safeguards Rule and the Disposal Rule To Cover All Transfer Agents 3. Maintaining the Current Regulatory Framework for Notice-Registered BrokerDealers C. Recordkeeping D. Exception From Requirement To Deliver Annual Privacy Notice E. Existing Staff No-Action Letters and Other Staff Statements F. Compliance Period III. Other Matters IV. Economic Analysis A. Introduction B. Broad Economic Considerations C. Baseline 1. Safeguarding Customer Information: Risks and Practices 2. Regulations and Guidelines 3. Market Structure D. Benefits and Costs of the Final Rule Amendments 1. Written Policies and Procedures 2. Extending the Scope of the Safeguards Rule and the Disposal Rule 3. Recordkeeping 4. Exception From Annual Notice Delivery Requirement PO 00000 Frm 00002 Fmt 4701 Sfmt 4700 E. Effects on Efficiency, Competition, and Capital Formation F. Reasonable Alternatives Considered 1. Reasonable Assurances From Service Providers 2. Lower Threshold for Customer Notice 3. Encryption Safe Harbor 4. Longer Customer Notification Deadlines 5. Broader National Security and Public Safety Delay in Customer Notification V. Paperwork Reduction Act A. Introduction B. Amendments to the Safeguards Rule and Disposal Rule VI. Final Regulatory Flexibility Act Analysis A. Need for, and Objectives of, the Final Amendments B. Significant Issues Raised by Public Comments C. Small Entities Subject to Final Amendments D. Projected Reporting, Recordkeeping, and Other Compliance Requirements E. Agency Action To Minimize Effect on Small Entities Statutory Authority I. Introduction and Background Regulation S–P is a set of privacy rules adopted pursuant to the GLBA and the Fair and Accurate Credit Transactions Act of 2003 (‘‘FACT Act’’) that govern the treatment of nonpublic personal information about consumers by certain financial institutions.1 The Commission is adopting rule amendments that are designed to modernize and enhance the protections that Regulation S–P provides by addressing the expanded use of technology and corresponding risks that have emerged since the Commission originally adopted Regulation S–P in 2000. The amendments in particular update the requirements of the ‘‘safeguards’’ and ‘‘disposal’’ rules. The safeguards rule requires brokers, dealers, investment companies,2 and registered investment advisers to adopt written policies and procedures that address administrative, technical, and physical safeguards to protect customer records and information.3 The disposal rule, which applies to transfer agents 1 See 17 CFR 248.1. S–P applies to investment companies as the term is defined in section 3 of the Investment Company Act (15 U.S.C. 80a–3), whether or not the investment company is registered with the Commission. See 17 CFR 248.3(r). Thus, a business development company, which is an investment company but is not required to register as such with the Commission, is subject to Regulation S–P. Similarly, employees’ securities companies— including those that are not required to register under the Investment Company Act—are investment companies and are, therefore, subject to Regulation S–P. By contrast, issuers that are excluded from the definition of investment company—such as private funds that are able to rely on section 3(c)(1) or 3(c)(7) of the Investment Company Act—are not subject to Regulation S–P. 3 17 CFR 248.30(a). References in this release to ‘‘rule 248.30’’ are to 17 CFR 248.30. 2 Regulation E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations registered with the Commission in addition to the institutions covered by the safeguards rule, requires proper disposal of consumer report information.4 In addition, under Regulation Crowdfunding, funding portals must comply with the requirements of Regulation S–P as they apply to brokers.5 Thus, funding portals will also be required to comply with the applicable amendments to Regulation S–P adopted in this release. The final Regulation S–P amendments are needed to provide enhanced protection of customer or consumer information and help ensure that customers of covered institutions receive timely and consistent notifications in the event of unauthorized access to or use of their information.6 In evaluating amendments to Regulation S–P, we have considered developments in how firms obtain, share, and maintain individuals’ personal information since the Commission originally adopted Regulation S–P, which correspond with an increasing risk of harm to individuals.7 This environment of expanded risks and the importance of reducing or mitigating the potential for 4 Rule 248.30(b). 17 CFR 227.403(b). Accordingly, unless otherwise stated (for example, see infra sections IV and V), references in this release to ‘‘brokers’’ or ‘‘broker-dealers’’ include funding portals. 6 See Proposing Release at section II.A.4. 7 See, e.g., Federal Bureau of Investigation, 2022 internet Crime Report (Mar. 27, 2023), at 7–8, available at: https://www.ic3.gov/Media/PDF/ AnnualReport/2022_IC3Report.pdf (stating that the FBI’s internet Crime Complaint Center received 800,944 complaints in 2022 (an increase from 351,937 complaints in 2018). The complaints included 58,859 related to personal data breaches (an increase from 50,642 breaches in 2018)); the Financial Industry Regulatory Authority (‘‘FINRA’’), 2022 Report on FINRA’s Examination and Risk Monitoring Program: Cybersecurity and Technology Governance (Feb. 2022), available at: https:// www.finra.org/rules-guidance/guidance/reports/ 2022-finras-examination-and-risk-monitoringprogram (noting increased number and sophistication of cybersecurity attacks and reminding firms of their obligations to oversee, monitor, and supervise cybersecurity programs and controls of third-party vendors); Office of Compliance Inspections and Examinations (now the Division of Examinations) (‘‘EXAMS’’), Risk Alert, Cybersecurity: Safeguarding Client Accounts against Credential Compromise (Sept. 15, 2020), available at https://www.sec.gov/files/Risk%20 Alert%20-%20Credential%20Compromise.pdf (describing increasingly sophisticated methods used by attackers to gain access to customer accounts and firm systems). This Risk Alert, and any other Commission staff statements represent the views of the staff. They are not a rule, regulation, or statement of the Commission. Furthermore, the Commission has neither approved nor disapproved their content. These staff statements, like all staff statements, have no legal force or effect. They do not alter or amend applicable law; and they create no new or additional obligations for any person. lotter on DSK11XQN23PROD with RULES2 5 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 harm also supports our amendments to Regulation S–P. In March 2023, the Commission proposed amendments to Regulation S– P.8 In particular, the proposed amendments would amend the safeguards rule to require any broker or dealer, investment company, registered investment adviser, or transfer agent (collectively, ‘‘covered institutions’’) to develop, implement, and maintain written policies and procedures for an incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. The proposal included a further requirement that, as part of this incident response program, covered institutions would provide notices to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization as soon as practicable, but not later than 30 days, after becoming aware that the incident occurred or is reasonably likely to have occurred. The proposed notice requirement included provisions that addressed the use of service providers by covered institutions and included a provision that would permit covered institutions to delay providing notice after receiving a written request from the United States Attorney General (‘‘Attorney General’’) that this notice poses a substantial risk to national security. The Commission also proposed other amendments to Regulation S–P to enhance the protection of customers’ nonpublic personal information. The proposed amendments included provisions to expand the scope of the protections of the safeguards and disposal rules, including extending the safeguards rule to transfer agents. The proposed amendments also included requirements for covered institutions to maintain written records documenting compliance with the proposed amended rules. Finally, the Commission proposed amendments to conform annual privacy notice delivery provisions to the terms of an exception provided by a statutory amendment to the GLBA. The Commission received comment letters on the proposal from a variety of commenters, including financial 8 See Regulation S–P: Privacy of Consumer Financial Information and Safeguarding Customer Information, Securities Exchange Act Release No. 97141 (Mar. 15, 2023) [88 FR 20616 (Apr. 6, 2023)] (‘‘Proposing Release’’ or ‘‘proposal’’). The Commission voted to issue the Proposing Release on Mar. 15, 2023. The release was posted on the Commission website that day, and comment letters were received beginning the same day. The comment period closed on June 5, 2023. We have considered all comments received since Mar. 15, 2023. PO 00000 Frm 00003 Fmt 4701 Sfmt 4700 47689 services firms and their service providers, law firms, investor advocacy groups, professional and trade associations, public policy research institutes, academics, and interested individuals.9 Most individual and public interest group commenters and some industry groups generally supported the proposed amendments.10 A few commenters urged the Commission to consider taking additional steps to strengthen the proposed requirements, for example, by shortening the period for customer notification.11 Many industry commenters expressed concern with specific elements of the proposed amendments, however, suggesting that these amendments would pose operational difficulties.12 Comments on specific aspects of the proposed amendments focused on a few key themes. First, commenters urged the Commission to take a more holistic regulatory approach to harmonize the proposed amendments with other Commission rules and proposals to avoid creating redundant, overlapping, or conflicting obligations for covered institutions.13 We have modified the 9 The comment letters on the proposal are available at https://www.sec.gov/comments/s7-0523/s70523.htm. 10 See, e.g., Comment Letter of the Investment Adviser Association (June 5, 2023) (‘‘IAA Comment Letter 1’’); Comment Letter of the Investment Company Institute (May 23, 2023) (‘‘ICI Comment Letter 1’’); Comment Letter of Better Markets (June 5, 2023) (‘‘Better Markets Comment Letter’’); Comment Letter of North American Securities Administrators Association (May 22, 2023) (‘‘NASAA Comment Letter’’). Some commenters suggested more tailored requirements for smaller covered institutions. See, e.g., IAA Comment Letter 1; Comment Letter of the Securities Transfer Association (June 2, 2023) (‘‘STA Comment Letter 2’’); Comment Letter of the Committee of Annuity Insurers (June 5, 2023) (‘‘CAI Comment Letter’’). As discussed in more detail below, the final amendments apply to all covered institutions because entities of all sizes are vulnerable to the types of data security breach incidents we are trying to address. See infra section VI. 11 See, e.g., Better Markets Comment Letter. 12 See, e.g., Comment Letter of the Securities Industry and Financial Markets Association, et al. (June 5, 2023) (‘‘SIFMA Comment Letter 2’’); Comment Letter of the Financial Services Institute (May 22, 2023) (‘‘FSI Comment Letter’’); Comment Letter of Federated Hermes, Inc. (June 6, 2023) (‘‘Federated Comment Letter’’). 13 See, e.g., IAA Comment Letter 1; ICI Comment Letter 1; Comment Letter of Nasdaq Stock Market LLC (June 2, 2023) (‘‘Nasdaq Comment Letter’’). Commenters also raised these concerns about other proposed rulemakings that the Commission has not adopted. See, e.g., Comment Letter of the Investment Adviser Association (June 17, 2023) (‘‘IAA Comment Letter 2’’); ICI Comment Letter 1. Other commenters requested more specific guidance regarding how the various policies and procedure requirements in other Commission proposals would interact with each other. See, e.g., CAI Comment Letter; SIFMA Comment Letter 2; IAA Comment Letter 2. To the extent that those E:\FR\FM\03JNR2.SGM Continued 03JNR2 47690 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 rule from the proposal to address comments.14 For example, covered institutions may be required to adopt written policies and procedures on similar issues under other provisions of the Federal securities laws.15 A covered institution can, however, adopt a single set of policies and procedures covering Regulation S–P and other rules, provided that the policies and procedures meet the requirements of each rule.16 Additionally, we have changed the proposed requirement to delay providing customer notices when that notice poses a substantial risk to national security or public safety in order to align with a similar provision contained in the Public Company Cybersecurity Rules.17 proposals are adopted, the baseline in those subsequent rulemakings will reflect the existing regulatory requirements at that time. 14 Since the publication of the proposing release, the Commission adopted new rules to enhance and standardize disclosures regarding cybersecurity risk management, strategy, governance, and incidents by public companies that are subject to the reporting requirements of the Securities Exchange Act of 1934 (‘‘Public Company Cybersecurity Rules’’). See Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, Securities Act Release No. 11216 (July 26, 2023) [88 FR 51896 (Aug. 4, 2023)]. 15 See, e.g., 15 U.S.C. 80b–4a (requiring each adviser registered with the Commission to have written policies and procedures reasonably designed to prevent misuse of material non-public information by the adviser or persons associated with the adviser); 17 CFR 270.38a–1(a)(1) (requiring investment companies to adopt compliance policies and procedures); 275.206(4)–7(a) (requiring investment advisers to adopt compliance policies and procedures); and Regulation S–ID, 17 CFR part 248, subpart C (requiring financial institutions subject to the Commission’s jurisdiction with covered accounts to develop and implement a written identity theft prevention program that is designed to detect, prevent, and mitigate identity theft in connection with covered accounts, which must include, among other things, policies and procedures to respond appropriately to any red flags that are detected pursuant to the program). 16 Two commenters addressed the proposal’s application to dually-registered investment advisers and broker-dealers or firms operating both business models (collectively, ‘‘dual registrants’’). One of these commenters stated that the proposed amendments to Regulation S–P allow for streamlining of process because they would apply uniformly to broker-dealers and investment advisers. FSI Comment Letter. The other commenter addressed collectively other Commission cyber proposals and the proposed amendments to Regulation S–P. The commenter stated that these proposals collectively would involve significant burden for a dual registrant to bring both brokerdealer and investment adviser entities into compliance, urging the Commission to provide an extended compliance period for all of the proposed rules to provide time for dual registrants to come into compliance and ‘‘identify some synergies that might make compliance more effective and economical.’’ Cambridge Comment Letter. As one of these commenters stated, Regulation S–P’s requirements apply uniformly to broker-dealers and advisers, although each covered institution— including a dual registrant—will have to tailor its policies and procedures to its business. 17 See infra section II.A.3.d(2). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Commenters also questioned the need for the proposed amendments in light of existing State laws that also address data breaches and raised concerns about differences between the proposed amendments and State regulatory requirements. One commenter stated that the proposed amendments were not needed because existing State laws already require firms to provide notice to individuals in the event of a data breach.18 Some commenters stated that parts of the proposed amendments would conflict with certain provisions of State laws,19 while other commenters stated that parts of the proposed amendments would duplicate existing State laws.20 As discussed more fully later in this section, while we recognize that existing State laws require covered institutions to notify State residents of data breaches in some cases, State laws are not consistent on this point and exclude some entities from certain requirements.21 The final amendments will require notification to all customers of a covered institution affected by a data breach (regardless of State residency), in order to provide timely and consistent disclosure of important information to help affected customers respond to a data breach.22 To that end, the final amendments will enhance investor protection in a number of ways, including by covering a broader scope of customer information than many States; 23 providing for a 30-day notification deadline that is shorter than the timing currently mandated by many States (including States that have no deadline or those allowing for various notification delays); 24 and providing for a more robust notification trigger than in many States.25 Commenters also raised concerns with differences between the proposed amendments and other Federal regulators’ safeguarding standards that 18 See CAI Comment Letter. e.g., IAA Comment Letter 1; Letter from Computershare (June 5, 2023) (‘‘Computershare Comment Letter’’); SIFMA Comment Letter 2. 20 See, e.g., CAI Comment Letter. 21 See infra section IV.C.2. 22 With respect to the interaction of the final rule with State law, Section 15(i)(1) of the Exchange Act (15 U.S.C. 78o(i)(1)) provides that no law, rule, regulation, or order, or other administrative action of any State or political subdivision thereof shall establish capital, custody, margin, financial responsibility, making and keeping records, bonding, or financial or operational reporting requirements for brokers, dealers, municipal securities dealers, government securities brokers, or government securities dealers that differ from, or are in addition to, the requirements in those areas established under the Exchange Act. 23 See infra section IV.D.1.b(3). 24 See infra section IV.D.1.b(2). 25 See infra section IV.D.1.b(4). 19 See, PO 00000 Frm 00004 Fmt 4701 Sfmt 4700 also include a requirement for a data breach response plan or program.26 The GLBA and FACT Act oblige us to adopt regulations, to the extent possible, that are consistent and comparable with those adopted by the Banking Agencies, the Consumer Financial Protection Bureau (‘‘CFPB’’), and the FTC.27 Accordingly, the Commission has also been mindful of the need to set standards for safeguarding customer records and information that are consistent and comparable with the corresponding standards set by these agencies in developing the amendments.28 To this end, we have modified the final amendments from the proposal to promote greater consistency with other applicable Federal safeguard standards to the extent they do not affect the investor protection purposes of this rulemaking, as discussed in more detail below. For example, the final amendments require covered institutions to ensure that their service providers provide notification as soon 26 The Federal Trade Commission (‘‘FTC’’) in 2021 amended its Safeguards Rule (16 CFR part 314 (‘‘FTC Safeguards Rule’’)) by, among other things, adding a requirement for financial institutions under the FTC’s GLBA jurisdiction to establish a written incident response plan designed to respond to information security events. See FTC, Standards for Safeguarding Customer Information, 86 FR 70272 (Dec. 9, 2021). As amended, the FTC’s rule requires that a response plan address security events materially affecting the confidentiality, integrity, or availability of customer information in the financial institution’s control, and that the plan include specified elements that would include procedures for satisfying an institution’s independent obligation to perform notification as required by State law. See id. at n.295. The ‘‘Banking Agencies’’ include the Office of the Comptroller of the Currency (‘‘OCC’’), the Board of Governors of the Federal Reserve System (‘‘FRB’’), the Federal Deposit Insurance Corporation (‘‘FDIC’’), and the former Office of Thrift Supervision. In 2005, the Banking Agencies and the National Credit Union Administration (‘‘NCUA’’) jointly issued guidance on responding to incidents of unauthorized access to or use of customer information. See Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice, 70 FR 15736 (Mar. 29, 2005) (‘‘Banking Agencies’ Incident Response Guidance’’). The Banking Agencies’ Incident Response Guidance provides, among other things, that when an institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to determine promptly the likelihood that the information has been or will be misused. If the institution determines that misuse of the information has occurred or is reasonably possible, it should notify affected customers as soon as possible. 27 See generally 15 U.S.C. 6804(a) (directing the agencies authorized to prescribe regulations under title V of the GLBA to assure to the extent possible that their regulations are consistent and comparable); 15 U.S.C. 1681w(a)(2)(A) (directing the agencies with enforcement authority set forth in 15 U.S.C. 1681s to consult and coordinate so that, to the extent possible, their regulations are consistent and comparable). 28 See Proposing Release at the text following n.37. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 as possible, but no later than 72 hours after becoming aware that an applicable breach has occurred, which is informed by the 72-hour deadline that is required under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (‘‘CIRCIA’’).29 We recognize, however, that there are some areas of divergence between the final amendments and other Federal regulators’ GLBA safeguarding standards, and we discuss the basis for each provision of the final rules below, including cases where the amendments differ from analogous requirements under State law or other Federal regulations.30 Many commenters also urged the Commission to coordinate with other Federal agencies, particularly on reporting deadlines.31 For example, a number of commenters suggested that the Commission coordinate with CISA as it develops regulations pursuant to CIRCIA.32 We have consulted and coordinated with CISA and, consistent with the requirements of the GLBA and other statutory requirements,33 other relevant agencies and their representatives for the purpose of ensuring, to the extent possible, that the amendments are consistent and 29 See final rule 248.30(a)(5)(i); see also infra footnote 245 and accompanying text (discussing how a 72-hour reporting deadline would align with other regulatory standards). Under CIRCIA, the 72hour reporting deadline is for entities to report cyber incidents to the Cybersecurity and Infrastructure Security Agency (‘‘CISA’’). 30 Among the changes being adopted, we are revising as proposed the requirements of 17 CFR 248.17 (‘‘rule 248.17’’) to refer to determinations made by the CFPB rather than the FTC, consistent with changes made to section 507 of the GLBA by the Dodd-Frank Wall Street Reform and Consumer Protection Act. See Public Law 111–203, sec. 1041, 124 Stat. 1376 (2010). Upon its adoption, rule 248.17 essentially restated the then-current text of section 507 of the GLBA, and as such, referenced determinations made by the FTC. See Privacy of Consumer Financial Information (Regulation S–P), Exchange Act Release No. 42974 (June 22, 2000) [65 FR 40334 (June 29, 2000)]. 31 See, e.g., Comment Letter of Amazon Web Services (June 5, 2023) (‘‘AWS Comment Letter’’); Comment Letter of Google Cloud (June 5, 2023) (‘‘Google Comment Letter’’); and Nasdaq Comment Letter. 32 See, e.g., SIFMA Comment Letter 2; Cambridge Comment Letter; Google Comment Letter. CISA has provided a notice of proposed rulemaking that would implement the CIRCIA requirements but they have not yet been adopted. See also Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements, 89 FR 23644 (Apr. 4, 2024). 33 See Exchange Act Section 17A(d)(3)(A), 15 U.S.C. 78q–1(d)(3)(A) (providing that ‘‘[w]ith respect to any clearing agency or transfer agent for which the Commission is not the appropriate regulatory agency, the Commission and the appropriate regulatory agency for such clearing agency or transfer agent shall consult and cooperate with each other . . .’’). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 comparable with the regulations prescribed by other relevant agencies.34 We are adopting amendments to Regulation S–P substantially as proposed, with some changes in response to comments. The principal elements of the final amendments, as discussed in more detail below, are as follows: • Incident Response Program. The final safeguards rule requires covered institutions to develop, implement, and maintain written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. The final amendments will require that a response program include procedures to assess the nature and scope of any incident and to take appropriate steps to contain and control the incident to prevent further unauthorized access or use. • Notification Requirement. The response program procedures in the final amendments also includes a requirement that covered institutions provide a notification to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice will not be required if a covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. Under the final amendments, a customer notice must be clear and conspicuous and provided by a means designed to ensure that each affected individual can reasonably be expected to receive it. This notice must be provided as soon as reasonably practicable, but not later than 30 days, after the covered institution becomes aware that unauthorized access to or use of customer information has, or is reasonably likely to have, occurred. As discussed in more detail below, the final amendments will permit covered institutions to delay providing notice after the Commission receives a written request from the Attorney General that this notice poses a substantial risk to national security or public safety.35 34 See 15 U.S.C. 6804(a)(2). The relevant agencies include the OCC, FRB, FDIC, CFPB, FTC, CISA, Commodity Futures Trading Commission (‘‘CFTC’’), Department of Justice (‘‘DOJ’’), and the National Association of Insurance Commissioners. 35 See infra section II.A.3.d(2). PO 00000 Frm 00005 Fmt 4701 Sfmt 4700 47691 • Service Providers. The final amendments to the safeguards rule include new provisions that address the use of service providers by covered institutions. Under these provisions, covered institutions will be required to establish, maintain, and enforce written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring of service providers, including to ensure that affected individuals receive any required notices. The final amendments make clear that while covered institutions may use service providers to provide any required notice, covered institutions will retain the obligation to ensure that affected individuals are notified in accordance with the notice requirements. • Scope. The final amendments will more closely align the information protected under the safeguards rule and the disposal rule by applying the protections of both rules to ‘‘customer information,’’ a newly defined term. The final amendments will also broaden the group of customers whose information is protected under both rules. Also, transfer agents will be required to comply with the safeguards rule. • Recordkeeping and Annual Notice Amendments. The final amendments will add requirements for covered institutions, other than funding portals,36 to make and maintain written records documenting compliance with the requirements of the safeguards rule and the disposal rule. Further, the final amendments amend the existing requirement to provide annual privacy notices to codify a statutory exception. II. Discussion Since Regulation S–P was first adopted in 2000, evolving digital communications and information storage tools and other technologies have made it easier for firms to obtain, share, and maintain individuals’ personal information. This increases the risk of customers’ information being accessed or used without authorization, for example in a cyberattack or if customer information is improperly disposed of or stolen. In particular, as a frequently-targeted industry, the financial sector has observed increased exposure to cyberattacks that threaten not only the financial firms themselves, but also their customers, especially considering that customer records and other information that covered 36 As discussed below, funding portals are already subject to recordkeeping requirements with regard to documenting their compliance with Regulation S–P, which are not being amended by these final amendments. See infra footnote 385 and accompanying discussion. E:\FR\FM\03JNR2.SGM 03JNR2 47692 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations institutions possess can be particularly sensitive.37 The final amendments will modernize and enhance the protections that Regulation S–P already provides to address this changed landscape. A. Incident Response Program Including Customer Notification As set forth in the proposal, security incidents may result in, among other things, misuse, exposure or theft of a customer’s nonpublic personal information, and potentially leave affected individuals vulnerable to having their information further compromised. Threat actors can use customer information to cause harm in a number of ways, such as by stealing customer identities to sell to other threat actors on the dark web, publishing customer information on the dark web, using customer identities to carry out fraud themselves, or taking over a customer’s account for malevolent purposes. To help protect against harms that may result from a security incident involving customer information, the Commission proposed and is adopting amendments to the safeguards rule largely as proposed, with certain modifications to the notification requirement as discussed further below.38 The amendments will require that covered institutions’ safeguards policies and procedures include an incident response program for unauthorized access to or use of customer information, including customer notification procedures.39 The amendments will require the incident response program to be reasonably designed to detect, respond to, and recover from both unauthorized access to and unauthorized use of customer information (for the purposes of this release, an ‘‘incident’’).40 Any instance of unauthorized access to or use of customer information will trigger a covered institution’s incident response program. The amendments will also require that the response program include procedures for notifying affected individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.41 37 See infra section IV.C.1. infra section II.A.3. 39 See final rule 248.30(a)(3). For clarity, when the amendments to the safeguards rule refer to ‘‘unauthorized access to or use’’, the word ‘‘unauthorized’’ modifies both ‘‘access’’ and ‘‘use.’’ 40 See final rule 248.30(a)(3). See also infra section II.B.1 for a discussion of ‘‘customer information.’’ 41 See final rule 248.30(d)(9) for the definition of ‘‘sensitive customer information.’’ See also infra section II.A.3.b, which includes a discussion of ‘‘sensitive customer information.’’ Notice must be lotter on DSK11XQN23PROD with RULES2 38 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 In this regard, requiring covered institutions to have incident response programs will help mitigate the risk of harm to affected individuals stemming from incidents where a customer’s information has been accessed or used without authorization. For example, incident response programs will help covered institutions to be better prepared to respond to such incidents, and providing notice to affected individuals will aid those individuals in taking protective measures that could mitigate harm that might otherwise result from unauthorized access to or use of their information. Further, a reasonably designed incident response program will help facilitate more consistent and systematic responses to customer information security incidents and help avoid inadequate responses based on a covered institution’s initial impressions of the scope of the information involved in the compromise. Requiring the incident response program to address any incident involving customer information can help a covered institution better contain and control these incidents and facilitate a prompt recovery. As proposed, the amendments will require that a covered institution’s incident response program include policies and procedures containing certain general elements but will not prescribe specific steps a covered institution must undertake when carrying out incident response activities, thereby enabling covered institutions to create policies and procedures best suited to their particular circumstances. Specifically, a covered institution’s incident response program will be required to have written policies and procedures to: (i) Assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization; 42 provided unless a covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information that occurred at the covered institution or one of its service providers that is not itself a covered institution, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. 42 See final rule 248.30(a)(3)(i). The term ‘‘customer information systems’’ would mean the information resources owned or used by a covered institution, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, PO 00000 Frm 00006 Fmt 4701 Sfmt 4700 (ii) Take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information; 43 and (iii) Notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization in accordance with the notification obligations discussed below,44 unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.45 The Commission received multiple comments regarding the proposed requirement for an incident response program generally.46 One commenter supported requiring the incident response program and appreciated its similarity to the Banking Agencies’ Incident Response Guidance.47 Another commenter stated that there should not be a one-size-fits-all approach to incident response programs, stating that an adviser should have discretion to determine how the incident response program should be implemented, and requested that any final rule make clear that specific steps for incident response are not required.48 Moreover, this commenter requested that the final rule expressly indicate that in developing their programs, advisers should employ a principles- and risk-based approach.49 This commenter also opposed the addition of any requirement in the policies and procedures for an adviser to designate an employee with specific qualifications and experience (or hire a similarly qualified third party) to coordinate its incident response program.50 Covered institutions need the flexibility to develop policies and procedures suited to their size and dissemination, or disposition of customer information to maintain or support the covered institution’s operations. See final rule 248.30(d)(6). 43 See final rule 248.30(a)(3)(ii). 44 See infra section II.A.3. 45 See final rule 248.30(a)(3)(iii). 46 Comments for specific components of the incident response program are discussed in more depth separately. See infra sections II.A.1–4. 47 See ICI Comment Letter 1; see also supra footnote 26 (discussing the Banking Agencies’ Incident Response Guidance). 48 See IAA Comment Letter 1. 49 See id.; see also CAI Comment Letter stating that policies and procedures should be based on the specific risks of the particular covered institution and commensurate with the size and complexity of the covered institution’s activities. 50 See id. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 complexity and the nature and scope of their activities. Therefore, we did not propose, and are not adopting, specific steps a covered institution must take when carrying out its incident response program, and we are not specifically designating who must undertake oversight responsibilities, thus providing covered institutions flexibility to determine whether and how to appropriately assign or divide such responsibilities. As proposed and adopted, the amendments will require that a covered institution’s incident response program include policies and procedures containing certain general elements, so covered institutions may tailor their policies and procedures to their individual facts and circumstances. Additionally, advisers, like other covered institutions, can continue to use a risk-based approach to tailor their assessment and containment policies and procedures if they choose to do so, as long as the required elements of the incident response program are met. Two commenters opposed the scope of the proposed incident response program.51 Specifically, these commenters stated that, consistent with the notification requirements, the assessment and containment and control components of the incident response program should be limited to sensitive customer information (and not encompass all nonpublic customer information).52 According to one commenter, because sensitive customer information is the information likely to cause substantial harm or inconvenience to a customer and that requires notification to customers, it follows that incident response programs should be tailored to sensitive customer information.53 The other commenter stated that clients would view the protection of their sensitive customer information as a critically important aspect of their relationship with their adviser and that an adviser’s efforts and resources should appropriately be focused on this information.54 We are adopting as proposed final rules which require the incident response program’s assessment and containment and control components to cover a broader scope of information than the notification requirements. The scope of information covered by the assessment and containment and control requirements is designed to help 51 See Comment Letter of Schulte Roth & Zabel LLP (June 5, 2023) (‘‘Schulte Comment Letter’’) and IAA Comment Letter 1. 52 See Schulte Comment Letter; IAA Comment Letter 1. 53 See Schulte Comment Letter. 54 See IAA Comment Letter 1. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 ensure all information covered by the requirements of the GLBA 55 are appropriately safeguarded and that sufficient information is assessed to fulfill the more narrowly tailored obligation to notify affected individuals. For example, assessment of any incident involving unauthorized access to or use of customer information will help facilitate the evaluation of whether sensitive customer information has been accessed or used without authorization, which informs whether notice has to be provided. Additionally, a covered institution’s assessment may also be useful for collecting other information that is required to populate the notice, such as identifying the date or estimated date of the incident, among other details. Therefore, the scope of the incident response program is appropriate, and we are adopting as proposed. 1. Assessment The final amendments will require that the incident response program include procedures for: (1) assessing the nature and scope of any incident involving unauthorized access to or use of customer information, and (2) identifying the customer information systems and types of customer information that may have been accessed or used without authorization.56 We did not receive comments addressing the assessment portion of the incident response program and are adopting it as proposed.57 The assessment requirement is designed to require a covered institution to identify both the customer information systems and types of customer information that may have been accessed or used without authorization during the incident, as well as the specific customers affected, which would be necessary to fulfill the obligation to notify affected 55 The GLBA directs the Commission to establish standards to insure the security and confidentiality of customer records and information; to protect against any anticipated threats or hazards to the security or integrity of such records; and to protect against unauthorized access to or use of records or information which could result in substantial harm or inconvenience to any customer. 15 U.S.C. 6801(b). 56 See final rule 248.30(a)(3)(i). The proposed requirements related to assessing the nature and scope of a security incident are consistent with the components of a response program as set forth in the Banking Agencies’ Incident Response Guidance. See Banking Agencies’ Incident Response Guidance. 57 Although no comments discussed only the assessment requirement, multiple comments discussed the incident response program generally, which includes the assessment requirement. These comments are discussed in section II.A. PO 00000 Frm 00007 Fmt 4701 Sfmt 4700 47693 individuals.58 Information developed during the assessment process may also help covered institutions develop a contextual understanding of the circumstances surrounding an incident, as well as enhance their technical understanding of the incident, which should be helpful in guiding incident response activities such as containment and control measures. The assessment process may also be helpful for identifying and evaluating existing vulnerabilities that could benefit from remediation in order to prevent such vulnerabilities from being exploited in the future. Further, covered institutions generally should consider reviewing and updating the assessment procedures periodically to ensure that the procedures remain reasonably designed.59 2. Containment and Control The final amendments will require that the response program have procedures for taking appropriate steps to contain and control a security incident, in order to prevent further unauthorized access to or use of customer information.60 We did not receive comments discussing the containment and control portion of the incident response program and are adopting as proposed.61 As set forth in the proposal, the objective of containment and control is to prevent additional damage from unauthorized activity and to reduce the immediate impact of an incident by removing the source of the unauthorized activity.62 Strategies for containing and controlling an incident vary depending upon the type of incident and may include, for example, isolating 58 For example, a covered institution’s assessment may include gathering information about the type of access, the extent to which systems or other assets have been affected, the level of privilege attained by any unauthorized persons, the operational or informational impact of the breach, and whether any data has been lost or exfiltrated. 59 See also 17 CFR 270.38a–1, 275.206(4)–7. 60 See final rule 248.30(a)(3)(ii). These proposed requirements are consistent with the components of a response program as set forth in the Banking Agencies’ Incident Response Guidance. See Banking Agencies’ Incident Response Guidance at 15752. 61 Although no comments discussed only the containment and control requirements, multiple comments discussed the incident response program generally, which includes the containment and control requirement. These comments are discussed in section II.A. 62 See Proposing Release at Section II.A.2. For a further discussion of the purposes and practices of such containment measures, see generally CISA Incident Response Playbook, at 14; see also Federal Financial Institutions Examination Council (‘‘FFIEC’’), Information Technology Examination Handbook—Information Security (Sept. 2016), at 52, available at https://ithandbook.ffiec.gov/media/ 274793/ffiec_itbooklet_informationsecurity.pdf. E:\FR\FM\03JNR2.SGM 03JNR2 47694 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 compromised systems or enhancing the monitoring of intruder activities, searching for additional compromised systems, changing system administrator passwords, rotating private keys, and changing or disabling default user accounts and passwords, among other interventions. Because incident response may involve making complex judgment calls, such as deciding when to shut down or disconnect a system, developing and implementing written containment and control policies and procedures will provide a framework to help facilitate improved decision making at covered institutions during potentially high-pressure incident response situations. Further, covered institutions generally should consider reviewing and updating the containment and control procedures periodically to ensure that the procedures remain reasonably designed.63 3. Notice to Affected Individuals As part of their incident response programs, covered institutions will be required under the final amendments to provide a clear and conspicuous notice to affected individuals under certain circumstances.64 We are adopting this requirement substantially as proposed, with some changes in response to comments. We are adopting as proposed, a requirement for a covered institution to notify each affected individual whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization, unless the covered institution has determined, after a reasonable investigation of the incident, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. The covered institution will be required to provide a clear and conspicuous notice to each affected individual by a means designed to ensure that the individual can reasonably be expected to receive actual notice in writing. Also as proposed, the final amendments require the notice to be provided as soon as practicable, but not later than 30 days, after the covered institution becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. Lastly, in a modification from the proposal, the final amendments provide for an incrementally longer period of time than the proposal for a covered institution to delay providing notice to 63 See 64 See also 17 CFR 270.38a–1, 275.206(4)–7. final rule 248.30(a)(4). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 affected individuals in cases where the Attorney General has determined that providing the notice would pose a substantial risk to national security or public safety. These requirements are discussed in detail below. a. Standard for Providing Notice and Identification of Affected Individuals We are adopting as proposed a requirement for a covered institution to provide notice to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, it determines that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.65 The final amendments reflect a presumption of notification: a covered institution must provide a notice unless it determines notification is not required following a reasonable investigation. Also as proposed, if an incident of unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, but a covered institution is unable to identify which specific individuals’ sensitive customer information has been accessed or used without authorization, the final amendments require the covered institution to provide notice to all individuals whose sensitive customer information resides in the customer information system that was, or was reasonably likely to have been, accessed without authorization (‘‘affected individuals’’).66 While the incident response program is generally required to address information security incidents involving any form of customer information,67 notification is only required when there has been unauthorized access to or use of sensitive customer information, a subset of customer information, because it presents increased risks to affected individuals.68 This notice standard is 65 Final rule 248.30(a)(4)(i). rule 248.30(a)(4)(ii). This proposed provision was not intended to require notification of customers whose sensitive customer information resided in the affected customer information system if the covered institution has reasonably determined that such customers’ sensitive customer information was not accessed or used without authorization. Accordingly, we have modified the final rule to reflect this intended result. See infra footnote 102 and accompanying text. 67 See infra section II.B.1. 68 See infra section II.A.3.b. Additionally, customer information that is not disposed of properly could trigger the requirement to notify 66 Final PO 00000 Frm 00008 Fmt 4701 Sfmt 4700 designed to give affected individuals an opportunity to mitigate the risk of substantial harm or inconvenience arising from an information security incident that potentially implicates their sensitive customer information by affording them an opportunity to take timely responsive actions, such as monitoring credit reports for unauthorized activity, placing fraud alerts on relevant accounts, or changing passwords used to access accounts. At the same time, the final amendments provide a mechanism for covered institutions to avoid making unnecessary notifications in cases where, following a reasonable investigation, the institution determines that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience to the affected individual.69 Whether an investigation is reasonable will depend on the particular facts and circumstances of the unauthorized access or use. For example, unauthorized access or use that is the result of intentional intrusion by a threat actor may warrant more extensive investigation than inadvertent unauthorized access or use by an employee. The investigation may occur in parallel with an initial assessment and scoping of the incident and may build upon information generated from those activities. The scope of the investigation generally should be refined by using available data and the results of ongoing incident response activities. Information related to the nature and scope of the incident may be relevant to determining the extent of the investigation, such as whether the incident is the result of internal unauthorized access or use of sensitive customer information or an external intrusion, the duration of the incident, what accounts have been compromised and at what privilege level, and whether and what type of customer information may have been copied, transferred, or retrieved without authorization.70 A covered institution cannot avoid its notification obligations in cases where affected individuals under final rule 248.30(a)(4)(i). For example, a covered institution whose employee leaves un-shredded customer files containing sensitive customer information in a dumpster accessible to the public would be required to notify affected customers, unless the institution has determined that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. 69 See infra section II.A.3.c. 70 For example, depending on the nature of the incident, it may be necessary to consider how a malicious intruder might use the underlying information based on current trends in identity theft. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations an investigation’s results are inconclusive. Instead, the notification requirement is excused only where a reasonable investigation supports a determination that sensitive customer information has not been and is not reasonably likely to be used in a manner that would result in substantial harm or inconvenience. Thus, in a case where a threat actor has gained access to a customer information system that stores sensitive customer information, and the covered institution lacks information indicating that any particular individual’s sensitive customer information stored in that customer information system was or was not used in a manner that would result in substantial harm or inconvenience, a covered institution will be required to provide notice to affected individuals even though it may not have a sufficient basis to determine whether the breach would result in substantial harm or inconvenience.71 Pursuant to the amendments, as proposed and adopted, for any determination that a covered institution makes that notice is not required, covered institutions other than funding portals will be required to maintain a record of the investigation and basis for its determination.72 As further described below,73 a number of commenters supported the proposal’s requirement for covered institutions to provide notices promptly, emphasizing the importance of ensuring that customers receive timely notification when their sensitive customer information is reasonably likely to have been subject to unauthorized access or use so they have an opportunity to effectively respond to the incident.74 One commenter stated that timeliness is key because any delay will impact consumers’ ability to take steps to protect themselves from identify theft, account compromise, and other downstream impacts resulting from the initial harm of the unauthorized access or use.75 According to this commenter, a breach notification regime is fundamentally deficient if it does not empower consumers with the 71 See 72 See final rule 248.30(a)(4)(ii). infra section II.C; see also infra footnote 76 See 385. lotter on DSK11XQN23PROD with RULES2 73 See infra section II.A.3.d. 74 See, e.g., Better Markets Comment Letter; EPIC Comment Letter; NASAA Comment Letter; ICI Comment Letter 1; Nasdaq Comment Letter. 75 See EPIC Comment Letter; see also Better Markets Comment Letter (customers whose information has been exposed need appropriate and timely notifications to decide for themselves whether and how to address the breach to avoid being ‘‘victimized twice’’: first when the breach occurs, and then again when ‘‘bad actors use the information to steal their identity, drain their bank accounts, or run up their credit cards’’). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 information and tools necessary to take action to protect themselves or understand what risks they may face as a result of a breach.76 Several commenters proposed alternative notification standards, some expanding the circumstances requiring customer notification, and others suggesting a narrower notification regime.77 One commenter suggested we require notification for any incident of unauthorized access to or use of sensitive information, regardless of the risk of harm or inconvenience.78 According to this commenter, customers should always be notified when their sensitive information is accessed or used without authorization, which would allow customers to determine for themselves whether they believe there is a risk of substantial harm or inconvenience that should prompt action on their part. Similarly, another commenter suggested that the notification standard should be expanded from a ‘‘reasonably likelihood’’ standard to a ‘‘reasonably possible’’ standard with regard to whether an individual’s sensitive customer information was accessed or used without authorization.79 This commenter stated that this change was necessary to protect against the possibility that a covered institution might conclude it lacked sufficient information to find the reasonably likely standard satisfied if, for example, it knows it has been hacked but is unable to determine the scope of the hack. According to these commenters, the seemingly higher threshold proposed by the Commission, coupled with their belief that businesses want to avoid making disclosures that could incur liability or lose customers, leaves open the potential that customers will not be notified of some information security compromises that could threaten their investments.80 One commenter suggested that, in addition to requiring notifications to affected individuals, the rules should be modified to also require that covered institutions provide notice to the Commission whenever they are providing notice to affected individuals.81 EPIC Comment Letter. e.g., Better Markets Comment Letter, NASAA Comment Letter (proposing more expansive standards); SIFMA Comment Letter 2, CAI Comment Letter, IAA Comment Letter 1 (proposing narrower standards). 78 See Better Markets Comment Letter. 79 See NASAA Comment Letter. 80 See Better Markets Comment Letter; NASAA Comment Letter; see also EPIC Comment Letter (‘‘EPIC agrees that businesses have a natural tendency to want to avoid making disclosures that could incur liability or lose customers’’). 81 See Better Markets Comment Letter. 77 See, PO 00000 Frm 00009 Fmt 4701 Sfmt 4700 47695 By contrast, with regard to narrowing the standard, some commenters suggested eliminating the presumption of notification altogether, such that covered institutions would have a notification obligation only after having affirmatively determined, following an investigation, a likelihood of a breach or resulting harm to customers.82 These commenters suggested that eliminating the notification presumption, and allowing for the completion of an investigation, would provide covered institutions with additional time to respond to and mitigate an incident as opposed to spending time deliberating over notification obligations, and would allow for more informed notifications. These commenters also suggested that this approach would be more consistent with certain State law regimes that only require notification where an investigation shows a risk of harm and the Banking Agencies’ Incident Response Guidance.83 To address the concern that lengthy investigations might unduly delay customer notifications, one commenter suggested revising the rule to separately require covered institutions ‘‘to conduct a prompt investigation of potential incidents,’’ which the commenter stated would better align with certain existing State law standards while still providing a mechanism for timely notifications.84 We considered the alternative approaches suggested by commenters but determined that adopting the standard as proposed strikes an appropriate balance in accommodating the relevant competing concerns. The suggestions to expand the circumstances requiring notification (either by requiring notification regardless of the risk of harm, or by expanding notification to include cases where it is ‘‘reasonably possible’’ that an 82 See, e.g., SIFMA Comment Letter 2 (notification should only be required if the covered institution makes an affirmative finding of substantial harm or inconvenience); CAI Comment Letter (proposing revised notification trigger to no later than 30 days from a determination that actual or reasonably likely unauthorized access to sensitive customer information has occurred); ACLI Comment Letter (suggesting trigger should instead be only after the completion of a reasonable investigation and conclusion of the incident response process). 83 The Banking Agencies’ Incident Response Guidance advises that a covered institution should provide notice to affected customers if, following the conclusion of a reasonable investigation, it has determined that misuse of sensitive customer information has occurred or is reasonably possible. See Banking Agencies’ Incident Response Guidance. See also section II.A.3.d(1) (responding to commenters’ concerns that the proposed notification timing requirements provide an insufficient amount of time for covered institutions to conduct a reasonable investigation of a data breach incident and prepare and send notices to affected individuals). 84 See CAI Comment Letter. E:\FR\FM\03JNR2.SGM 03JNR2 lotter on DSK11XQN23PROD with RULES2 47696 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations individual’s sensitive customer information was accessed or used without authorization) raise overnotification concerns, particularly given that the adopted standard already has a presumption towards notification.85 We also disagree that the ‘‘reasonably likely’’ standard would allow a covered institution that knows it suffered a breach to avoid providing notice simply by pointing to a lack of information about the scope of the breach as the commenter recommending this approach suggested.86 To the contrary, under the proposed and final amendments, if it is reasonably likely that a malicious actor gained access to a covered institution’s information system containing sensitive customer information but the scope of the breach is unclear (i.e., the covered institution is unable to determine which specific individuals’ sensitive customer information has been accessed or used without authorization and cannot make the determinations required under the rule to avoid sending notices), the covered institution would be required to provide notice to each individual whose sensitive customer information resides in the customer information system.87 In addition, providing notice of every incident, regardless of the risk of harm to affected individuals or the need to take protective measures, could diminish the impact and effectiveness of the notice in a situation where enhanced vigilance is necessary. Utilizing a ‘‘reasonably possible’’ standard raises similar concerns, as it could require covered institutions to provide notice in situations where it is possible, but not reasonably likely, that sensitive customer information was compromised. This could result in overnotification where, for example, a customer’s sensitive information ultimately was not accessed or used without authorization, but it was not possible to rule out that possibility at the time of the incident or in the course of a reasonable investigation during the 30-day period for notices. Additionally, we are not adopting a commenter’s recommendation that the Commission require covered institutions to provide notices to the Commission when they are required to send notices to affected individuals, as one commenter suggested.88 A primary reason for these amendments was to require a reasonably designed incident response program, including policies 85 See supra footnotes 78–80 and accompanying text. 86 See NASAA Comment Letter. final rule 248.30(a)(4)(i) and (ii). 88 See Better Markets Comment Letter. 87 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 and procedures for assessment, control and containment, and customer notification, in order to mitigate the potential harm to individuals whose sensitive information is exposed or compromised in a data breach.89 Providing timely notices to affected individuals accomplishes this goal without the need for covered institutions also to provide copies of the notice to the Commission. Conversely, the narrower alternative standards suggested by commenters (i.e., that covered institutions have a notification obligation only after an investigation, and only if they affirmatively determine a likelihood of a breach or resulting harm to customers) could result in an unreasonable risk of significant delays in providing notice and in notification not being provided to affected individuals. A principal purpose of these amendments is to provide a notification regime that allows affected individuals to take actions to avoid or mitigate the risk of substantial harm or inconvenience.90 If customer notification of a potential breach was delayed to allow a covered institution to complete an investigation that comes to a definitive conclusion about the precise details of the breach, even if done promptly, it would frustrate this goal by postponing (or potentially limiting or foreclosing) the ability of affected individuals to take mitigating actions pending the conclusion of that investigation. For these same reasons, we were not persuaded by those commenters who suggested that we should allow for the completion of an investigation in order to align with the Banking Agencies’ Incident Response Guidance. After considering the comments, we continue to believe the notification standard we proposed (and are adopting in the final amendments) is necessary to enable affected individuals to make their own determinations on needed self-protections regarding the incident.91 Regarding commenters’ concerns about harmonizing Regulation S–P with State law requirements, State law notification standards vary widely such that broad harmonization would be impracticable, and a benefit of the final amendments is that they provide a consistent minimum Federal notification standard to protect affected 89 Proposing Release at section I. Proposing Release at nn.97–98 and accompanying text. 91 See Proposing Release at n.100 (discussing reasons for divergence from Banking Agencies’ Incident Response Guidance); see also infra sections II.A.3.b, II.A.3.e, II.A.4, II.B.2, and IV.C (also discussing the Banking Agencies’ Incident Response Guidance). 90 See PO 00000 Frm 00010 Fmt 4701 Sfmt 4700 individuals in an environment of enhanced risk. This will, for example, provide additional protections for customers in States whose laws do not mandate notification without an affirmative determination of harm or provide an outside time by which notification must be provided.92 This standard will protect all customers, regardless of their State of residence and reduce the potential confusion that could result from customers in one State receiving notice of an incident while customers in another State do not. Moreover, to the extent a covered institution will have a notification obligation under both the final amendments and a similar State law, a covered institution may be able to provide one notice to satisfy notification obligations under both the final amendments and the State law, provided that the notice includes all information required under both the final amendments and the State law, which may reduce the number of notices an individual receives.93 Relatedly, some commenters suggested eliminating or narrowing the concept of ‘‘affected individuals’’ entitled to notification in situations where a covered institution is unable to identify which specific individuals’ sensitive customer information has been accessed or used without authorization. Instead of the proposed requirement that the covered institution must provide notice to all individuals whose sensitive customer information resides in the customer information system that was, or was reasonably likely to have been, accessed or used without authorization, commenters urged narrowing notification to individuals whose sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization based on the covered institution’s reasonable investigation.94 92 See Proposing Release at nn.107–108 and accompanying text (discussing variation in State laws); see also infra section IV.C.2 for a fuller discussion of State law variations, and infra section IV.D.1.b(2) discussing timing of State law notification regimes. 93 See also infra section IV.C.2.a(2) (discussing States that excuse covered entities from individual notification under State law if the entities comply with the notification requirements of another regulator). 94 See, e.g., IAA Comment Letter 1 (suggesting the rule’s affected individuals’ provision be modified to remove the reference to situations where an institution is unable to identify which specific individual’s sensitive customer information has been accessed or used without authorization, as well as the presumption that affected individuals include individuals whose sensitive customer information resides in the breached customer information system); CAI Comment Letter (suggesting the provision be revised to remove the requirement to notify all individuals whose E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 These commenters stated that, by requiring a covered institution to provide all affected individuals notice prior to the conclusion of an investigation and particularized determination, the proposed notification standard could result in the overnotification of individuals whose sensitive customer information may not have been accessed but was residing on a system that was compromised.95 For example, one commenter posited a situation where a threat actor was able to compromise an employee’s email account through a phishing email, and access documents accessible through that account’s shared file server. According to this commenter, if the covered institution were unable to determine which files containing personal information actually were accessed, the institution would be required to provide notice in connection with millions of records, even though the ‘‘vast majority of files and data on that file server would not have been accessible to the employee or to the threat actor.’’ 96 These commenters stated that the resulting overnotification could, in turn, desensitize or unnecessarily disturb individuals whose information was not actually compromised, and might increase costs and litigation and reputational risks for the covered institution, its service providers, or other financial institutions whose contracts reside on the system.97 For similar reasons to those discussed above,98 we were not persuaded by commenter suggestions to narrow the scope of affected individuals entitled to notification in cases where a breach has or is reasonably likely to have occurred, but the covered institution is unable to identify which specific individuals’ sensitive customer information has been accessed or used without authorization.99 Because of the potential that customers might be adversely affected by the breach, covered institutions should be required to provide notice to affected individuals in these circumstances so they may make information is on an affected system, and instead require the institution to notify individuals whose information it reasonably believes was, or reasonably could have been, subject to unauthorized access based on the finding of its investigation). 95 See, e.g., CAI Comment Letter; Computershare Comment Letter; IAA Comment Letter 1. 96 CAI Comment Letter. 97 See also infra section IV.D.1.b.(4) (discussing reputational costs). 98 See supra footnotes 90–93 and accompanying text. 99 See supra footnotes 94–97 and accompanying text. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 their own determination as to whether to take remedial actions. Contrary to the concerns expressed by some commenters, under the proposed and final amendments, a covered institution would not need to provide notice in connection with files or data residing on a system where it knows that information was not used or accessed.100 Rather, a covered institution is only required to provide notification to an affected individual where her sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.101 Additionally, a covered institution need not provide notice where, after a reasonable investigation of the facts and circumstances of the incident, it has determined that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. To address these commenters’ concerns, in a change from the proposal, the final amendments explicitly provide that, in cases where a covered institution reasonably determines that a specific individual’s sensitive customer information that resides in the customer information system was not accessed or used without authorization, the covered institution need not provide notice to that individual.102 Thus, a covered institution would not have an obligation to provide notice to an affected individual whose files happened to reside on a breached information system if it was able to reasonably conclude that those files were not subject to unauthorized use or access. The notification standard should help to improve security outcomes by incentivizing covered institutions to conduct more thorough investigations after an incident occurs because the rule does not permit a covered institution to rebut the presumption of notification without conducting a reasonable investigation. Further, the rule’s requirement that a covered institution provide notice to all affected individuals where it is unable to identify which specific individuals’ sensitive customer information has been accessed or used without authorization should incentivize covered institutions to establish procedures (for themselves and their service providers) that provide robust protections for sensitive customer information. For example, it may encourage covered institutions to employ a principle of least privilege, so 100 See supra footnote 96 and accompanying text. final rule 248.30(a)(4)(i). 102 See final rule 248.30(a)(4)(ii). 101 See PO 00000 Frm 00011 Fmt 4701 Sfmt 4700 47697 that users’ access rights to sensitive customer information on a particular information system are limited to the information strictly required to do their jobs.103 Protections that limit the scope of any breaches reduce the investigation and notification costs (and as a consequence, the potential harm) resulting from a breach. For a covered institution’s customer notification procedures to remain reasonably designed to notify each affected individual whose sensitive customer information was reasonably likely to have been compromised, as required by the final amendments, the covered institution’s policies and procedures generally should be designed to include revisiting notification determinations whenever the covered institution becomes aware of new facts that are potentially relevant to the determination.104 For example, if at the time of the incident, a covered institution determines that risk of use in a manner that would result in substantial harm or inconvenience is not reasonably likely based on the use of encryption in accordance with industry standards, but subsequently the encryption is compromised or it is discovered that the decryption key was also obtained by the threat actor, the covered institution generally should revisit its determination. As discussed in more detail below, the scope of the final amendments will apply to customer information in a covered institution’s possession or that is handled or maintained on the covered institution’s behalf, regardless of whether such information pertains to (a) individuals with whom the covered institution has a customer relationship or (b) to the customers of other financial institutions where such information has been provided to the covered institution.105 Some commenters expressed concern that, as a result of this scope, covered institutions would be required to provide notification to customers of other institutions with whom they do not have a preexisting 103 See, e.g., Defend Privileges and Accounts, National Security Agency Cybersecurity Information (‘‘Least privilege is the restriction of privileges to only those accounts that require them to perform their duties, while limiting accounts to only those privileges that are truly necessary. Doing this reduces the exposure of those privileges to a smaller, more easily manageable set of accounts. Local administrative accounts and accounts for software program management and installation are particularly powerful, but have small scopes of control and should be restricted as much as possible’’) (available at https://media.defense.gov/ 2019/Sep/09/2002180330/-1/-1/0/ Defend%20Privileges%20and%20Accounts%20%20Copy.pdf). 104 See final rule 248.30(a)(3). 105 See infra section II.B.1. E:\FR\FM\03JNR2.SGM 03JNR2 47698 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 relationship.106 One of these commenters suggested that it was unclear how a third-party service provider’s notice to a covered institution of a breach would affect that covered institution’s obligations.107 Additionally, some commenters addressed circumstances where multiple covered institutions would all be required to notify affected individuals concerning the same incident, asserting that requiring all covered institutions involved to provide notices to customers would be burdensome, duplicative, and confusing to customers.108 Where a covered institution experiences an incident involving sensitive customer information related to the customers of another covered institution, commenters generally suggested that the covered institution that has the customer relationship with the customer whose information was affected should be responsible for providing the required notice.109 These commenters asserted that this would be more efficient because, if the covered institution that experienced the incident did not have a customer relationship with an affected individual, that covered institution might not have contact information for the individual necessary to send a notice. After considering comments, we are modifying the proposal to avoid requiring multiple covered institutions to notify the same affected individuals about a given incident. In an effort to minimize duplicative notices, rather than requiring the covered institution with the customer relationship to send the notice as some commenters suggested, the final amendments only require a covered institution to provide notice where unauthorized access to or use of sensitive customer information has occurred at the covered institution or one of its service providers that is not itself a covered institution.110 That covered institution will have information about the incident itself 106 See ACLI Comment Letter; Federated Hermes Comment Letter; ICI Comment Letter; SIFMA Comment Letter 2. 107 See ACLI Comment Letter. 108 See CAI Comment Letter; Computershare Comment Letter. 109 See SIFMA Comment Letter 2; ACLI Comment Letter; Federated Hermes Comment Letter; CAI Comment Letter. Two of these commenters suggested that the covered institution with the customer relationship may make arrangements with other institutions to provide the notice on its behalf. SIFMA Comment Letter 2; ACLI Comment Letter. 110 Final rule 248.30(a)(4). If a covered institution is acting as a service provider, in addition to its own obligations under rule 248.30, it must provide notification to the other covered institution as required by the policies and procedures required in rule 248.30(a)(5)(i). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 that is necessary to properly inform affected individuals. Thus, in response to the commenter question about the relationship between a covered institution’s receipt of a breach notification from a third party service provider and the covered institution’s own obligations,111 where a service provider (that is not itself a covered institution) provides notice to a covered institution that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider,112 that covered institution will be required to initiate its incident response program under the final amendments 113 and thereafter, if applicable, provide notice to affected individuals.114 While we appreciate, as offered by commenters,115 that a covered institution may not have access to the contact information for some customers, it can coordinate with the covered institution that has a customer relationship to receive contact information as needed for the notices.116 Moreover, in another modification from the proposal, the final amendments also provide that a covered institution that is required to notify affected individuals may satisfy that obligation by ensuring that the notice is provided.117 Accordingly, if a covered institution experiences an incident affecting another covered institution’s customers, although the covered institution that experienced the incident is responsible for notification under the final amendments, the two covered institutions can coordinate with each other as to which institution will send the notice. b. Definition of ‘‘Sensitive Customer Information’’ As discussed above, covered institutions will be required to notify customers when ‘‘sensitive customer information’’ was, or is reasonably 111 See ACLI Comment Letter. final rule 248.30(a)(5)(i)(B). 113 See id.; see also infra Section II.A.4.a. 114 See final rule 248.30(a)(4)(iii). As described above, a covered institution need not provide notice where, after a reasonable investigation of the facts and circumstances of the incident, it has determined that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. See final rule 248.30(a)(4)(i). 115 See ACLI Comment Letter, SIFMA Comment Letter 2. 116 Further, as discussed below, a covered instituition will be permitted to enter into a written agreement with its service provider to notify affected individuals on its behalf in accordance with the notice requirements. See final rule 248.30(a)(5)(ii); see also supra section II.A.4. 117 Final rule 248.30(a)(4) (requiring covered institutions to either provide notice or ensure that such notice is provided). 112 See PO 00000 Frm 00012 Fmt 4701 Sfmt 4700 likely to have been, accessed or used without authorization, subject to a reasonable investigation. As proposed and as adopted, the final amendments define the term ‘‘sensitive customer information’’ to mean ‘‘any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information.’’ 118 This definition is calibrated to include types of information that, if exposed, could put affected individuals at a higher risk of suffering substantial harm or inconvenience through, for example, fraud or identity theft enabled by the unauthorized access to or use of the information.119 As with the proposal, the final amendments provide examples of the types of information that will be considered sensitive customer information.120 These examples include certain customer information identified with an individual that, without any other identifying information, could create a substantial risk of harm or inconvenience to an individual identified with the information,121 along with examples of combinations of identifying information and authenticating information that could create such a risk to an individual identified with the information.122 One commenter supported our proposed definition of sensitive customer information and emphasized the benefits of a broad definition.123 According to this commenter, this breadth helps protect customers by ensuring that they can take the necessary steps to minimize their 118 See final rule 248.30(d)(9)(i). The definition is limited to information identified with customers of financial institutions. See final rule 248.30(d)(5)(i); infra section II.B.1. As proposed, information pertaining to a covered institution’s customers and to customers of other financial institutions that the other institutions have provided to the covered institution are subject to the safeguards rule under the final amendments, including the incident response program and customer notice requirements. See final rule 248.30(a); infra section II.B.1. 119 See supra section II.A.3.a. 120 See final rule 248.30(d)(9)(ii). 121 These examples include Social Security numbers and other types of identifying information that can be used alone to authenticate an individual’s identity such as a driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number, biometric records, a unique electronic identification number, address, or routing code, or telecommunication identifying information or access device. 122 These examples include information identifying a customer, such as a name or online user name, in combination with authenticating information such as a partial Social Security number, access code, or mother’s maiden name. 123 See Better Markets Comment Letter. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations exposure risks and will assist covered institutions in formulating and improving their security standards. Another commenter suggested the proposed definition might be too narrow because it includes the separate concept of substantial harm or inconvenience in the definition, resulting in undernotification.124 This commenter stated that harms can take many forms, and customers should receive notice of breaches involving customer information even where that information’s compromise might not have obvious financial implications to the customer. Conversely, a number of commenters asserted that the proposed definition was too broad and could lead to overnotification, suggesting that the definition be narrowed to focus on information whose exposure would be more likely to lead to tangible economic harms.125 For example, some commenters suggested that, rather than providing examples, the definition should list specific data elements that, when combined with an individual’s name, are sufficiently sensitive to require notification.126 These commenters focused on those data elements that could be used to commit identity theft or access the customer’s financial account, such as a Social Security number, driver’s license or State ID number, or financial account number combined with information necessary to access the account. According to one of these commenters, by using illustrative examples rather than a circumscribed list, covered institutions would face uncertainty over the definition’s meaning and would likely err on the side of over-inclusion, which could lead to over-notification.127 A number of commenters stated that narrowing the definition would be more consistent with the Banking Agencies’ Incident Response Guidance and with various State laws.128 One commenter also suggested the proposed use of the term ‘‘compromise’’ in the definition was unclear, and should be replaced with ‘‘unauthorized access or use,’’ consistent with other authorities and language used elsewhere in the proposal.129 124 See EPIC Comment Letter. e.g., CAI Comment Letter; IAA Comment Letter 1; SIFMA Comment Letter 2; ICI Comment Letter 1. 126 See CAI Comment Letter; SIFMA Comment Letter 2. 127 See CAI Comment Letter. 128 See, e.g., SIFMA Comment Letter 2; Computershare Comment Letter; CAI Comment Letter. 129 See CAI Comment Letter. lotter on DSK11XQN23PROD with RULES2 125 See, VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 After considering these comments, we are adopting the definition of ‘‘sensitive customer information’’ as proposed. We recognize that this definition is broader than that used by some States and the Banking Agencies’ Incident Response Guidance.130 However, in contrast to the narrower definition used in some States, the definition of sensitive customer information we are adopting includes identifying information that, in combination with authenticating information (such as a partial Social Security number, access code, or mother’s maiden name), could create a substantial risk of harm or inconvenience to the customer because they may be widely used for authentication purposes.131 Similarly, in contrast to the definition provided in the Banking Agencies’ Incident Response Guidance (which includes a customer’s name, address, or telephone number, only in conjunction with other pieces of information that would permit access to a customer account), the definition in the Commission’s final amendments includes customer information identified with an individual (such as Social Security numbers, driver’s license numbers, biometric records) that, without any other identifying information, could create a substantial risk of harm or inconvenience to an individual identified with the information.132 Accordingly, our adopted definition could help affected individuals take measures to protect themselves. Given the varied and evolving nature of security practices across covered institutions, it would be impractical to provide an exhaustive list of data elements whose exposure could put affected individuals at risk of substantial harm or inconvenience. Further, while we are mindful of 130 See Proposing Release at nn.113 and 115 (describing the differences). But see id. at n.115, stating that a number of States define the scope of personal information subject to a notification obligation in a manner that generally aligns with the definition of sensitive customer information under these final rules. 131 See infra footnote 810 and surrounding text (discussing that 14 States more narrowly define the kind of information that trigger notice requirements than our adopted definition of sensitive customer information in that only the compromise of a customer’s name together with one or more enumerated pieces of information triggers the notice requirement). 132 See Proposing Release at n.114 and accompanying text, stating that Social Security numbers alone, without any other information linked to the individual, are sensitive because they have been used by malicious actors in ‘‘Social Security number-only’’ or ‘‘synthetic’’ identity theft, to open new financial accounts, and that a similar sensitivity exists with other types of identifying information that can be used alone to authenticate an individual’s identity such as a biometric record of a fingerprint or iris image. PO 00000 Frm 00013 Fmt 4701 Sfmt 4700 47699 concerns about overbreadth and potential over-notification, those concerns are tempered by the definition’s harm component and the ability of covered entities to rebut the notification presumption following a reasonable investigation and determination. Given these considerations, we are not broadening the definition of sensitive customer information to encompass information whose exposure does not pose a reasonably likely risk of substantial harm or inconvenience. Nor do we agree that the definition’s use of the verb ‘‘compromise,’’ which is commonly used to mean ‘‘to expose or make liable to danger,’’ is ambiguous in this context or inconsistent with other Federal authorities.133 Individuals are less likely to need to take protective measures in cases where the exposure of their information is not likely to involve a substantial harm or inconvenience.134 Finally, several commenters suggested we include an exception or safe harbor in the definition of sensitive customer information for encrypted information.135 These commenters stated that excepting encrypted information would protect customers by incentivizing covered institutions to adopt encryption practices, limit the potential for voluminous over-reporting of less severe incidents, and align with existing State data breach notification rules. Some of these commenters acknowledged that an exception should not apply in cases where there is reason to believe that the encryption key has been compromised or that the encryption method is outdated.136 One commenter suggested that if we did not include an exception in the rule text, we should acknowledge that encryption is a factor that covered institutions may take into account in determining whether an incident will result in substantial harm or inconvenience.137 After considering these comments, we are not excepting encrypted information from the rule’s definition of sensitive customer information because the rule 133 See, e.g., Harmonization of Cyber Incident Reporting to the Federal Government, Homeland Security Office of Strategy, Policy, and Plans, Appendix B: Federal Cyber Incident Reporting Requirements Inventory (Sept. 10, 2023) (summarizing cyber incident reporting regulations of multiple agencies that use the term ‘‘compromise,’’ including Departments of Defense, Justice, and Energy, the Federal Communications Commission, the Nuclear Regulatory Commission, and the Federal Energy Regulatory Commission). 134 See infra section II.A.3.c. 135 See AWS Comment Letter; Google Comment Letter; IAA Comment Letter 1; SIFMA Comment Letter 2. 136 See Google Comment Letter, IAA Comment Letter 1; SIFMA Comment Letter 2. 137 See IAA Comment Letter 1. E:\FR\FM\03JNR2.SGM 03JNR2 47700 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 text effectively addresses encrypted information without the need for a provision specifically tailored to that information. Specifically, in applying the final rule, a covered institution may consider encryption as a factor in determining whether the compromise of customer information could create a reasonably likely harm risk to an individual identified with the information.138 Specifically, we acknowledge that encryption of information using current industry standard best practices is a reasonable factor for a covered institution to consider in making this determination. To the extent such encryption minimizes the likelihood that the cipher text could be decrypted, it would also reduce the likelihood that the cipher text’s compromise could create a risk of harm, as long as the associated decryption key is secure.139 Covered institutions may also reference commonly used cryptographic standards to determine whether encryption, in fact, does substantially impede the likelihood that the cipher text’s compromise could create a risk of harm.140 As industry standards continue to develop in the future, covered institutions generally should review and update, as appropriate, their encryption practices. While we agree with commenters that it is important to incentivize the use of encryption consistent with State law regimes, the final amendments’ approach accomplishes this goal while also addressing concerns that any particular approach to encryption may become outdated as technologies and security practices evolve. Relatedly, and for the same reasons, when information that would otherwise constitute sensitive customer information is encrypted, the covered institution may consider the security provided by that encryption in determining whether the cipher text (i.e., the data rendered in a format not understood by people or machines without an encryption key) is sensitive customer information. Accordingly, while the final amendments provide illustrative examples of information (such as a customer’s Social Security 138 See Proposing Release at n.116 and accompanying text. 139 As discussed in the Proposing Release, most States except encrypted information in certain circumstances, including, for example, where the covered institution can determine that the encryption offers certain levels of protection or the decryption key has not also been compromised. See Proposing Release at n.117 and accompanying text. 140 We understand that standards included in Federal Information Processing Standard Publication 140–3 (FIPS 140–3) are widely referenced by industry participants. See Proposing Release at n.118. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 number) that can constitute sensitive customer information when unencrypted,141 a covered institution could nevertheless determine that the encrypted representation of that information is not sensitive customer information if the encryption renders the cipher text sufficiently secure, such that the compromise of that encrypted information does not create a reasonably likely risk of substantial harm or inconvenience to an individual.142 c. Substantial Harm or Inconvenience The GLBA directs the Commission and other Federal financial regulators to, among other things, establish appropriate standards requiring financial institutions subject to their jurisdiction to protect against unauthorized access to or use of customer records or information which could result in ‘‘substantial harm or inconvenience’’ to any customer, without defining what constitutes a substantial harm or inconvenience under the statute.143 The Commission proposed to define ‘‘substantial harm or inconvenience’’ to mean all personal injuries, as well as instances of financial loss, expenditure of effort, or loss of time when they are ‘‘more than trivial,’’ with the proposal also providing a nonexhaustive list of examples of included harms or inconveniences.144 This proposed definition included a broad range of financial and non-financial harms and inconveniences that may result from the failure to safeguard sensitive customer information.145 After considering comments, and as discussed further below, we have determined not to define the term ‘‘substantial harm or inconvenience’’ in the final amendments. Commenters raised various concerns with the proposed definition. Some commenters proposed expanding the definition to include a broader array of harms requiring notification.146 For example, one commenter suggested revising it to enumerate a list of specific personal injuries requiring notification to help clarify to covered institutions 141 See final rule 248.30(d)(9)(ii)(A)(1) through (4) and 248.30(d)(9)(ii)(B). 142 To the extent a covered institutioon’s determination about the security of cipher text affects its determination about whether notice of a breach is required under the final rules, the covered institution would be required to make and maintain written documentation of that documentation. See final rule 248.30(c)(1)(iii). 143 See 15 U.S.C. 6801(b). The Banking Agencies’ Incident Response Guidance likewise does not define the term ‘‘substantial harm or inconvenience.’’ 144 See proposed rule 248.30(e)(11). 145 See Proposing Release at n.124. 146 See EPIC Comment Letter; NASAA Comment Letter; Better Markets Comment Letter. PO 00000 Frm 00014 Fmt 4701 Sfmt 4700 that there are a range of personal injuries that can result from an exposure of customer data.147 Commenters also suggested we remove the requirement that personal or financial harms be nontrivial because, according to these commenters, there might always be some set of individuals to whom a particular personal or financial harm is material, and securities firms are not well positioned to determine what potential personal or financial harms to their customers are significant enough to require customer notice.148 One of these commenters observed that, while it made sense to apply the concept of nontriviality to potential harms or inconveniences that would infringe upon a customer’s time and personal labors, risks to the customer’s person and pocketbook are materially different from risks to the customer’s time and energies.149 This commenter also suggested broadening the definition to include the term ‘‘cyberattack’’ as one of the enumerated events that could give rise to the customer notice obligation. Alternatively, a number of commenters suggested that the proposed standard was ambiguous and urged narrowing the definition to reduce the types of injuries that would require notification.150 For example, one commenter suggested that we not attempt to define ‘‘substantial harm or inconvenience’’ at all, and further expressed concern that the proposed definition would require notice for harms or inconveniences that are unrelated to identify theft, the means to access an account without authority, or other ‘‘tangible harms.’’ 151 Another commenter proposed narrowing the kinds of financial loss or time and effort cognizable under the rules from ‘‘more than trivial’’ to only ‘‘material’’ financial loss or ‘‘significant’’ expenditure of effort or loss of time, suggesting that the proposed definition would be inconsistent with the usual meaning of the term ‘‘substantial’’ and could include any financial loss that is slightly 147 See EPIC Comment Letter (suggesting the definition specifically list as examples of personal injuries: theft, fraud, harassment, physical harm, psychological harm, impersonation, intimidation, damaged reputation, impaired eligibility for credit or government benefits, or the misuse of information identified with an individual to obtain a financial product or service, or to access, log onto, effect a transaction in, or otherwise misuse the individual’s account). 148 See NASAA Comment Letter; EPIC Comment Letter (agreeing with NASAA’s comment). 149 See NASAA Comment Letter. 150 See, e.g., Comment Letter of Cambridge (‘‘Cambridge Comment Letter’’); CAI Comment Letter; IAA Comment Letter 1; SIFMA Comment Letter 2. 151 See SIFMA Comment Letter 2. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations above trivial as substantial.152 Another commenter stated that the use of ‘‘more than trivial’’ set a very low bar that could result in second-guessing and over notification by covered intuitions that could lead to notification in practically all instances, not just instances of what the commenter viewed as a substantial harm or inconvenience.153 This commenter also stated that, as drafted, it was unclear whether the proposed ‘‘more than trivial’’ standard was meant to apply to instances of personal injury or financial loss and suggested replacing ‘‘more than trivial’’ with substantial, while making clear that the word substantial modified all elements of the definition. Other commenters suggested narrowing the proposed definition by removing the term ‘‘inconvenience’’ from the definition, with notification only required in cases of substantial harm that were more than trivial.154 After considering comments, we have determined, consistent with the approach of the Banking Agencies, not to define the term ‘‘substantial harm or inconvenience.’’ As the range of commenter concerns discussed above reflects, commenters found the proposed definition simultaneously too broad and too narrow, suggesting it could consequently lead to both undernotification and over-notification. Eliminating the proposed definition avoids this result without diminishing investor protection. Determining whether a given harm or inconvenience rises to the level of a substantial harm or a substantial inconvenience would depend on the particular facts and circumstances surrounding an incident. As stated in the Proposing Release, we do not intend for covered institutions to design programs and incur costs to protect customers from harms of such trivial significance that the customer would be unconcerned with remediating them.155 At the same time, consistent with the GLBA, the rules are intended to protect against unauthorized access to or use of customer records or information which could result in substantial harm or inconvenience to any customer. Given the wide variety of ways that a data breach can injure a customer,156 and the IAA Comment Letter 1. CAI Comment Letter (‘‘it is hard to imagine any instance of unauthorized access or use of customer information that could not create a reasonably likely risk of more than trivial inconvenience, and therefore not require notification’’). 154 See Cambridge Comment Letter; Financial Services Institute Comment Letter. 155 See Proposing Release at Section II.A.4.c. 156 See Proposing Release at n.124. potentially varied nature of those harms and inconveniences,157 the range of harms outlined in the proposed definition may be a useful starting point for this determination. A personal injury, financial loss, expenditure of effort, or loss of time, each could constitute a substantial harm or inconvenience depending on the particular facts and circumstances. Some examples of these harms could include theft, fraud, harassment, physical harm, impersonation, intimidation, damaged reputation, impaired eligibility for credit, or the misuse of information identified with an individual to obtain a financial product or service, or to access, log into, effect a transaction in, or otherwise misuse the individual’s account. d. Timing Requirements (1) General Timing Requirements Consistent with the proposal, the final amendments require covered institutions to provide notices to affected individuals as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, except under the limited circumstances discussed below.158 This approach reflects the goal of giving covered institutions adequate time to make an initial assessment of an incident and prepare and send notices to affected individuals, while helping to ensure that those individuals receive sufficient notice to protect themselves. A few commenters expressed support for the proposed notification timing requirements.159 As described above, these commenters viewed timeliness as important because any delay in notification could impact individuals’ ability to take steps to protect themselves from the downstream impacts resulting from the unauthorized access to or use of their sensitive customer information.160 One commenter asserted that 30 days after becoming aware of an incident is more than an ample amount of time for covered institutions to determine the scope of the compromised information and compile a list of affected customers that must be notified.161 Accordingly, this commenter suggested that the 152 See lotter on DSK11XQN23PROD with RULES2 153 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 157 See, e.g., NASAA Comment Letter; IAA Comment Letter 1. 158 See final rule 248.30(a)(4)(iii); see also section II.A.3.d(2) (discussing the national security and public safety delay to the notification timing requirements). 159 EPIC Comment Letter; Better Markets Comment Letter. 160 See supra section II.A.3.a. 161 Better Markets Comment Letter. PO 00000 Frm 00015 Fmt 4701 Sfmt 4700 47701 Commission should shorten the outside notification date from 30 days after becoming aware of a data security incident to 14 days, asserting that the longer an instance of identity theft goes undetected, the greater the damage that usually follows. In contrast, some commenters objected to the proposed notification timing requirements because, in their view, it provided an insufficient amount of time to notify affected individuals.162 These commenters emphasized the logistical tasks associated with responding to an information breach, asserting that in some cases it would be impossible to accomplish these steps within 30 days.163 Commenters expressed that these steps often include remediating the security incident directly, conducting a risk assessment and investigation to determine what information may have been affected, obtaining the information needed to make notification to affected individuals, arranging identity protection services for affected individuals, and generating and delivering the notifications to affected individuals, all while simultaneously engaging in extensive communication with and oversight from senior management, the board of directors, and external parties (such as outside counsel, expert consultants, and regulators).164 Some commenters also suggested that the proposed timing requirements would lead to covered institutions delivering unnecessary or incomplete notifications to customers, which would have the result of confusing or desensitizing customers to such notifications.165 Similarly, commenters expressed that requiring a covered institution to notify affected individuals before the covered institution has had time to fully assess an incident could result in incorrect or incomplete conclusions being drawn and 162 See, e.g., SIFMA Comment Letter 2; IAA Comment Letter 1; FSI Comment Letter; NASDAQ Comment Letter; CAI Comment Letter. 163 For example, one commenter offered the example of a ransomware attack that successfully shuts down systems and requires significant remediation to recover backup systems, as well as rebuilding and redeploying essential systems prior to conducting a forensic investigation to determine the scope of data subject to unauthorized access or use. See CAI Comment Letter. According to this commenter, it would be practically impossible to accomplish these tasks within 30 days of becoming aware of a possible issue, as required under the proposed rules. 164 See, e.g., CAI Comment Letter, NASDAQ Comment Letter; IAA Comment Letter 1. 165 See, e.g., ACLI Comment Letter; AWS Comment Letter, NASDAQ Comment Letter. E:\FR\FM\03JNR2.SGM 03JNR2 47702 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 disclosed.166 One commenter suggested, for this reason, that notices would be subject to continuous revision during an ongoing investigation.167 Accordingly, commenters stated that the Commission should revise the proposal to allow more time for covered institutions to provide notices to affected individuals, asserting that premature, incomplete, or frequent notifications would ultimately mislead and confuse customers rather than provide clarity about an incident.168 Several commenters suggested alternatives to the proposed timing requirements.169 For instance, a few commenters urged the Commission to expand the 30-day outside date to 45 or 60 days, stating that this modification would allow more time for a proper investigation and notification process.170 In addition, a couple of commenters suggested that the rule should not specify a number of days at all.171 One of these commenters stated that simply requiring a covered institution to notify affected individuals as soon as possible after the conclusion of an investigation, without including an outside date timeframe, would permit appropriate notification in both simple cases—where notification in less than 30 days may be appropriate—and more complex cases—where it may take significantly longer to identify the appropriate notice population and prepare and deliver notifications.172 Some commenters suggested that the trigger for notification should be the completion of a reasonable investigation and conclusion of the incident response process following the actual or reasonably likely unauthorized access to or use of sensitive customer information, rather than the proposal’s trigger of a covered institution ‘‘becoming aware’’ of a breach of customer information.173 These commenters stated this alternative would allow covered institutions sufficient time to engage in system and 166 NASDAQ Comment Letter; AWS Comment Letter. 167 AWS Comment Letter. 168 ACLI Comment Letter; AWS Comment Letter, NASDAQ Comment Letter. 169 See, e.g., IAA Comment Letter 1; FSI Comment Letter; Cambridge Comment Letter; Federated Comment Letter; SIFMA Comment Letter 2. 170 See FSI Comment Letter; Cambridge Comment Letter; IAA Comment Letter 1. 171 Federated Comment Letter; SIFMA Comment Letter 2. 172 SIFMA Comment Letter 2. 173 See SIFMA Comment Letter 2; ACLI Comment Letter; see also CAI Comment Letter (suggesting that a revised rule could require covered institutions to conduct a prompt investigation of potential incidents to address concerns about lengthy investigations unduly delaying customer notification.). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 data analysis to determine what data was impacted and what individuals were affected. Moreover, some commenters stated that their suggested alternatives would harmonize the rule’s approach to timing with existing data breach requirements and guidance, such as the Banking Agencies’ Incident Response Guidance and some current State laws.174 Lastly, one commenter urged that the 30-day outside timeframe to provide notices should run from the time that the covered institution determines that an incident involved ‘‘sensitive customer information,’’ rather than ‘‘customer information’’ as proposed.175 After considering comments and alternatives suggested by commenters, we are adopting the final amendments as proposed. We considered the concern raised by commenters that it may be logistically challenging for covered institutions to provide notice to affected individuals within the proposed rule’s notification timing requirements, particularly for more complex data breach incidents.176 We recognize that modifying the timing trigger in the rule to start after a covered institution has completed an investigation that comes to a definitive conclusion about the precise details of the breach, as suggested by some commenters, could avoid over-notification in cases where a covered institution is able to determine that a given individual’s customer information ultimately was not affected after a lengthy investigation. We agree with commenters, however, that timeliness is important in the context of a breach of sensitive customer information because delay in notification would impact the ability of affected individuals to take measures to protect themselves. Accordingly, the final amendments maintain the proposed timing trigger of after the covered institution ‘‘becomes aware’’ that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.177 174 See FSI Comment Letter; SIFMA Comment Letter 2 (suggesting conforming to Banking Agencies’ Incident Response Guidance which does not mandate specific number of days to provide notices); see also IAA Comment Letter 1 (stating that ‘‘over half of state data breach notification laws do not specify a number of days to report a breach and a majority of those states that do require notification allow for 45–60 days for reporting’’). 175 IAA Comment Letter 1 (suggesting that referring to ‘‘customer information,’’ rather than ‘‘sensitive customer information,’’ in this part of the proposed rule was an inadvertent omission). 176 See, e.g., CAI Comment Letter; ACLI Comment Letter. 177 While this ‘‘becoming aware’’ standard differs from the reporting trigger in the Public Company Cybersecurity Rules (which require public disclosure of public issuer cybersecurity incidents PO 00000 Frm 00016 Fmt 4701 Sfmt 4700 In addition, the final amendments adopt the proposed 30-day outside date. We disagree that the rule should not include a specified notification deadline, as such an approach would diminish the goal of providing customers (regardless of State residency) with early and consistent notification of data breaches so that they may take remedial action because many States do not have any specific deadline for sending notices or provide deadlines exceeding 30 days.178 We understand that there are a number of steps a covered institution may have to take after becoming aware of a data breach incident to determine if it has met the standard for providing notice. In the context of the final amendments, 30 days should be sufficient to conduct an initial assessment and notify affected individuals. While a covered institution may still be working towards remediating the breach after the 30-day timeframe, the final amendments require a covered institution to notify affected customers within the 30-day timeframe so that affected individuals may take measures to protect themselves. The final amendments remove the specific requirement in the proposal that the notice describe what has been done to protect the sensitive customer information from further four business days from when an issuer determines that a cybersecurity incident that it has experienced is material), that difference is attributable to the different purposes underlying the rules. The Public Company Cybersecurity Rules were designed to inform investment and voting decisions and to reduce information asymmetry and mispricing in the market, and therefore tie public disclosure to an issuer making a determination that information about an incident would be material, meaning there would be a substantial likelihood that a reasonable shareholder would consider it important in making an investment decision. As we stated in that release, ‘‘we reiterate, consistent with the standard set out in the cases addressing materiality in the securities laws, that information is material if ‘there is a substantial likelihood that a reasonable shareholder would consider it important’ in making an investment decision, or if it would have ‘significantly altered the ‘‘total mix’’ of information made available.’ ’’ See Public Company Cybersecurity Rules. By contrast, the notice provisions under these final rules do not require covered institutions to make a materiality determination, and balance the need for timely notifications with a regime that allows for reasonable investigations to avoid over-notification by allowing covered institutions up to 30 days to conduct a reasonable investigation after becoming aware of an incident. In light of this 30-day window, and the fact that covered institutions are not required to make a materiality determination, there is less need for a trigger based on a determination standard, and greater risk of harm to affected individuals if customer notification were further delayed by requiring that a covered institution come to a determination before triggering the 30-day notification window. 178 See infra section IV.D.1.b(2). E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 unauthorized access or use.179 This change will help address some of the timing and logistical concerns raised by commenters because the process of preparing the requisite notices will be less time intensive, such that, once a covered institution has made its initial assessment of the incident and determined the universe of affected individuals, it should possess the information necessary to provide the requisite notices. In addition, with regard to the commenter concern that it may be logistically challenging to provide a notice within the rule’s timing requirements in cases where a ransomware attack has denied the covered institution access to its systems,180 that comment does not account for the fact that, under the proposed and final amendments, covered institutions will now be required to have an incident response program that includes policies and procedures to, among other things, assess the nature and scope of any qualifying incidents, identify customer information systems and types of customer information that may have been accessed or used without authorization, and respond to and recover from those incidents.181 Thus, as proposed, consistent with the final amendments, covered institutions will need to anticipate and prepare for the possibility that they may be denied access to a particular system (such as in the ransomware example offered by one commenter) and have procedures in place for complying with the notice requirements when applicable. Consistent with the proposal, the final amendments will require that covered institutions provide notices ‘‘as soon as practicable,’’ but not more than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The amount of time that would constitute ‘‘as soon as practicable’’ may vary based on several factors, such as the time required to assess, contain, and control the incident.182 The requirement to notify affected individuals as soon as practicable but not more than 30 days in 179 See final rule 248.30(a)(4)(iv); infra section II.A.3.e. (discussing in more detail the modification to the notice content requirements). 180 See CAI Comment Letter. 181 See supra section II.A; final rule 248.30(a). 182 For example, an incident of unauthorized access by a single employee to a limited set of sensitive customer information may take only a few days to assess, remediate, and investigate. In those circumstances a covered institution generally should provide notices to affected individuals at the conclusion of those tasks and as soon as the notices have been prepared. See Proposing Release at n.133. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 the final amendments is consistent with the purposes of the GLBA and reflects the importance of expeditious notification. The amendments are designed to help ensure that customers receive notification in a timely manner. It would be contrary to this policy goal for a covered institution to unduly delay notification to customers, for example by delaying notice until it has definitively concluded that a data breach incident has occurred, because this could result in excessively delayed notifications that could unnecessarily hinder affected customers from engaging their own remedial measures to protect their data. A covered institution should act promptly and must not delay its initial assessment of the available details of the incident as delaying notices could deprive customers of the ability to take prompt action to protect themselves. The 30-day outside timeframe under both the proposed and final rules begins following an incident involving customer information. This is consistent with the scope of the incident response program, which is required to address unauthorized access to or use of customer information. The outside timeframe does not begin from the time that the covered institution determines that an incident involved ‘‘sensitive customer information,’’ as suggested by one commenter.183 The commenter’s suggested modification would likely delay notification as compared to the final rule because covered institutions could take considerable time to determine that an incident involved sensitive customer information before the outside timeframe would begin and this could further delay any potential notice to affected individuals. (2) National Security and Public Safety Delay The final amendments will allow covered institutions to delay providing notice if the Attorney General determines that the notice required under the final amendments poses a substantial risk to national security or public safety, and notifies the Commission of such determination in writing, in which case the covered institution may delay such notice for a time period specified by the Attorney General, up to 30 days following the date when such notice was otherwise required to be provided.184 Previously referred to as the ‘‘law enforcement exception’’ in the proposal, the national security and public safety delay has been expanded to incorporate risks 183 IAA 184 See PO 00000 Comment Letter 1. final rule 248.30(a)(4)(iii). Frm 00017 Fmt 4701 Sfmt 4700 47703 related to public safety in addition to national security. In a modification of the proposal, in which the Attorney General would have informed only the covered institution in cases where this delay is granted, in the final amendments the Attorney General will instead inform the Commission, in writing, if the Attorney General determines that the notice poses a substantial risk to national security or public safety. This modification is designed to ensure that the Commission receives information related to a delay in notice in an efficient and timely manner. We have consulted with the Department of Justice to establish an interagency communication process to allow for the Attorney General’s determination to be communicated to the Commission in a timely manner. The Department of Justice will notify the covered institution that communication to the Commission has been made so that the covered institution may delay providing the notice. In another change from the proposal, the notice may be delayed for an additional period of up to 30 days if the Attorney General determines that the notice continues to pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing. In a further change in response to comments, in extraordinary circumstances, notice may be delayed for a final additional period of up to 60 days if the Attorney General determines that notice continues to pose a substantial risk to national security and notifies the Commission of such determination in writing. Beyond the final 60-day delay, if the Attorney General indicates that further delay is necessary, the Commission will consider additional requests for delay and may grant such delay through a Commission exemptive order or other action. By contrast, the proposed rules would have allowed a covered institution to delay notice only for an aggregate period of 30 days following a written request from the Attorney General to the covered institution, upon the expiration of which the covered institution would have been required to provide notice immediately. The modification to the proposed rule is designed to respond to concerns raised by commenters.185 One commenter stated that a delay in notifying affected individuals for law enforcement activity may cause harm to 185 The final amendments will align more closely with the Public Company Cybersecurity Rules on this point by incorporating a similar scope and timing for its national security and public safety delay. E:\FR\FM\03JNR2.SGM 03JNR2 47704 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations customers whose personal information has been exposed.186 In addition, this commenter asserted that notifying affected individuals would not impede a law enforcement investigation of the data security incident. Other commenters, however, urged the Commission to expand the proposed law enforcement exception because, in their view, the proposed exception was too narrowly drawn.187 Several of these commenters expressed concern that requests by local or State police, or even other Federal agencies, would not be sufficient to delay notification under the proposed rule.188 Some commenters stated concerns about the feasibility and process of reaching out to the Attorney General to request a delay in support of expanding the exception to permit other law enforcement agencies to direct a covered institution to delay a notice.189 Commenters also expressed particular concern around competing requirements, noting that many State regulations include a more permissive delay and that covered institutions, in an effort to comply with the proposed exception, may be put into the difficult and unnecessary position of being subject to conflicting requirements from the Commission and a State law enforcement entity.190 Further, commenters articulated that the proposed exception is excessively narrow because it only accommodates law enforcement actions that address concerns that rise to the level of ‘‘national security.’’ 191 In addition to concerns regarding the scope of the proposed law enforcement exception, several commenters opposed the length of time that a covered institution would be permitted to delay notice under the proposed rule.192 These commenters suggested that there should be no outside time limitation on the proposed law enforcement 186 Better Markets Comment Letter. e.g., IAA Comment Letter 1; SIFMA Comment Letter 2; NASDAQ Comment Letter; CAI Comment Letter; FII Comment Letter. 188 See, e.g., CAI Comment Letter; ICI Comment Letter 1; FII Comment Letter; SIFMA Comment Letter 2 (suggesting that the proposed law enforcement exception should also contemplate foreign law enforcement and include cooperation with international authorities). 189 See ICI Comment Letter; SIFMA Comment Letter 2. 190 See, e.g., ICI Comment Letter 1; NASDAQ Comment Letter; FII Comment Letter; IAA Comment Letter 1 (viewing the proposed exception as creating broader security risks for clients and advisers and forcing an adviser to choose between disregarding a law enforcement request or violating the rule). 191 CAI Comment Letter; ICI Comment Letter 1; SIFMA Comment Letter 2. 192 See, e.g., IAA Comment Letter 1; ICI Comment Letter 1; NASDAQ Comment Letter; SIFMA Comment Letter 2; CAI Comment Letter. lotter on DSK11XQN23PROD with RULES2 187 See, VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 exception, asserting that the judgment of any law enforcement agency investigating a breach should be an adequate and respected basis for delaying a regulatory notice regarding such breach. Commenters urged the Commission to expand the scope and timing requirements of the proposed law enforcement exception, expressing that they failed to understand the public purpose that would be served by ignoring the request of a law enforcement agency to delay notification.193 In response to commenters’ concerns, we have broadened both the scope and timing requirements of the delay in the final amendments. The final amendments will allow covered institutions to delay notice in cases where disclosure would pose a substantial risk to national security or public safety, contingent on a written notification by the Attorney General to the Commission.194 This provision has been expanded to incorporate risks related to public safety, and not just national security, as proposed. This expansion allows for notice delay in scenarios where there may be significant risk of harm from disclosure; however, there may not be a substantial risk to national security. This modification should make the provision sufficiently expansive to protect against significant risks of harm from disclosure—such as the risk of alerting malicious actors targeting critical infrastructure that their activities have been discovered—while also helping to ensure that individuals are not unduly denied timely access to information about the unauthorized access to or use of their sensitive customer information. With respect to commenters who recommended that other Federal agencies, State and local law enforcement agencies, and foreign law enforcement authorities also be permitted to trigger a delay or suggested that the perceived limited nature of this delay would cause conflict with State authorities, the rule does not preclude any such entity from requesting that the 193 See, e.g., IAA Comment Letter 1; NASDAQ Comment Letter; see also SIFMA Comment Letter 2 (stating its view that only for a limited number of cases would delay be requested or mandated by other government entities, or court orders, so notification delays would not become routine or be otherwise abused). 194 A covered institution requesting that the Attorney General determine that notification under the rule would pose a substantial risk to national security or public safety does not change the covered institution’s obligation to provide notice to affected customers within the timing required under the final amendments. This is because the rule permits a delay only upon the Attorney General making that determination and communicating it to the Commission in writing. PO 00000 Frm 00018 Fmt 4701 Sfmt 4700 Attorney General determine that the disclosure poses a substantial risk to national security or public safety and communicate that determination to the Commission. Designating a single law enforcement agency as the point of contact for both the covered institution and the Commission on such delays is critical to ensuring that the rule is administrable. Some commenters stated concerns about the feasibility and process of reaching out to the Attorney General to request a delay, urging the Commission to expand the delay to apply to requests made by other law enforcement agencies in addition to the Attorney General. The FBI, in coordination with the Department of Justice, has since provided guidance on how firms can request disclosure delays for national security or public safety reasons in connection with the Public Company Cybersecurity Rules.195 To the extent needed, further guidance may be issued on how other law enforcement agencies may contact the Department of Justice to request a delay. The final amendments also will expand the amount of time that a covered institution can delay notice under this provision. However, we are not persuaded, as some commenters suggested, that the rules should not incorporate a timing component at all because such an approach would diminish the goal of providing customers (regardless of State residency) with timely and consistent notification of data breaches so that they may take remedial action. This includes permitting, in extraordinary circumstances, a delay for a final additional period of up to 60 days— following two previous 30-day extensions—if the Attorney General determines that disclosure continues to pose a substantial risk to national security and notifies the Commission of such determination in writing. We are providing for this additional delay period in the final amendments, beyond what was originally proposed, and in addition to the two 30-day delays that may precede it, in recognition that, in extraordinary circumstances, national security concerns may justify additional delay beyond that warranted by public safety concerns, due to the relatively more critical nature of national security concerns.196 Beyond the final 60-day 195 See FBI Guidance to Victims of Cyber Incidents on SEC Reporting Requirements, available at: https://www.fbi.gov/investigate/cyber/fbiguidance-to-victims-of-cyber-incidents-on-secreporting-requirements. 196 Under the proposal, in contrast, the covered institution could delay a notice if the Attorney General informed the covered institution, in writing, that the notice poses a substantial risk to E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations delay, if the Attorney General indicates to the Commission in writing that further delay is necessary, the covered institution can request an additional delay that the Commission may grant through exemptive order or other action. These modifications acknowledge that additional time beyond that proposed may be necessary, as called for by commenters, while balancing national security and public safety concerns against affected individuals’ informational needs. e. Notice Contents and Format lotter on DSK11XQN23PROD with RULES2 The final amendments, consistent with the proposal, require that notices include key information with details about the incident, the breached data, and how affected individuals can respond to the breach to protect themselves. This requirement is designed to help ensure that covered institutions provide basic information to affected individuals that will help them avoid or mitigate substantial harm or inconvenience. In a modification from the proposal, however, the final amendments will not require the notice to ‘‘[d]escribe what has been done to protect the sensitive customer information from further unauthorized access or use.’’ Some of the information required by the final amendment, including information regarding a description of the incident, and the type of sensitive customer information accessed or used without authorization, will provide affected individuals with basic information to help them understand the scope of the incident and its potential ramifications. As proposed, the final amendments will require covered institutions to include contact information sufficient to permit an affected individual to contact the covered institution to inquire about the incident, including a telephone number (which should be a toll-free number if available), an email address or equivalent method or means, a postal address, and the name of a specific office to contact for further information and assistance, so that affected individuals can easily seek additional information from the covered institution. All of this information may help affected individuals assess the risk posed by the incident and whether to take additional measures to protect national security. The proposal provided that the covered institution could delay such a notice for a time period specified by the Attorney General, but not for longer than 15 days, plus an additional period of up to 15 days if the Attorney General determines that the notice continues to pose a substantial risk to national security. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 against harm from unauthorized access or use of their information. Similarly, as proposed, the final amendments will require information regarding the date of the incident, the estimated date of the incident, or the date range within which the incident occurred, if such information is reasonably possible to determine at the time the notice is provided. This requirement reflects the reality that a covered institution may have difficulty determining a precise date range for certain incidents because it may only discover an incident well after an initial time of access.197 In addition, as proposed, the final amendments will require that covered institutions include certain information to assist affected individuals in evaluating how they should respond to the incident. Specifically, if the affected individual has an account with the covered institution, the final amendments will require the notice to recommend that the customer review account statements and immediately report any suspicious activity to the covered institution. The final amendments will also require the notice to explain what a fraud alert is and how an affected individual may place a fraud alert in credit reports. Further, the final amendments will require that the notice recommend that the affected individual periodically obtain credit reports from each nationwide credit reporting company and that the individual have information relating to fraudulent transactions deleted. The notice must also explain how a credit report can be obtained free of charge. Lastly, the final amendments require that notices include information regarding FTC and usa.gov guidance on steps an affected individual can take to protect against identity theft, a statement encouraging the individual to report any incidents of identity theft to the FTC, and the FTC’s website address. These specific requirements are designed to give affected individuals resources and additional information to help them evaluate how they should respond to the incident. As proposed, under the final rules covered institutions will be required to provide the information specified in the final amendments in each required notice. While we recognize that relevant information may vary based on the facts and circumstances of the incident, customers will benefit from the same minimum set of basic information in all notices. Accordingly, the final amendments will permit covered institutions to include additional 197 See PO 00000 Proposing Release at n.142. Frm 00019 Fmt 4701 Sfmt 4700 47705 information but will not permit omission of the prescribed information. In addition, the final amendments will require covered institutions to provide notice in a clear and conspicuous manner and by means designed to ensure that the customer can reasonably be expected to receive actual notice in writing.198 Pursuant to 17 CFR 248.3, notices will therefore be required to be reasonably understandable and designed to call attention to the nature and significance of the information required to be provided in the notice.199 To the extent that a covered institution includes information in the notice that is not required to be provided to customers under the final amendments or provides notice contemporaneously with other disclosures, the covered institution will still be required to ensure that the notice is designed to call attention to the important information required to be provided under the final amendments; the inclusion of any additional information in the notice may not prevent the required information from being presented in a clear and conspicuous manner. The requirement to provide notices in writing, further, will ensure that customers receive the information in a format appropriate for receiving important information, with accommodation for those customers who agree to receive the information electronically.200 These requirements are designed to help ensure that customers are provided informative notifications and alerted to their importance. Several commenters broadly supported the proposed notice contents and format requirements.201 One commenter stated that the provision will lead to notices that contain important information in a clear and conspicuous manner, which will allow affected individuals to assess the risk of the incident paired with guidance on 198 See final rule 248.30(a)(4)(i); see also 17 CFR 248.9(a) (delivery requirements for privacy and opt out notices) and 17 CFR 248.3(c)(1) (defining ‘‘clear and conspicuous’’). 199 See 17 CFR 248.3(c)(2) (providing examples explaining what is meant by the terms ‘‘reasonably understandable’’ and ‘‘designed to call attention’’). 200 This requirement to provide notice ‘‘in writing’’ could be satisfied either through paper or, for customers who agree to receive information electronically, though electronic means consistent with existing Commission guidance on electronic delivery of documents. See Use of Electronic Media by Broker Dealers, Transfer Agents, and Investment Advisers for Delivery of Information; Additional Examples Under the Securities Act of 1933, Securities Exchange Act of 1934, and Investment Company Act of 1940 [61 FR 24644 (May 15, 1996)]; Use of Electronic Media, [65 FR 25843 (May 4, 2000)]. 201 See, e.g., Better Markets Comment Letter, IAA Comment Letter 1; NASAA Comment Letter. E:\FR\FM\03JNR2.SGM 03JNR2 47706 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 potential protective measures to take.202 Another commenter agreed with the proposed approach of requiring notices to contain certain information but not prescribing the specific format for the notices, asserting that this approach will ‘‘make it easier for covered institutions to fulfill all their notice obligations under Federal and State laws with as few notice documents as possible (ideally through a single notice to all affected customers nationwide).’’ 203 Conversely, a few commenters opposed certain aspects of the notice content and format requirements.204 One commenter expressed concern related to the proposed requirement for covered institutions to include in the notice specific efforts they have taken to protect the sensitive customer information from further unauthorized access or use.205 This commenter articulated that this information could be extremely useful to threat actors and not particularly useful to affected individuals.206 Another commenter urged the Commission to remove the requirement for covered institutions to provide ‘‘the date of the incident, the estimated date of the incident, or the date range,’’ asserting that this specific information is not required by the Banking Agencies’ Incident Response Guidance and should not be included in an amended Regulation S–P.207 In addition, two commenters suggested that the final amendments should provide more flexibility for covered institutions to determine the manner and method in which they should be contacted by affected individuals inquiring about an incident.208 Lastly, 202 Better Markets Comment Letter (stating that the provision ‘‘avoids some common problems with the content of many data breach notifications, such as confusing language, a lack of details, and insufficient attention to the practical steps customers should take in response.’’). 203 See NASAA Comment Letter (stating that ‘‘[b]eing prescriptive here could potentially create inconsistencies with current or future State notice laws, which in turn could cause covered institutions to feel compelled to deliver entirely duplicative notices to customers simply for reasons of form. Customers should not be burdened in this way, and the Reg. S–P Proposal rightly takes this into account.’’). 204 See, e.g., CAI Comment Letter; ICI Comment Letter 1; IAA Comment Letter. 205 IAA Comment Letter 1. 206 Id. (further stating that in many cases ‘‘the adviser will have already remediated the vulnerability, making the information even less relevant to a client’s decision.’’). 207 ICI Comment Letter 1. 208 CAI Comment Letter; SIFMA Comment Letter 2 (asserting that the rule should not require each of a telephone number, an email address, a postal address and a specific office contact, but rather should allow covered institutions to choose one or more of those contact options based on how the covered institution normally interacts with its customers). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 one commenter urged the Commission to consider whether it should require specific notice obligations at all, asserting that Federal notice would simply add another layer on top of existing State data breach notice requirements and would offer limited benefits to affected individuals.209 After considering comments, we are removing the specific requirement in the proposal that the notice ‘‘[d]escribe what has been done to protect the sensitive customer information from further unauthorized access or use.’’ We agree that this information has the potential to advantage threat actors and does not provide actionable information for affected individuals. Accordingly, the provision has been removed from the final amendments, which should reduce the perceived risk of providing a roadmap for threat actors compared with the proposal. Covered institutions may, however, voluntarily disclose details related to the incident’s remediation status. The final amendments do not modify the proposed requirement for covered institutions to provide information about the date of the incident, as suggested by one commenter.210 Providing this information to affected individuals, to the extent the information is reasonably possible to determine, can help affected individuals identify the point in time in which their sensitive customer information was compromised, thus providing critical details that affected individuals can use to take targeted protective measures (e.g., review account statements) to mitigate the potential harm that could result from the unauthorized access to or use of their sensitive customer information. For this reason, we disagree with the commenter that stated firms should not be required to provide this information in their notice. Similarly, the final amendments do not modify the requirement for notices to include the prescribed contact information sufficient to permit an affected individual to contact the covered institution to inquire about the incident. We understand that covered institutions communicate with their customers using many different methods and formats. However, providing a telephone number, an email address or equivalent method or means (e.g., an online submission form), a postal address, and the name of a specific office to contact, is designed to 209 See CAI Comment Letter; see also NASDAQ Comment Letter (asserting that covered institutions ‘‘should be permitted to comply with various State and Federal cybersecurity notification obligations with a single streamlined form.’’). 210 ICI Comment Letter 1. PO 00000 Frm 00020 Fmt 4701 Sfmt 4700 provide sufficient optionality for affected individuals, who may have differing preferences and aptitudes in their use of contact methods.211 Nothing in this requirement, however, prevents a covered institution from choosing to provide additional contact methods. Lastly, the final amendments do not prescribe a specific format for the notice to affected customers. We agree with the commenter that asserted that such flexibility will make it easier for covered institutions to provide notices that meet the requirements of the final amendments while also meeting the requirements of other notice obligations, such as certain State requirements, and thereby mitigates commenter concerns about the potential for more than one notice covering a given incident. 4. Service Providers The final amendments require that each covered institution’s incident response program include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence on and monitoring, of service providers, including to ensure that the covered institution satisfies the customer notification requirements set forth in paragraph (a)(4) of the final amendments.212 In a modification from the proposal, rather than requiring written policies and procedures requiring the covered institution to enter into a written contract with its service providers to take certain appropriate measures, the policies and procedures required by the final amendments must be reasonably designed to ensure service providers take appropriate measures to: (A) protect against unauthorized access to or use of customer information; and (B) provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware of a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider.213 211 In addition, the final rule’s requirement to provide contact information sufficient to permit an affected individual to inquire about the incident does not preclude a covered institution from providing the contact information of a third-party service provider that has been engaged by the covered institution to provide specialized information or assistance about the unauthorized access or use of sensitive customer information on the covered institution’s behalf. See CAI Comment Letter (asserting that it is current business practice for companies to hire vendors who provide specialized breach response call centers to handle consumer inquiries). 212 See final rule 248.30(a)(5)(i). 213 See id. In the proposal, the covered institution’s written contract with its service E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations In a modification from the proposal, upon receipt of such notification, a covered institution must initiate its incident response program pursuant to paragraph (a)(3) of this section.214 The final amendments thus modify the proposal by removing the written contract requirement and shifting the notification deadline for the service provider’s notification of the covered institution from 48 to 72 hours, while retaining the notice trigger of the service provider ‘‘becoming aware of’’ a breach in security resulting in unauthorized access to a customer information system maintained by the service provider.215 However, the Commission is adopting as proposed final amendments that provide that a covered institution, as part of its incident response program, may enter into a written agreement with its service provider to notify affected individuals on the covered institution’s behalf in accordance with paragraph (a)(4) of the final amendments.216 In a modification from the proposal, the final amendments provide that even where a covered institution uses a service provider in accordance with paragraphs (a)(5)(i) and (ii) of the final amendments, the covered institution’s obligation to ensure that affected individuals are notified in accordance with paragraph (a)(4) of the final amendments rests with the covered institution.217 Finally, the Commission is also defining a ‘‘service provider’’ at adoption to mean any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution.218 As discussed further below, this definition removes language from the proposed definition relating to third parties, but does so solely to make plain that the definition of a ‘‘service provider’’ can include affiliates of a covered institution.219 a. Covered Institutions’ Incident Response Program Obligations Regarding Service Providers In a change from the proposed rule, the Commission is adopting the final amendments without requiring covered institutions to enter into a written contract with their service providers.220 Instead, the final amendments require that a covered institution’s incident response program ‘‘include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of the covered institution’s service providers, including to ensure that the covered institution notifies affected individuals as set forth in paragraph (a)(4),’’ in the event of a breach at the service provider.221 Further, while the final amendments do not require covered institutions to enter into a written contract, the final amendments incorporate the protections that would have been required in the proposed written contract 222 by requiring that a lotter on DSK11XQN23PROD with RULES2 218 See provider would have needed to require the service providers to take appropriate measures designed to protect against unauthorized access to or use of customer information, including notification to the covered institution as soon as possible, but no later than 48 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system maintained by the service provider to enable the covered institution to implement its response program. See proposed rule 248.30(b)(5)(i). 214 See id. As discussed further below, this modification responds to comments by incorporating into rule text the Commission’s intention that covered institutions would ‘‘expeditiously’’ implement their incident response program following the receipt of such notification from a service provider, as discussed in the Proposing Release. See infra footnote 223 and accompanying discussion on clarifying modifications. See also Proposing Release at Section II.A.3. 215 See final rule 248.30(a)(5)(i). 216 See final rule 248.30(a)(5)(ii). 217 See final rule 248.30(a)(5)(iii). As discussed further below, this modification is intended to clarify covered institutions’ responsibilities under the final amendments by incorporating into rule text the Commission’s intended scope, as discussed in the Proposing Release. See discussion on Delegation of Notice and Covered Institutions’ Customer Notification Obligations infra Section II.A.4.c. and footnote 264, including accompanying discussion on clarifying modifications. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 final rule 248.30(d)(10). stated below, this modification from the proposal responds to comments by incorporating into rule text the Commission’s intended scope of the ‘‘service provider’’ definition, as discussed in the Proposing Release. See discussion on the Service Provider definition infra footnote 271, including accompanying discussion on clarifying modifications. See also proposed rule 248.30(e)(10). 220 See proposed rule 248.30(b)(5)(i). See also supra footnote 213 and accompanying discussion. 221 See final rule 248.30(a)(5)(i). In the Proposing Release, we requested comment on whether the proposed written contract requirement should instead require that a covered institution adopt policies and procedures that ‘‘require due diligence of or some type of reasonable assurances from its service providers.’’ See Proposing Release at section II.A.3. We also encouraged commenters to review our separate proposal to prohibit registered investment advisers from outsourcing certain services or functions without first meeting minimum due diligence and monitoring requirements to determine whether that proposal might affect their comments on the Proposing Release. See Proposing Release at section G.2, n.300; see also Outsourcing by Investment Advisers, Investment Advisers Act Release No. 6176 (Oct. 26, 2022) [87 FR 68816 (Nov. 16, 2022)]. The due diligence standards we are adopting are intended to address related concerns raised by commenters who requested that we adopt a more principles-based set of requirements. 222 See supra footnote 213 and accompanying discussion of the substantive obligations that were 219 As PO 00000 Frm 00021 Fmt 4701 Sfmt 4700 47707 covered institution’s policies and procedures be reasonably designed to ensure service providers take the appropriate measures to: (A) protect against unauthorized access to or use of customer information, and (B) provide notification to the covered institution in the event of a breach resulting in unauthorized access to a customer information system maintained by the service provider, in accordance with the timing and notice trigger conditions discussed further below. Finally, in a modification from the proposal, upon receipt of such notification, a covered institution must initiate its incident response program adopted pursuant to paragraph (a)(3) of this section.223 Two commenters expressed varying degrees of support for requiring a written contract between a covered institution and its service providers.224 One such commenter expressed support for requiring a specific contractual agreement with a service provider, stating that the information covered by the service provider provision is already subject to a contractual agreement between the covered institution and the service provider.225 The other commenter agreed that service providers should be contractually required to take appropriate risk-based measures and due diligence to protect against unauthorized access to or use of customer information, but suggested that for flexibility in oversight covered institutions should be permitted to rely on ‘‘reasonable assurances’’ from service providers that they have taken appropriate measures to protect customer information.226 included in the proposal’s written contract requirement. 223 See final rule 248.30(a)(5)(i). 224 See ICI Comment Letter. While this commenter supported a written contract requirement, it did assert that the Commission should adopt a longer compliance period due to the necessity of renegotiating existing contracts with service providers to align the breach notification provisions in those contracts to the rule’s requirements. This comment is separately addressed below. See also SIFMA Comment Letter 2. 225 See ICI Comment Letter. Specifically, this commenter stated that the information that is covered by proposed rule 248.30(b)(5) ‘‘is already subject to a contractual agreement between the covered institution and the service provider.’’ Id. This commenter further explained it is opposing the contractual requirement because of its very narrow scope, specifically stating that ‘‘as drafted, [the requirement] would only apply to any service provider that receives, maintains, processes, or otherwise is permitted access to customer information through the service provider’s provision of services directly to the covered institution.’’ Id. 226 See SIFMA Comment Letter 2. E:\FR\FM\03JNR2.SGM 03JNR2 47708 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 Several commenters opposed this proposed requirement.227 Specifically, two commenters asserted that the written contract requirement would harm covered institutions, which may not have the negotiating power or leverage to demand specific contractual provisions from large third-party service providers, particularly where specific provisions are ‘‘inconsistent with the business imperatives’’ of the service provider and/or in the case of small covered institutions.228 A number of commenters also suggested alternatives to either adopting a written contract requirement or, if such a requirement is adopted, to mandating specified contractual requirements.229 Two commenters suggested that rather than requiring specific practices to be included within a written contract, the Commission should structure the final amendments to enable covered institutions to take a risk-based approach to due diligence and thirdparty risk management that integrates reliance on independent certifications, attestations, and industry standards as a sufficient means of assessing and determining whether the service provider is appropriately addressing these risks to an adequate standard.230 Meanwhile, another commenter who opposed the contractual requirement suggested the Commission should provide covered institutions with the flexibility to oversee their service providers ‘‘based on the nature and size of their businesses and in light of the risks posed by the facts and 227 See, e.g., AWS Comment Letter; IAA Comment Letter 1 (stating that [covered institutions] should not be required to enter into written agreements with service providers); Google Comment Letter; STA Comment Letter 2; and CAI Comment Letter (stating that many leading service providers (such as cloud service providers) do not negotiate the standard terms of their services with customers and those standard terms generally would not meet the proposed contractual requirements). 228 See IAA Comment Letter 2; see also STA Comment Letter 2. 229 See SIFMA Comment Letter 2; AWS Comment Letter; Google Comment Letter; and IAA Comment Letter 1. 230 See AWS Comment Letter (suggesting that in order to address the practical difficulties of compliance, the Commission should provide covered institutions with a flexible approach to achieving compliance with the service provider provisions that relies on the use of independent certifications, attestations, and adherence to industry standards); see also Google Comment Letter (suggesting that rather than prescribing the specific practices that must be included in the contract, (a) contracts should require service providers to implement and maintain appropriate measures that are consistent with industry standards, and (b) each covered entity should oversee its providers to assess if the provider addresses the relevant practices to an adequate standard—noting this activity can be supported with third party certifications and standards). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 circumstances.’’ 231 Finally, one commenter suggested that it was unclear how a third-party service provider’s notice to a covered institution would affect a covered institution’s own obligations.232 Eliminating the written contract requirement from the final amendments, while enhancing the policies and procedures obligation, strikes an appropriate balance between providing covered institutions with greater flexibility in achieving compliance with the requirements of this rule within the context of their service provider relationships, while also helping to ensure the investor protections afforded by the final amendments are maintained when covered institutions utilize service providers. In particular, as adopted, the enhanced policies and procedures obligations will enable covered institutions to identify and utilize the most appropriate means for their business of achieving compliance with the final amendments through policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of their service providers. Providing this flexibility will help address commenters’ concerns about imposing a written contractual agreement for covered institutions, particularly those that are small entities, which may not have sufficient negotiating power or leverage to demand specific contractual provisions from a large third-party service provider. At the same time, the enhanced policies and procedures requirements will provide for effective safeguarding of customer information when it is received, maintained, processed, or otherwise accessed by a service provider, as well as timely notice to customers affected by a breach at a covered institution’s service provider, by requiring that the policies and procedures be reasonably designed to: (1) require oversight, including through due diligence and monitoring, of service providers, including to ensure that the covered institution notifies affected individuals as required in paragraph (a)(4) and (2) ensure service providers take appropriate measures to protect against the unauthorized access to or use of customer information and provide covered institutions with timely notification of a breach so that the covered institution can carry out their incident response program. While the final amendments thus provide increased flexibility as to a covered institution’s means of 231 See 232 See PO 00000 IAA Comment Letter 1. ACLI Comment Letter. Frm 00022 Fmt 4701 Sfmt 4700 overseeing its service providers, the modification the Commission is making at adoption does not lower the standard of a covered institution’s substantive oversight obligations. Some covered institutions may find that such oversight can be accomplished more easily and less expensively through less formal arrangements in certain circumstances, based on the covered institution’s relationship with its service provider, as well as the scope of the services that are now or will be provided over the course of the relationship.233 However, regardless of the means and arrangements employed, the covered institution must ensure that any service provider it decides to utilize takes appropriate measures to (A) protect against unauthorized access to or use of customer information, and (B) provide breach notifications to the covered institution as required by these final amendments. Further, while it may be helpful to a covered institution in achieving compliance with the final amendments to receive ‘‘reasonable assurances’’ from its service providers that they have taken appropriate measures to both protect customer information and provide timely notification to the covered institution in the event of a relevant breach of the service provider’s customer information systems, reliance solely on such assurances may be insufficient depending on the facts and circumstances, for example when a covered institution knows, or has reason to know, that such assurance is inaccurate. Instead, the final rules require the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of the service provider to ensure the covered institution will be able to satisfy the obligations of paragraph (a)(4). Further, covered institutions generally should consider reviewing and updating these policies and procedures periodically throughout their relationship with a service provider, including updates designed to address any information learned during the course of their monitoring. The final amendments provide covered institutions with flexibility in overseeing their service provider relationships, while helping to ensure the additional investor protections intended by these final amendments are 233 Although a written contract is not required under the final amendments, covered institutions should generally consider whether a written contract that memorializes the expectations of both covered institutions and their service providers is appropriate. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations still achieved. Consistent with this riskbased approach, covered institutions may wish to consider employing such tools as independent certifications and attestations obtained from the service provider, as suggested by some commenters, as part of their policies and procedures to require oversight, including through due diligence and monitoring, of the service provider. However, the covered institution’s written policies and procedures must be reasonably designed under the circumstances, and the covered institution’s oversight of its service providers pursuant to those written policies and procedures generally should be tailored to the facts and circumstances of the two parties’ relationship, which may or may not include the use of such tools. Further, as stated above, we are modifying the proposed rule to state that upon a covered institution’s receipt of a service provider’s notification, the covered institution must initiate its incident response program required by paragraph (a)(3) of the rule.234 The Commission is adopting this modification in response to comment requesting clarification of a covered institution’s obligations upon receipt of service provider breach notifications.235 Further, this modification helps further align the final amendments with the intended purpose of the service provider’s breach notifications, as discussed in the Proposing Release.236 While receipt of such notice automatically triggers the covered institution’s obligation to initiate the procedures of its incident response program, such notice is not a necessary predicate to trigger this obligation for incidents occurring at the service provider. A covered institution also must initiate its incident response program where the covered institution has otherwise independently detected an incident of unauthorized access to or use of customer information at the service provider.237 Finally, some commenters asked that we consider making any new obligations with respect to a written contract requirement forward-looking so final rule 248.30(a)(5)(i). ACLI Comment Letter. 236 This modification is consistent with the intended purpose of this notification, as discussed in the Proposing Release. See Proposing Release at Section II.A.3 stating that the purpose of breach notifications to be provided by service providers to a covered institution is ‘‘to enable the covered institution to implement its incident response program expeditiously.’’ 237 See final rule 248.30(a)(3). See also discussion on covered institutions’ required Incident Response Program Including Customer Notification supra Section II.A. as not to disrupt contracts already in existence by requiring renegotiation, and that we should further extend the compliance date to address this.238 As we are adopting the rule without a written contract requirement, these comments have become moot.239 b. Deadline for Service Provider Notice to Covered Institutions and Notice Trigger As described above, the final amendments require that a covered institution’s policies and procedures be reasonably designed to ensure service providers take appropriate measures to provide covered institutions with notice ‘‘as soon as possible, but no later than 72 hours after becoming aware of a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider.’’ 240 This modification extends the proposed timeframe for service providers to provide such notice to 72 hours, but maintains the proposed notice triggering event to initiate this timeframe of the service provider becoming aware of a breach.’’ 241 Commenters addressed both the notification deadline and the triggering event for notifications to be provided by service providers to covered institutions in the event of a relevant breach involving unauthorized access to a customer information system maintained by the service provider. As to the notification deadline, one commenter supported requiring service providers to notify a covered institution within 48 hours of a breach impacting the covered institution or affected individuals, stating its understanding is that this is ‘‘not an uncommon arrangement’’ today between covered institutions and service providers maintaining their nonpublic personal information (e.g., between investment companies and transfer agents).242 Another commenter raised concerns that a standard of ‘‘as soon as possible, but no later than 48 hours after becoming aware of a breach,’’ when paired with a written contract requirement, might impose formidable challenges to covered institutions in 234 See lotter on DSK11XQN23PROD with RULES2 235 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 238 See, e.g., Computershare Comment Letter; Google Comment Letter; ICI Comment Letter. 239 See discussion of compliance date infra section II.F. 240 See final rule 248.30(a)(5)(i). In the proposed rule, such notice would have been required ‘‘as soon as possible, but no later than 48 hours after becoming aware of a breach, in the event of any breach in security resulting in unauthorized access to a customer information system maintained by the service provider.’’ See proposed rule 248.30(a)(5)(i). 241 See Proposing Release at section II.A.3. 242 See ICI Comment Letter. PO 00000 Frm 00023 Fmt 4701 Sfmt 4700 47709 mandating such contractual provisions with service providers who are not explicitly subject to Commission jurisdiction, and may have their own policies and procedures addressing breaches.243 Several commenters suggested the Commission adopt a 72hour notification deadline.244 In particular, one such commenter stated that this notification provision should be extended to ‘‘as soon as possible but no later than 72 hours,’’ to harmonize the Commission’s standard with a number of related Federal, State, and international regulatory deadlines governing required service provider notification to financial institutions in the event of a cyber incident, and also further the White House’s and Congress’s express policy of harmonizing cyber incident reporting requirements.245 Finally, this commenter stated that a consistent 72hour reporting deadline would promote more effective cybersecurity incident response and cyber threat information sharing than shorter, or varied reporting periods, and that a 48-hour deadline in the commenter’s experience would lead to ‘‘premature reporting’’ that increases the likelihood of reporting inaccurate or incomplete information and tends to create confusion and uncertainty.246 In contrast, some commenters recommended modifying the proposal to remove any specified duration for a reporting deadline.247 Several 243 See Computershare Comment Letter. Letter from Microsoft Corporation (June 5, 2023) (‘‘Microsoft Comment Letter’’); AWS Comment Letter (this commenter ‘‘encourage[d] the Commission’’ to consider a longer reporting deadline than 48 hours to ‘‘support the dedication of resources needed to discover and mitigate potential harm caused by an incident,’’ and highlighted the 72-hour reporting timeframe that ‘‘CIRCIA contemplates. . .for national critical infrastructure, including the financial services sector’’ in the alternative.). 245 See Microsoft Comment Letter (explaining that use of this 72-hour reporting deadline would align the SEC’s rules with other notification requirements that may apply to entities covered by the Proposed Rules, and identifying additional authorities that use the 72-hour deadline, such as the CIRCIA, Pub. L. 117–103, 136 Stat. 49 (2022); Executive Order 14028, ‘‘Improving the Nation’s Cybersecurity,’’ 86 FR 26,633 (May 12, 2021), directing the Federal government to incorporate a 72-hour reporting period into the Federal Acquisition Regulation (‘‘FAR’’); the Defense Federal Acquisition Regulation Supplement (‘‘DFARS’’), 48 CFR 204.7302(b) and 252.204–7012(c); the New York State Department of Financial Services’ (‘‘NYDFS’’) Cybersecurity Requirements for Financial Service Companies, 23 NYCRR section 500.17(a); the European Union’s General Data Protection Regulation (‘‘GDPR’’), Regulation (EU) 2016/679; and Article 23 of the EU’s new Network and Information Security Directive (‘‘NIS 2 Directive’’), Directive (EU) 2022/2555). 246 Id. 247 See, e.g., Schulte Comment Letter; SIFMA Comment Letter 2. 244 See E:\FR\FM\03JNR2.SGM 03JNR2 47710 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 commenters suggested that rather than an inflexible time deadline, the Commission should require that notification be provided without unreasonable delay after a reasonable investigation has been performed by the service provider.248 Another commenter stated that rather than mandating any form of a deadline, the time period should be left to covered institutions and service providers to negotiate, accounting for the nature of services and customer data.249 As to the triggering event requiring service providers to notify covered institutions of a relevant breach, one commenter urged the Commission to shift from the service provider ‘‘becoming aware’’ of a breach that entailed unauthorized access to customer information, to the service provider ‘‘determining’’ that such a breach had occurred.250 This commenter asserted that the process of ‘‘becoming aware’’ will involve time and resources to investigate and that changing to a ‘‘determining’’ standard may minimize pressure on the service provider to report prior to performing sufficient investigation, while helping harmonize regulatory approaches across the financial sector, as it would align with similar requirements adopted by Federal banking agencies related to notice provided by bank service providers.251 Another commenter stated the Commission should, in addition to shifting to a 72-hour reporting deadline, amend the trigger initiating this reporting deadline to the moment the service provider ‘‘has a reasonable basis to conclude that a notifiable incident has occurred or is occurring.’’ 252 Other commenters suggested narrowing the scope of incidents that would trigger required notice by service 248 See, e.g., SIFMA Comment Letter 2 (stating this modification would harmonize with the Proposed Interagency Guidance on Third-Party Relationships: Risk Management, 86 FR 38182, 38184 (proposed July 19, 2021)); ACLI Comment Letter (stating this modification would harmonize service provider and covered entity requirements); and Federated Comment Letter. 249 See Schulte Comment Letter. This commenter stated that by mandating a 48-hour limit, service providers would be ‘‘left with the impractical challenge of allocating resources to making disclosures to counterparties (i) when resources could be better allocated to identifying and containing the scope of the data breach, and (ii) before the service provider has a complete picture of the impact of a data breach.’’ See id. 250 See Google Comment Letter. 251 See Google Comment Letter (referencing Computer-Security Incident Notification Requirements for Banking Organizations and Their Bank Service Providers, available at: fdic.gov/news/ board-matters/2021/2021-11-17-notationalfr.pdf?source=govdelivery&utm_ medium=email&utm_source=govdelivery). 252 See Microsoft Comment Letter. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 providers to a covered institution.253 One commenter asserted that incident response program requirements should only address and be triggered by incidents that involve unauthorized access to or use of a subset of customer information (e.g., sensitive customer information).254 Another commenter stated that the proposal would result in notices to a covered institution if there has been unauthorized access to the service provider’s customer information system, regardless of whether the covered institution’s customers were in any way affected by the breach.255 Instead, the commenter stated that the Commission should limit the scope of incidents requiring notification to a covered institution to only those resulting in unauthorized access to that covered institution’s ‘‘customer information’’ maintained by the service provider.256 After consideration, the Commission is extending the deadline for providing notification from 48 to 72 hours. Although we appreciate that the 48-hour standard in the proposed amendments may not be an uncommon arrangement between covered institutions and their service providers in the market today, extending this deadline by 24 hours will provide service providers with additional time to conduct more effective investigations of a breach at the service provider, resulting in more relevant and accurate notifications to the covered institution. Further, the 72hour standard brings this notification deadline in alignment with other existing regulatory standards, which should reduce costs to service providers and covered institutions without sacrificing the investor protection benefits of the rule.257 The Commission disagrees that there should be no specified notification deadline and that covered institutions and service providers should be able to negotiate the appropriate timing for 253 See Schulte Comment Letter; SIFMA Comment Letter 2. 254 See Schulte Comment Letter. 255 See SIFMA Comment Letter 2. 256 See id. 257 As discussed above, a 72-hour reporting deadline aligns with, among others, requirements in CIRCIA that include a 72-hour deadline for entities to report cyber incidents to CISA, Executive Order 14028 on ‘‘Improving the Nation’s Cybersecurity,’’ which directs the Federal government to incorporate a 72-hour reporting period into the FAR, the DFARS, NYDFS’s cybersecurity regulations, which include a 72-hour reporting deadline to NYDFS after any determination that a cybersecurity incident has occurred at the covered entity, its affiliates, or a third-party service provider, the European Union’s GDPR, as well as the European Union’s NIS 2 Directive. See discussion of Microsoft Comment Letter and cited regulatory frameworks supra footnote 245. PO 00000 Frm 00024 Fmt 4701 Sfmt 4700 such notification. As discussed above, upon receipt of the breach notification from the service provider, a covered institution must initiate its incident response program adopted pursuant to paragraph (a)(3) of the final amendments.258 As covered institutions cannot reasonably be expected to initiate their incident response programs for incidents occurring at a service provider that the covered institution is not yet aware have occurred, providing the indefinite timeline commenters suggest could significantly hinder the effectiveness of covered institutions’ incident response programs.259 For example, delays in the service provider’s notification to the covered institution of a breach could result in further delays in the initiation of the incident containment and control procedures the covered institution has adopted pursuant to its incident response program obligations, consequently diminishing their effectiveness. Further, any excess delay in the service provider’s notification to the covered institution and resulting delay in the covered institution’s initiation of its incident response program, could significantly hinder the goal of the final amendments of providing customers with timely notification of data breaches so that they may take remedial action. In light of this, reasonably designed policies and procedures generally should also account for instances where the covered institution determines that a service provider has failed to provide notice to the covered institution within 72 hours as required. In such circumstances, in addition to initiating its incident response program upon receipt of the notice as required, a covered institution generally should reevaluate its policies and procedures governing its relationship with the service provider and make adjustments as necessary to ensure the service provider will take the required appropriate measures going forward. Further, the Commission is adopting as proposed the ‘‘becoming aware of’’ standard for triggering a service provider’s breach notifications to a covered institution. This standard is 258 See supra footnote 237 and accompanying discussion. 259 While a covered institution’s receipt of such notice from a service provider establishes such awareness, as discussed above, where a covered institution has otherwise independently detected an incident of the unauthorized access to or use of customer information at the service provider, it must implement its incident response program under paragraph (a)(3) of the final amendments regardless of any notice provided by the service provider. See supra footnote 237 and accompanying discussion. See also final rule 248.30(a)(3). E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 intended to enable the covered institution to implement its incident response program expeditiously. While the Commission believes it is appropriate, as discussed above, to extend the timeframe for service provider notifications from 48 to 72 hours, adopting either a ‘‘having a reasonable basis to conclude’’ standard or a ‘‘determining’’ standard could frustrate the investor protection goals of these final amendments. Specifically, adopting either of these alternative standards could result in undue delays in a service provider’s notification to the covered institution beyond the point at which the service provider is already aware that a relevant breach has occurred. Such a delay would frustrate the goal of both enabling covered institutions to initiate their incident response program expeditiously, as well as the goal of providing timely notification to affected individuals. For similar reasons, given that the ‘‘determining’’ standard used by Federal banking regulators involves a different context—notice to the banking organization of downgraded or degraded services—adopting it here solely to harmonize regulatory approaches would be inappropriate.260 Accordingly, the final amendments maintain the proposed ‘‘becoming aware of’’ standard for triggering a service provider’s notification. The Commission also is not limiting the scope of incidents to be reported to covered institutions to only those involving ‘‘sensitive customer information’’ or alternatively to breaches that result in unauthorized access to ‘‘customer information’’ maintained by the service provider rather than those that result in unauthorized access to a service provider’s ‘‘customer information system.’’ Under the final amendments, a covered institution’s incident response program must be reasonably designed to ‘‘detect, respond to, and recover from unauthorized access to or use of customer information,’’ and must include provisions to assess such incidents to ‘‘identify the customer information systems and types of customer information that may have been accessed or used without authorization’’ and take appropriate 260 Specifically, the Federal banking agency regulations require notification from the bank service provider to ‘‘each affected banking organization customer as soon as possible when the bank service provider determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to the banking organization for four or more hours.’’ See 12 CFR 304.24(a). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 steps to ‘‘contain and control the incident to prevent further unauthorized access to or use of customer information.’’ 261 As discussed above, in doing so, we are requiring that covered institutions’ incident response programs address any incident involving customer information—not merely those involving sensitive customer information—and also account for the identification of affected customer information systems in addition to the types of customer information that may have been accessed or used without authorization.262 For the same reasons, we are not limiting the scope of reportable incidents to only those breaches in security at the service provider that result in unauthorized access to sensitive customer information, or alternatively to only those breaches that result in unauthorized access to ‘‘customer information’’ maintained by the service provider. c. Delegation of Notice and Covered Institutions’ Customer Notification Obligations The Commission is adopting as proposed language that permits covered institutions, as part of their incident response programs, to enter into a written agreement with their service providers to notify affected individuals on the covered institution’s behalf.263 However, the Commission is also adopting a new paragraph that states that, notwithstanding any covered institution’s use of a service provider, the covered institution’s obligation to ensure that affected individuals are notified in accordance with this rule rests with the covered institution.264 One commenter stated that it is appropriate to permit a covered institution to enter into a written agreement with its service provider to notify affected individuals on the 261 See final rule 248.30(a)(3)(i) and (ii). See also discussion of the Assessment and Containment and Control portions of covered institutions’ incident response program requirements supra sections II.A.1 and II.A.2. 262 See discussion of incident response program Assessment and Containment and Control requirements, and the reasons for not restricting such requirements to only ‘‘sensitive customer information’’ supra Sections II.A.1 and II.A.2. See also discussion of incident response program Containment and Control requirements and the reasons for requiring identification of both the customer information systems as well as types of customer information that may have been accessed or used without authorization supra Section II.A.2. 263 See final rule 248.30(a)(5)(ii) (stating ‘‘As part of its incident response program, a covered institution may enter into a written agreement with its service provider to notify affected individuals on its behalf in accordance with paragraph (a)(4) of this section.’’); see also proposed rule 248.30(b)(5)(ii). 264 See final rule 248.30(a)(5)(iii). PO 00000 Frm 00025 Fmt 4701 Sfmt 4700 47711 covered institution’s behalf, so long as the notification is actually ultimately provided to customers in a manner that satisfies the covered institution’s notice obligations.265 The Commission agrees that there may be situations where a covered institution’s service provider is better situated than the covered institution to provide a customer a breach notification. Thus, the Commission is adopting paragraph (a)(5)(ii) as proposed.266 At the same time, the Commission is adopting a new paragraph (a)(5)(iii) to specify that even where a covered institution uses a service provider, the obligation to ensure that affected individuals are notified in accordance with the rule rests with the covered institution.267 While the proposing release included similar language,268 the final rule explicitly provides that the covered institution will be obligated to satisfy the customer notification requirements of paragraph (a)(4) in the event of a relevant breach occurring at the service provider. The Commission 265 See Schulte Comment Letter (stating that if the service provider was the victim of a cyber-attack that included unauthorized access to the covered institution’s sensitive customer information, the service provider would be better situated to notify the affected customers). 266 As discussed below infra footnote 391 and in the accompanying discussion, in accordance with the recordkeeping provisions adopted in these final amendments, covered institutions, other than funding portals, are required to preserve a copy of any notice transmitted by the service provider to any customer on the covered institution’s behalf following the covered institution’s determination made regarding whether notification is required pursuant to 17 CFR 248.30(a)(4). See also discussion of funding portal recordkeeping requirements infra footnote 385. 267 See final rule 248.30(a)(5)(iii) (specifically stating ‘‘Notwithstanding a covered institution’s use of a service provider in accordance with paragraphs (a)(5)(i) and (ii), the obligation to ensure that affected individuals are notified in accordance with paragraph (a)(4) of this section rests with the covered institution’’). 268 In the proposal, the Commission stated that in such a circumstance where the covered institution has delegated performance of its notice obligation to a service provider through written agreement, the covered institution would remain responsible for any failure to provide a notice as required by the proposed rule. See Proposing Release at II.A.3. The Commission also stated in the proposal that covered institutions may delegate other functions to service providers, such as reasonable investigation to determine whether sensitive customer information has not been and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience, but covered institutions would remain responsible for these functions even if they are delegated to service providers. See id. at footnote 93; see also discussion of paragraph (a)(4) customer notification obligations supra section II.A.3. Under new paragraph (a)(5)(iii), covered institutions may still delegate such functions to service providers as stated in the proposal, but the rule text expressly states that the ultimate obligation to ensure affected individuals are notified in accordance with paragraph (a)(4) will remain with the covered institution. E:\FR\FM\03JNR2.SGM 03JNR2 47712 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 agrees that in providing flexibility to covered institutions by permitting them to enter into a written agreement with their service providers to notify affected individuals on the covered institution’s behalf, such notification to customers should be provided in a manner that satisfies the covered institution’s notice obligations. Accordingly, where a covered institution has entered into a written agreement with its service provider to provide notice on the covered institution’s behalf, the covered institution must ensure that the service provider has satisfied the customer notification obligations.269 To accomplish this, the covered institution’s policies and procedures should consider including steps for conducting reasonable due diligence to confirm that the service provider has provided notice to affected customers. In addition to maintaining a copy of any notice transmitted to affected individuals by the service provider on the covered institution’s behalf as required by the covered institution’s (other than funding portals) recordkeeping obligations under the final amendments,270 effective due diligence might also include obtaining confirmation of delivery of such notification in the form of attestations or certifications made by the service provider. Covered institutions could also consider confirming with a sample of affected customers that they received such service provider notifications. In addition, where the covered institution has entered into a written agreement with its service provider to provide notice on the covered institution’s behalf pursuant to paragraph (a)(5)(ii), and the covered institution determines that the service provider has not provided such notifications in a manner that satisfies the conditions of paragraph (a)(4), the covered institution must still ensure that notification is provided to the customer, and the covered institution’s policies and procedures generally should be designed to address these instances. To accomplish this, the covered institution generally should conduct timely due diligence to identify 269 See final rule 248.30(a)(5)(iii); see also final rule 248.30(a)(4) (enumerating the scope of the covered institution’s customer notification obligations). 270 See, e.g. final rule 17 CFR 240.17a– 4(e)(14)(iii). See also discussion on a covered institution’s recordkeeping obligations as to notices delivered to customers by its service providers infra footnote 391 and accompanying discussion. Funding portals generally should maintain all copies of such notices in connection with their own requirements to demonstrate compliance with Regulation S–P. See discussion of existing funding portal recordkeeping obligations infra footnote 385. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 any lack of notification by the service provider to the customer and remedy the matter in advance of the deadline set out in paragraph (a)(4). d. Service Provider Definition The Commission is adopting the definition of ‘‘service provider’’ to mean ‘‘any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution.’’ 271 This definition thereby includes affiliates of covered institutions if they are permitted access to this information through their provision of services. The scope of this definition is intended to help protect against the risk of harm that may arise from service providers’ access to a covered institution’s customer information and customer information systems.272 A number of commenters addressed the scope of the proposed definition. Several commenters suggested narrowing the scope of the service provider definition by revising it to exclude affiliates or other GLBA regulated entities.273 Similarly, three commenters asserted that the Commission should revise the definition to exclude affiliates and other entities under common control with the covered institution, as those affiliates are typically subject to the same cybersecurity and privacy programs, including service provider management, which are frequently structured and operate on a group-wide basis.274 One of these commenters also stated the Commission should also exclude entities subject to the GLBA that have direct contractual relationships with the client.275 This commenter separately asserted that the service provider definition should be narrowed to only cover those persons or entities that are a third party and receive, maintain, 271 See final rule 248.30(d)(10); see also proposed rule 248.30(e)(10). 272 For example, in 2015, Division of Examinations staff released observations following the examinations of some institutions’ cybersecurity policies and procedures relating to vendors and other business partners, which revealed mixed results with respect to whether the firms had incorporated requirements related to cybersecurity risk into their contracts with vendors and business partners. See EXAMS, Cybersecurity Examination Sweep Summary, National Exam Program Risk Alert, Volume IV, Issue 4 (Feb. 3, 2015), at 4, available at https://www.sec.gov/about/offices/ocie/ cybersecurity-examination-sweep-summary.pdf. 273 See, e.g., CAI Comment Letter; IAA Comment Letter 1; SIFMA Comment Letter 2; and Schulte Comment Letter. 274 See CAI Comment Letter; IAA Comment Letter 1, SIFMA Comment Letter 2. 275 See IAA Comment Letter 1. PO 00000 Frm 00026 Fmt 4701 Sfmt 4700 process, or otherwise are permitted access to sensitive customer information, so that covered institutions can prioritize ‘‘higher-risk service providers’’ and not expend resources unnecessarily on an overly broad set of service providers.276 Finally, one commenter requested that the Commission ‘‘clarify the scope of the service provider definition, including whether service providers would include financial counterparties such as brokers, clearing and settlement firms, and custodial banks.’’ 277 As stated above, we are modifying the definition of service provider from the proposal to remove reference to third parties in response to commenters to incorporate into rule text the Commission’s intended scope of the ‘‘service provider’ definition, as discussed in the Proposing Release.278 It would not be appropriate to narrow the definition to exclude affiliates or nonaffiliates that are also subject to the GLBA, as commenters have suggested. While a covered institution’s affiliates may collectively operate under the same cybersecurity and privacy programs, such uniformity in approach does not diminish the risk of harm to the institution’s customers in the event of a cyber incident involving unauthorized access to or use of customer information at the affiliate.279 This risk is similarly not diminished where a cyber incident involving unauthorized access to or use of customer information occurs at a covered institution’s unaffiliated service provider that is subject to the GLBA, even where the service provider has a direct contractual relationship with the client. In such instances, maintaining such an entity’s inclusion within the service provider definition will help ensure that the covered institution is made aware of cyber incidents that occur at the service provider to aid in both the covered institution’s oversight of its service providers, as well as satisfaction of its customer notification and broader customer information safeguarding obligations under the final 276 See id. SIFMA Comment Letter 2. 278 See Proposing Release at Section II.A.3, stating ‘‘This definition would include affiliates of covered institutions if they are permitted access to this information through their provision of services.’’ 279 While we are not narrowing the service provider definition to exclude affiliates of the covered institution, in most instances it generally should be appropriate for the covered institution to rely upon the adherence of any affiliated service provider to enterprise-wide cybersecurity and privacy programs that cover both the covered institution and its affiliates, so long as such programs satisfy the requirements of the final rules and the covered institution does not know, or have reason to know, that the affiliate is not adhering to such enterprise-wide programs. 277 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 amendments. It is thus important for the service provider definition to remain sufficiently broad to address these risks by setting out clear obligations for all parties possessing legitimate access to customer information regarding both the safeguarding of that information, and, where necessary, ensuring notification to the affected customers in the event of a breach involving unauthorized access to or use of customer information. However, while we are not narrowing the scope of the ‘‘service provider’’ definition to exclude either affiliates of the covered institution or unaffiliated service providers that are independently subject to the GLBA, pursuant to paragraph (a)(5)(ii) of these final amendments the covered institution and a service provider may enter into a written agreement for the service provider to notify affected individuals on its behalf in in the event of a breach at the service provider, as discussed above.280 Further, it would not be appropriate to narrow the service provider definition to only address those persons or entities that operate as ‘‘higher-risk service providers’’ that receive, maintain, process, or are otherwise permitted access to sensitive customer information, as one commenter suggested. As discussed above, the scope of information covered by the assessment and containment and control requirements of the final amendments is designed to help ensure all information covered by the requirements in the GLBA is appropriately safeguarded, and that sufficient information is assessed to fulfill the more narrowly tailored obligation to notify affected individuals.281 Specifically, consistent with the GLBA, the final amendments are tailored to require that a covered institution’s written policies and procedures must be reasonably designed to protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer, not merely all sensitive customer 280 See discussion on Delegation of Notice and Covered Institutions’ Customer Notification Obligations supra Section II.A.4.c. See also 17 CFR 248.30(a)(5)(ii). The permissibility of such written agreements between covered institutions and their service providers, including both their affiliates and those unaffiliated service providers that are also subject to the GLBA, may also help reduce costs related to customer notifications at the covered institution, and help reduce the risk of overnotification of affected individuals in instances where both the covered institution and its affiliated service provider are independently subject to customer notification obligations for the same breach in security. 281 See discussion on Incident Response Program Including Customer Notification supra Section II.A. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 information.282 Narrowing the service provider definition in a manner that would fail to cover the full scope of information that the GLBA requires to be covered in a covered institution’s safeguarding policies and procedures, as would result from commenters’ suggestion, would be inappropriate.283 Further, we are also concerned that limiting the service provider definition to only address those persons or entities that receive, maintain, process, or are otherwise permitted access to sensitive customer information, as commenters suggest, would result in insufficient notification to covered institutions in the event of a breach at a service provider. The purpose of this service provider notification is to enable the covered institution to begin carrying out its response program, which requires an assessment of the nature and scope of any incident involving unauthorized access to or use of customer information, not merely those involving sensitive customer information.284 For these reasons, the Commission is 282 See 17 CFR 248.30(a)(2)(iii). See also 15 U.S.C. 6801(b)(3) (mandating that the Commission shall establish appropriate standards for the financial institutions subject to its jurisdiction relating to administrative, technical, and physical safeguards ‘‘to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.’’). 283 As discussed below, the definition of ‘‘customer information’’ we are adopting in these final amendments is intended to ensure that the standard for covered institutions’ safeguards rule policies and procedures is consistent with the objectives of the GLBA, which focuses on protecting ‘‘nonpublic personal information’’ of those who are ‘‘customers’’ of financial institutions. See discussion on the Definition of Customer Information infra Section II.B.1. See also 17 CFR 248.30(d)(5) (defining ‘‘customer information’’). In contrast, the definition of ‘‘sensitive customer information’’ that we are adopting is more narrowly tailored to only cover any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. See 17 CFR 248.30(d)(9)(i). As discussed above, this definition is more narrowly tailored, and has been specifically calibrated to include types of information that, if exposed, could put affected individuals at a higher risk of suffering substantial harm or inconvenience through, for example, fraud or identity theft enabled by the unauthorized access to or use of the information. See discussion on the Definition of ‘‘Sensitive Customer Information’’ supra Section II.A.3.b. The narrower tailoring than is used in the ‘‘customer notification’’ definition is intended to protect customers by ensuring that they can take the necessary steps to minimize their exposure to these risks, while also being mindful of concerns of how a broader definition could increase the potential for over-notification of customers to address such risks. See id. 284 See final rule 248.30(b)(i). See also discussion on the assessment required by paragraph (a)(3) as to a covered institution’s incident response program supra section II.A.1 above. PO 00000 Frm 00027 Fmt 4701 Sfmt 4700 47713 adopting the service provider definition as modified. The Commission also acknowledges the request to clarify the scope of what is included within the service provider definition, including ‘‘whether service providers would include financial counterparties such as brokers, clearing and settlement firms, and custodial banks.’’ In alignment with the service provider definition we are adopting, covered institutions should make this determination based on the facts and circumstances about the substance of the relationship with the covered institution, rather than the form of the entity in question. Where financial counterparties receive, maintain, or otherwise are permitted access to customer information through the provision of services directly to the covered institution, they meet the service provider definition as adopted. B. Scope of Safeguards Rule and Disposal Rule 1. Scope of Information Protected We are adopting amendments to rule 248.30 that define the scope of information covered by the safeguards and disposal rules. These amendments will broaden and more closely align the scope of both rules by applying them to the information of not only a covered institution’s own customers, but also the customers of other financial institutions that has been provided to the covered institution.285 These amendments further specify that the rules also apply to customer information handled or maintained on behalf of the covered institution.286 We are adopting these changes substantively as proposed, with changes to the structure of the rule in response to comments as discussed in more detail below. Specifically, the amendments: • Adopt a new definition of ‘‘customer information’’ defining the scope of information covered by both the safeguards and disposal rules. These amendments provide greater specificity regarding what constitutes customer information that must be protected under the safeguards rule. They also expand the scope of the disposal rule, which currently applies only to consumer information (defined as ‘‘consumer report information’’ in the 285 Final rule 248.30(a), (b), and (d)(5)(i). Regulation S–P defines ‘‘financial institution’’ generally to mean any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)). 17 CFR 248.3(n). 286 Final rule 248.30(d)(5)(i). E:\FR\FM\03JNR2.SGM 03JNR2 47714 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations current rule) so that it applies to both customer and consumer information. • Provide that customer information protected under both the safeguards and disposal rules includes both customer information in the possession of a covered institution as well as customer information handled or maintained on its behalf. • Provide that both customer and consumer information include information that pertains to individuals with whom the covered institution has a customer relationship, as well as to the customers of other financial institutions where such information has been provided to the covered institution. We are adopting this expansion as proposed but, as discussed below, have reorganized the rule provisions effectuating the change in response to comments. lotter on DSK11XQN23PROD with RULES2 Definition of Customer Information Currently, Regulation S–P’s protections under the safeguards rule and disposal rule apply to different, and at times overlapping, sets of information.287 Specifically, as required under the GLBA, the safeguards rule currently requires broker-dealers, investment companies, and registered investment advisers (but not transfer agents) to maintain written policies and procedures to protect ‘‘customer records and information,’’ 288 which is not defined in the GLBA or in Regulation S– P. The disposal rule requires every covered institution properly to dispose of ‘‘consumer report information,’’ a different term, which Regulation S–P defines consistently with the FACT Act provisions.289 To align more closely the information protected by both rules, as proposed, we 287 See Disposal of Consumer Report Information, Investment Company Act Release No. 26685 (Dec. 2, 2004) [69 FR 71322 (Dec. 8, 2004)], at n.13 (‘‘Disposal Rule Adopting Release’’). 288 See 17 CFR 248.30; 15 U.S.C. 6801(b)(1). 289 See 17 CFR 248.30(b)(2). Section 628(a)(1) of the FCRA directed the Commission to adopt rules requiring the proper disposal of ‘‘consumer information, or any compilation of consumer information, derived from consumer reports for a business purpose.’’ 15 U.S.C. 1681w(a)(1). Regulation S–P currently uses the term ‘‘consumer report information,’’ defined to mean a record in any form about an individual ‘‘that is a consumer report or is derived from a consumer report.’’ 17 CFR 248.30(b)(1)(ii). ‘‘Consumer report’’ had the same meaning as in section 603(d) of the Fair Credit Reporting Act (15 U.S.C. 1681(d)). 17 CFR 248.30(b)(1)(i). We are amending the term ‘‘consumer report information’’ currently in Regulation S–P to ‘‘consumer information’’ (without changing the definition) to conform to the term used by other Federal financial regulators in their guidance and rules. See, e.g., 16 CFR 682.1(b) (FTC); 17 CFR 162.2(g) (CFTC); OCC Information Security Guidance at I.C.2.b; FRB Information Security Guidance’’) at I.C.2.b; FDIC Information Security Guidance at I.C.2.b. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 are amending rule 248.30 by replacing the term ‘‘customer records and information’’ in the safeguards rule with a newly defined term ‘‘customer information’’ and by adding customer information to the coverage of the disposal rule. For covered institutions other than transfer agents, the term ‘‘customer information’’ will mean, as proposed, ‘‘any record containing nonpublic personal information as defined in section 248.3(t) about a customer of a financial institution, whether in paper, electronic, or other form.’’ 290 Commenters did not object to the proposed definition of ‘‘customer information.’’ As discussed in the Proposing Release, the customer information definition in the coverage of the safeguards rule is intended to be consistent with the objectives of the GLBA, which focuses on protecting ‘‘nonpublic personal information’’ of those who are ‘‘customers’’ of financial institutions.291 The customer information definition is also based on the definition of ‘‘customer information’’ in the safeguards rule adopted by the FTC.292 Additionally, adding customer information to the coverage of the disposal rule is also consistent with the objectives of the GLBA. Under the GLBA, an institution has a ‘‘continuing obligation’’ to protect the security and confidentiality of customers’ nonpublic personal information.293 The final amendments specify that this obligation continues through disposal of customer information. The final amendments also are consistent with the objectives of the 290 As discussed below, the customer information definition also specifies that the definition covers information in the possession of a covered institution or that is handled or maintained by the covered institution or on its behalf, regardless of whether such information pertains to individuals with whom the covered institution has a customer relationship or the customers of other financial institutions where such information has been provided to the covered institution. This is being adopted substantively as proposed, but reflects structural modifications to the rule text to address the concerns of a commenter who asked for increased clarity. See infra section II.B.2 for a discussion of the term customer information with respect to transfer agents. 291 See 15 U.S.C. 6801(a). 292 See 16 CFR 314.2(d) (The FTC safeguards rule defining ‘‘customer information’’ to mean ‘‘any record containing nonpublic personal information, as defined in 16 CFR 313.3(n) about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates’’). The final amendments do not require covered institutions to be responsible for their affiliates’ policies and procedures for safeguarding customer information because covered institutions affiliates generally are financial institutions subject to the safeguards rules of other Federal financial regulators. 293 See 15 U.S.C. 6801(a). PO 00000 Frm 00028 Fmt 4701 Sfmt 4700 FACT Act, which focuses on protecting ‘‘consumer information,’’ a category of information that will remain within the scope of the disposal rule.294 Adding customer information to the disposal provisions will simplify compliance with the FACT Act by eliminating a covered institution’s need to determine whether its customer information is also consumer information subject to the disposal rule. Covered institutions should also be less likely to fail to dispose of consumer information properly by misidentifying it as customer information only. In addition, including customer information in the coverage of the disposal rule would conform the rule more closely to the Banking Agencies’ Safeguards Guidance.295 Commenters did not address the expansion of the disposal rule to cover customer information. One commenter sought clarification regarding the proposal’s coverage of customer information handled or maintained on behalf of a covered institution. This commenter stated that proposed paragraph (a) of rule 248.30, which set out the scope of information collectively covered under the safeguards and disposal rules, could be interpreted to limit the application of the rules to customer information in the possession of the covered institution, while proposed paragraph (e)(5) defined customer information to include information that is handled or maintained on behalf of the covered institution. The proposal included both customer information in the possession of a covered institution as well as customer information handled or maintained on its behalf in both the safeguards and disposal rules. This is because rule 248.30 provided the rules applied to ‘‘customer information’’ and, as the commenter observed, the proposal defined customer information to include ‘‘any record containing 294 See 15 U.S.C. 1681w(a)(1); proposed rule 248.30(c)(1). ‘‘Consumer information’’ is not included within the scope of the safeguards rule, except to the extent it overlaps with any ‘‘customer information,’’ because the safeguards rule is adopted pursuant to the GLBA and therefore is limited to information about ‘‘customers.’’ 295 See, e.g., OCC Information Security Guidance (OCC guidelines providing that national banks and Federal savings associations’ must develop, implement, and maintain appropriate measures to properly dispose of customer information and consumer information.’’); FRB Information Security Guidance (similar Federal Reserve Board provisions for State member banks). See also 15 U.S.C. 6804(a) (directing the agencies authorized to prescribe regulations under title V of the GLBA to assure to the extent possible that their regulations are consistent and comparable); 15 U.S.C. 1681w(2)(B) (directing the agencies with enforcement authority set forth in 15 U.S.C. 1681s to consult and coordinate so that, to the extent possible, their regulations are consistent and comparable). E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations nonpublic personal information as defined in § 248.3(t) about a customer of a financial institution, whether in paper, electronic or other form, that is handled or maintained by the covered institution or on its behalf.’’ Applying these rules to information handled or maintained on behalf of a covered institution is necessary so that the incident response program applies to information about a covered institution’s customers that is handled or maintained by a service provider on the covered institution’s behalf and to require that such information is disposed of properly. In response to this comment, we have removed the dedicated scope paragraph (a) from the proposed rule and moved all the requirements for customer information and consumer information into the definitions of those terms, now in renumbered paragraphs (d)(5)(1) and (d)(1) respectively. Accordingly, and substantively as proposed, the definition of consumer information covers information that a covered institution maintains or otherwise possesses for a business purpose, and the customer information definition covers information in the possession of a covered institution or that is handled or maintained by the covered institution or on its behalf.296 These structural changes do not change the scope of the proposed rule, but rather consolidate in each definition the scope of covered information as opposed to referring to information possessed by a covered institution in one paragraph of the rule and referring to information handled on its behalf in another. lotter on DSK11XQN23PROD with RULES2 Safeguards Rule and Disposal Rule Coverage of Customer Information We also are adopting the requirement, substantively as proposed, that both the safeguards rule and the disposal rule apply to the information specified in those definitions regardless of whether such information pertains to (a) individuals with whom the covered institution has a customer relationship or (b) the customers of other financial institutions where such information has been provided to the covered institution.297 As discussed above, 296 We also eliminated language in paragraph (b)(1) that now appears in the final amendments’ definitions of customer information and consumer information. 297 The safeguards rule is applicable to ‘‘consumer information’’ only to the extent it overlaps with ‘‘customer information.’’ See supra footnote 291. Regulation S–P defines ‘‘financial institution’’ generally to mean any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)). Rule 248.3(n). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 however, we are structurally reflecting this requirement in the definitions of customer information and consumer information, rather than in proposed paragraph (a). Comments were mixed on expanding the safeguards and disposal rules to cover nonpublic personal information received by covered institutions from third party financial institutions. Some commenters supported the expansion.298 Two of these commenters stated that sensitive nonpublic information should be protected regardless of how it came into a covered institution’s possession.299 Other commenters opposed the proposed expansion, suggesting that the rules should be limited to the customer information of the covered institution’s own customers and stating that the safeguards rule in its current form is appropriately calibrated.300 One of these commenters stated that requiring notification of customers of other financial institutions under the proposed expansion would be confusing to customers and impractical for covered institutions.301 After considering comments, the final amendments provide that the safeguards rule and disposal rule apply to both nonpublic personal information that a covered institution collects about its own customers and to nonpublic personal information it receives from another financial institution about that institution’s customers. Currently, in contrast, Regulation S–P defines ‘‘customer’’ as ‘‘a consumer who has a customer relationship with you.’’ The safeguards rule, therefore, only protects the ‘‘records and information’’ of individuals who are customers of the particular institution and not others, such as individuals who are customers of another financial institution. The disposal rule, on the other hand, requires proper disposal of certain records about individuals without regard to whether the individuals are customers of the particular institution. The final amendments better align the scope of the safeguards and disposal rules by requiring that a covered institution protect the information of individuals even if those individuals are not customers of that particular institution but customers of another financial institution. 298 See EPIC Comment Letter; ICI Comment Letter; Better Markets Comment Letter. 299 See ICI Comment Letter; Better Markets Comment Letter. 300 See SIFMA Comment Letter 2; CAI Comment Letter. 301 See SIFMA Comment Letter 2; see also supra footnote 110 and accompanying text. PO 00000 Frm 00029 Fmt 4701 Sfmt 4700 47715 The amendments also are designed to help ensure that the nonpublic personal information of covered institution customers is better protected from unauthorized disclosure on an ongoing basis, regardless of what entity is maintaining or handling that information.302 For example, information that a registered investment adviser has received from the custodian of a former client’s assets would be covered under both the safeguard and disposal rules if the former client remains a customer of either the custodian or of another financial institution, even though the individual no longer has a customer relationship with the investment adviser.303 Applying the safeguards rule and the disposal rule to customer information that a covered institution receives from other financial institutions will help ensure customer information safeguards are not lost because a third party financial institution shares that information with a covered institution. 2. Extending the Scope of the Safeguards Rule and the Disposal Rule To Cover All Transfer Agents As discussed in more detail below, the final amendments, which are the same as proposed except for the modifications to the structure of the rules discussed above,304 extend both the safeguards rule and the disposal rule to apply to any transfer agent registered with the Commission or another appropriate regulatory agency.305 We are extending these provisions to transfer agents because, as discussed in the Proposing Release, transfer agents maintain sensitive, detailed information related to securityholders.306 Like other market participants, systems maintained by transfer agents are subject to threats and hazards to the security or integrity of those systems. Likewise, the individuals whose information is maintained by those transfer agents’ systems are subject to similar risks of substantial harm and inconvenience as individuals whose customer information is maintained by other covered institutions. Yet, prior to the amendments, the safeguards rule did 302 See Proposing Release at the text accompanying nn.156–158. 303 See final rule 248.30(d)(5)(i) (customer information is covered by the rule if it pertains to ‘‘the customers of other financial institutions where such information has been provided to the covered institution’’). 304 See supra section II.B.1 (discussing the changes to the structure of final rule 248.30(d)). 305 The term ‘‘transfer agent’’ is defined by rule 248.30(d)(12) to have the same meaning as in section 3(a)(25) of the Exchange Act (15 U.S.C. 78c(a)(25)). 306 See Proposing Release at section II.C.3. E:\FR\FM\03JNR2.SGM 03JNR2 47716 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 not apply to any transfer agents, and the disposal rule applied only to those transfer agents registered with the Commission. To address these risks, and help ensure that individuals whose customer information is held by a transfer agent are protected and receive appropriate notice of a breach in the same manner as individuals whose customer information is held by any other covered institution, the final amendments apply both the safeguards rule and the disposal rule to all transfer agents, even if the transfer agent is registered with another appropriate regulatory agency. The final amendments do this by including ‘‘transfer agents registered with the Commission or another appropriate regulatory agency’’ in the definition of a ‘‘covered institution,’’ in the same manner as we proposed.307 As proposed, the final amendments also account for the fact that transfer agents’ clients generally are the issuers whose securities are held by investors, not the individual investors themselves, by defining ‘‘customer’’ with respect to a transfer agent registered with the Commission or another appropriate regulatory agency as any natural person who is a securityholder of an issuer for which the transfer agent acts or has acted as a transfer agent. Some commenters supported extending these rules to all transfer agents. These commenters stated that doing so would: (i) be consistent with current market practice; (ii) benefit investors; and (iii) create a single, equal standard for all transfer agents.308 Other commenters opposed extension of the safeguards rule and disposal rule to all transfer agents. In general, these commenters stated that doing so would: (i) exceed the scope of the Commission’s authority; (ii) fail to recognize that a transfer agent’s customer is an issuer of securities; (iii) potentially conflict with State law; (iv) confuse securityholders; and (v) impose unnecessary costs on transfer agents.309 As discussed below, the Commission agrees with the commenters who supported extending the safeguards rule and disposal rule to all transfer agents and is adopting the amendments as proposed. rule 248.30(d)(3). Better Markets Comment Letter, ICI Comment Letter 1, EPIC Comment Letter. 309 See SIFMA Comment Letter 2, Comment Letter from the Securities Transfer Association (May 10, 2023) (‘‘STA Comment Letter 1’’), STA Comment Letter 2, Computershare Comment Letter. Extending to All Transfer Agents, Including Transfer Agents Subject to Existing Federal and State Requirements, and Scope of the Commission’s Authority We received some comments in support of our proposed extension of scope to include transfer agents. One commenter stated that extending the protections of the safeguards rule and the disposal rule to all transfer agents would benefit the public and protect investors, due to the sensitive information they possess, and would equalize the standards that are applicable to transfer agents.310 This commenter stated that due to their role, transfer agents have information related to securityholders that may include names, addresses, phone numbers, email addresses, employers, employment history, bank account information, credit card information, transaction histories, and securities holdings.311 This commenter further stated that the systems transfer agents maintain are subject to the same risks of a breach as other covered institutions, and therefore the individuals whose customer information transfer agents maintain are subject to the same risks as customers of other covered institutions.312 Finally, the commenter stated that extending the safeguards rule and disposal rule to all transfer agents will promote regulatory parity and fair competition among firms, regardless of their registration status.313 Similarly, one commenter supported including transfer agents and requiring breach notifications,314 and another commenter stated that establishing incident response and minimum data breach reporting requirements for transfer agents would be a significant step toward a stronger and more comprehensive national data breach regime.315 Other comments, however, objected to scoping transfer agents into the Safeguards Rule. For example, one commenter suggested that applying the rules to all transfer agents could subject transfer agents registered with an appropriate regulatory agency that is not the Commission to conflicting data security requirements from those regulators, resulting in regulatory confusion.316 One commenter stated that extending the rules to all transfer agents would exceed the scope of the 307 Final 310 See 308 See 311 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Better Markets Comment Letter. id. 312 See id. 313 See id. 314 See ICI Comment Letter 1. 315 See EPIC Comment Letter. 316 See SIFMA Comment Letter 2. PO 00000 Frm 00030 Fmt 4701 Sfmt 4700 Commission’s authority.317 Similarly, two commenters stated that the Commission should exempt certain transfer agents from the safeguards rule, such as transfer agents subject to existing State and Federal banking laws addressing privacy and safeguarding customer information, or those that do not engage in paying agent services.318 One of these commenters stated that transfer agents ‘‘do not have the type or scope of personal information which could lead to further complications for securityholders’’ because transfer agents are not subject to know-your-customer obligations, do not have extensive background information concerning securityholders, and generally do not have possession of shareholder assets or have information which could be used to take or transfer assets of shareholders.319 One of these commenters also stated that it is already subject to banking laws and inter-agency guidelines that address privacy, breach notification, and disposal of personal information, such as the Banking Agencies’ Incident Response Guidance.320 The Commission does not agree that extending the rules to all transfer agents would result in regulatory confusion. As discussed above, the GLBA and FACT Act oblige us to adopt regulations, to the extent possible, that are consistent and comparable with those adopted by the Banking Agencies, the CFPB, and the FTC.321 The Commission has been mindful of the need to set standards for safeguarding customer records and information that are consistent and comparable with the corresponding standards set by these agencies, and to this end, we have modified the final amendments from the proposal to promote greater consistency with other applicable Federal safeguard standards where such changes do not affect the investor protection purposes of this rulemaking, as discussed in more detail above.322 Thus, although there are some differences, the final amendments are largely aligned with the Banking 317 See SIFMA Comment Letter 2. STA Comment Letter 2 and Computershare Comment Letter. We use the term ‘‘paying agent services’’ to refer to administrative, recordkeeping, and processing services related to the distribution of cash and stock dividends, bond principal and interest, mutual fund redemptions, and other payments to securityholders. 319 See STA Comment Letter 2. 320 See Computershare Comment Letter. 321 See supra section I. 322 For example, the final amendments require covered institutions to ensure that their service providers provide notification as soon as possible, but no later than 72 hours after becoming aware that an applicable breach has occurred, which is informed by the 72-hour deadline that is required under CIRCIA. See supra section II.A.4.b. 318 See E:\FR\FM\03JNR2.SGM 03JNR2 lotter on DSK11XQN23PROD with RULES2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations Agencies’ Incident Response Guidance and Safeguards Guidance to which some transfer agents supervised by one of the Banking Agencies are already subject.323 We recognize, however, that transfer agents registered with the Banking Agencies are already subject to the Banking Agencies’ Incident Response Guidance and Safeguards Guidance and therefore may need to review their existing procedures under the Banking Agencies’ Guidance for compliance with the final amendments. To the extent there are differences between their existing procedures and the final amendments, given the Commission’s efforts to promote consistency between the final amendments and other Federal safeguards standards, it will be possible for transfer agents to update their existing policies, procedures, and practices to ensure consistency with both the Banking Agencies’ Guidance and the final amendments.324 Finally, even if the final amendments impose additional requirements on some transfer agents already subject to the Banking Agencies’ Guidance, it is appropriate to establish a minimum nationwide standard for the notification of securityholders who are affected by a transfer agent data breach that is tailored to the Commission’s mission and the specific requirements.325 For these reasons, the Commission does not agree that it should exempt from the safeguards rule transfer agents that are subject to existing Federal banking laws addressing privacy and safeguarding customer information. Moreover, the Commission is not exempting from the safeguards rule transfer agents that do not engage in paying agent services. The population of transfer agents that maintain sensitive, detailed and individualized information related to securityholders is not limited to those transfer agents that engage in paying agent services. Providing the exemption suggested by this commenter would deprive securityholders whose sensitive customer information is maintained by a non-paying agent transfer agent of the important protections afforded under the final amendments. The Commission does not agree that extending the rules to all transfer agents would exceed the scope of the Commission’s authority. As discussed in the proposal, when the Commission initially proposed and adopted the disposal rule, it did so to implement the congressional directive in section 216 of the FACT Act to adopt regulations to 323 See infra sections IV.C.2.b and IV.D.2.b. supra section I. 325 See supra section I. 324 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 require any person who maintains or possesses a consumer report or consumer information derived from a consumer report for a business purpose to properly dispose of the information.326 The Commission determined at that time that, through the FACT Act, Congress intended to instruct the Commission to adopt a disposal rule to apply to transfer agents registered with the Commission.327 The Commission also stated at that time that the GLBA did not include transfer agents within the list of covered entities for which the Commission was required to adopt privacy rules.328 The Commission extended the disposal rule only to those transfer agents registered with the Commission to carry out its directive under the FACT Act, while deferring to the FTC to utilize its ‘‘residual jurisdiction’’ under the same congressional mandate, to enact both a disposal rule and broader privacy rules that might apply to transfer agents registered with another appropriate regulatory agency.329 The Commission, however, has broad authority under Section 17A of the Exchange Act that is independent of either the FACT Act or the GLBA, to prescribe rules and regulations for transfer agents as necessary or appropriate in the public interest, for the protection of investors, for the safeguarding of securities and funds, or otherwise in furtherance of the purposes of Title I of the Exchange Act.330 Specifically, whether transfer agents initially register with the Commission or another appropriate regulatory agency,331 section 17A(d)(1) of the Exchange Act authorizes the Commission to prescribe such rules and regulations as may be necessary or appropriate in the public interest, for the protection of investors, or otherwise in furtherance of the purposes of the Exchange Act with respect to any 326 See Proposing Release at section II.C.3; see also 15 U.S.C. 1681w. 327 See Disposal of Consumer Report Information, Exchange Act Release No. 50361 (Sept. 14, 2004), 69 FR 56307 at n.23 (Sept. 20, 2004). 328 See id. at n.27. 329 See id. 330 See 15 U.S.C. 78q–1. 331 See Exchange Act Section 17A(d)(1), 15 U.S.C. 78q–1(d)(1) (providing that ‘‘no registered clearing agency or registered transfer agent shall . . . engage in any activity as . . . transfer agent in contravention of such rules and regulations’’ as the Commission may prescribe); Exchange Act Section 17A(d)(3)(b), 15 U.S.C. 78q–1(d)(3)(b) (providing that ‘‘Nothing in the preceding subparagraph or elsewhere in this title shall be construed to impair or limit . . . the Commission’s authority to make rules under any provision of this title or to enforce compliance pursuant to any provision of this title by any . . . transfer agent . . . with the provisions of this title and the rules and regulations thereunder.’’). PO 00000 Frm 00031 Fmt 4701 Sfmt 4700 47717 transfer agents registered with either the Commission or another appropriate regulatory agency. Once a transfer agent is registered with any appropriate regulatory agency, the Commission ‘‘is empowered with broad rulemaking authority over all aspects of a transfer agent’s activities as a transfer agent.’’ 332 Pursuant to its statutory authority, the Commission has adopted rules that address various aspects of transfer agents’ activities, including annual disclosures, transaction processing, responses to written inquiries, recordkeeping, safeguarding of funds and securities, lost securityholder searches, among others.333 These and the Commission’s other transfer agent rules 334 currently apply to and are enforceable against all registered transfer agents, including those that initially registered with an appropriate regulatory agency other than the Commission.335 The FTC has not adopted disposal and privacy rules to govern transfer agents registered with an appropriate regulatory agency that is not the Commission. The Commission is exercising its authority under section 17A(d)(1) of the Exchange Act to extend the safeguards rule to apply to any transfer agent registered with either the Commission or another appropriate regulatory agency and to extend the disposal rule to apply to transfer agents registered with another appropriate regulatory agency. The Commission does so to address the risks of market disruptions and investor harm posed by 332 See Senate Report on Securities Act Amendments of 1975, S. Rep. No. 94–75. 333 See, e.g., SEC Form TA–2, 17 CFR 249b.102 (Form for Reporting Activities of Transfer Agents Registered Pursuant to Section 17A of the Securities Exchange Act of 1934) (annual disclosures); Exchange Act Rule 17Ad–2, 17 CFR 240.17Ad–2 (transaction processing); Exchange Act Rule 17Ad– 5, 17 CFR 240.17Ad–5 (written inquiries); Exchange Act Rule 17Ad–6, 17 CFR 240.17Ad–6 (recordkeeping); Exchange Act Rule 17Ad–7, 17 CFR 240.17Ad–7 (record retention); Exchange Act Rule 17Ad–12, 17 CFR 240.17Ad–12 (safeguarding); Exchange Act Rule 17Ad–17, 17 CFR 240.17Ad–17 (lost securityholder searches). 334 See, e.g., Exchange Act Rules 17Ad–1 through 17Ad–20, 17 CFR 240.17Ad–1 through 240.17Ad– 20. 335 For example, the Commission has found bankregistered transfer agents in violation of various Commission rules. See In the Matter of Citibank, N.A., Exchange Act Release No. 31612 (Dec. 7, 1992) (settled matter) (Exchange Act Rules 17Ad– 12 and 17f–1); In the Matter of the Chase Manhattan Bank, Exchange Act Release No. 44835 (Sept. 24, 2001) (settled matter) (Exchange Act Rules 17Ac2–2, 17Ad–10, and 17Ad–11); In the Matter of Wilmington Trust Company, Exchange Act Release No. 49904 (Jun. 23, 2004) (settled matter) (Exchange Act Rules 17Ac2–2, 17Ad–10, 17Ad–11, and 17Ad–13); In the Matter of the Bank of New York, Exchange Act Release No. 53709 (Apr. 24, 2006) (settled matter) (Exchange Act Rule 17Ad–17). E:\FR\FM\03JNR2.SGM 03JNR2 47718 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 cybersecurity and other operational risks faced by transfer agents. Extending the safeguards rule and disposal rule to address those risks is in the public interest, and necessary for the protection of investors and for the safeguarding of funds and securities. As explained in the proposal, transfer agents are subject to many of the same risks of data system breach or failure that other market participants face.336 For example, transfer agents are vulnerable to a variety of software, hardware, and information security risks that could threaten the ownership interests of securityholders or disrupt trading within the securities markets.337 A software, hardware, or information security breach or failure at a transfer agent could result in the corruption or loss of securityholder information, erroneous securities transfers, or the release of confidential securityholder information to unauthorized individuals. A concerted cyber attack or other breach could have the same consequences, or result in the theft of securities and other crimes. A transfer agent’s failure to account for such risks and take appropriate steps to mitigate them can directly lead to the loss of funds or securities, including through theft or misappropriation, due to the information about securityholders that transfer agents maintain.338 At the same time, the scope and volume of funds and securities that are processed or held by transfer agents have increased dramatically since Regulation S–P was first adopted.339 The risk of loss of such funds and securities presents significant risks to issuers, securityholders, other industry participants, and the U.S. financial system as a whole. For example, transfer agents that provide paying agent services on behalf of issuers play a significant role within that system. According to Form TA–2 filings in 2023, transfer agents distributed approximately $3.68 trillion in securityholder dividends and bond principal and interest payments. Critically, because Form TA–2 does not include information relating to the value of purchase, redemption, and exchange orders by mutual fund transfer agents, the $3.68 trillion amount stated above does not include these amounts. If the value of such transactions by mutual fund transfer agents was captured by Form TA–2 it is possible that the $3.68 336 See Proposing Release at section II.C.3. generally SEC Cybersecurity Roundtable transcript (Mar. 26, 2014), available at https:// www.sec.gov/spotlight/cybersecurity-roundtable/ cybersecurity-roundtable-transcript.txt. 338 See Proposing Release at section II.C.3. 339 See id. 337 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 trillion number would be significantly higher.340 Moreover, contrary to some commenters’ statements, transfer agents do maintain personal information about individual securityholders that could be used to take or transfer assets of securityholders or otherwise lead to further complications for securityholders. As stated in the proposal, transfer agents may obtain, share, and maintain personal information on behalf of securityholders who hold securities in registered form (i.e., in their own name rather than indirectly through a broker).341 For example, any registered transfer agent that maintains a master securityholder file on behalf of an issuer must post to that file debits and credits containing minimum and appropriate certificate detail representing every security transferred, purchased, redeemed, or issued.342 Pursuant to Exchange Act Rule 17Ad–9, certificate detail must include, among other things, the name and address of the registered securityholder, the number of shares or principal dollar amount of the equity or debt security, and any other identifying information about the securityholder or the securityholder’s securities that the transfer agent reasonably deems essential to its recordkeeping system for the efficient and effective research of record differences.343 This can include date of birth, social security or tax payer identification number, phone numbers, email addresses, information about relatives, and other sensitive personal information.344 Transfer agents also maintain additional personal information about securityholders in connection with ancillary account, administrative, and other services transfer agents provide to securityholders on behalf of issuers, such as plan administration, proxy services, corporate action processing, and disbursement of dividend and 340 As stated in the proposal, Commission staff has observed through supervisory activities that aggregate gross purchase and redemption activity for some of the larger mutual fund transfer agents has ranged anywhere from $3.5 trillion to nearly $10 trillion just for a single entity in a single year. See Proposing Release at section II.C.3. 341 See Proposing Release at section I, section II.C.3. 342 See 17 CFR 240.17Ad–10. 343 See 17 CFR 240.17Ad–9(a). 344 See In the Matter of Columbia Management Investment Services Corp., Exchange Release No. 80016 (Feb. 10, 2017) (settled matter) (finding that the transfer agent’s Records Management Manager ‘‘viewed sensitive personal account information such as addresses, dates of birth, and identification numbers’’ to misappropriate foreign deceased shareholders’ funds and securities). PO 00000 Frm 00032 Fmt 4701 Sfmt 4700 interest payments.345 This is the same type of customer information collected and maintained by other covered institutions and warrants the same level of protection. For example, the Commission is aware of instances in which threat actors have utilized securityholder information obtained from a transfer agent to steal securities and funds from those securityholders.346 For these reasons, the Commission is extending the safeguards rule and disposal rule to cover all registered transfer agents because it is in the public interest and will help protect investors and safeguard their securities and funds. Extending the safeguards rule to cover any registered transfer agent addresses the risks to the security and integrity of customer information associated with the systems those transfer agents maintain. This in turn helps prevent securityholders’ customer information from being compromised, which, as discussed above, could threaten the ownership interest of securityholders or disrupt trading within the securities markets. Extending the final amendments to all registered transfer agents also helps establish minimum nationwide standards for the notification of securityholders who are affected by a transfer agent data breach that leads to the unauthorized access or use of their information so that affected securityholders could take additional mitigating actions to protect their customer information, ownership interest in securities, and trading activity. Finally, as discussed above, extending the disposal rule to cover those transfer agents registered with another appropriate regulatory agency helps ensure all registered transfer agents are subject to the same minimum nationwide standard, tailored to the Commission’s mission and requirements, and will protect investors and safeguard their securities and funds by reducing the risk of fraud or related crimes, including identity theft, which can lead to the loss of securities and funds. 345 See Proposing Release at section II.C.3 (discussing generally the services provided by transfer agents); Advanced Notice of Proposed Rulemaking, Concept Release, Transfer Agent Regulations, Exchange Act Release No. 76743 (Dec. 22, 2015), 80 FR 81948 (Dec. 31, 2015) (describing the recordkeeping, shareholder communications, securities issuance, and tax reporting services provided by transfer agents). 346 See In the Matter of Columbia Management Investment Services Corp., Exchange Act Release No. 80016 (Feb. 10, 2017) (settled matter) (finding that the transfer agent’s Records Management Manager ‘‘viewed sensitive personal account information such as addresses, dates of birth, and identification numbers’’ to misappropriate foreign deceased shareholders’ funds and securities). E:\FR\FM\03JNR2.SGM 03JNR2 lotter on DSK11XQN23PROD with RULES2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations Definition of a Transfer Agent’s Customer As stated above, the final amendments include a definition of customer that is specific to transfer agents, which is being adopted as proposed, except for a clarification noted below. For a transfer agent, customer means any natural person who is a securityholder of an issuer for which the transfer agent acts or has acted as a transfer agent.347 The Commission is clarifying that this definition applies for purposes of section 248, meaning that it does not apply to any other rules, including those specific to transfer agents codified at 17 CFR 240.17Ad. Unless specified, securityholders of issuers are not customers of transfer agents for purposes of other rules. The Commission is adopting this definition because, as discussed above, although transfer agents’ customers generally are issuers of securities, transfer agents collect and maintain non-public personal information about the individual registered owners who hold those issuers’ securities in connection with various services and activities they engage in on behalf of issuers. Some commenters supported this definition and approach of treating securityholders of an issuer as a transfer agent’s customer, while other commenters did not. One commenter stated that this approach would close a ‘‘regulatory gap’’—despite possessing and maintaining sensitive information about securityholders, no transfer agents are currently subject to the safeguards rule, and only transfer agents registered with the Commission are subject to the disposal rule.348 Similarly, one commenter supported protecting customer information by subjecting that information to Regulation S–P, regardless of how it comes into the covered institution’s possession.349 On the other hand, one commenter opposed this proposed definition, stating that the need for a specific defined term for transfer agents indicated that the amendments were not well suited for transfer agents.350 Three commenters stated that securityholders of issuers are not customers of the transfer agent, rather the issuer is the customer of the transfer agent.351 The Commission agrees that customer information held by a covered institution must be protected, regardless 347 See final rule 248.30(d)(4)(ii). Better Markets Comment Letter. 349 See ICI Comment Letter 1. 350 See STA Comment Letter 2. 351 See STA Comment Letter 2, Computershare Comment Letter, and SIFMA Comment Letter 2. 348 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 of how that customer information comes into the covered institution’s possession. As discussed in the proposal and above, transfer agents obtain, share, and maintain personal information on behalf of securityholders who hold securities in registered form (i.e., in their own name rather than indirectly through a broker).352 They also collect detailed personal information in connection with various services provided directly to individual securityholders, such as facilitating legal and other transfers of securities, replacing lost or stolen securities certificates, facilitating corporate communications with investors, providing cost-basis calculations for tax purposes, and other services.353 The fact that a transfer agent may not have a direct contractual relationship with an individual securityholder does not eliminate the need for transfer agents to protect the sensitive personal information about individual securityholders that is collected and maintained by the transfer agent. Contrary to some commenters’ statements, adopting a transfer agentspecific definition of customer does not indicate that the safeguards rule and disposal rule are not well-suited for transfer agents. Rather, it helps ensure that the rule is appropriately tailored to address transfer agents and the specific type of customer information they collect and maintain. Tailoring specific rule provisions to specific types of entities to address their unique functions, structures, and businesses does not render the rule inappropriate to the entity for which the provisions are being tailored, nor is it an approach that is unique to transfer agents or to Regulation S–P. For example, since the adoption of Exchange Act Rule 17Ad– 12, transfer agents have been required to safeguard any funds and securities, including securityholder funds and securities, in the transfer agent’s possession or control.354 This is the case although securityholders may not be direct customers of transfer agents. As another example, final rule 248.30(d)(5)(i) defines customer information, for any covered institution other than a transfer agent as any record 352 See Proposing Release at section I; section II.C.3; see also supra the text accompanying footnote 285. 353 See Proposing Release at section II.C.3 (discussing generally the services provided by transfer agents); Advanced Notice of Proposed Rulemaking, Concept Release, Transfer Agent Regulations, Exchange Act Release No. 76743 (Dec. 22, 2015), 80 FR 81948 (Dec. 31, 2015) (describing the recordkeeping, shareholder communications, securities issuance, and tax reporting services provided by transfer agents). 354 See 17 CFR 240.17Ad–12. PO 00000 Frm 00033 Fmt 4701 Sfmt 4700 47719 containing nonpublic personal information as defined in final rule 248.3(t) about a customer of a financial institution, whether in paper, electronic or other form, in the possession of a covered institution or that is handled or maintained by the covered institution or on its behalf, regardless of whether such information pertains to (a) individuals with whom the covered institution has a customer relationship, or (b) the customers of other financial institutions where such information has been provided to the covered institution.355 The fact that the securityholder whose funds and securities the transfer agent is in possession of is not a direct customer of the transfer agent does not eliminate the need for the transfer agent to safeguard those funds and securities. The same is true for customer information in the possession of a transfer agent or that is handled or maintained by the transfer agent or on its behalf. Finally, two commenters stated that the Commission should propose a rule specific to transfer agents as part of the existing rules that apply specifically to transfer agents.356 In these commenters’ views, such a rule would impose obligations similar to the final amendments but would apply only to transfer agents. One of these commenters further explained that it would support general safeguarding of securityholder information requirements, similar to those set forth in the safeguard rule, if the Commission enacted them as part of the regulations specific to transfer agents codified at 17 CFR 240.17Ad.357 The Commission is not taking the approach suggested by the commenters. The final amendments will accomplish a similar result to a transfer agentspecific rule, while helping to ensure consistent requirements among covered institutions. Further, the commenters did not explain how such a rule would differ from the final amendments, other than being in a different set of Commission regulations, or how such a rule would be a material improvement over the approach being adopted as proposed. The Commission does not agree that adopting something different from the final amendments is necessary to achieve the ‘‘Commission’s privacy and cybersecurity goals in a manner specific to the business and role of transfer agents.’’ 358 Rather, doing so would undermine the Commission’s 355 See final rule 248.30(d)(5)(i). STA Comment Letter 2 and Computershare Comment Letter. 357 See Computershare Comment Letter. 358 STA Comment Letter 2. 356 See E:\FR\FM\03JNR2.SGM 03JNR2 47720 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations goal of establishing a consistent minimum nationwide standard. Further, where necessary, the Commission has already tailored the final amendments in a manner specific to transfer agents. As noted above, the final amendments include a definition of customer that it is specific to transfer agents. Finally, to the extent one of commenters’ goals is ensuring that all transfer agent rules are codified in the same place, specifically 17 CFR 240.17Ad, commenters’ suggestion would not further that goal. Transfer agents registered with the Commission are already subject to the disposal rule, which is not part of the existing rule set codified at 17 CFR 240.17Ad, and a new safeguards or disposal rule within that section would necessarily cite to Regulation S–P for defined terms and other references. lotter on DSK11XQN23PROD with RULES2 Application of Laws, Requirements, and Contractual Provisions Some commenters raised concerns about potential conflicts with, or duplication, of State law requirements. One commenter stated that securityholders of issuers are not customers of the transfer agent and imposing obligations on them creates conflicting and duplicative requirements to those already in place through State laws to safeguard securityholders’ personal information.359 Another commenter stated that under State law, transfer agents do not notify securityholders of a breach but issuers do.360 Specifically, this commenter stated that all fifty States have laws that require transfer agents to notify their issuer clients of unauthorized access to personal information of securityholders, and issuers may then be required to notify securityholders depending on whether the standards of the State law have been met. This commenter also stated that its existing policies, procedures, and contractual obligations are designed to track these State law requirements and that certain provisions in transfer agents’ contracts with issuer clients could prohibit transfer agents from notifying securityholders of data breaches in the manner required by the amendments.361 Both commenters stated that the Commission should consider preempting State laws to minimize the potential for multiple and competing obligations, and if not, prepare and produce a cost-benefit analysis to identify the specific ways in which the amendments would be an 359 See STA Comment Letter 2. Computershare Comment Letter. 361 See Computershare Comment Letter. 360 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 improvement over existing law.362 This commenter further explained that the issuer client would notify securityholders depending on whether the standards of the State law have been met.363 While we acknowledge the commenters’ concerns, the final amendments permit transfer agents and issuers to develop arrangements to address them. Nothing in the final amendments will prohibit or limit transfer agents’ ability to enter into or modify their contracts with issuer clients in a manner that allows the transfer agent to comply with applicable legal requirements. Indeed, some transfer agents already send customer notices on behalf of their issuer clients. As one commenter stated in requesting that the Commission permit covered institutions to have their service providers send breach notices to affected individuals on their behalf, it is a common practice today for investment companies to have their transfer agents assume responsibility for sending affected customers breach notices.364 The Commission acknowledges that, to the extent a transfer agent has contractual provisions with issuer clients that prevent securityholders from receiving notice of a breach directly from the transfer agent, the transfer agent may determine to amend those contractual provisions to comply with the final amendments. Further, as discussed above, in a modification from the proposal, the final amendments provide that a covered institution that is required to notify affected individuals may satisfy that obligation by ensuring that the notice is provided by another party (as opposed to providing the notice itself). Accordingly, if a transfer agent experiences an incident affecting securityholders of another covered institution, it would have the option of coordinating with the covered institution as to which institution will actually send the notice.365 As explained in the proposal, the Commission understands that State laws generally require persons or entities that own or license computerized data that includes private information to notify residents of the State when a data breach results in the compromise of their private information.366 In addition, State laws generally require persons and entities that do not own or license such computerized data, but that maintain 362 See STA Comment Letter 2 and Computershare Comment Letter. See also infra section IV.D.2.b. 363 See id. 364 See ICI Comment Letter 1. 365 See supra section II.A.3.a. 366 See Proposing Release at section III.C.2. PO 00000 Frm 00034 Fmt 4701 Sfmt 4700 such computerized data for other entities, to notify the affected entity in the event of a data breach (so as to allow that entity to notify affected individuals). However, the specific requirements regarding the timing of the notice, content of the notice, types of data covered, and other aspects may vary.367 Indeed, one commenter highlighted the variation and uncertainty among different State law requirements.368 Thus, while transfer agents may already be complying with one or more State notification laws, variations in these State laws could result in residents of one State receiving notice while residents of another do not receive notice, or receive it later, or receive different information for the same data breach incident. The final amendments address this concern by imposing a Federal minimum standard for customer notification, which will help ensure timely, consistent notice to affected securityholders regardless of their State of residence. Impact of Notices From Transfer Agents One commenter stated that the proposal would equalize standards governing transfer agents, and in doing so, promote investor protection.369 On the other hand, several commenters stated that the proposed rule regarding transfer agents would confuse securityholders. One commenter suggested that requiring a transfer agent to identify and contact customers of another institution may cause those customers to be confused and concerned.370 Two commenters similarly stated that the notification requirement is likely to confuse securityholders because it would result in securityholders receiving notice from both the transfer agent and the issuer with respect to the same breach.371 One commenter further stated that a transfer agent should only be required to notify an issuer of an incident.372 We acknowledge that due to existing State law provisions, individuals affected by a breach at a transfer agent may receive notice from the issuer and the transfer agent with respect to the same breach. Moreover, transfer agents subject to the Banking Agencies’ Incident Response Guidance may send notices under those provisions as well, and it is possible that an issuer may also send notices to securityholders, pursuant to State law or other 367 See supra section I. Computershare Comment Letter. 369 See Better Markets Comment Letter. 370 See SIFMA Comment Letter 2. 371 See STA Comment Letter 2 and Computershare Comment Letter. 372 See SIFMA Comment Letter 2. 368 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations requirements. We acknowledge that these existing provisions, coupled with the requirements of the final amendments, may result in multiple notices being sent for the same incident. That said, as explained above, we have modified the final amendments to minimize the likelihood of multiple notices being sent by covered institutions for the same incident.373 Regardless, we do not agree that individuals who receive a notice from both a transfer agent and the issuer with respect to the same breach or who are contacted by a transfer agent on behalf of another institution will be confused. Any potential confusion could be ameliorated through a clear description of the specific incident that would allow an individual to determine whether it is covered by a notice from any covered institution.374 Rather than create confusion, as some commenters assert, the final amendments will establish a Federal minimum standard for covered institutions, thereby reducing any extant or potential confusion. As discussed in the proposal, there are variations in existing State laws regarding a firm’s duty to investigate a data breach, the specific events that trigger when notice of a breach is required, the timing of any such notices, and other details of a notice. The Federal minimum standard established by the final amendments will eliminate this confusion by ensuring that all affected securityholders receive an appropriate notice, regardless of the securityholder’s State of residence, thereby enhancing investor protection overall. This benefit justifies the remote risk of potential confusion suggested by some commenters. 3. Maintaining the Current Regulatory Framework for Notice-Registered Broker-Dealers The final amendments will, as proposed, contain a number of amendments to Regulation S–P that result in the continuation of the same regulatory treatment for noticeregistered broker-dealers as they were subject to under the existing safeguards rule and disposal rule.375 Specifically, 373 See supra section II.A.3.a. is possible that customers may not be aware of their relationship with a transfer agent or otherwise may not recognize the transfer agent and therefore could read the notification as a phishing attempt or another nefarious scheme. See infra section IV.D.2.b. 375 Notice-registered broker-dealers are futures commission merchants and introducing brokers registered with the CFTC that are permitted to register as broker-dealers by filing a notice with the Commission for the limited purpose of effecting transactions in security futures products. See Registration of Broker-Dealers Pursuant to section lotter on DSK11XQN23PROD with RULES2 374 It VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 notice-registered broker-dealers are explicitly excluded from the scope of the disposal rule,376 but subject to the safeguards rule. However, under substituted compliance provisions, notice-registered broker-dealers are deemed to comply with the safeguards rule (and all other aspects of Regulation S–P, other than the disposal rule) if they are subject to, and comply with, the financial privacy rules of the CFTC,377 including similar obligations to safeguard customer information.378 The Commission initially adopted substituted compliance provisions with regard to the safeguards rule in acknowledgment that notice-registered broker-dealers are subject to primary oversight by the CFTC, and to mirror similar substituted compliance provisions afforded by the CFTC to broker-dealers registered with the Commission.379 When the Commission later adopted the disposal rule, it excluded notice-registered brokerdealers from the rule’s scope, stating its belief that Congress did not intend for the Commission’s FACT Act rules to apply to entities subject to primary oversight by the CFTC.380 For these reasons, the Commission tailored the proposal to ensure there would be no change in the treatment of noticeregistered broker-dealers under the safeguards rule and the disposal rule.381 No comments were received regarding the treatment of notice-registered broker-dealers under the safeguards rule and the disposal rule. For the reasons outlined in the Proposing Release, the 15(b)(11) of the Securities Exchange Act of 1934, Exchange Act Release No. 44730 (Aug. 21, 2001) [66 FR 45138 (Aug. 27, 2001)] (‘‘Notice-Registered Broker-Dealer Release’’). 376 See 17 CFR 248.30(b)(2)(i). 377 See 17 CFR 248.2(c) and 248.30(b). Under the substituted compliance provision in rule 248.2(c), notice-registered broker-dealers operating in compliance with the financial privacy rules of the CFTC are deemed to be in compliance with Regulation S–P, except with respect to Regulation S–P’s disposal rule (currently rule 248.30(b)). 378 See 17 CFR 160.30. 379 See Notice-Registered Broker-Dealer Release; see also CFTC, Privacy of Customer Information [66 FR 21236 (Apr. 27, 2001)]. 380 See Proposing Release at n.203. 381 This approach will provide notice-registered broker-dealers with the benefit of consistent regulatory treatment under Regulation S–P, without imposing any additional costs, while also maintaining the same investor protections that the customers of notice-registered broker-dealers currently receive. To the extent notice-registered broker-dealers opt to comply with Regulation S–P and the proposed safeguards rule rather than avail themselves of substituted compliance by complying with the CFTC’s financial privacy rules, the benefits and costs of complying with the proposed rule would be the same as those for other broker-dealers. Notice-registered broker-dealers should not face additional costs under the final rule related to the disposal rule, as they would remain excluded from its scope. See Proposing Release. PO 00000 Frm 00035 Fmt 4701 Sfmt 4700 47721 Commission is adopting the amendments as proposed.382 Specifically, as proposed, the definition of a ‘‘covered institution’’ includes ‘‘any broker or dealer,’’ without excluding notice-registered broker-dealers, thus ensuring that Regulation S–P’s substituted compliance provisions still apply to notice-registered broker-dealers with respect to the safeguards rule.383 In addition, the final amendments include the ‘‘covered institution’’ defined term within the disposal rule, while retaining the disposal rule’s existing exclusion for notice-registered broker-dealers.384 C. Recordkeeping We are adopting amendments to require covered institutions to make and maintain written records documenting compliance with the requirements of the safeguards rule and of the disposal rule as outlined in the table below (collectively, ‘‘recordkeeping requirements’’).385 We are adopting these amendments substantially as proposed, but, in response to a comment, with modifications designed to provide additional specificity to the scope of certain of the recordkeeping requirements as discussed below. The table below reflects the time periods that covered institutions will be 382 See Proposing Release at Section II.C.4. proposed rule 248.30(e)(3); see also 17 CFR 248.2(c). 384 See proposed rule 248.30(c)(1). As we are not adopting the paragraph in proposed rule 248.30(a), we are similarly not adopting the proposed technical amendment to 17 CFR 248.2(c), which, as to the disposal rule, provides an exception from the substituted compliance regime afforded to noticeregistered broker-dealers for Regulation S–P. See proposed rule 248.2(c); see also discussion on Scope of Information Protected supra Section II.B.1. This proposed technical amendment was intended to reflect the proposed shift in the disposal rule’s citation from paragraph (b) of rule 248.30 to paragraph (c) of rule 248.30, to ensure continuity in the treatment of notice-registered broker-dealers under Regulation S–P. As the final amendments will not result in such a shift to the disposal rule’s citation, this proposed technical amendment has been rendered unnecessary. 385 As discussed previously, pursuant to Regulation Crowdfunding, funding portals must comply with the requirements of Regulation S–P as they apply to brokers. Funding portals are not, however, subject to the recordkeeping obligations for brokers found under Rule 17a–4. See 17 CFR 240.17a–4; see also supra footnote 5 and accompanying text. Instead, funding portals are already obligated, pursuant to Rule 404 of Regulation Crowdfunding, to make and preserve all records required to demonstrate their compliance with, among other things, Regulation S–P for five years, the first two years in an easily accessible place. See 17 CFR 227.404(a)(5). While the final amendments do not modify funding portals’ recordkeeping requirements to include the same enumerated list of obligations as those applied to brokers under the amendments to Rule 17a–4, funding portals generally should look to make and preserve the same scope of records in connection with demonstrating their compliance with this portion of Regulation S–P. 383 See E:\FR\FM\03JNR2.SGM 03JNR2 47722 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations required to preserve these records, which are as proposed. These times vary by covered institution but are consistent with existing recordkeeping rules for these entities to the extent they have pre-existing recordkeeping obligations. TABLE 1—RECORDKEEPING REQUIREMENTS Covered institution Rule Retention period Registered Investment Companies. 17 CFR 270.31a–1(b) ........ 17 CFR 270.31a–2(a) ........ Unregistered Investment Companies 1. 17 CFR 248.30(c) .............. Registered Investment Advisers. Broker-Dealers ..................... Transfer Agents ................... 17 CFR 275.204–2(a) ........ Policies and Procedures. A copy of policies and procedures in effect, or that at any time in the past six years were in effect, in an easily accessible place. Other records. Six years, the first two in an easily accessible place. Policies and Procedures. A copy of policies and procedures in effect, or that at any time in the past six years were in effect, in an easily accessible place. Other records. Six years, the first two in an easily accessible place. All records for five years, the first two in an easily accessible place.2 17 CFR 240.17a–4(e) ........ 17 CFR 240.17ad–7(k) ...... All records for three years, in an easily accessible place. All records for three years, in an easily accessible place. lotter on DSK11XQN23PROD with RULES2 Note: 1 Regulation S–P applies to investment companies as the term is defined in section 3 of the Investment Company Act (15 U.S.C. 80a–3), whether or not the investment company is registered with the Commission. See 17 CFR 248.3(r). Thus, a business development company, which is an investment company but is not required to register as such with the Commission, is subject to Regulation S–P. Similarly, employees’ securities companies—including those that are not required to register under the Investment Company Act—are investment companies and are, therefore, subject to Regulation S–P. By contrast, issuers that are excluded from the definition of investment company—such as private funds that are able to rely on section 3(c)(1) or 3(c)(7) of the Investment Company Act—are not subject to Regulation S–P. 2 All books and records required to be made under the provision of 17 CFR 275.204–2(a) must be maintained and preserved in an easily accessible place for a period of not less than five years. 17 CFR 275.204–2(e). These recordkeeping requirements should aid covered institutions in periodically reassessing the effectiveness of their safeguarding and disposal programs by helping to ensure that those institutions have the records needed to perform that assessment. Additionally, maintenance of these records for sufficiently long periods of time and in accessible locations will help the Commission and its staff to monitor compliance with the requirements of the amended rules. We received one comment broadly in support of these recordkeeping requirements.386 The text of the proposed recordkeeping rules were worded differently for different covered institutions. For example, the proposed recordkeeping rule text for brokerdealers and transfer agents detailed the specific records to be kept whereas the proposed rule for advisers stated that advisers would be required to make and keep true, accurate and current a copy of the written records documenting compliance with the requirements of the safeguards and disposal rules.387 The Commission sought comment on whether the detailed requirements proposed for broker-dealers and transfer agents should be included in the recordkeeping rules for other covered entities. While no commenter specifically responded to this request, one commenter did suggest that a clarification of the adviser recordkeeping rule could assist in understanding their obligations under the rule.388 We are modifying the text of the proposed recordkeeping rules for registered investment advisers and registered and unregistered investment companies to provide in the final amendments the same detailed description as found in the rule text for broker-dealers and transfer agents. This should provide specificity as to what records are required to be kept under all of the recordkeeping rules.389 In addition, and in a change from the proposal, we are modifying the final rules to require a covered institution to retain any written documentation from the Attorney General related to a delay in notice.390 This should help ensure that a covered institution can justify a valid delay in sending notifications to affected individuals and aid the Commission’s examination and oversight program. The records that will be required under these amendments are: • Written policies and procedures required to be adopted and implemented pursuant to final rule 248.30(a)(1), which requires policies and procedures to address administrative, technical, and physical safeguards for the protection of customer information; • Written documentation of any detected unauthorized access to or use of customer information, as well as any response to, and recovery from such unauthorized access to or use of customer information required by final rule 248.30(a)(3); • Written documentation of any investigation and determination made regarding whether notification to affected 388 IAA 386 ICI Comment Letter. 387 See proposed 17 CFR 240.17a–4, 17 CFR 240.17ad–7, and 17 CFR 275.204–2. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Comment Letter. Proposing Release at section II.D. 390 See e.g., final 17 CFR 240.17a–4(e)(14)(iii) and final rule 248.30(c)(iii). 389 See PO 00000 Frm 00036 Fmt 4701 Sfmt 4700 individuals is required pursuant to final rule 248.30(a)(4), including the basis for any determination made, any written documentation from the Attorney General related to a delay in notice, as well as a copy of any notice transmitted following such determination; 391 • Written policies and procedures required to be adopted and implemented pursuant to final rule 248.30(a)(5)(i), which requires policies and procedures to oversee, monitor, and conduct due diligence on service providers, including to ensure that the covered institution is notified when a breach in security has occurred at the service provider; • Written documentation of any contract or agreement between a covered institution and a service provider entered into pursuant to final rule 248.30(a)(5); and • Written policies and procedures required to be adopted and implemented pursuant to final rule 248.30(b)(2), which requires policies and procedures to address the proper disposal of consumer information and customer information. The records that will be required include records of policies and procedures under the safeguards rule that address administrative, technical, and physical safeguards for the protection of customer information.392 The requirements will also include 391 Covered institutions are required to preserve a copy of any notice transmitted following the determination required under the final amendments, including those notices provided by the service provider to the covered institution’s customers on behalf of the covered institution. See e.g., final 17 CFR 270.31a–1(b)(13)(iii) (requiring registered investment companies to keep a copy of ‘‘any notice transmitted following such determination’’) (emphasis added); see also supra Section II.A.4.c. 392 See, e.g., final 17 CFR 240.17a–4(e)(14)(i) and final 17 CFR 270.31a–1(b)(13)(i); see also final rule 248.30(a)(1). E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations records documenting, among other things: (i) a covered institution’s assessments of the nature and scope of any incidents involving unauthorized access to or use of customer information; (ii) steps taken to contain and control such incidents; and (iii) a covered institution’s notifications to affected individuals consistent with the requirements of the final amendments as discussed above, or, where applicable, any determination that notification is not required after a reasonable investigation of the incident.393 Records required to be made and maintained will also include records of those written policies and procedures associated with the service provider notification requirements of the final amendments as well as related records of written contracts and agreements between the covered institution and the service provider.394 The disposal rule, as amended, will require that every covered institution adopt and implement written policies and procedures that address the proper disposal of consumer information and customer information.395 The only record required under the final amendments for purposes of the disposal rule is these written policies and procedures.396 lotter on DSK11XQN23PROD with RULES2 D. Exception From Requirement To Deliver Annual Privacy Notice Currently, Regulation S–P generally requires broker-dealers, investment companies, and registered investment advisers to provide customers with annual notices informing them about the institutions’ privacy practices (‘‘annual privacy notice’’).397 The 393 See, e.g., final 17 CFR 17a–4(e)(14)(ii) and (iii) and final 17 CFR 270.31a–1(b)(13)(ii) and (iii); see also final rule 248.30(a)(3)(i) through (iii). 394 See, e.g., final 17 CFR 17a–4(e)(14)(iv) and (v) and final 17 CFR 270.31a–1(b)(13)(iv) and (v); see also final rule 248.30(a)(5)(i) through (ii). 395 See final rule 248.30(b)(2). While the disposal rule does not currently require covered institutions to adopt and implement written policies and procedures, those adopted pursuant to the current safeguards rule should already cover disposal. See Disposal Rule Adopting Release at text accompanying n.20 (‘‘proper disposal policies and procedures are encompassed within, and should be a part of, the overall policies and procedures required under the safeguard rule.’’). Therefore, rule 248.30(b)(2) is intended primarily to seek sufficient documentation of policies and practices addressing the specific provisions of the disposal rule. 396 See, e.g., final 17 CFR 17a–4(e)(14)(vi) and final 17 CFR 270.31a–1(b)(13)(vi); see also final rule 248.30(b)(2). 397 17 CFR 248.4; 248.5. ‘‘Annually’’ for these purposes is defined as at least once in any period of 12 consecutive months during which that relationship exists. Institutions are permitted to define the 12-consecutive-month period, but must apply it to the customer on a consistent basis. 17 CFR 248.5(a)(1). The institution does not need to provide an annual notice in addition to an initial notice in the same 12-month period. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Commission is adopting as proposed amendments to conform Regulation S–P to the requirements of the Fixing America’s Surface Transportation Act (‘‘FAST Act’’),398 which provides an exception to the annual privacy notice required by Regulation S–P, provided certain requirements are met. As proposed, we are amending Regulation S–P to include an exception to the annual privacy notice requirement if the institution (1) only provides non-public personal information to non-affiliated third parties when an exception to third-party opt-out applies and (2) the institution has not changed its policies and practices with regard to disclosing non-public personal information from its most recent disclosure sent to customers.399 The amendments also, as proposed, provide the timing for when an institution must resume providing annual privacy notices in the event that the institution changes its policies and practices such that the exception no longer applies. We received one comment supporting the proposed exception and timing requirements.400 We are adopting as proposed amendments to the annual notice provision requirement of Regulation S–P to include the exception to the annual notice delivery added by the statutory exception Congress enacted in the FAST Act. The statutory exception states that a financial institution that meets the requirements for the annual privacy notice exception will not be required to provide annual privacy notices ‘‘until such time’’ as that financial institution fails to comply with the conditions to the exception, but does not specify a date by which the annual privacy notice delivery must resume.401 The amended timing requirements are designed to be consistent with the existing timing requirements for privacy notice delivery in Regulation S–P. Specifically, if the change in policies and practices will also result in the institution being required to send a revised privacy notice under the current requirements, the revised notice will be treated as an initial notice for the purpose of the timing requirement and the institution will be required to resume notices at the same time it otherwise provides annual privacy notices.402 If a revised notice is not required, the institution will be required to resume providing annual 398 Public Law 114–94, Sec. 75001, 129 Stat. 1312 (2015) (adding section 503(f) to the GLBA, codified at 15 U.S.C. 6803(f)). 399 See final 17 CFR 248.5(e)(1). 400 ICI Comment Letter. 401 See supra footnote 398. 402 See 17 CFR 248.8. PO 00000 Frm 00037 Fmt 4701 Sfmt 4700 47723 privacy notices within 100 days of the change. The amendments allow institutions to preserve their existing approach to selecting a delivery date for annual privacy notices, thereby avoiding the potential burdens of determining delivery dates based on a new approach and any 100-day period will accommodate the institution delivering the privacy notice alongside any quarterly reporting to customers. The amendments also are intended to be consistent with existing privacy notice delivery requirements of the CFTC, CFPB, and FTC.403 E. Existing Staff No-Action Letters and Other Staff Statements As stated in the Proposing Release, certain staff letters and other staff statements addressing Regulation S–P and other matters covered by the final amendments may be withdrawn or rescinded in connection with this adoption. Upon the compliance date of these rules, staff letters and other staff statements, or portions thereof, will be withdrawn or rescinded to the extent that they are moot, superseded, or otherwise inconsistent with the rules. This may include the letters and statements below. To the extent any staff statement is inconsistent or conflicts with the requirements of the rules, even if not specifically identified below, that statement is superseded. TABLE 2—LETTERS AND STATEMENTS Name of letter or statement Date issued Staff Responses to QuesJan. 23, 2003. tions about Regulation S–P. Certain Disclosures of InforMar. 11, 2011; mation to the CFP Board. Dec. 11, 2014. Investment Adviser and Apr. 16, 2019. Broker-Dealer Compliance Issues Related to Regulation S–P—Privacy Notices and Safeguard Policies. F. Compliance Period The Commission is providing an 18month compliance period after the date of publication in the Federal Register for larger entities, and a 24-month compliance period after the date of publication in the Federal Register for 403 See 17 CFR 160.5(D) (CFTC); 12 CFR 1016.5(e)(2) (CFPB); 16 CFR 313.5(e)(2) (FTC). See also CFTC, Privacy of Consumer Financial Information—Amendment to Conform Regulations to the Fixing America’s Surface Transportation Act, 83 FR 63450 (Dec. 10, 2018), at n.17; CFPB, Amendment to the Annual Privacy Notice Requirement Under the Gramm-Leach-Bliley Act (Regulation P) 83 FR 40945 (Aug. 17, 2018); FTC, Privacy of Consumer Financial Information Rule Under the Gramm-Leach-Bliley Act, 84 FR 13150 (Apr. 4, 2019). E:\FR\FM\03JNR2.SGM 03JNR2 47724 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations smaller entities. Table 3 below outlines which entities will be considered ‘‘larger entities’’ for these purposes. Smaller entities will be those covered institutions that do not meet these standards. The Commission generally has approved similar tiered compliance dates with respect to smaller versus larger entities in the past and, in our experience, these thresholds are a reasonable means of distinguishing larger and smaller entities for purposes of tiered compliance dates for rules affecting these entities.404 TABLE 3—DESIGNATION OF LARGER ENTITIES Entity Qualification to be considered a ‘‘larger entity’’ Investment companies together with other investment companies in the same group of related investment companies 1. Registered investment advisers 2 ............................................................. Broker-dealers 3 ........................................................................................ Net assets of $1 billion or more as of the end of the most recent fiscal year. $1.5 billion or more in assets under management. All broker-dealers that are not small entities under the Securities Exchange Act for purposes of the Regulatory Flexibility Act. All transfer agents that are not small entities under the Securities Exchange Act for purposes of the Regulatory Flexibility Act. Transfer agents 4 ...................................................................................... lotter on DSK11XQN23PROD with RULES2 Note: 1 ‘‘Group of related investment companies’’ is as defined in 17 CFR 270.0–10. We estimate that, as of September 2023, 77% of registered investment companies would be considered to be larger entities. This estimate is based on data reported in response to Items B.5, C.19, and F.11 on Form N–CEN. 2 We estimate that, as of September 2023, 23% of registered investment advisers would be considered to be larger registered investment advisers. This estimate is based on data reported in response to Items 2.A and 5.F.2.(c) on Form ADV. 3 A broker or dealer is a small entity if it: (i) had total capital of less than $500,000 on the date in its prior fiscal year as of which its audited financial statements were prepared or, if not required to file audited financial statements, on the last business day of its prior fiscal year; and (ii) is not affiliated with any person that is not a small entity. This threshold was chosen to include all broker-dealers who do not fall within the definition of a small entity under the Regulatory Flexibility Act (5 U.S.C. 553). Based upon FOCUS filings for the third quarter of 2023, we estimate approximately 77% of broker-dealers, not including funding portals, would be considered larger entities. Based upon staff analysis and review of public filings, we estimate approximately 3% of funding portals would be considered larger entities. 4 A transfer agent is a small entity if it: (i) received less than 500 items for transfer and less than 500 items for processing during the preceding six months; (ii) transferred items only of issuers that are small entities; (iii) maintained master shareholder files that in the aggregate contained less than 1,000 shareholder accounts or was the named transfer agent for less than 1,000 shareholder accounts at all times during the preceding fiscal year; and (iv) is not affiliated with any person that is not a small entity. 17 CFR 240.0–10. This threshold was chosen to include all transfer agents who do not fall within the definition of a small entity under the Regulatory Flexibility Act. Based on the number of transfer agents that reported a value of fewer than 1,000 for items 4(a) and 5(a) on Form TA–2 filed with the Commission as of September 30, 2023, we estimate approximately 132 transfer agents may be considered small entities, of 315 total registered transfer agents. See infra section VI. We proposed a 12-month transition period from the effective date for all covered institutions, regardless of asset size, and we solicited comment on whether the compliance period should be shorter or longer, and whether it should be the same for all covered institutions. Commenters that addressed this aspect of the proposal urged the Commission to provide additional time, generally suggesting a two-year or threeyear period to provide time for covered institutions to prepare to comply with the rule’s requirements.405 Commenters suggested that the proposed compliance period underestimates the time it would take to implement any final rule.406 In particular, commenters expressed that advisers will need to holistically reassess their current service provider infrastructure and may need time to find new service providers or renegotiate terms of service provider agreements in order to comply with the rule’s requirements.407 Separately, two commenters urged the Commission to consider a tiered compliance period that staggers the compliance date based on firm size, with larger firms having to comply with the rule’s requirements prior to smaller firms.408 These commenters asserted that a longer compliance period for smaller brokerdealers and investment advisers would allow these firms to benefit from the implementation of larger industry participants. We have taken commenter concerns into account in determining the compliance schedule,409 and we are adopting a compliance period of 18months following the date of publication of the final amendments in the Federal Register for larger entities, and 24-months following the date of publication in the Federal Register for smaller entities.410 The compliance period we are adopting is designed to 404 See, e.g., Investment Company Names, Investment Company Act Release No. 35000 (Sept. 20, 2023) [88 FR 70436 (Oct. 27, 2023)]; Investment Company Reporting Modernization, Investment Company Act Release No. 32314 (Oct. 13, 2016) [81 FR 81870 (Nov. 18, 2016)]; Investment Company Liquidity Risk Management Programs, Investment Company Act Release No. 32315 (Oct. 13, 2016) [81 FR 82142 (Nov. 18, 2016)]; Inline XBRL Filing of Tagged Data, Securities Act Release No. 10514 (June 28, 2018) [83 FR 40846 (Sept. 17, 2018)]; and Private Fund Advisers; Documentation of Registered Investment Adviser Compliance Reviews, Investment Advisers Act Release No. 6383 (Aug. 23, 2023) [88 FR 63206 (Sept. 14, 2023)]. 405 See, e.g., SIFMA Comment Letter 2; Computershare Comment Letter; ICI Comment Letter 1; Federated Comment Letter; Google Comment Letter. 406 See, e.g., IAA Comment Letter 1; FII Comment Letter; SIFMA Comment Letter 2; ICI Comment Letter 1; see also IAA Comment Letter 2 (stating that ‘‘advisers would need to holistically reassess their current service provider infrastructure and undergo the time-consuming and expensive process of negotiating terms with each Service Provider, reevaluate their current policies, procedures, and practices in light of any new requirements, prepare for new and/or different client notification obligations, and create and implement modified written incident response program policies and procedures and recordkeeping requirements’’). 407 See, e.g., Google Comment Letter; Federated Comment Letter; SIFMA Comment Letter 2; AWS Comment Letter; FII Comment Letter. 408 IAA Comment Letter 1; FSI Comment Letter. 409 ICI Comment Letter 1; Schulte Comment Letter; IAA Comment Letter 2 (asserting that the Commission’s new rules could potentially require investment advisers to establish and implement new regulatory requirements during compressed and overlapping compliance periods while attempting to comply with existing ongoing regulatory obligations). For further discussion of other recent Commission rules that may have overlapping compliance periods for some covered entities, as well as the potential associated costs associated with implementing multiple rules at once, see infra section IV. 410 With respect to the compliance period, commenters requested the Commission consider interactions between the proposed rule and other recent Commission rules. In determining compliance dates, the Commission considers the benefits of the rules as well as the costs of delayed compliance dates and potential overlapping compliance dates. For the reasons discussed throughout the release, to the extent that there are costs from overlapping compliance dates, the benefits of the rule justify such costs. See infra section IV for a discussion of the interactions of the final amendments with certain other Commission rules. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 PO 00000 Frm 00038 Fmt 4701 Sfmt 4700 E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations strike the appropriate balance between allowing covered institutions adequate time to establish or adjust their data notification compliance practices and allowing customers and investors to benefit from the amended Regulation S–P framework. Taking concerns of smaller entities into account, smaller entities will benefit from having an additional six months to come into compliance with the final amendments, based on feedback from commenters and to the extent that smaller entities may face additional or different challenges in coming into compliance with the final amendments than larger entities. Although we are providing for a longer compliance period than proposed, we are not providing more than 18 or 24 months, as suggested by some commenters, because we have made modifications from the proposal that should alleviate commenters’ concerns related to time needed to establish and implement processes to comply with the final amendments. In a modification from the proposal, the final amendments will no longer require covered institutions to have a written contract with its service providers mandating that service providers take appropriate measures to protect against unauthorized access to or use of customer information, but will instead require covered institutions to establish written policies and procedures reasonably designed to oversee, monitor, and conduct due diligence on service providers.411 Accordingly, the compliance dates will provide an appropriate amount of time for covered institutions to comply with the final amendments. Section 3(f) of the Exchange Act, section 2(c) of the Investment Company Act, and section 202(c) of the Investment Advisers Act provide that when engaging in rulemaking that requires us to consider or determine whether an action is necessary or appropriate in or consistent with the public interest, to also consider, in addition to the protection of investors, whether the action will promote efficiency, competition, and capital formation. Section 23(a)(2) of the Exchange Act also requires us to consider the effect that the rules will have on competition and prohibits us from adopting any rule that would impose a burden on competition not necessary or appropriate in furtherance of the Exchange Act. The analysis below addresses the likely economic effects of the final amendments, including the anticipated and estimated benefits and costs of the amendments and their likely effects on efficiency, competition, and capital formation. The Commission also discusses the potential economic effects of certain alternatives to the approaches taken in this adoption. The final amendments require every broker-dealer,413 every funding portal,414 every investment company, every registered investment adviser, and every transfer agent to notify affected customers of certain data breaches.415 To that end, the final amendments require these covered institutions to develop, implement, and maintain written policies and procedures that include an incident response program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information,416 and that III. Other Matters Pursuant to the Congressional Review Act,412 the Office of Information and Regulatory Affairs has designated the final amendments as a ‘‘major rule’’ as defined by 5 U.S.C. 804(2). If any of the provisions of these rules, or the application thereof to any person or circumstance, is held to be invalid, such invalidity shall not affect other provisions or application of such provisions to other persons or circumstances that can be given effect without the invalid provision or application. lotter on DSK11XQN23PROD with RULES2 IV. Economic Analysis A. Introduction The Commission is mindful of the economic effects, including the benefits and costs, of the adopted amendments. 411 See 412 5 supra section II.A.4. U.S.C. 801 et seq. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 413 Notice-registered broker-dealers subject to and complying with the financial privacy rules of the CFTC will be deemed to be in compliance with the final provision through the substituted compliance provisions of Regulation S–P. See supra section II.B.3. As discussed above, unless otherwise stated, references elsewhere in this release to ‘‘brokers’’ or ‘‘broker-dealers’’ include funding portals. See supra footnote 5. For the purposes of this economic analysis, however, ‘‘broker’’ and ‘‘broker-dealer’’ do not include funding portals because the economic effects of the final amendments on funding portals differ in some respects from the effects on brokerdealers. 414 Pursuant to Regulation Crowdfunding, funding portals ‘‘must comply with the requirements of [Regulation S–P] as they apply to brokers.’’ See 17 CFR 227.403(b); see also supra footnote 5 and accompanying text. 415 Notification is required in the event that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. See final rule 248.30(a)(4)(i). 416 As discussed above, ‘‘customer information’’ includes not only information of customers of the aforementioned entities, but also information of customers of other financial institutions in the possession of covered institutions. See supra section II.B.1 and final rule 248.30(d)(5)(i). In PO 00000 Frm 00039 Fmt 4701 Sfmt 4700 47725 includes a customer notification component for cases where sensitive customer information has been, or is reasonably likely to have been, accessed or used without authorization.417 The final amendments also define the scope of information covered by the safeguards rule and by the disposal rule,418 and extend the covered population to all transfer agents registered with the Commission or with another appropriate regulatory agency.419 Finally, the final amendments impose various related recordkeeping requirements,420 and include in the regulation an existing statutory exception to annual privacy notice requirements.421 The final amendments will affect covered institutions as well as customers who will receive the required notices. The final amendments will also have indirect effects on service providers that receive, maintain, process, or otherwise are permitted access to customer information on behalf of covered institutions: under the final amendments, unauthorized access to or use of sensitive customer information via service providers will fall under the customer notification requirement. The final amendments require that a covered institution’s incident response program include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers.422 These policies and procedures must be reasonably designed to ensure that service providers take appropriate measures to protect against unauthorized access to or use of customer information and provide notification to the covered institution of a breach of security resulting in addition, with respect to transfer agents, ‘‘customers’’ refers to ‘‘any natural person who is a securityholder of an issuer for which the transfer agent acts or has acted as a transfer agent.’’ See final rule 248.30(d)(4)(ii). 417 See final rule 248.30(a)(4); see also supra section II.A. Notice will not be required, however, if a covered institution has determined, after a reasonable investigation of the facts and circumstances of an incident of unauthorized access to or use of sensitive customer information, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. 418 Under the final amendments, the safeguards rule applies to ‘‘customer information’’ and the disposal rule applies to ‘‘consumer information’’ and ‘‘customer information.’’ See final rule 248.30(a)(1), 248.30(b), 248.30(d)(1), and 248.30(d)(5). 419 See final rule 248.30(d)(3). 420 See, e.g., final rule 17 CFR 275.204–2(a). See also supra section II.C and footnote 385. 421 See final rule 248.5(e). 422 See final rule 248.30(a)(5). E:\FR\FM\03JNR2.SGM 03JNR2 47726 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations unauthorized access to a customer information system maintained by the service provider.423 The main economic effects of the final amendments will result from the notification and incident response program requirements applicable to all covered institutions.424 For reasons discussed later in this section, the extension of Regulation S–P to transfer agents will have more limited economic effects.425 Finally, we anticipate the recordkeeping requirements and the incorporation of the existing statutory exception to annual privacy notice requirements to have minimal economic effects, as discussed further below.426 The main economic benefits of the final notification and incident response program requirements, as well as the extension of Regulation S–P to include all transfer agents, will result from enhanced protection of customer information. Customers will directly benefit from the opportunity to take appropriate mitigating actions to protect their accounts and information in the event of unauthorized access to or use of their sensitive information. Direct benefits will result from covered institutions allocating additional resources towards policies and procedures, information safeguards, and cybersecurity to comply with the final requirements. There may lastly be indirect benefits from covered institutions undertaking these actions to the extent they seek to avoid reputational harm resulting from the mandated notifications. These additional resources will contribute to reducing the exposure of covered institutions, and of the broader financial system, to incidents resulting in unauthorized access to or use of customer information.427 The main economic costs from these new requirements will be compliance costs related to the development and implementation of the required policies and procedures, reputational costs borne by firms that would not otherwise have notified customers of a data breach, and indirect costs from increased expenditures on additional safeguards for covered institutions who will choose to make such investments to avoid such reputational costs.428 lotter on DSK11XQN23PROD with RULES2 423 See id. 424 See infra sections IV.D.1.a and IV.D.1.b. 425 See infra section IV.D.2.b. 426 See infra sections IV.D.3 and IV.D.4. 427 While the scope of the safeguards rule and of the final amendments is not limited to cybersecurity, in the contemporary context, their main economic effects are realized through their effects on cybersecurity. See infra footnote 507. 428 Throughout this economic analysis, ‘‘compliance costs’’ refers to the direct costs that VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 We anticipate that the economic benefits and costs of the final notification requirements will—in the aggregate—be limited because all States already require some form of customer notification of certain data breaches,429 and because many entities are likely to already have response programs in place.430 Many customers already receive some level of data breach notification under other laws. This means that the benefits and costs, both direct and indirect, will only accrue from actions taken by covered institutions that are not already required by existing rules or caused by existing competitive forces. The final amendments will, however, afford many individuals greater protections by, for example, defining ‘‘sensitive customer information’’ more broadly than the current definitions used by certain States; 431 providing for a 30-day notification outside timeframe that is shorter than the timing currently mandated by many States, including States providing for no deadline or those allowing for various delays; 432 and providing for a more robust notification trigger than in many States.433 The final amendments also limit the time a service provider can take to notify a covered institution of a breach to 72 hours, which is a shorter period of time than mandated by many States, allowing covered institutions to notify their customers faster if such notification is required under the final amendments.434 Further, in certain States, State customer notification laws do not apply to entities subject to or in compliance with the GLBA, and the final amendments will help ensure that customers residing in these States receive notice of a breach if it occurs.435 The final amendments will help ensure that all customers, regardless of where they reside, receive a minimum of must be borne in order to avoid violating the Commission’s rules. This includes costs related to the development of policies and procedures required by the regulation, costs related to delivery of the required notices, and the direct costs of any other required action. As used here, ‘‘compliance costs’’ excludes costs that are not required, but may nonetheless arise as a consequence of the Commission’s rules (e.g., reputational costs resulting from disclosure of data breach, or increased cybersecurity spending aimed at avoiding such reputational costs). 429 See infra section IV.C.2.a. 430 See infra sections IV.C.1 and IV.C.2. 431 See infra section IV.D.1.b(3). 432 See infra section IV.D.1.b(2). 433 See infra section IV.D.1.b(4). 434 Upon receipt of such a notification from a service provider, a covered institution must initiate its incident response program. This may or may not result in the covered institution having to notify customers. See final rule 248.30(a)(5)(i); infra section IV.D.1.c. 435 See infra section IV.D.1.b(1). PO 00000 Frm 00040 Fmt 4701 Sfmt 4700 information regarding a given breach affecting their information and are therefore equally able to take appropriate mitigating actions. For these reasons, the final requirements will improve customers’ knowledge of when their sensitive information has been compromised. Specifically, we expect that the adopted Federal minimum standard for notifying customers of certain types of data breaches, along with the preparation of written policies and procedures for incident response, will result in more customers being notified of these data breaches as well as faster notifications for some customers, and that both of these effects will improve customers’ ability to act to protect their personal information. Moreover, such improved notification will—in many cases— become public and impose additional reputational costs on covered institutions that fail to safeguard customers’ sensitive information. We expect that these potential additional reputational costs will increase the disciplining effect on covered institutions, incentivizing them to improve customer information safeguards and reduce their exposure to data breaches, thereby improving the resilience of the financial system more broadly.436 This will reduce economic inefficiency in that it will better align customers’ and covered institutions’ incentives to safeguard customer information, but will also result in new indirect costs for covered institutions who choose to undertake these improvements in order to avoid those potential reputational costs. In addition, by revealing when breaches occur, the final amendments will help provide customers with information on the effectiveness of covered institutions’ customer information safeguards, further helping customers make betterinformed decisions when choosing a covered institution.437 To the extent that a covered institution does not have policies and procedures to safeguard customer information and respond to unauthorized access to or use of customer information, it will bear the costs to develop and implement the 436 As discussed below, the final amendments could result in unnecessary notification, which could lead to customer desensitization. See infra section IV.D.1. Unnecessary notification could decrease covered institutions’ incentives to invest in customer information safeguards in order to avoid reputational costs if unnecessary notification, for example, desensitizes customers to notices. In that scenario, those reputational costs are themselves reduced as a result of unnecessary notification. See infra section IV.D.1.b(4) for a discussion of the effects of unnecessary notification. 437 See infra section IV.B. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 required policies and procedures for the incident response program.438 Moreover, transfer agents—who were not subject to any of the customer information safeguard provisions of Regulation S–P prior to this adoption— will face additional compliance costs related to the development of policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information.439 As adopting policies and procedures involves fixed costs, doing so is very likely to impose a proportionately larger compliance cost on smaller covered institutions as compared to larger covered institutions.440 This may reduce smaller covered institutions’ ability to compete with their larger peers, for whom the fixed costs are spread over more customers.441 However, given the considerable competitive challenges arising from economies of scale and scope already faced by smaller firms, we do not anticipate that the costs associated with this adoption will significantly alter these challenges. Similarly, although the final amendments may lead to improvements to capital formation, existing State rules are similar in many respects to the amendments, and so we do not expect the amendments to have a significant impact on capital formation vis-à-vis the baseline.442 Many of the benefits and costs discussed below are difficult to quantify. Doing so would involve estimating the losses likely to be incurred by a customer in the absence of mitigation measures, the efficacy of mitigation measures implemented with a given delay, and the expected delay 438 See infra section IV.D.1 for a discussion of these costs. 439 That is, they will face the compliance costs of the provisions of Regulation S–P not applicable to registered transfer agents before this adoption. See 17 CFR 248.30(a). In addition, transfer agents registered with a regulatory agency other than the Commission will face additional compliance costs to develop, implement, and maintain written policies and procedures that address the proper disposal of customer information, as these transfer agents were not subject to the disposal rule before this adoption. See 17 CFR 248.30(b); see also infra section IV.D.2.b for a discussion of these costs. 440 If both large and small covered institutions were to undertake the same compliance activities, the fixed costs associated with these activities would impose a proportionately larger compliance cost on smaller covered institutions. See infra footnote 722. As discussed below, smaller covered institutions may have to undertake additional activities compared to larger covered institutions, which would result in additional burdens. See, e.g., infra section IV.D.1.a. 441 See infra sections IV.D.1 and IV.E. 442 We acknowledge, however, that the final amendments could have incremental effects on capital formation, and we discuss these effects below. See infra section IV.E. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 before notification can be provided under the final amendments. In general, data needed to arrive at such estimates are not available to the Commission. Thus, while we have attempted to quantify economic effects where possible, much of the discussion of economic effects is qualitative in nature. B. Broad Economic Considerations In a market with complete information, customers are able to perfectly observe the quality of the goods and services being provided and the processes and service provider relationships by which they are being provided. Fully informed customers can then decide what level of quality of good or service to consume, based on their own personal preferences. In this context, one element of a financial service’s quality is the customer information safeguards of the firm providing the service, which capture the likelihood of a customer’s information being exposed in the event of a breach, as well as the firm’s response to such a breach if it were to occur.443 Under this assumption, a customer is then able to choose a financial firm that offers a service of a quality that meets his or her preferences.444 In the context of covered institutions—firms whose services frequently involve custody of highly sensitive customer information—the assumption of complete information is unrealistic. Customers have little visibility into the internal processes of a firm and those of its service providers, so it is impractical for them to directly observe the level of customer information safeguards that a firm is employing.445 In addition, customers generally do not know how a firm would respond to a breach, including whether and to what extent a firm would inform its customers about such breach.446 In fact, firms often lack incentives to voluntarily disclose when information breaches occur (and likely have substantial incentives to avoid 443 The response includes elements such as detection, assessment, recovery, and the communication of the breach to the firm’s customers. 444 For example, a customer may be particularly averse to risk and consequently choose a financial firm with a higher level of information safeguards, even if this firm’s service is being provided for a higher price. 445 As discussed below, customers already receive some information on covered institutions’ customer information safeguards and disclosure of nonpublic personal information to third parties. See infra section IV.C.2.c. 446 Even if a firm has been the subject of a breach in the past, it may have changed its procedures since the last breach. In this case, even knowing the firm’s response to a previous breach would not be fully informative to customers. PO 00000 Frm 00041 Fmt 4701 Sfmt 4700 47727 such disclosures). Hence, customer information could be compromised without the customers being informed or with the customers being only partially informed.447 As a result, prospective customers have limited ability to choose a covered institution that is offering the service that most closely meets their needs. In addition, current customers may be paying for a service that is of lower quality than they expect.448 In both cases, customers have limited ability to avoid covered institutions that fail to protect customer information to the level expected by these customers.449 Hence, this information asymmetry prevents market forces from penalizing covered institutions that fail to protect customer information, and therefore prevents market forces from yielding economically efficient outcomes. This market failure serves as the economic rationale for this regulatory intervention. The information asymmetry can lead to three inefficiencies. First, the information asymmetry about specific information breaches that have occurred prevents individual customers whose information has been compromised from taking timely actions (e.g., increased monitoring of account activity or placing blocks on credit reports) necessary to mitigate the potential 447 Here, customers are ‘‘partially informed’’ if the information they receive about the breach is not sufficient to allow them to take appropriate mitigating actions. 448 It could also be the case that the true quality of the service is higher than what customers expect. In this case, the customers would not be harmed, but the firm would not be fully realizing the benefits from its investment in customer information safeguards. 449 The release of information about data breaches can lead to loss of customers, reputational harm, litigation, or regulatory scrutiny. See, e.g., U.S. Fed. Trade Comm’n, Press Release, Equifax to Pay $575 Million as Part of Settlement with FTC, CFPB, and States Related to 2017 Data Breach (July 22, 2019), available at https://www.ftc.gov/news-events/news/ press-releases/2019/07/equifax-pay-575-millionpart-settlement-ftc-cfpb-states-related-2017-databreach. See also James Mackay, 5 Damaging Consequences of Data Breach: Protect Your Assets (Dec. 15, 2023), available at https:// www.metacompliance.com/blog/data-breaches/5damaging-consequences-of-a-data-breach (stating that research has shown that up to a third of customers in retail, finance and healthcare would stop doing business with organizations that have been breached and that 85% would tell others about their experience) and 2019 Consumer Survey: Trust and Accountability in the Era of Data Misuse, Ping Identity, available at https://www.pingidentity.com/ en/resources/content-library/misc/3464-2019consumer-survey-trust-accountability.html (last visited Apr. 9, 2024) (describing a survey of more than 4,000 individuals across the U.S., U.K., Australia, France, and Germany which found that 81% of people would stop engaging with a brand online following a data breach; this includes 25% who would stop interacting with the brand in any capacity). E:\FR\FM\03JNR2.SGM 03JNR2 47728 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 consequences of such breaches. Second, the information asymmetry about covered institutions’ efforts at avoiding and limiting the consequences of such breaches can lead to customers choosing financial firms with levels of safeguards different from what they expect, which can result in customers choosing firms that they would not have otherwise chosen if provided with better information. Third, this asymmetry can also reduce covered institutions’ incentives to sufficiently safeguard customer information. As a result, they could devote too little effort (i.e., ‘‘underspend’’) toward safeguarding this information, thereby increasing the probability of the information being compromised in the first place.450 This scenario is often characterized as a moral hazard problem. When an agent’s actions cannot be observed or directly contracted for by the principal, it is difficult to induce the agent to supply the proper amounts of productive inputs.451 In other words, information asymmetry prevents covered institutions (the agents) that spend more effort on safeguarding customer information from having customers (the principals) recognize their extra efforts and therefore prevents the covered institutions from realizing some of the benefits associated with this additional effort.452 This reduces the incentives for 450 For example, in a recent survey of financial firms, 58% of the respondents self-reported ‘‘underspending’’ on cybersecurity. See McKinsey & Co. and Institute of International Finance, IIF/ McKinsey Cyber Resilience Survey (Mar. 2020), available at https://www.iif.com/portals/0/Files/ content/cyber_resilience_survey_3.20.2020_ print.pdf (‘‘IIF/McKinsey Report’’). A total of 27 companies participated in the survey, with 23 having a global footprint. Approximately half of respondents were European or U.S. Globally Systemically Important Banks (G–SIBs). 451 See, e.g., Bengt Holmstrom, Moral Hazard and Observability, 10 Bell J. Econ. 74–91 (1979) (‘‘It has long been recognized that a problem of moral hazard may arise when individuals engage in risk sharing under conditions such that their privately taken actions affect the probability distribution of the outcome [. . .]. The source of this moral hazard or incentive problem is an asymmetry of information among individuals that results because individual actions cannot be observed and hence contracted upon.’’); Bengt Holmstrom, Moral Hazard in Teams, 13 Bell J. Econ. 324–340 (1982) (‘‘Moral hazard refers to the problem of inducing agents to supply proper amounts of productive inputs when their actions cannot be observed and contracted for directly.’’). In other contexts, moral hazard refers to a party taking on excessive risk when knowing another party will be responsible for negative outcomes. This alternative definition may be viewed as a special case within the broader economic definition associated with the difficulty of contracting for privately taken actions. See, e.g., Adam Carpenter, Moral Hazard Definition, U.S. News (Aug. 11, 2022; updated Dec. 8, 2023), available at https://money.usnews.com/investing/ term/moral-hazard. 452 Such benefits include attracting customers who are willing to pay more for enhanced security, VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 covered institutions to exert effort towards safeguarding information.453 We expect the final amendments may mitigate the inefficiencies described above in several ways. First, by helping facilitate timely and informative notices to customers when their information is compromised, the amendments may mitigate information asymmetries around the compromise of information and improve customers’ ability to take appropriate remedial actions. Second, by revealing when such events occur, the amendments may help customers draw inferences about a covered institution’s efforts toward protecting customer information, which might help inform their choice of covered institution and reduce the probability of customers inadvertently choosing a firm that is less likely to meet their preferences or needs.454 This, in turn, might provide firms with greater incentives to exert effort toward protecting customer information,455 thereby mitigating the moral hazard problem. And, by imposing a regulatory requirement to develop, implement, and maintain policies and procedures, the final amendments might further enhance firms’ cybersecurity preparations and will restrict firms’ ability to limit efforts in these areas. The effectiveness of the final amendments at mitigating these problems will depend on several factors. First, the effectiveness of the amendments will depend on the degree to which breach notification provides customers with sufficient actionable information in a sufficient timeframe to help them mitigate the effects of the compromise of sensitive customer information. Second, it will depend on customers’ ability to draw inferences on a covered institution’s protection of customer information based on the notifications they receive, or the thereby allowing these covered institutions to charge a higher price for their services. 453 This is not to say that firms do not have any incentives to invest in customer information safeguards. As discussed below, firms themselves are hurt by incidents resulting in unauthorized access to or use of customer information and therefore have incentives to invest in safeguards even when these incidents remain unknown to their customers. See infra section IV.C.1. 454 In the case of transfer agents and funding portals, such effects would usually be mediated through security-issuing firms’ choice of transfer agent or funding portal and therefore be less direct. Nonetheless we expect that, all else being equal, firms would prefer to avoid employing the services of transfer agents or funding portals that have been unable to prevent investors’ information from being compromised. 455 See, e.g., Richard J. Sullivan & Jesse Leigh Maniff, Data Breach Notification Laws, 101 Econ. Rev. 65 (2016) (‘‘Sullivan & Maniff’’). PO 00000 Frm 00042 Fmt 4701 Sfmt 4700 absence thereof.456 Third, it will also depend on the degree to which the prospect of issuing such notices—and the prospect of the reputational harm, litigation, and regulatory scrutiny that could ensue—helps alleviate underspending on safeguarding customer information.457 These factors themselves depend on the extent to which covered institutions already have in place processes and practices that satisfy the final requirements and therefore on the extent to which the amendments will induce improvements to existing practices relative to the baseline.458 Some commenters supported generally the economic rationale in the Proposing Release.459 Some of these commenters expressed that the asymmetric information market failure was present in this context.460 Some 456 Because breaches can happen even at firms with very high customer information safeguards, and because firms with very low levels of safeguards might never be victim of a breach, customers’ ability to draw inferences could be limited. 457 Although empirical evidence on the effectiveness of notification breach laws (that is, on how such laws help individuals mitigate the effects of a breach and how they prevent such breaches from occurring by influencing firms’ levels of safeguards) is quite limited, extant studies suggest that such laws protect consumers from harm. See Sasha Romanosky et al., Do Data Breach Disclosure Laws Reduce Identity Theft?, 30 J. Pol’y Analysis & Mgmt 256 (2011); see also Sullivan & Maniff, supra footnote 455. 458 This economic analysis presents evidence suggesting that the inefficiencies described above do exist in this context, and therefore suggesting that covered institutions’ existing processes and practices can be improved. See infra footnote 464 and accompanying text for evidence that some notices do not currently contain sufficient information for customers to take appropriate mitigating actions and infra section IV.D.1.b(2) for evidence that such notices are sometimes sent with such delay as to make it difficult for customers to take ‘‘timely’’ mitigating actions; see also supra footnote 449 for evidence that customers would modify the firms with which they do business if they learned that this firm was the victim of a breach, suggesting that such customers do draw inferences on firms’ customer information safeguards when learning that breaches occur and modify their behavior as a result; see also infra section IV.C.1 for evidence that some firms are currently underspending on cybersecurity. 459 See, e.g., Nasdaq Comment Letter; FSI Comment Letter. 460 See, e.g., Better Markets Comment Letter (‘‘But companies will not always disclose data breaches to affected individuals voluntarily. They may be concerned about the damage to their reputation and their bottom line from disclosing a breach.’’); EPIC Comment Letter (‘‘A company has better visibility than its consumers do into the threats to the privacy and security of consumer data entrusted to that company’s custody; and the company’s interests are not directly aligned with those of its consumers.’’); Nasdaq Comment Letter (‘‘Requiring various financial institutions and market entities to address these cybersecurity risks through policies and procedures, incident response programs, third-party management, notifications and/or public disclosures can promote transparency and E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 commenters stated that this market failure could lead to inefficiencies.461 One commenter stated that firms ‘‘either seek to skirt notification requirements altogether or provide vague or confusing notifications,’’ preventing affected individuals from taking timely actions, and that firms’ self-interest could lead them to fail to notify customers affected by a breach.462 Another commenter stated its view that firms have a natural tendency to want to avoid making disclosures that could incur liability or lead to a loss of customers.463 Another commenter stated that beginning in the fourth quarter of 2021, less information started being included in data breach notices and that in 2022, only 34 percent of notices included information about the breaches and their victims.464 This commenter further added that this lack of actionable information in breach notices prevented individuals from effectively judging the risks they faced and from taking the appropriate actions to protect themselves.465 One commenter supported the economic rationale of the Proposing Release, stating that stronger notification requirements could effectively incentivize covered institutions to improve their data security practices in order to avoid the reputational harm associated with distributing breach notices.466 Other commenters disagreed with the economic rationale in the Proposing Release and stated that covered institutions’ level of customer information safeguards and/or breach notification practices were already adequate, and that existing regulation made the amendments unnecessary.467 consistency. Investors, issuers and other market participants benefit from healthy capital markets that promote trust and transparency.’’). 461 See, e.g., EPIC Comment Letter; Better Markets Comment Letter. 462 See EPIC Comment Letter. 463 See NASAA Comment Letter. 464 See Better Markets Comment Letter, citing Identity Theft Resource Center, Data Breach Annual Report (Jan 2023), available at https:// www.idtheftcenter.org/wp-content/uploads/2023/ 01/ITRC_2022-Data-Breach-Report_Final-1.pdf (‘‘IRTC Data Breach Annual Report’’). 465 See Better Markets Comment Letter. 466 See EPIC Comment Letter. This commenter also cited Federal Communications Commission (FCC), Data Breach Reporting Requirements, Proposed Rule, FCC 22–102, 88 FR 3953 (Jan. 23, 2023) (stating that the FCC ‘‘anticipate[s] that requiring notification for accidental breaches will encourage telecommunications carriers to adopt stronger data security practices and will help us identify and confront systemic network vulnerabilities’’). 467 See ASA Comment Letter (stating that the proposal was not ‘‘supported by evidence that brokers are fundamentally failing in their obligations to safeguard investor information and notify government authorities—within applicable Federal and State law—when a significant breach VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 We disagree with these commenters that the amendments are unnecessary, even if some covered institutions may already have policies and procedures in place that satisfy the final amendments’ requirements. We have discussed, here and in the Proposing Release, the information asymmetries that prevent customers from knowing whether or how they will be notified of a data breach and from choosing firms based on the level of their customer information safeguards.468 Furthermore, in addition to describing existing requirements and guidance available to (and potentially adopted by) covered institutions addressing customer information safeguards and customer notification, we have described (here and in the Proposing Release) a variety of practices and State law requirements that could lead to different notification outcomes depending on where the customer resides.469 In particular, we have described a variety of delays and inconsistencies in notification under existing requirements.470 Hence, the Proposing Release described in detail the existing regulatory framework and analyzed the benefits and costs of the proposed amendments relative to this framework. In addition, as discussed above, some commenters provided additional evidence of deficiencies in of sensitive information has occurred’’ and that the Proposing Release did not ‘‘provide any discussion about how current broker-dealer cybersecurity and customer notification policies are deficient or in need of a regulatory fix’’); ACLI Comment Letter (‘‘The ACLI’s members already comply with much of the Proposal’s content through State regulations, such as those that require companies to maintain written cybersecurity policies and procedures, respond to cyber incidents, notify authorities and consumers of certain cyber incidents, and dispose of consumer data. However, we are concerned with the Proposal’s shortened notification timeframes and expanded scope.’’); CAI Comment Letter (stating that ‘‘[n]otice currently is given to individuals whose information is reasonably believed to have potentially been affected after the findings of the investigation are determined,’’ that it ‘‘believes this current practice is an appropriate and common-sense approach to notification,’’ and that ‘‘[t]he new notice requirement proposed under Proposed Rule 30(b) would simply add another layer on top of these existing requirements and would likely go entirely unnoticed by consumers’’); Computershare Comment Letter (‘‘Computershare believes Proposed Reg S–P is an unnecessary regulation for transfer agents, as they are already subject, either directly or indirectly, to State, Federal or provincial laws designed to protect personal information of securityholders and requiring breach notification.’’); STA Comment Letter 2 (stating that the proposed amendments would not ‘‘meaningfully increase the safeguarding of shareholder information’’ and instead ‘‘cause ambiguity among competing laws.’’). 468 See Proposing Release at section III.B. 469 See Proposing Release at section III.C; see also infra section IV.C.2. 470 See Proposing Release at section III.C.2.a; see also infra section IV.C.2.a. PO 00000 Frm 00043 Fmt 4701 Sfmt 4700 47729 existing practices.471 Moreover, in response to commenters, we have supplemented the analysis of the amendments’ benefits and costs, describing in greater detail the changes made by the final amendments over the baseline.472 We summarize these changes below. We have also supplemented the analysis of the expected benefits and costs of expanding the scope of the safeguards and disposal rules to include transfer agents.473 In particular, the variety of practices and State law requirements that could lead to different notification outcomes under existing requirements provides a further rationale for the rule and motivated specific differences in the final amendments relative to State laws. We discuss the effects of these differences in detail below,474 but for example, the required timing of notification in the final amendments is stricter than under many State laws. The analysis in section IV.D.1.b(2) provides evidence that currently, many customers receive notification long after the event. The amendments are designed to help ensure that customers receive notification in a timely manner. In addition, the notification obligation covers a set of customer information that is broader than in many State laws, thereby covering more data breaches. Moreover, the final amendments require certain information to be included in the notice sent to customers. This requirement will help ensure that customers receive relevant information, allowing them to take appropriate mitigating actions in case of a breach. Hence, while the final amendments contain some requirements that are similar to those in some existing State laws, the final requirements are stricter than many State laws and may therefore lead to customers receiving additional, timelier, and more relevant notices than under existing regulations.475 In addition, variations in State law requirements highlight the need for a consistent Federal minimum standard for covered institutions. Such a standard will protect all customers regardless of their State of residence and reduce the potential confusion that could result from customers in one State receiving 471 See supra footnote 460 and accompanying text. 472 See infra section IV.D. infra section IV.D.2.b. 474 See infra section IV.D.1. 475 It is possible that, because of the overlap with State laws, some covered institutions already have policies and procedures in place satisfying the final amendments’ requirements. For these institutions and their customers, both the benefits and the costs of the amendments will be limited. 473 See E:\FR\FM\03JNR2.SGM 03JNR2 47730 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations notice of an incident while customers in another State do not. Other commenters stated that the analysis in the Proposing Release underestimated the costs of the amendments.476 Some commenters also stated that the proposed amendments in general would be very costly to implement for smaller covered institutions.477 As discussed more fully below, we expect some of the changes made to the final amendments to result in lower costs relative to the proposal.478 For example, the changes made to the service provider provisions of the amendments (requiring that covered institutions oversee service providers instead of requiring written contracts between covered institutions and their service providers, and requiring that the covered institution’s policies and procedures be reasonably designed to ensure service providers take appropriate measures to notify covered institutions of an applicable breach in security within 72 hours instead of 48 hours) may reduce some costs relative to the proposal and facilitate their implementation, especially for smaller covered institutions.479 In addition, in a change from proposal, we are adopting longer compliance periods for all covered institutions, and an even longer compliance period for smaller covered institutions,480 who are less likely to already have policies and procedures broadly consistent with the final amendments. lotter on DSK11XQN23PROD with RULES2 C. Baseline The baseline against which the costs, the benefits, and the effects on efficiency, competition, and capital formation of the final amendments are measured consists of current requirements for customer notification and information safeguards, current practice as it relates to customer notification and information safeguards, and the current market structure and regulatory framework. The economic analysis appropriately considers existing regulatory requirements, including recently adopted Commission rules as well as State, Federal, and foreign laws and regulations, as part of the economic baseline against which the 476 See, e.g., IAA Comment Letter 1 (‘‘We urge the Commission to undertake a more expansive, accurate, and quantifiable assessment of the specific and cumulative costs, burdens, and economic effects that would be placed on advisers by the proposed requirements, as well as of the potential unintended consequences for their clients.’’). 477 See, e.g., ASA Comment Letter; IAA Comment Letter 1. 478 See, e.g., infra sections IV.D.1.c and IV.E. 479 See supra section II.A.4; infra section IV.D.1.c. 480 See supra section II.F. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 costs and benefits of the final amendments are measured.481 Several commenters requested that the Commission consider interactions between the economic effects of the proposal and other recent Commission proposals.482 The Commission adopted several of the rules mentioned by commenters, namely the Electronic Recordkeeping Adopting Release,483 the Form N–PX Adopting Release,484 the Settlement Cycle Adopting Release,485 481 See, e.g., Nasdaq v. SEC, 34 F.4th 1105, 1111– 15 (D.C. Cir. 2022). This approach also follows SEC staff guidance on economic analysis for rulemaking. See SEC Staff, Current Guidance on Economic Analysis in SEC Rulemaking (Mar. 16, 2012), available at https://www.sec.gov/divisions/riskfin/ rsfi_guidance_econ_analy_secrulemaking.pdf (‘‘The economic consequences of proposed rules (potential costs and benefits including effects on efficiency, competition, and capital formation) should be measured against a baseline, which is the best assessment of how the world would look in the absence of the proposed action.’’); Id. at 7 (‘‘The baseline includes both the economic attributes of the relevant market and the existing regulatory structure.’’). The best assessment of how the world would look in the absence of the proposed or final action typically does not include recently proposed actions, because that would improperly assume the adoption of those proposed actions. 482 See, e.g., IAA Comment Letter 2; IAA Comment Letter 1; CAI Comment Letter; Comment Letter of the Securities Industry and Financial Markets Association, et al. (Mar. 31, 2023) (‘‘SIFMA Comment Letter 1’’). See also Comment Letter of the Investment Company Institute (Aug. 17, 2023) (‘‘ICI Comment Letter 2’’) (stating the Commission should analyze the interconnections in related rules). 483 Electronic Recordkeeping Requirements for Broker-Dealers, Security-Based Swap Dealers, and Major Security-Based Swap Participants, Release No. 34–96034 (Oct. 12, 2022) [87 FR 66412 (Nov. 3. 2022)] (‘‘Electronic Recordkeeping Adopting Release’’). One commenter stated that the Proposing Release could create concurrent obligations with Rule 17a–4 and Rule 18a–6. See AWS Comment Letter. Rule 17a–4 and Rule 18a–6 were amended in the Electronic Recordkeeping Adopting Release. Those amendments modified requirements regarding the maintenance and presentation of electronic records, the use of third-party recordkeeping services, and prompt production of records. The compliance dates were May 3, 2023, and Nov. 3, 2023. See Electronic Recordkeeping Adopting Release, section II.I. 484 Enhanced Reporting of Proxy Votes by Registered Management Investment Companies; Reporting of Executive Compensation Votes by Institutional Investment Managers, Release Nos. 33– 11131, 34–96206, IC–34745 (Nov. 2, 2022) [87 FR 78770 (Dec. 22, 2022)] (‘‘Form N–PX Adopting Release’’). The Form N–PX amendments enhanced the information funds report publicly about their proxy votes, and apply to most registered management investment companies. The effective date is July 1, 2024. Form N–PX Adopting Release, section II.K. 485 Shortening the Securities Transaction Settlement Cycle, Release No. 34–96930 (Feb. 15, 2023) [88 FR 13872 (Mar. 6, 2023)] (‘‘Settlement Cycle Adopting Release’’). This rule shortens the standard settlement cycle for most broker-dealer transactions from two business days after the trade date to one business day after the trade date. To facilitate orderly transition to a shorter settlement cycle, the rule requires same-day confirmations, allocations, and affirmations for processing transactions subject to the rule, and requires registered investment advisers to make and keep PO 00000 Frm 00044 Fmt 4701 Sfmt 4700 the May 2023 SEC Form PF Adopting Release,486 the Public Company Cybersecurity Rules,487 the Money Market Fund Adopting Release,488 the Investment Company Names Adopting records of each confirmation received, and of any allocation and each affirmation sent or received, with a date and time stamp for each indicating when it was sent or received. With certain exceptions, the rule has a compliance date of May 28, 2024. Settlement Cycle Adopting Release, sections VII, VII.B.3. 486 Form PF; Event Reporting for Large Hedge Fund Advisers and Private Equity Fund Advisers; Requirements for Large Private Equity Fund Adviser Reporting, Investment Company Act Release No. 6297 (May 3, 2023) [88 FR 38146 (June 12, 2023)] (‘‘May 2023 SEC Form PF Adopting Release’’). The Form PF amendments adopted in May 2023 require large hedge fund advisers and all private equity fund advisers to file reports upon the occurrence of certain reporting events. The compliance dates are Dec. 11, 2023, for the event reports in Form PF sections 5 and 6, and June 11, 2024, for the remainder of the Form PF amendments in the May 2023 SEC Form PF Adopting Release. See May 2023 SEC Form PF Adopting Release, section II.E. 487 Public Company Cybersecurity Rules, supra footnote 14. The amendments require current disclosure about material cybersecurity incidents, and periodic disclosures about a registrant’s processes to assess, identify, and manage material cybersecurity risks, management’s role in assessing and managing material cybersecurity risks, and the board of directors’ oversight of cybersecurity risks. With respect to Item 106 of Regulation S–K and item 16K of Form 20–F, all registrants must provide disclosures beginning with annual reports for fiscal years ending on or after Dec. 15, 2023. With respect to incident disclosure requirements in Item 1.05 of Form 8–K and in Form 6–K, all registrants other than SRCs were required to begin complying on Dec. 18, 2023; SRCs must begin complying with Item 1.05 of Form 8–K on June 15, 2024. With respect to structured data requirements, all registrants must tag disclosures beginning one year after the initial compliance date: specifically, beginning with annual reports for fiscal years ending on or after Dec. 15, 2024, in the case of Item 106 of Regulation S–K and item 16K of Form 20– F, and beginning Dec. 18, 2024, in the case of Item 1.05 of Form 8–K and Form 6–K. Cybersecurity Disclosure Adopting Release, section II.I. 488 Money Market Fund Reforms; Form PF Reporting Requirements for Large Liquidity Fund Advisers; Technical Amendments to Form N–CSR and Form N–1, Release No. 33–11211 (July 12, 2023) [88 FR 51404 (Aug. 3, 2023)] (‘‘Money Market Fund Adopting Release’’). The amendments are designed to improve the resilience and transparency of money market funds by increasing minimum liquidity requirements to provide a more substantial buffer in the event of rapid redemptions; removing provisions that permitted a money market fund to temporarily suspend redemptions, and removing the regulatory tie between the imposition of liquidity fees and a fund’s liquidity level; requiring certain money market funds to implement a liquidity fee framework that will better allocate the costs of providing liquidity to redeeming investors; and enhancing certain reporting requirements. The Money Market Fund Adopting Release has compliance dates of Oct. 2, 2024, for implementing mandatory liquidity fees and of Apr. 2, 2024, for discretionary liquidity fees; a compliance date of Apr. 2, 2024, for minimum liquidity requirements and weighted average maturity calculations; a compliance date of June 11, 2024, for certain form amendments and website reporting requirements; and an effective date of Oct. 2, 2023, for other provisions. Money Market Fund Adopting Release, section II.H. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 Release,489 the Beneficial Ownership Adopting Release,490 the Private Fund Advisers Adopting Release,491 the Securitizations Conflicts Adopting Release,492 and the February 2024 Form PF Adopting Release.493 These adopted 489 Investment Company Names, Release No. 33– 11238 (Sept. 20, 2023) [88 FR 70436 (Oct. 11, 2023)], as amended by Investment Company Names; Correction, Release No. 33–11238A (Oct. 24, 2023) [88 FR 73755 (Oct. 27, 2023)] (‘‘Investment Company Names Adopting Release’’). The amendments broaden the scope of the requirement for certain funds to adopt a policy to invest at least 80 percent of the value of their assets in accordance with the investment focus that the fund’s name suggests; require enhanced prospectus disclosure for terminology used in fund names; impose related notice, recordkeeping, and reporting requirements. The compliance date for the final amendments is Dec. 11, 2025, for larger entities and June 11, 2026, for smaller entities. See Investment Company Names Adopting Release, sections II.H, IV.D.3. 490 Modernization of Beneficial Ownership Reporting, Release No. 33–11253 (Oct. 10, 2023) [88 FR 76896 (Nov. 7, 2023)] (‘‘Beneficial Ownership Adopting Release’’). Among other things, the amendments generally shorten the filing deadlines for initial and amended beneficial ownership reports filed on Schedules 13D and 13G, and require that Schedule 13D and 13G filings be made using a structured, machine-readable data language. The amendments are effective Feb. 5, 2024. The new filing deadline for Schedule 13G will not be required before Sept. 30, 2024, and the rule’s structured data requirements have a one-year implementation period ending Dec. 18, 2024. Beneficial Ownership Adopting Release, section II.G. 491 Private Fund Advisers; Documentation of Registered Investment Adviser Compliance Reviews, Release No. IA–6383 (Aug. 23, 2023) [88 FR 63206 (Sept. 14, 2023)] (‘‘Private Fund Advisers Adopting Release’’). The Commission adopted five new rules and two rule amendments as part of the reforms. The compliance date for the quarterly statement rule and the audit rule is Mar. 14, 2025, for registered private fund advisers. For the adviser-led secondaries rule, the preferential treatment rule, and the restricted activities rule, the Commission adopted staggered compliance dates that provide for the following compliance periods: for advisers with $1.5 billion or more in private funds assets under management, a 12-month compliance period (ending on Sept. 14, 2024) and for advisers with less than $1.5 billion in private funds assets under management, an 18-month compliance period (ending on Mar. 14, 2025). The amended Advisers Act compliance provision for registered investment advisers had a Nov. 13, 2023, compliance date. See Private Fund Advisers Adopting Release, sections IV, VI.C.1. 492 Prohibition Against Conflicts of Interest in Certain Securitizations, Release No. 33–11254 (Nov. 27, 2023) [88 FR 85396 (Dec. 7, 2023)] (‘‘Securitizations Conflicts Adopting Release’’). The new rule prohibits an underwriter, placement agent, initial purchaser, or sponsor of an asset-backed security (including a synthetic asset-backed security), or certain affiliates or subsidiaries of any such entity, from engaging in any transaction that would involve or result in certain material conflicts of interest. The compliance date for securitization participants to comply with the prohibition is Jun. 9, 2025. Securitizations Conflicts Adopting Release, section II.I. 493 Form PF: Reporting Requirements for All Filers and Large Hedge Fund Advisers, Release No. IA–6546 (Feb. 8, 2024) [89 FR 17984 (Mar. 12, 2024)] (‘‘February 2024 Form PF Adopting Release’’). The Form PF amendments are designed VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 rules are part of the baseline against which this economic analysis considers the benefits and costs of the final amendments. In response to commenters, this economic analysis also considers potential economic effects arising from the extent to which there is any overlap between the compliance period for the final amendments and the compliance periods for these other adopted rules.494 The parties directly affected by the final amendments, the ‘‘covered institutions,’’ 495 include every brokerdealer (3,476 entities),496 every funding portal (92 entities),497 every investment company (13,766 distinct legal to enhance the Financial Stability Oversight Council’s ability to monitor systemic risk as well as bolster the SEC’s regulatory oversight of private fund advisers and investor protection efforts. The compliance date for the rule is Mar. 12, 2025. February 2024 Form PF Adopting Release, section II.F. 494 See infra sections IV.D and IV.E. In addition, commenters indicated there could be overlapping compliance costs between the final amendments and proposals that have not been adopted. See, e.g., IAA Comment Letter 2, Exhibit A; IAA Comment Letter 1; CAI Comment Letter; FSI Comment Letter. Proposed rules that commenters mentioned included Cybersecurity Risk Management for Investment Advisers, Registered Investment Companies, and Business Development Companies, Release No. 33–11028 (Feb. 9, 2022), 87 FR 13524 (Mar. 9, 2022); Enhanced Disclosures by Certain Investment Advisers and Investment Companies About Environmental, Social, and Governance Investment Practices, Release No. 33–11117 (Oct. 7, 2022) [87 FR 63016] (Oct. 18, 2022)]; Open-End Fund Liquidity Risk Management Programs and Swing Pricing; Form N–PORT Reporting, Release No. 33–11130 (Nov. 2, 2022), [87 FR 77172 (Dec. 16, 2022)]; Safeguarding Advisory Client Assets, Release No. IA–6240 (Feb. 15, 2023), [88 FR 14672 (Mar. 9, 2023)]; and Cybersecurity Risk Management Rule for Broker-Dealers, Clearing Agencies, Major Security-Based Swap Participants, the Municipal Securities Rulemaking Board, National Securities Associations, National Securities Exchanges, Security-Based Swap Data Repositories, SecurityBased Swap Dealers, and Transfer Agents, Release No. 34–97142 (Mar. 15, 2023) [88 FR 20212 (Apr. 5, 2023)]. To the extent those proposals are adopted, the baseline in those subsequent rulemakings will reflect the existing regulatory requirements at that time. 495 See infra section IV.C.3. 496 Of these, 303 are dually registered as investment advisers. See infra section IV.C.3.a. These numbers exclude notice-registered brokerdealers, who will be deemed in compliance with the final provision through the substituted compliance provisions of Regulation S–P. See supra section II.B.3. For this release, the number of broker-dealers dually registered as investment advisers was estimated based on FOCUS filings for broker-dealers during the third quarter of 2023, Form BD filings as of Sept. 2023, and Form ADV filings for investment advisers as of Oct. 5, 2023. The Proposing Release cited a figure of 502 as of Dec. 2021. The correct number of broker-dealers dually registered as investment advisers as of Dec. 2021 in the Proposing Release should be 328. This change would not have affected the Commission’s assessment of economic effects at Proposal as these assessments were focused primarily on effects at the level of individual covered institutions and their customers. 497 See infra section IV.C.3.b. PO 00000 Frm 00045 Fmt 4701 Sfmt 4700 47731 entities),498 every investment adviser (15,565 entities) registered with the Commission,499 and every transfer agent (315 entities) registered with the Commission or another appropriate regulatory agency.500 In addition, the final amendments will affect current and prospective customers of covered institutions as well as certain service providers to covered institutions.501 The final amendments will impact hundreds of millions of customers. For example, as discussed in more detail in subsequent sections, carrying brokerdealers report a total of 233 million customer accounts,502 registered investment advisers report a total of more than 51 million individual clients,503 and transfer agents report around 250 million individual accounts.504 1. Safeguarding Customer Information: Risks and Practices Over the last two decades, the widespread adoption of digitization and the migration toward internet-based products and services has radically changed the manner in which firms interact with customers. This trend has also applied to the financial services industry.505 Alongside this progress, the industry has observed increased exposure to cyberattacks that threaten not only the financial firms themselves, but also their customers. Hence, the trend toward digitization has increasingly turned the problem of safeguarding customer records and information into one of cybersecurity.506 498 See infra section IV.C.3.d, in particular Table 4, for statistics on the different types of investment companies. Many of these distinct legal entities represent different series of a common registrant. Moreover, many of the registrants are themselves part of a larger family of companies (although BDCs and ESCs are not grouped in families, see Form N– 2 and Form 40–APP). See infra footnote 660. We estimate there are 313 such families. See infra section IV.C.3.d. For this release, the number of families was estimated by counting unique family names in Form N–CEN filings as of Sept. 30, 2023. The Proposing Release cited a figure of 1,093 using 2021 N–CEN filings. The correct number of distinct fund families using 2021 N–CEN filings in the Proposing Release should be 327. This change would not have affected the Commission’s assessment of economic effects at Proposal as these assessments were focused primarily on effects at the level of individual covered institutions and their customers. 499 See infra section IV.C.3.c. 500 See infra section IV.C.3.e. 501 See infra section IV.C.3.f. 502 See infra section IV.C.3.a. 503 See infra section IV.C.3.c. 504 See infra section IV.C.3.e. 505 See Michael Grebe et al., Digital Maturity Is Paying Off, BCG (June 7, 2018), available at https:// www.bcg.com/publications/2018/digital-maturityis-paying-off. 506 This is not to say that this is exclusively a problem of cybersecurity. Generally, however, the E:\FR\FM\03JNR2.SGM Continued 03JNR2 47732 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 Cyber threat intelligence surveys find the financial sector to be a highly attacked industry,507 making the problem of cybersecurity particularly acute for financial firms. The customer records and information in their possession can be quite sensitive (e.g., personal identifying information, bank account numbers, financial transactions) and their compromise could lead to substantial harm.508 Certain recent changes in the industry, including changes discussed by commenters, have continued the trend toward digitization and the importance of cybersecurity. For example, the shift to remote work has brought new cybersecurity challenges. One commenter stated that 91 percent of data security professionals saw negative risk implications from remote and hybrid work.509 The same commenter cited a report finding that in 2022, the cost of a data breach was on average nearly $1 million higher when remote work was a factor in the breach and more than $1 million higher in organizations with a share of employees working remotely between 80 percent and 100 percent compared with organizations where less than 20 percent of employees worked remotely.510 Remote work arrangements have significantly expanded following the onset of the COVID–19 pandemic in risks associated with purely physical forms of compromise are of a smaller magnitude, as largescale compromise using physical means is cumbersome. The largest publicly known incidents of compromised information have appeared to involve electronic access to digital records, as opposed to physical access to records or computer hardware. For a partial list of recent data breaches and their causes. See, e.g., Michael Hill and Dan Swinhoe, The 15 Biggest Data Breaches of the 21st Century, CSO (Nov. 8, 2022), available at https:// www.csoonline.com/article/2130877/the-biggestdata-breaches-of-the-21st-century.html (last visited Apr. 9, 2024); Drew Todd, Top 10 Data Breaches of All Time, SecureWorld (Sept. 14, 2022), available at https://www.secureworld.io/industry-news/top10-data-breaches-of-all-time (last visited Apr. 9, 2024). 507 See, e.g., IBM, X-Force Threat Intelligence Index 2022 (Feb. 2022), available at https:// www.ibm.com/downloads/cas/ADLMYLAZ. 508 See, e.g., David W. Opderbeck, Cybersecurity and Data Breach Harms: Theory and Reality, 82 Md. L. Rev. 1001 (2023) (‘‘A criminal actor can use stolen PII in true identity theft to open new lines of credit in the victim’s name, including new credit cards, personal loans, business loans, or mortgages. Criminal actors also employ true identity theft to file for tax refunds, welfare, insurance, or pension benefits in the victim’s name.’’). 509 See Better Markets Comment Letter, citing Hugo Guzman, Remote Work Leading to Big DataLoss Problems, Law.com (Mar. 7, 2023). 510 See Better Markets Comment Letter citing IBM, Cost of a Data Breach Report 2022 (July 2022) (‘‘2022 IBM Cost of Data Breach Report’’), available at https://www.ibm.com/downloads/cas/3R8N1DZJ. The 2023 version of the same report does not address remote work specifically. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 the United States in 2020,511 and a recent study found the financial services industry to be the fifth most flexible industry in terms of work location flexibility.512 The financial sector is one of the biggest spenders on cybersecurity measures: a recent survey found that financial firms spent an average of approximately 13.6 percent of their technology budget on cybersecurity in 2023, compared to an overall average across industries of 11.6 percent.513 While spending on cybersecurity measures in the financial services industry is considerable, it may nonetheless be inadequate—even in the estimation of financial firms themselves. According to one recent survey, 58 percent of financial firms self-reported ‘‘underspending’’ on cybersecurity measures.514 In addition, some covered institutions increasingly use third-party vendors to provide a wide range of functions, which may implicate a review of those service providers’ cybersecurity controls.515 Before adopting these amendments, the Commission did not require covered institutions to notify customers (or the Commission) in the event of a data breach, and so statistics relating to data breaches that occurred at covered institutions were not readily available. However, data compiled from notifications required under various State laws indicate that in 2022 the 511 Census Press Release, U.S. Census Bureau Releases New 2021 American Community Survey 1year Estimates for All Geographic Areas With Populations of 65,000 or More (Sept. 15, 2022), available at https://www.census.gov/newsroom/ press-releases/2022/people-working-fromhome.html#:∼:text=SEPT.,by%20the% 20U.S.%20Census%20Bureau. 512 See The Flex Index, Q3 2023 Flex Report, available at https://www.flex.scoopforwork.com/ reports/flex-report-2023-q3 (last visited Apr. 9, 2024). 513 See James Rundle, Cybersecurity Budgets Grow, But at a Slower Pace, Wall St J. (Sept. 29, 2023), available at https://www.wsj.com/articles/ cybersecurity-budgets-grow-but-at-a-slower-pace89ce3d3c. One commenter agreed that total cybersecurity costs are significant. See Better Markets Comment Letter (‘‘While the magnitude of dollar losses is difficult to estimate, it is clear that companies must expend significant resources to prevent breaches, detect breaches that do occur, contain the damage from breaches, prevent future breaches, and in some cases make customers whole.’’). 514 See IIF/McKinsey Report, supra footnote 450. 515 See, e.g., FINRA, Regulatory Notice 21–29: Vendor Management and Outsourcing (Aug. 13, 2021), available at https://www.finra.org/sites/ default/files/2021-08/Regulatory-Notice-21-29.pdf (encouraging firms that ‘‘use—or are contemplating using—Vendors to review [. . .] obligations and assess whether their supervisory procedures and controls for outsourced activities or functions are sufficient to maintain compliance with applicable rules’’). See also infra section IV.C.3.f for a discussion of different types of covered institutions’ reliance on service providers. PO 00000 Frm 00046 Fmt 4701 Sfmt 4700 number of data breaches reported in the U.S. was 1,802—a 3 percent decrease over 2021, but a 63 percent increase over 2020.516 Of these, 268 (15 percent) were reported by firms in the financial services industry.517 However, the report estimating these statistics states that the 1,802 breaches reported are a minimum estimate and states that in the U.S., the number of breach notices issued per business day in 2022 (7 notices) was much lower than in the European Union (356 notices) in 2021 (the last year for which data is available).518 One commenter cited a report stating that nearly half of U.S. consumers had been affected by data breaches where a firm holding their personal data was hacked, compared to a global average of 33 percent of consumers.519 The average total cost of a data breach for a U.S. firm in 2023 was estimated to be $9.48 million by one report.520 While the report does not provide estimates for U.S. financial services firms specifically, it estimated that worldwide, the cost of a data breach for financial services firms averaged $5.90 million, and that average costs for U.S. firms were approximately twice the world-wide average.521 Hence, we can estimate that for U.S. financial firms, the cost of a data breach was about $12 million. The bulk of these costs is attributed to detection and escalation (36 percent), lost business (29 percent), and post-breach response (27 percent); customer notification is estimated to account for only a small fraction (8 percent) of these costs.522 For the U.S. 516 See IRTC Data Breach Annual Report. id. 518 See id. See also Better Markets Comment Letter. The report suggests that this disparity may be related to the fact that in the European Union, enforcement officials, together with the organization affected by a breach, make the determination that the breach puts individuals or businesses at risk and therefore requires notification. See also infra section IV.D.1.b(4). 519 See EPIC Comment Letter, citing Thales, 2022 Thales Consumer Digital Trust Index (Sept. 2022). 520 See IBM, Cost of a Data Breach Report 2023 (July 2023) (‘‘2023 IBM Cost of Data Breach Report’’), available at https://www.ibm.com/ reports/data-breach?utm_content=SRCWW& p1=Search&p4=43700077723822555&p5=p &&msclkid=45aa555fae8d1f62fb9c3066eddb719a& gclid=45aa555fae8d1f62fb9c3066eddb 719a&gclsrc=3p.ds. 521 The 2023 IBM Cost of Data Breach Report estimates that the global average cost of a data breach is $4.45 million. One commenter, citing the 2022 IBM Cost of Data Breach Report, stated that the average cost of a data breach in 2022 was $4.35 million, which is a global average. See Better Markets Comment Letter. In the Proposing Release, we also cited the 2022 IBM Cost of Data Breach Report and stated that the cost of a data breach was $9.44 million, which applies to U.S. firms specifically. 522 See 2023 IBM Cost of Data Breach Report. 517 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 financial industry as a whole, this implies an estimate of aggregate notification costs under the baseline of between $200 million and $250 million.523 Because these estimates are based on data breach incidence rates for all firms, and because financial firms are part of one of the most attacked industries,524 the actual aggregate notification costs are likely higher than this estimated range. Some commenters supported the Proposing Release’s assessment that data breaches are an important risk currently faced by covered institutions and their customers.525 One commenter cited an article describing a data breach at a financial institution that had cost that institution more than $150 million.526 Commenters also mentioned additional types of risks. One commenter stated that in addition to the financial costs imposed on firms by data breaches, individuals whose sensitive information is compromised also suffer harms, both financial and psychological, as many become victims of identity theft.527 Another commenter stated that the consequences of these breaches were staggering and that the Commission’s proposals to establish minimum standards for incident response and breach notification could help with mitigation.528 The same commenter cited a report by the Government Accountability Office indicating that past victims of identity theft, which can be a consequence of data breaches, have ‘‘lost job opportunities, been refused loans, or even been arrested for crimes they did not commit as a result of identity theft.’’ 529 523 The $200 million figure is based on 8% (the customer notification portion) of an average cost of $9.48 million multiplied by 268 data breaches. The $250 million figure is based on the same calculation but using $12 million instead of $9.48 million. See supra footnotes 516 and 520 and accompanying text. 524 See supra footnotes 507–512 and accompanying text. 525 See, e.g., Better Markets Comment Letter; Nasdaq Comment Letter. 526 See Better Markets Comment Letter, citing Emily Flitter & Karen Weise, Capital One Data Breach Compromises Data of Over 100 Million, N.Y. Times (July 29, 2019), available at https:// www.nytimes.com/2019/07/29/business/capitalone-data-breach-hacked.html. 527 See Better Markets Comment Letter. Citing the IRTC Data Breach Annual Report, the same commenter also stated that globally, organizational data compromises impacted over 392 million individual victims in 2022. 528 See EPIC Comment Letter. 529 See EPIC Comment Letter citing U.S. Government Accountability Office, GAO–14–34, Agency Responses to Breaches of Personally Identifiable Information Need to be More Consistent (Dec. 2013), available at https://www.gao.gov/assets/ 660/659572.pdf. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 2. Regulations and Guidelines Two features of the existing regulatory framework are most relevant to the amendments: existing regulations that require covered institutions to notify customers in the event that their information is compromised; and existing regulations and guidelines that affect covered institutions’ practices for safeguarding customers’ information. While the relevance of the former is obvious, the latter is potentially more significant: regulations aimed at improving firms’ practices for safeguarding customer information reduce the need for data breach notifications in the first place. In this section, we summarize these two aspects of the regulatory framework as well as existing annual notice delivery requirements. a. State Law Customer Notification Requirements (1) Scope of Requirements All 50 States and the District of Columbia impose some form of data breach notification requirement under State law. These laws vary in detail from State to State but have certain common features. State laws trigger data breach notification obligations when some type of ‘‘personal information’’ of a State’s resident is either accessed or acquired in an unauthorized manner, subject to various common exceptions. For the vast majority of States (46), a notification obligation is triggered only when there is unauthorized acquisition, while a handful of States (5) require notification whenever there is unauthorized access.530 Generally, States can be said to adopt either a basic or an enhanced definition of personal information. A typical example of a basic definition specifies personal information as the customer name linked to one or more pieces of nonpublic information such as Social Security number, driver’s license number (or other State identification number), or financial account number together with any required credentials to permit access to said account.531 A typical enhanced definition includes additional types of nonpublic 530 See, e.g., notification requirements in California (Cal. Civ. Code section 1798.82(a)) and Texas (Tex. Bus. & Com. Code section 521.053) triggered by the unauthorized acquisition of certain information, as compared to notification requirements in Florida (Fla. Stat. section 501.171) and New York (N.Y. Gen. Bus. Law section 899– AA) triggered by unauthorized access to personal information. ‘‘States’’ in this discussion includes the 50 U.S. States and the District of Columbia, for a total of 51. All State law citations are to the Sept. 2023 versions of State codes. 531 See, e.g., Kan. Stat. section 50–7a01(g) or Minn. Stat. section 325E.61(e). PO 00000 Frm 00047 Fmt 4701 Sfmt 4700 47733 information that trigger the notification requirement; examples include: passport number, military identification number, or other unique identification number issued on a government document commonly used to verify the identity of a specific individual; unique biometric data generated from measurements or technical analysis of human body characteristics, such as a fingerprint, retina, or iris image, used to authenticate a specific individual.532 Enhanced definitions also trigger notification requirements when a username or email address in combination with a password or security question and answer that would permit access to an online account is compromised.533 Most States (37) adopt some form of enhanced definition, while a minority (14) adopt a basic definition. One commenter stated that all States provided an exception to the notification requirement if the data compromised were encrypted.534 We found that States may include an explicit encryption or redaction exception in their definition of personal information,535 in their definition of breach,536 or in the determination that notification of affected individuals is necessary.537 Multiple States include at least two of these exceptions. States 532 See, e.g., Md. Comm. Code section 14–3501 (defining ‘‘personal information’’ to include credit card numbers, health information, health insurance information, and biometric data such as retina or fingerprint). 533 See, e.g., Ariz. Code section 18–551 (defining ‘‘personal information’’ to include an individual’s username or email address, in combination with a password or security question and answer, that allows access to an online account). 534 See SIFMA Comment Letter 2 (‘‘Note that all U.S. State data breach notification laws provide an encryption safe harbor.’’); see also Liisa M. Thomas, Thomas on Data Breach: A Practical guide to Handling Data Breach Notifications Worldwide (Feb. 2023), at section 2:45 (‘‘Thomas 2023’’). 535 See, e.g., Kan. Stat. section 50–7a01(g) (defining ‘‘personal information’’ to include a consumer’s first name or first initial and last name linked to any one or more of the specified data elements that relate to the consumer, when the data elements are neither encrypted nor redacted); Wyo. Stat. section 40–12–501 (defining ‘‘personal identifying information’’ to exclude redacted data elements). 536 See, e.g., Ariz. Code section 18–551 (defining ‘‘breach’’ to include unauthorized acquisition of and unauthorized access that materially compromises the security or confidentiality of unencrypted and unredacted computerized personal information). 537 See, e.g., Minn. Stat. section 325E.61(a) (requiring notification of a breach to any resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person). E:\FR\FM\03JNR2.SGM 03JNR2 47734 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations vary, however, in the whether and how they define encryption or redaction.538 Most States (43) provide an exception to the notification requirement if, following a breach of security, the entity investigates and determines that there is no reasonable likelihood that the individual whose personal information was breached has experienced or will experience certain harms (‘‘no-harm exception’’).539 Twenty of these States do not have a presumption of notification and instead require notification only if, for example, an investigation reveals a risk of harm or misuse.540 Although the types of harms ' I Harm Identity theft or other fraud Misuse of personal information Loss or injury Use for an authorized purpose Misuse, financial harm, or emotional harm Identity theft Substantial loss or injury, or identity theft Financial harm Identity deception, identity theft, or fraud Identity theft or other financial harm Susbtantial economic loss Substantial harm vary by State, they most commonly include: ‘‘harm’’ generally (13), identity theft or other fraud (10), or misuse of personal information (8). Figure 1 plots the frequency of the various types of harms referenced in States’ no-harm exceptions. I I I i I I -= ~ ~ ~ 0 I 2 4 6 8 10 12 14 Number of States (2) Timing, Content, and Method of Notification lotter on DSK11XQN23PROD with RULES2 In general, State laws provide a general principle for timing of notification (e.g., delivery shall be made ‘‘without unreasonable delay,’’ or ‘‘in the most expedient time possible and without unreasonable delay’’).541 Some 538 We considered a safe harbor from the notification requirements for encrypted information. See infra section IV.F.3. 539 See, e.g., Fla. Stat. section 501.171(4)(c) and N.Y. Gen. Bus. Law section 899–AA(2)(a). Eight States, including California and Texas, do not have a no-harm exception and require notification even in the cases where there is no risk of harm. 540 See, e.g., N.C. Stat. section 75–61(14) and Utah Code 13–44–202(1). 541 See, e.g., Cal. Civ. Code section 1798.82(a) (disclosure to be made ‘‘in the most expedient time possible and without unreasonable delay’’ but allowing for needs of law enforcement and measures to determine the scope of the breach and restore the system). 542 See, e.g., Colo. Rev. Stat. section 6–1–716(2)(a) (notice to be made ‘‘in the most expedient time possible and without unreasonable delay, but not later than thirty days after the date of determination that a security breach occurred, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and to restore the reasonable VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 States augment the general principle with a specific deadline (e.g., notice must be made ‘‘in the most expedient time possible and without unreasonable delay, but not later than 30 days after the date of determination that the breach occurred’’ unless certain exceptions apply).542 All States allow for a delay if it is requested by a law enforcement agency.543 Additionally, some States allow for a delay if necessary to determine the nature and scope of the breach or to restore the reasonable integrity of the information system.544 Figure 2 plots the frequency of different notification deadlines in integrity of the computerized data system’’); Fla. Stat. section 501.171(4)(a) (notice to be made ‘‘as expeditiously as practicable and without unreasonable delay . . . but no later than 30 days after the determination of a breach’’ unless delayed at the request of law enforcement or waived pursuant to the State’s no-harm exception). 543 See, e.g., Ala. Stat. section 8–38–5(c) (‘‘If a federal or State law enforcement agency determines that notice to individuals required under this section would interfere with a criminal investigation or national security, the notice shall be delayed upon the receipt of written request of the law enforcement agency for a period that the law enforcement agency determines is necessary.’’); Ark. Code section 4–110–105(c) (‘‘The notification required by this section may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.’’); Conn. Stat. section 36a–701b.(d) (‘‘Any notification required by this section shall be delayed for a reasonable period of time if a law enforcement agency determines that the notification will impede a criminal investigation and such law enforcement agency has made a request that the notification be delayed.’’); Md. Comm. Code section 14–3504(d)(1) (notice may be delayed if ‘‘a law enforcement agency determines that the notification will impede a criminal investigation or jeopardize homeland or national security’’); N.C. Stat. section 75–65(c) (‘‘The notice required by this section shall be delayed if a law enforcement agency informs the business that notification may impede a criminal investigation or jeopardize national or homeland security, provided that such request is made in writing or the business documents such request contemporaneously in writing, including the name of the law enforcement officer making the request and the officer’s law enforcement agency engaged in the investigation.’’). 544 See, e.g., Tex. Bus. & Com. Code section 521.053 (notice to be made ‘‘without unreasonable delay and in each case not later than the 60th day after the date on which the person determines that the breach occurred, except as provided by Subsection (d) or as necessary to determine the scope of the breach and restore the reasonable integrity of the data system’’). PO 00000 Frm 00048 Fmt 4701 Sfmt 4700 E:\FR\FM\03JNR2.SGM 03JNR2 ER03JN24.000</GPH> Figure 1: Frequency of types of harms referenced by State laws with no-harm exceptions to notification requirements. Data source: State law in 2023. Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations State laws. For States with specific deadlines, the figure distinguishes between States that allow an exception to determine the nature and scope of the breach or to restore the reasonable 47735 integrity of the information system, and those that do not. 35 30 ~ ~ 25 ~ 20 .. 0 ~ 15 1z 10 5 0 No specific deadline 30 days ■ exception 45 days 1111 60 days no exception One commenter stated that, where State laws have a 30-day notice requirement, the 30-day periods generally do not begin to run until a determination has been made that the incident affected residents of that State that will require notice, and that the Commission’s proposed 30-day requirement would be triggered much sooner in the process.545 The same commenter also stated that notices are currently sent to individuals whose information is reasonably believed to have potentially been affected after the findings of an investigation are determined.546 To help analyze and respond to these comments, and also to provide additional context for our analysis of the possible effects of the final amendments,547 we conducted supplemental analysis of the frequency of different triggers for the specific deadline requirement in the 20 States that specify such a deadline. The results of this analysis are in Figure 3 and demonstrate variation in triggering events. For example, State laws specify that the notification of customers be made ‘‘not later than sixty days from the discovery of the breach,’’ 548 or ‘‘no later 545 See CAI Comment Letter (‘‘While the Commission correctly notes in the S–P Proposing Release that some existing State laws also include a 30-day notice requirement, those requirements generally do not begin to run until a determination has been made that the incident affected residents of that State that will require notice.’’). In the final amendments, as in the proposal, the beginning of the 30-day outside timeframe is a covered institution ‘‘becoming aware’’ that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. See proposed rule 248.30(b)(4)(iii); final rule 248.30(a)(4)(iii). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 PO 00000 Frm 00049 Fmt 4701 Sfmt 4700 than 30 days after the determination of a breach or reason to believe a breach occurred.’’ 549 Many of these triggers use words such as ‘‘determination’’ or ‘‘confirmation,’’ which, consistent with the commenter’s observation, suggests investigation that might cause the specific deadline to be triggered later than the Commission’s proposed or adopted notification trigger, although ‘‘discovery of breach’’—used in five States—could potentially be earlier.550 BILLING CODE 8011–01–P 546 See CAI Comment Letter. infra section IV.D.1.b(2). 548 See La. Rev. Stat. section 51:3074. 549 See Fla. Stat. section 501.171(4)(a). 550 See infra section IV.D.1.b(2). 547 See E:\FR\FM\03JNR2.SGM 03JNR2 ER03JN24.001</GPH> lotter on DSK11XQN23PROD with RULES2 Figure 2: Frequency of notification deadlines in State laws. "Exception" States allow an exception to determine the nature and scope of the breach or to restore the reasonable integrity of the information system. Data source: State law in 2023. 47736 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations Discovery or receipt of notification of breach Discovery of breach Determination that there has been a breach I I Determination of breach or reason to believe breach occurred Receipt of notice that breach has occurred or determination that breach has occurred and is reasonably likely to cause substantial harm Leaming of acquisition of personal information Becoming aware of a breach of security and identifying its scope Confirmation of breach and ability to ascertain the information required to fulfill notice requirements I I ~ -~ I I ! i I 5 6 ~~: l~_LL 0 2 3 4 Number of states 7 Figure 3: Frequency of triggers of notification deadline, for the 20 States that specify such a deadline. Data source: State law in 2023. One commenter stated that most State data breach notification laws did not specify a number of days to report a breach, and that of the States that did have a specific timeframe, many had an exception allowing for compliance with the GLBA in lieu of adherence to their timeframes.551 To help analyze and respond to this comment, and also to provide additional context for our analysis of the possible effects of the final amendments, we conducted supplemental analysis of the overlap between States that have a specific deadline and States that include a GLBA exception.552 We found that of the 20 States that have a specific deadline, 10 do not include a GLBA exception.553 Additionally, one commenter stated the establishment of a Federal minimum standard for data breach notification would satisfy State notice laws that provide exemptions for firms subject to such a requirement.554 To help analyze 551 See SIFMA Comment Letter 2. infra section IV.D.1.b(1). 553 We discuss this exception and the States where it applies in section IV.D.1.b(1). 554 See IAA Comment Letter 1. 552 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 and respond to this comment, and also to provide additional context for our analysis of the possible effects of the final amendments,555 we conducted supplemental analysis of this question. We have found that some States excuse entities from individual notification under State law if the entities comply with the notification requirements of a Federal regulator or, in some cases, another State. Some States allow these substitute notifications to replace their own state-specific requirements on notice content and timing,556 while 555 See infra section IV.D.1.b. 556 See, e.g., Fla. Stat. section 501.171(4)(g) (‘‘Notice provided pursuant to rules, regulations, procedures, or guidelines established by the covered entity’s primary or functional federal regulator is deemed to be in compliance with the notice requirement in this subsection . . . .’’); Va. Code. Ann. section 18.2–186.6(H) (‘‘An entity that complies with the notification requirements . . . established by the entity’s primary or functional state or federal regulator shall be in compliance with this section.’’). According to Thomas 2023, approximately 15 States allow compliance with a primary regulator to replace their own State’s required notification in some circumstances; see also ICI Comment Letter 1 (‘‘Today, approximately 13 states provide an exemption or exclusion from the state’s breach notice requirements if the entity experiencing the breach has a duty under federal PO 00000 Frm 00050 Fmt 4701 Sfmt 4700 others only allow it if the provisions are at least as protective as State law.557 Some commenters stated that different State laws currently have different requirements as to what content must be included in a notice to customers.558 One of these commenters further stated that, as a result, covered institutions may, when they experience a data breach incident today, send different notification letters to residents of different States for the same incident.559 To help analyze and law to provide notice of the breach.’’). See also infra section IV.D.1.b(1) on GLBA safe harbor provisions, which are similar but distinct. 557 See, e.g., Colo. Rev. Stat. 6–1–716(3)(b) (‘‘In the case of a conflict . . . the law or regulation with the shortest timeframe for notice to the individual controls.’’); Iowa Code section 715C.2(7)(b) (exempting in the case of compliance ‘‘with a state or federal law that provides greater protection to personal information and at least as thorough disclosure requirements for breach of security or personal information than that provided by this section’’). 558 See, e.g., IAA Comment Letter 1. 559 See ICI Comment Letter 1 (‘‘In discussing breach notices with our members, we understand it is not uncommon for their current breach response programs to include separate notification letters depending upon the state the individual resides in.’’). One benefit of the final amendments will be E:\FR\FM\03JNR2.SGM 03JNR2 ER03JN24.002</GPH> lotter on DSK11XQN23PROD with RULES2 BILLING CODE 8011–01–C 47737 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations respond to these comments, and to provide additional context for our analysis of the possible effects of the final amendments,560 we conducted supplemental analysis of the frequency at which different items are currently required by State laws to be included in notices to customers. This analysis, shown in Figure 4, supports commenters’ observation that different States have different requirements. While half of the States do not have such requirements, many States (25) provide minimum content to be included in the notices sent to individuals whose information has been affected by a breach. The most common required items include the type of information affected, contact information for consumer reporting agencies, and the date of the breach. Figure 4 plots the frequency of different items required by State laws to be included in the notices. ' Type of information affected 1 Contact information for consumer reporting agencies 1• - - - • - - - • - Date of breach .,- - - • - - • - Description of incident Contact information: phone number Contact information: any type I Recommendation to review account statements Recommendation to monitor credit reports Steps taken to protect information Contact information for FTC Contact information: address Date of discovery of breach Whether notice was delayed for law enforcement 0 5 15 Number of States 20 25 States also differ in their requirements regarding the method that must be used to notify affected individuals.561 While all States allow for a written notification, most States impose conditions if the notice is sent electronically. For example, 37 States provide that a notice can be sent electronically only if the notice is consistent with the Electronic Signatures in Global and National Commerce Act.562 Fifteen States have as a condition that a primary method of communication between the entity and the affected residents be by electronic means.563 Five States impose no condition for electronic notices,564 and 2 States only require that the notifying institution have the email address of the affected individuals.565 In addition, 26 States allow for the notice to be made over the phone.566 Of these 26 States, 7 provide that a condition for a telephonic notice is that contact is made directly with the affected individuals.567 All States allow, under some conditions, for substitute notification instead of the required methods of notification discussed above. The most common conditions include a specified large number of individuals to notify and/or a minimum dollar cost to notify the affected individuals. These conditions vary widely across States.568 In most States, a substitute notice consists of all of the following elements: email notification to the affected individuals, a notice on the institution’s website, and notification to major statewide media.569 However, other States have fewer requirements.570 to help ensure that all customers receive a minimum level of information regarding a given breach. See infra section IV.D.1.b(5). 560 See infra section IV.D.1.b(5). 561 We conducted this supplemental analysis to help analyze and respond to comments, and also to provide additional context for our analysis of the possible effects of the final amendments. See infra section IV.D.1.b(5). 562 15 U.S.C. 7001, et seq. See, e.g., Cal. Civ. Code section 1798.82(j); Conn. Stat. section 36a–701b.(e); Ga. Code section 10–1–911(4); Tex. Bus. & Com. Code section 521.053(e). 563 See. e.g., Colo. Rev. Stat. section 6–1– 716(1)(F); Del. Code Tit. 6 section 12B–101(5); Tenn. Code Ann. section 47–18–2107(e). 564 See, e.g., Ala. Code section 8–38–5(d); Fla. Stat. section 501.171(4)(d); Va. Code. Ann. section 18.2–186.6(A). 565 See Ariz. Code section 18–552(F); Ind. Code 24–4.9–3–4. 566 See. e.g., Conn. Stat. section 36a–701b.(e); N.Y. Gen. Bus. Law section 899–AA(5); 73 Pa. Stat. section 2302. 567 See, e.g., Ariz. Code section 18–552(F); Mo. Stat. 407.1500 section 2(6); 9 Vt. Stat. Ann. section 2435(b)(6)(A). 568 For example, some States allow for a substitute notice if the number of affected individuals is above 1,000 or 5,000 or if the cost of providing notice is above $5,000 or $10,000, while many States have a threshold of 500,000 affected individuals or a cost threshold of $250,000. See, e.g., Maine Rev. Stat. Tit. 10 section 1347(4); Miss. Code section 75–24–29(6); N.H. Rev. Stat. section 359–C:20(III); Cal. Civ. Code section 1798.82(j); Fla. Stat. section 501.171(4)(f); N.Y. Gen. Bus. Law section 899–AA(5). 569 See, e.g., DC Code section 28–3851(2); La. Rev. Stat. section 51:3074(G); N.J. Stat. section 56:8– 163(d).; Va. Code. Ann. section 18.2–186.6(A). 570 See, e.g., Ala. Code section 8–38–5(e) (‘‘Substitute notice shall include both of the following: 1. A conspicuous notice on the internet website of the covered entity, if the covered entity maintains a website, for a period of 30 days. 2. Notice in print and in broadcast media, including major media in urban and rural areas where the affected individuals reside.’’); Fla. Stat. section 501.171(4)(f) (‘‘Such substitute notice shall include the following: 1. A conspicuous notice on the internet website of the covered entity if the covered entity maintains a website; and 2. Notice in print and to broadcast media, including major media in urban and rural areas where the affected individuals reside.’’); Tex. Bus. & Com. Code section 521.053(f) (requiring that under certain Continued VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 PO 00000 Frm 00051 Fmt 4701 Sfmt 4700 E:\FR\FM\03JNR2.SGM 03JNR2 ER03JN24.003</GPH> lotter on DSK11XQN23PROD with RULES2 Figure 4: Frequency of different items required by State laws to be included in the notices to affected individuals. Date source: State law in 2023. lotter on DSK11XQN23PROD with RULES2 47738 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations (3) Notification by Service Providers Some data breach incidents involve service providers. Covered institutions may use service providers to perform certain business activities and functions, such as trading and order management, information technology functions, and cloud computing services. As a result of this outsourcing, service providers may receive, maintain, or process customer information, or be permitted to access it, and therefore a security incident at the service provider could expose information at or belonging to the covered institution. In general, State laws require persons and entities that maintain computerized data for other entities, but do not own or license that data, to notify the dataowning entity in the event of a data breach (so as to allow that entity to notify affected individuals).571 However, several State laws provide that a covered institution may contract with the service provider such that the service provider directly notifies affected individuals of a data breach.572 In addition, some States impose the responsibility of notifying affected individuals on entities that maintain or possess the data even if they do not own or license it.573 Some commenters opposed the proposed provision that would have required service providers to notify covered institutions of a breach of sensitive customer information within 48 hours.574 A commenter further stated that our analysis of the effects of this requirement was incomplete.575 We conducted supplemental analysis of the notification timeframe required by State laws for entities that do not own or license the compromised data to help analyze and respond to these comments, and to provide additional context for our analysis of the possible effects of the final amendments.576 In general, State laws provide a window for notification of the entity that owns or licenses the data by the entity that maintains the data.577 Ten States provide a specific deadline of either 24 hours (one State),578 10 days (four States),579 45 days (four States),580 or 60 days (one State).581 Thirty-eight States provide instead a general principle such as ‘‘as soon as practicable’’ or ‘‘without unreasonable delay.’’ 582 In particular, 24 States require the notification to take place immediately after the discovery of the breach or the determination that a breach has occurred.583 Figure 5 plots the frequency of these different provisions across State laws. This variation across State laws in timelines for (1) notification of the entity that owns or licenses the data by the entity that maintains the data and (2) notification of the affected individuals by the entity that owns or licenses the data can result in widely different lengths of time between the discovery of a breach and the time the affected individuals are notified. In addition, variations in these State laws could result in residents of one State receiving notice while residents of another receive no notice for the same data breach incident.584 conditions, ‘‘the notice may be given by: (1) electronic mail, if the person has electronic mail addresses for the affected persons; (2) conspicuous posting of the notice on the person’s website; or (3) notice published in or broadcast on major statewide media’’). 571 See, e.g., Cal. Civ. Code section 1798.82(b); DC Code section 28–3852(b); N.Y. Gen. Bus. Law section 899–AA(3); Tex. Bus. & Com. Code section 521.053(c). 572 See, e.g., Fla. Stat. section 501.171(6)(b); Ala. Code section 8–38–8. We do not have information on the frequency of such arrangements. 573 See, e.g., Ky. Rev. Stat. 365.732(2) (‘‘Any information holder shall disclose any breach of the security of the system, following discovery or notification of the breach in the security of the data, to any resident of Kentucky whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.’’); Maine Rev. Stat. Tit. 10 section 1348(1)(B). (‘‘If any other person who maintains computerized data that includes personal information becomes aware of a breach of the security of the system, the person shall conduct in good faith a reasonable and prompt investigation to determine the likelihood that personal information has been or will be misused and shall give notice of a breach of the security of the system following discovery or notification of the security breach to a resident of this State if misuse of the personal information has occurred or if it is reasonably possible that misuse will occur.’’). See also Thomas 2023, at section 2:21. 574 See, e.g., ACLI Comment Letter. 575 See Microsoft Comment Letter (‘‘The costbenefit analyses of the Proposed Rules do not identify why a 48-hour or shorter reporting period is optimal.’’). See also supra section II.A.4 for a discussion of the length of notification period. 576 See infra section IV.D.1.c. 577 A small number of States do not require such a notification. For example, Rhode Island does not distinguish between entities that own or license the data and those entities that do not, requiring all entities to notify customers directly (R.I. Gen. Laws section 11–49.3–4(a)(1) (‘‘Any municipal agency, State agency, or person that stores, owns, collects, processes, maintains, acquires, uses, or licenses data that includes personal information shall provide notification as set forth in this section of any disclosure of personal information, or any breach of the security of the system, that poses a significant risk of identity theft to any resident of Rhode Island whose personal information was, or is reasonably believed to have been, acquired by an unauthorized person or entity.’’). Similarly, South Dakota does not have a provision for persons or businesses that do not own or license computerized personal data (SDCL sections 22–40–19 through 22– 40–26). 578 See Ga. Code section 10–1–912(b) (‘‘Any person or business that maintains computerized data on behalf of an information broker or data collector that includes personal information of individuals that the person or business does not own shall notify the information broker or data collector of any breach of the security of the system within 24 hours following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.’’). 579 See, e.g., Md. Comm. Code section 14–3504(c) (‘‘Except as provided in subsection (d) of this section, the notification required under paragraph (1) of this subsection shall be given as soon as reasonably practicable, but not later than 10 days after the business discovers or is notified of the breach of the security of a system.’’). 580 See, e.g., Tenn. Code Ann. section 47–18– 2107(c) (‘‘Any information holder that maintains computerized data that includes personal information that the information holder does not own shall notify the owner or licensee of the information of any breach of system security if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made no later than fortyfive (45) days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement, as provided in subsection (d).’’). 581 See La. Rev. Stat. section 51:3074(E) (‘‘The notification required pursuant to Subsections C and D of this Section shall be made in the most expedient time possible and without unreasonable delay but not later than sixty days from the discovery of the breach, consistent with the legitimate needs of law enforcement, as provided in Subsection F of this Section, or any measures necessary to determine the scope of the breach, prevent further disclosures, and restore the reasonable integrity of the data system.’’). 582 See, e.g., Miss. Code section 75–24–29(4) (‘‘Any person who conducts business in this State that maintains computerized data which includes personal information that the person does not own or license shall notify the owner or licensee of the information of any breach of the security of the data as soon as practicable following its discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person for fraudulent purposes.’’); Va. Code. Ann. section 18.2–186.6(D) (‘‘An individual or entity that maintains computerized data that includes personal information that the individual or entity does not own or license shall notify the owner or licensee of the information of any breach of the security of the system without unreasonable delay following discovery of the breach of the security of the system’’). 583 See, e.g., Ark. Code section 4–110–105(b), N.C. Stat. section 75–65(b), and Utah Code 13–44– 202(3). For many of these States, this immediate notification can be delayed if the delay is requested by a law enforcement agency. 584 See supra footnote 578 on South Dakota. In addition, in some States, notification from the service provider to the information owner is required only in the case of fraud or misuse. See, e.g., Miss. Code section 75–24–29(4) (requiring notification if the information was or is reasonably believed to have been acquired by an unauthorized person for fraudulent purposes); Colo. Rev. Stat. section 6–1–716(2)(b) (requiring notification if misuse of personal information about a Colorado resident occurred or is likely to occur). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 PO 00000 Frm 00052 Fmt 4701 Sfmt 4700 E:\FR\FM\03JNR2.SGM 03JNR2 47739 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations Immediately I As soon as practicable Without unreasonable delay ~ Following discovery of breach As soon as practicable and without unreasonable delay In the most expedient time possible As soon as reasonably practicable In an expeditious manner When becoming aware Specific deadline 0 I I 5 15 Number of states 20 25 Figure 5: Frequency of timeline requirements for notification of entities that own or license data by entities that maintain but do not own or license data in case of breach in State laws. Data source: State law in 2023. 585 See supra section II.A.3.a. could be the case, for example, of transfer agents providing services only to publicly traded companies that are not covered institutions. 587 See, e.g., Computershare Comment Letter (‘‘It is also contrary to privacy laws that deem the issuer to be the ‘controller’ or ‘business’ with respect to securityholders and their data and deem the transfer agent based on its role to be the ‘processor’ or ‘service provider.’ ’’). 588 See STA Comment Letter 2. 589 See ICI Comment Letter 1. lotter on DSK11XQN23PROD with RULES2 586 This VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 complying with one or more notification requirements, pursuant to either State law or contract.590 b. Customer Information Safeguards Regulation S–P, prior to the adoption of the amendments, required all covered institutions to adopt written policies and procedures reasonably designed to: ‘‘(i) insure [sic] the security and confidentiality of customer records and information; (ii) protect against any anticipated threats or hazards to the security or integrity of customer records and information; and (iii) protect against unauthorized access to or use of customer records and information that could result in substantial harm or inconvenience to any customer.’’ 591 In addition, Regulation S–P established limitations on how covered institutions may disclose nonpublic personal information about a consumer to 590 Even if a State does not have specific requirements for entities that do not own or license computerized personal or protected information (such as South Dakota, see supra footnote 578), it is unlikely, by the nature of the transfer agent business, that a transfer agent would have access to customer information of individuals residing in this State only. 591 17 CFR 248.30. See also Compliance Programs of Investment Companies and Investment Advisers, Investment Advisers Act Release No. 2204 (Dec. 17, 2003) [68 FR 74714 (Dec. 24, 2003)], at n.22 (‘‘Compliance Program Release’’) (stating expectation that policies and procedures would address safeguards for the privacy protection of client records and information and noting the applicability of Regulation S–P); see also supra section II.B.2 explaining that prior to these final amendments, the safeguards rule did not apply to any transfer agents, and the disposal rule applied only to transfer agents registered with the Commission. PO 00000 Frm 00053 Fmt 4701 Sfmt 4700 nonaffiliated third parties.592 It also established limitations on the further disclosure of nonpublic personal information received by a covered institution from a nonaffiliated financial institution, as well as limitations on the further disclosure of nonpublic personal information disclosed from a covered institution to a nonaffiliated third party.593 Before this adoption, Regulation S–P did not include specific provisions for how covered institutions were to satisfy their obligations to safeguard customer records and information when utilizing service providers. Covered institutions that hold transactional accounts for consumers may also be subject to Regulation S– ID.594 Such entities must develop and implement a written identity theft program that includes policies and procedures to identify relevant types of identity theft red flags, detect the occurrence of those red flags, and respond appropriately to the detected red flags.595 592 See 17 CFR 248.10. 17 CFR 248.11. 594 Regulation S–ID applies to ‘‘financial institutions’’ or ‘‘creditors’’ that offer or maintain ‘‘covered accounts.’’ Entities that are likely to qualify as financial institutions or creditors and maintain covered accounts include most registered brokers, dealers, funding portals, investment companies, and some registered investment advisers. See 17 CFR 248.201; see also Identity Theft Red Flag Rules, Investment Advisers Act Release No. 3582 (Apr. 10, 2013) [78 FR 23637 (Apr. 19, 2013)] (‘‘Identity Theft Release’’); see also 17 CFR 227.403(b). 595 In a 2017 Risk Alert, the SEC Office of Compliance Inspections and Examinations (now 593 See E:\FR\FM\03JNR2.SGM Continued 03JNR2 ER03JN24.004</GPH> Some of the service providers that will be affected by the final amendments are covered institutions themselves.585 Also, some entities that are covered institutions but not service providers under the final amendments could, under State law, be entities that maintain but do not own or license that data, meaning they may have an obligation under State law to notify the data owner.586 In particular, commenters stated that transfer agents were generally considered service providers of the securities issuers under State laws.587 State laws typically require transfer agents to notify the securities issuers in case of security breach, which in turn must notify the affected customers. One commenter stated that transfer agents were, in addition, often required by contract to notify their securities issuer clients in case of data breach.588 Another commenter stated that it was not uncommon for covered institutions to require, by contract or agreement, that their service providers, including transfer agents, notify them in case of security breach.589 Hence, we expect that all or almost all covered institutions and their service providers are already 47740 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 In addition, broker-dealers that operate alternative trading systems exceeding specified volume thresholds are SCI entities subject to Regulation SCI and required, among other things, to have certain policies and procedures reasonably designed to ensure that their market systems have adequate levels of capacity, integrity, resiliency, availability, and security and take appropriate corrective action when ‘‘SCI events’’ occur.596 SCI entities are required to disseminate information to their members or participants about certain types of SCI events.597 Upon the SCI entity having a reasonable basis to conclude that a certain type of SCI event (such as a ‘‘systems intrusion’’ that is not de minimis) has occurred, it is generally required to promptly disseminate information about the SCI event to those members and participants that the SCI entity has reasonably estimated may have been affected. If such ‘‘SCI event’’ is ‘‘major,’’ the information disseminated must be to all of the entity’s members or participants.598 When required, the notification must include a summary description of the systems intrusion, including a description of the corrective action taken by the SCI entity and when the systems intrusion has been or is expected to be resolved, unless the SCI entity determines that dissemination of such information would likely compromise the security of the SCI entity’s SCI systems or indirect SCI systems, or an investigation of the systems intrusion, and documents the reasons for such determination.599 Therefore, information about an ‘‘SCI event’’ caused by a cybersecurity incident may be required to be disseminated to some or all an SCI entity’s members or participants pursuant to Regulation SCI. The safeguards rule of Regulation S– P did not, before this adoption, apply to called the Division of Examinations) noted that, based on observations from examinations of 75 registrants, nearly all examined broker-dealers and most of the examined advisers had specific cybersecurity and Regulation S–ID policies and procedures. See EXAMS Risk Report, Observations from Cybersecurity Examinations (Aug. 7, 2017), available at https://www.sec.gov/files/observationsfrom-cybersecurity-examinations.pdf; see also Identity Theft Release. In addition, affected entities must also periodically update their identity theft programs. See 17 CFR 248.201. Other rules also require updates to policies and procedures at regular intervals: see, e.g., Rule 38a–1 under the Investment Company Act; FINRA Rule 3120 (Supervisory Control System); and FINRA Rule 3130 (Annual Certification of Compliance and Supervisory Processes). 596 Regulation SCI is codified at 17 CFR 242.1000 through 1007. 597 17 CFR 242.1002(c). 598 17 CFR 242.1002(c)(3). 599 17 CFR 242.1002(c). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 transfer agents. In addition, the disposal rule did not apply to transfer agents registered with a regulatory agency other than the Commission.600 Thus, for these institutions, the final amendments create new requirements to adopt written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information and to take reasonable measures to protect against unauthorized access to or use of consumer information and customer information in connection with its disposal.601 Some transfer agents registered with a regulatory agency other than the Commission may already be subject to some of the Federal regulation described below. In addition, many States impose requirements regarding the safeguarding and the disposal of customer information.602 Hence, many transfer agents are likely to 600 See supra section II.B.2. final rule 240.30(a)(1) and (b). States have customer information safeguard requirements, and 30 States have customer information disposal requirements. See, e.g., Cal. Civ. Code section 1798.81.5 (‘‘A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.’’); Del. Code Tit. 6 section 12B–100 (‘‘Any person who conducts business in this State and owns, licenses, or maintains personal information shall implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of personal information collected or maintained in the regular course of business.’’); Fla. Stat. section 501.171(2) (‘‘Each covered entity, governmental entity, or third-party agent shall take reasonable measures to protect and secure data in electronic form containing personal information.’’). See also, e.g., Cal. Civ. Code section 1798.81 (‘‘A business shall take all reasonable steps to dispose, or arrange for the disposal, of customer records within its custody or control containing personal information when the records are no longer to be retained by the business by (a) shredding, (b) erasing, or (c) otherwise modifying the personal information in those records to make it unreadable or undecipherable through any means.’’); La. Rev. Stat. section 51:3074(B) (‘‘Any person that conducts business in the state or that owns or licenses computerized data that includes personal information, or any agency that owns or licenses computerized data that includes personal information shall take all reasonable steps to destroy or arrange for the destruction of the records within its custody or control containing personal information that is no longer to be retained by the person or business by shredding, erasing, or otherwise modifying the personal information in the records to make it unreadable or undecipherable through any means.’’); N.J. Stat. section 56:8–162 (‘‘A business or public entity shall destroy, or arrange for the destruction of, a customer’s records within its custody or control containing personal information, which is no longer to be retained by the business or public entity, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable, undecipherable or nonreconstructable through generally available means.’’). 601 See 602 Twenty PO 00000 Frm 00054 Fmt 4701 Sfmt 4700 already have policies and procedures in the areas covered by these new requirements. Some covered institutions may also be subject to other regulators’ rules and guidelines implicating customer information safeguards. Transfer agents supervised by one of the Banking Agencies may be subject to the Banking Agencies’ Incident Response Guidance and to the Banking Agencies’ Safeguards Guidance, for example.603 The Banking Agencies’ Incident Response Guidance requires covered financial institutions to develop a response program covering assessment, notification to relevant regulators and law enforcement, incident containment, and customer notice.604 These guidelines require customer notification if a financial institution determines that misuse of sensitive customer information ‘‘has occurred or is reasonably possible.’’ 605 They also require notices to occur ‘‘as soon as possible,’’ but permit delays if ‘‘an appropriate law enforcement agency determines that notification will interfere with a criminal investigation and provides the institution with a written request for the delay.’’ 606 Under the guidelines, ‘‘sensitive customer information’’ means ‘‘a customer’s name, address, or telephone number, in conjunction with the customer’s Social Security number, driver’s license number, account number, credit or debit card number, or a personal identification number or password that would permit access to the customer’s account.’’ 607 In addition, ‘‘any combination of components of customer information that would allow someone to log onto or access the customer’s account, such as user name and password or password and account number’’ is also considered sensitive customer information under the guidelines.608 The Banking Agencies’ Safeguards Guidance directs every financial institution covered by the 603 See Banking Agencies’ Incident Response Guidance and Banking Agencies’ Safeguards Guidance; see also Computershare Comment Letter (‘‘Many registered transfer agents like Computershare US and Computershare Canada entities are banks or trust companies, and therefore already subject to state, federal, or provincial banking laws, rules, regulations and inter-agency guidelines.’’ The commenter also refers to ‘‘Title V, Subtitle A, of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801–6809; 12 CFR 30, Appendix B to Part 30—Interagency Guidelines Establishing Information Security Standards; and New York State Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500.’’). 604 See Banking Agencies’ Incident Response Guidance at Supplement A, section II.A. 605 See id., at Supplement A, section III.A. 606 See id., at Supplement A, section III.A. 607 See id., at Supplement A, section III.A.1. 608 See id., at Supplement A, section III.A.1. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations guidelines to require its service providers by contract to implement appropriate measures designed to protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer.609 In addition, the Banking Agencies’ Incident Response Guidance directs that an institution’s contract with its service provider should require the service provider to take appropriate actions to address incidents of unauthorized access to the financial institution’s customer information, including notification to the institution as soon as possible of any such incident, to enable the institution to expeditiously implement its response program.610 The Banking Agencies’ Safeguards Guidance requires certain financial institutions to implement a comprehensive written information security program that includes administrative, technical, and physical safeguards appropriate to the size and complexity of the entity and the nature and scope of its activities.611 This guidance requires that the information security program be designed to (1) ensure the security and confidentiality of customer information; (2) protect against any anticipated threats or hazards to the security or integrity of such information; (3) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer; and (4) ensure the proper disposal of customer information and consumer information.612 Private funds may be subject to the FTC’s recently amended FTC Safeguards Rule, which contains data security requirements to protect customer financial information.613 The FTC Safeguards Rule generally requires financial institutions to develop, implement, and maintain a comprehensive information security program,614 defined as the administrative, technical, and physical 609 See id., at Supplement A, section I.C. id., at Supplement A, section II. 611 See Banking Agencies’ Safeguards Guidance, at section II.A. 612 See id., at section II.B. 613 The FTC Safeguards Rule applies to financial institutions of certain types ‘‘that are not otherwise subject to the enforcement authority of another regulator under section 505 of the Gramm-LeachBliley Act, 15 U.S.C. 6805.’’ See 16 CFR 314.1(b). Private funds that are able to rely on section 3(c)(1) or 3(c)(7) of the Investment Company Act are not subject to Regulation S–P but they may be subject to the FTC Safeguards Rule. See supra footnote 2. Investment advisers registered with the Commission, including those that are advisers to private funds, are covered institutions for the purposes of the final amendments. 614 See 16 CFR 314.3(a). lotter on DSK11XQN23PROD with RULES2 610 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 safeguards the financial institution uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information.615 The rule also requires that the comprehensive information security program contain various elements, including an incident response plan.616 In addition, it requires financial institutions to take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards for customer information and to require those service providers by contract to implement and maintain such safeguards.617 Since the date of our proposal, the FTC Safeguards Rule has been updated to require financial institutions to notify the FTC as soon as possible, and no later than 30 days after discovery, of a security breach involving the unencrypted information of at least 500 consumers.618 Although the FTC Safeguards Rule does not contain a customer notification requirement, the FTC indicated that it ‘‘intends to enter notification event reports into a publicly available database’’ unless a law enforcement official requests delay.619 In addition, many entities covered by this rule may be subject to other, more general information protection requirements.620 In particular, companies operating in foreign jurisdictions may need to comply with information protection requirements in their foreign markets. For example, the GDPR requires entities that process the personal data of EU citizens or residents to, among other things, do so in a manner that ensures appropriate security, integrity, and confidentiality.621 Other recent 615 See 16 CFR 314.2(i). 16 CFR 314.4(h). 617 See 16 CFR 314.4(f). The FTC Safeguards Rule does not contain a requirement that financial institutions require their service providers to notify them in case of a breach resulting in customer information being compromised. 618 The amendments are effective May 13, 2024. See Standards for Safeguarding Customer Information, 88 FR 77499 (Nov. 13, 2023); see also FTC Press Release, FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches (Oct. 27, 2023), available at https://www.ftc.gov/news-events/news/ press-releases/2023/10/ftc-amends-safeguards-rulerequire-non-banking-financial-institutions-reportdata-security-breaches. 619 88 FR at 77506. See also 16 CFR 315.4(j)(vi) (effective May 13, 2024), describing the conditions for a delay in notifying the public of the breach, if requested by law enforcement. 620 See supra Section I (discussing other requirements); footnotes 245, 257 (examples of other regimes); see also Microsoft Comment Letter. 621 GDPR, supra footnote 245, at Art. 5(1)(f); see also What is GDPR, the EU’s New Data Protection Law?, available at https://gdpr.eu/what-is-gdpr/ (last visited Apr. 8, 2024). The GDPR places data protection obligations on organizations that process 616 See PO 00000 Frm 00055 Fmt 4701 Sfmt 4700 47741 regulations in foreign jurisdictions may subject covered institutions to further rules intended to address cybersecurity risk management by financial institutions and some of their service providers.622 Hence, we expect that some of the entities covered by the final amendments, or their service providers, already have customer information safeguards in place because of other information protection regimes. A variety of guidance is available to institutions seeking to address information security risk, particularly through the development of policies and procedures. These include NIST and CISA voluntary standards, both of which include assessment, containment, and notification elements similar to those included in these amendments.623 We do not have extensive data spanning all types of covered institutions on their use of these or similar guidelines or on their development of written policies and procedures to address incident response, and no commenter suggested such data. However, past Commission examination sweeps of broker-dealers and investment advisers suggest that such practices are widespread.624 Thus, we expect that institutions seeking to develop written policies and procedures likely would have encountered these and similar standards and may have included the critical elements of the personal data of EU citizens and residents. Among these are provisions requiring notification in the case of a breach: Art. 34(1), for example, requires a personal data breach to be ‘‘communicated to the data subject without undue delay’’ when the breach is likely to result in a high risk to the rights and freedoms of natural persons, unless certain exceptions (including an encryption exception) apply. 622 See, e.g., Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on Digital Operational Resilience for the Financial Sector and Amending Regulations, Official J. of the Euro. Union (2022), available at https://eur-lex.europa.eu/legal-content/EN/TXT/ PDF/?uri=CELEX:32022R2554 (‘‘DORA’’). 623 See NIST Special Publication 800–61, Revision 2 (Aug. 2012) (‘‘NIST Computer Security Incident Handling Guide’’), available at https:// csrc.nist.gov/publications/detail/sp/800-61/rev-2/ final and CISA, Cybersecurity Incident & Vulnerability Response Playbooks (Nov. 2021) (‘‘CISA Incident Response Playbook’’), available at https://www.cisa.gov/sites/default/files/ publications/Federal_Government_Cybersecurity_ Incident_and_Vulnerability_Response_Playbooks_ 508C.pdf. 624 See OCIE, SEC, Cybersecurity Examination Sweep Summary (Feb. 3, 2015), available at https:// www.sec.gov/about/offices/ocie/cybersecurityexamination-sweep-summary.pdf (Written policies and procedures, for both the examined brokerdealers (82%) and the examined advisers (51%), discuss mitigating the effects of a cybersecurity incident and/or outline the plan to recover from such an incident. Similarly, most of the examined broker-dealers (88%) and many of the examined advisers (53%) reference published cybersecurity risk management standards.). E:\FR\FM\03JNR2.SGM 03JNR2 47742 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations range of services, including effecting customers’ securities transactions, providing liquidity, pooling c. Annual Notice Delivery Requirement investments, transferring ownership in Under the baseline,625 a broker-dealer, securities, advising on financial matters, funding portal, investment company, or managing portfolios, and consulting to registered investment adviser must pension funds. Many of the larger generally provide an initial privacy covered institutions belong to more than notice to its customers not later than one category (e.g., a dually registered when the institution establishes the broker-dealer/investment adviser), and customer relationship and annually thus operate in multiple markets. In the after that for as long as the customer rest of this section, we first outline the relationship continues.626 If an market for each class of covered institution chooses to share nonpublic institution and then consider service personal information with a providers. nonaffiliated third party other than as a. Broker-Dealers disclosed in an initial privacy notice, Broker-dealers include both brokers the institution must generally send a (persons engaged in the business of revised privacy notice to its effecting transactions in securities for customers.627 the account of others),630 as well as The types of information required to dealers (persons engaged in the business be included in the initial, annual, and of buying and selling securities for their revised privacy notices are identical. own accounts).631 Most brokers and Each privacy notice must describe the categories of information the institution dealers maintain customer relationships, and are thus likely to shares and the categories of affiliates come into the possession of sensitive and non-affiliates with which it shares nonpublic personal information.628 The customer information.632 In the market for broker-dealer services, a relatively privacy notices also must describe the small set of large- and medium-sized type of information the institution broker-dealers dominate while collects, how it protects the thousands of smaller broker-dealers confidentiality and security of compete in niche or regional segments nonpublic personal information, a of the market.633 Broker-dealers provide description of any opt out right, and certain disclosures the institution makes a variety of services related to the securities business, including (1) under the FCRA.629 managing orders for customers and 3. Market Structure routing them to various trading venues; The final amendments will affect five (2) providing advice to customers that is categories of covered institutions: in connection with and reasonably broker-dealers other than noticerelated to their primary business of registered broker-dealers, funding effecting securities transactions; (3) portals, registered investment advisers, holding customers’ funds and securities; investment companies, and transfer (4) handling clearance and settlement of agents registered with the Commission trades; (5) intermediating between or another appropriate regulatory customers and carrying/clearing agency. These institutions compete in brokers; (6) dealing in corporate debt several distinct markets and offer a wide and equities, government bonds, and municipal bonds, among other 625 For the purposes of the economic analysis, the securities; (7) privately placing baseline does not include the exception to the securities; and (8) effecting transactions annual notice delivery requirement provided by the in mutual funds that involve FAST Act. This statutory exception was selfeffectuating and became effective on Dec. 4, 2015. transferring funds directly to the issuer. See FAST Act, Public Law 114–94, section 75001, Some broker-dealers may specialize in adding section 503(f) to the GLBA, codified at 15 just one narrowly defined service, while U.S.C. 6803(f). others may provide a wide variety of 626 17 CFR 248.4 and 248.5. 627 17 CFR 248.8. Regulation S–P provides certain services. Based on an analysis of FOCUS filings exceptions to the requirement for a revised privacy notice, including if the institution is sharing as and Form BD filings, there were 3,476 permitted under rules 248.13, 248.14, and 248.15 or registered broker-dealers during the with a new nonaffiliated third party that was lotter on DSK11XQN23PROD with RULES2 assessment and containment, as well as notification. adequately disclosed in the prior privacy notice. 628 See 17 CFR 248.6(a)(2) through (5) and (9). 629 See 17 CFR 248.6(a)(1) (information collection); 248.6(a)(8) (protecting nonpublic personal information), 248.6(a)(6) (opt out rights); 248.6(a)(7) (disclosures the institution makes under section 603(d)(2)(A)(iii) of the FCRA (15 U.S.C. 1681a(d)(2)(A)(iii)), notices regarding the ability to opt out of disclosures of information among affiliates). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 630 See 15 U.S.C. 78c(a)(4). 15 U.S.C. 78c(a)(5). 632 Such information would include the customers’ names, tax numbers, telephone numbers, broker, brokerage account numbers, etc. 633 See Regulation Best Interest: The BrokerDealer Standard of Conduct, Release No. 34–86031 (June 5, 2019) [84 FR 33318 (July 12, 2019)], at 33406. 631 See PO 00000 Frm 00056 Fmt 4701 Sfmt 4700 third quarter of 2023.634 Of these, 303 were dually registered as investment advisers.635 There were over 233 million customer accounts reported by carrying brokers.636 However, the majority of broker-dealers are not ‘‘carrying brokerdealers’’ and therefore do not report the numbers of customer accounts.637 Therefore, we expect that this figure of 233 million understates the total number of customer accounts because many of the accounts at carrying brokerdealers have corresponding accounts with non-carrying brokers. Both carrying and non-carrying brokerdealers potentially possess sensitive customer information for the accounts that they maintain.638 Because noncarrying broker-dealers do not report on the numbers of customer accounts, it is not possible to ascertain with any degree of confidence the distribution of customer accounts across the broader broker-dealer population. b. Funding Portals Funding portals act as intermediaries in facilitating securities-based crowdfunding transactions that are subject to Regulation Crowdfunding.639 Securities-based crowdfunding involves using the internet to raise capital through small individual contributions from a large number of people. The crowdfunding transaction must be conducted through an intermediary registered with the Commission, but a statutory exemption allows that intermediary to forgo registration as a broker-dealer. Therefore some, but not all, crowdfunding intermediaries are registered broker-dealers while others are funding portals. Funding portals are registered with the Commission and are members of FINRA.640 They must provide investors 634 The numbers in this section exclude noticeregistered broker-dealers. See supra section II.B.3. 635 See supra footnote 496. 636 FOCUS filings and Form X–17A–5 Schedule I, Item I8080. For this release, the number of customer accounts reported by carrying brokers was estimated based on FOCUS filings during the third quarter of 2023 and Form X–17A–5 Schedule I, Item I8080 for 2022. The Proposing Release cited a figure of 72 million as of July 1, 2022. The correct number of customer accounts reported by carrying brokers as of July 1, 2022, in the Proposing Release should be 220 million. This change would not have affected the Commission’s assessment of economic effects at Proposal as these assessments were focused primarily on effects at the level of individual covered institutions and their customers. 637 See General Instructions to Form CUSTODY (as of Sept. 30, 2022). 638 This information includes name, address, age, and tax identification or Social Security number. See FINRA Rule 4512. 639 See 17 CFR part 227. 640 See Regulation Crowdfunding, Release No. 33–9974, (Oct. 30, 2015) [80 FR 71388 (Nov. 16, 2015)] (‘‘Regulation Crowdfunding Adopting E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations with educational materials, take measures to reduce the risk of fraud, make information available about the issuer and the offering, and provide communication channels to permit discussions about offerings on the funding portal’s platform, among other related services.641 In facilitating crowdfunding transactions, funding portals may come into possession of investors’ sensitive customer information, as investors are required to open an account with the funding portal before the funding portal may accept an investment commitment from them.642 Funding portals may have possession of sensitive customer information but, unlike broker-dealers, funding portals are statutorily prohibited from holding, managing, possessing, or handling investor funds or securities.643 These funding portals are required to direct investors to transmit money or other lotter on DSK11XQN23PROD with RULES2 Release’’). An entity raising funds through securities-based crowdfunding typically seeks small individual contributions from a large number of people. Individuals interested in the crowdfunding campaign—members of the ‘‘crowd’’—may share information about the project, cause, idea or business with each other and use the information to decide whether to fund the campaign based on the collective ‘‘wisdom of the crowd.’’ The JOBS Act established a regulatory structure for startups and small businesses to raise capital through securities offerings using the internet through crowdfunding. See id. at section I.A. Securities Act section 4(a)(6) provides an exemption from registration for certain crowdfunding transactions. 15 U.S.C. 77d(a)(6). A company issuing securities in reliance on rules established by the Regulation Crowdfunding Adopting Release (17 CFR part 227, ‘‘Regulation Crowdfunding’’) is permitted to raise a maximum of $5 million in a twelve-month period and is required to conduct the transaction exclusively through an intermediary registered with the Commission, either a broker-dealer or a funding portal. See 17 CFR 227.100(a). 641 See Regulation Crowdfunding Adopting Release at section II. 642 See 17 CFR 227.302(a)(1). Regulation Crowdfunding Rule 302 does not prescribe specific information that a funding portal must collect as part of opening an account. 643 See 15 U.S.C. 78c(a)(80)(D). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 consideration for the securities directly to a qualified third party that has agreed in writing to hold the funds for the benefit of investors and the issuer and to promptly transmit or return the funds to the person entitled to the funds.644 As of December 31, 2023, there were 92 registered funding portals that were members of FINRA (excluding funding portals that had withdrawn their registration and FINRA membership).645 The crowdfunding intermediary market is highly concentrated.646 For example, based on staff analysis from May 16, 2016 (inception of Regulation Crowdfunding) through December 31, 2023, five intermediaries accounted for 70 percent of all initiated offerings, including one funding portal accounting for 29 percent of all initiated offerings.647 c. Investment Advisers Registered investment advisers provide a variety of services to their clients, including financial planning advice, portfolio management, pension 644 See 17 CFR 227.303(e)(2), which defines a ‘‘qualified third party’’ as (i) a registered broker or dealer that carries customer or broker or dealer accounts and holds funds or securities for those persons or (ii) a bank or credit union (where such credit union is insured by National Credit Union Administration) that has agreed in writing either to hold the funds in escrow for the persons who have the beneficial interests therein and to transmit or return such funds directly to the persons entitled thereto when so directed by the funding portal as described in paragraph (e)(3) of the rule, or to maintain a bank or credit union account (or accounts) for the exclusive benefit of investors and the issuer. 645 See FINRA, ‘‘Funding Portals We Regulate,’’ at https://www.finra.org/about/funding-portals-weregulate. 646 The crowdfunding intermediary market includes all funding portals and some registered broker-dealers who may also serve as intermediaries of Regulation Crowdfunding transactions. See 17 CFR 227.300(a). 647 Based on staff analysis of EDGAR filings under Regulation Crowdfunding as of December 31, 2023. This includes all initiated offerings facilitated by either funding portals or registered broker-dealers. PO 00000 Frm 00057 Fmt 4701 Sfmt 4700 47743 consulting, selecting other advisers, publication of periodicals and newsletters, security rating and pricing, market timing, and conducting educational seminars.648 Although advisers engaged in any of these activities are likely to possess sensitive customer information, the degree of sensitivity will vary widely across advisers. Some advisers may only hold the customer’s address, payment details, and the customer’s overall financial condition, while others may hold account numbers, tax identification numbers, access credentials to brokerage accounts, and other highly sensitive information. Based on Form ADV filings received up to October 5, 2023, there are 15,565 investment advisers registered with the Commission with a total of more than 51 million individual clients and $114 trillion in assets under management.649 Practically all (97 percent) of these advisers reported providing portfolio management services to their clients.650 Over half (57 percent) reported having custody of clients’ cash or securities either directly or through a related person,651 with client funds in custody totaling $43 trillion.652 648 See Form ADV. ADV, Items 5D(a–b) (as of Oct. 5, 2023). Broadly, regulatory assets under management capture the current value of assets in securities portfolios for which the adviser provides continuous and regular supervisory or management services. See Form ADV, Part 1A Instruction 5.b. 650 Form ADV, Items 5G(2–5) (as of Oct. 5, 2023). 651 Here, ‘‘custody’’ means ‘‘holding, directly or indirectly, client funds or securities, or having any authority to obtain possession of them.’’ An adviser also has ‘‘custody’’ if ‘‘a related person holds, directly or indirectly, client funds or securities, or has any authority to obtain possession of them, in connection with advisory services [the adviser] provide[s] to clients.’’ See 17 CFR 275.206(4)– 2(d)(2). 652 Form ADV, Items 9A and 9B (as of Oct. 5, 2023). 649 Form E:\FR\FM\03JNR2.SGM 03JNR2 47744 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations 10 1 10K 1K 100 Individual Clients Figure 6 plots the cumulative distribution of the number of individual clients handled by investment advisers registered with the Commission. The distribution is highly skewed: 13 advisers each reported having more than one million clients while 95 percent of advisers reported having fewer than 2,000 clients. Many such advisers are quite small, with half reporting fewer than 62 clients.653 Similarly, most investment advisers registered with the Commission are limited geographically. These advisers must generally make a ‘‘notice filing’’ with a State in which they have a place of business or six or more clients.654 Figure 7 plots the frequency distribution of the number of such filings. Based on notice filings, 57 percent of investment advisers registered with the Commission operated in fewer than four States, and 37 percent operated in only one State.655 653 Form ADV, Items 5D(a) and (b) (as of Oct. 5, 2023). 654 See General Instructions to Form ADV (as of Oct. 5, 2023). 655 Form ADV, Item 2.C (as of Oct. 5, 2023). This includes 1,887 advisers who do not make any notice filings. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 PO 00000 Frm 00058 Fmt 4701 Sfmt 4700 E:\FR\FM\03JNR2.SGM 03JNR2 ER03JN24.005</GPH> lotter on DSK11XQN23PROD with RULES2 Figure 6: Cumulative distribution of the number of clients across investment advisers. Data source: Form ADV, Items SD(a-b) (as of Oct. 5, 2023). Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations 20 0 47745 40 #States Figure 7: Frequency of number of State notice filings by SEC-registered investment advisers. Data source: Form ADV, Item 2.C (as of Oct. 5, 2023). Investment companies are companies that issue securities and are primarily engaged in the business of investing in securities. Investment companies invest money they receive from investors on a collective basis, and each investor shares in the profits and losses in proportion to that investor’s interest in the investment company. Investment companies subject to the final amendments include registered openend and closed-end funds, business development companies (‘‘BDCs’’), Unit Investment Trusts (‘‘UITs’’), employee securities’ companies (‘‘ESCs’’), and management company separate accounts (‘‘MCSAs’’). Because they are not operating companies, investment companies do not have ‘‘customers’’ as such, and thus are unlikely to possess significant amounts of nonpublic ‘‘customer’’ information in the conventional sense. They may, however, have access to nonpublic information about their investors.656 Table 4 summarizes the investment company universe that will be subject to the final amendments. In total, as of September 30, 2023, there were 13,766 investment companies, including 12,183 open-end management investment companies, 682 closed-end managed investment companies, 702 UITs,657 141 BDCs,658 approximately 43 ESCs, and 15 MCSAs. Many of the investment companies that will be subject to the final amendments are part of a ‘‘family’’ of investment companies.659 Such families often share infrastructure for operations (e.g., accounting, auditing, custody, legal), and potentially marketing and distribution. We expect that many of the compliance costs and other economic costs discussed in the following sections will likely be borne at the family level.660 We estimate that there were up to 1,131 distinct operational entities (families and unaffiliated investment companies) in the investment company universe.661 656 The definition of ‘‘customer information’’ in the final amendments includes information about investment companies’ investors. See final rule §§ 248.30(d)(5)(i) and 248.3(t). 657 For this release, the number of UITs includes N–4, N–6, N–8B–2, and S–6 filers as of Sept. 30, 2023. The Proposing Release cited a figure of 662 UITs using 2021 N–CEN filings. The correct number of UITs using 2021 N–CEN filings in the Proposing Release should be 703. This change would not have affected the Commission’s assessment of economic effects at Proposal as these assessments were focused primarily on effects at the level of individual covered institutions and their customers. 658 For this release, the number of BDCs was estimated using London Stock Exchange Group (‘‘LSEG’’) BDC Collateral data as of Sept. 2023. 659 As used here, ‘‘family’’ refers to a set of funds reporting the same family investment company name (Form N–CEN Item B.5) or filing under the same registrant name (Form N–CEN Item B.1.A). 660 For example, each investment company in a family is likely to share common policies and procedures. 661 For this release, the number of unaffiliated entities was estimated using N–CEN filings as of Sept. 30, 2023. The Proposing Release cited a figure of 476 using 2021 N–CEN filings. The correct number of the unaffiliated entities using 2021 N– CEN filings in the Proposing Release should be 609. This change would not have affected the Commission’s assessment of economic effects at Proposal as these assessments were focused primarily on effects at the level of individual covered institutions and their customers. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 PO 00000 Frm 00059 Fmt 4701 Sfmt 4700 BILLING CODE 8011–01–P E:\FR\FM\03JNR2.SGM 03JNR2 ER03JN24.006</GPH> lotter on DSK11XQN23PROD with RULES2 d. Investment Companies 47746 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations Table 4: Investment Companies, sammary stadstles. For each type of fn.d, this table presents estimates of tile number of iav:estment companies and lavestment company families. Data soUtteS: 2023 N-CEN fllinas,• LSEG BDC Collateral (2023).• Fund Open-En Closed-Bndl un- BDC ESCi MCSA1 Totaf a Year 2023 Form N-CEN (as of Sept 2023). b LSEG BDC COUatem1 (as of Sept. 2023). c Number of fitmilies imculated from affiliation reported byregismmts OD DemB.S ofform N-CEN. The toW number of fiunilies represents lie number ofdistind &milies~ si11mriog overlie number of fiunilies aaoss different fund tJpes will double count some fiD1 fitmities. d Numberof regismmtsreporlmg no family affiliation. e Number of distinct entities, i.e., lie sum ofdistinct fiunilies (# Families) and unaffiliated~(# Umdfitiated). The grand toW is lie sum ofdistinct fiunilies (313},, totaJ ,maffiliated regis1nm1s (634), BDCs (141). and ESCs (43). f Form N-lA filers; includes all opea-eod funds, iuelnding ETFs registered OD Form N-lA. g Form N-2 filers not classified as BDCs. h urrs are co.mpmed of (1) Variable 8IJIRlity separate accounts organized as UlTs, which are series, or classes ofseries, of11:mts registered OD Form N-4~ (2) Variable life insunmce separate accounts organized as urrs, which are series, or classes ofseries, of11:mts registered OD Form N-6; (3) ETFs organized • urrs. which are series, or classes of series, oftrusts registemd OD Form N..SB-21 S-6 (Non-separateaccount urrs register mlie first instance OD formN-BB-2, aad fben their subsequent fi.liDes are OD Form S-6); and Noa-ETF urrs are 11:mts registered OD Forms N-4 or N-6. i Form N-2 filers classified as BDCs. j Form 40-APP filers [not dassified as BDCs]. k Trusts registered OD Form N-3. 1 Cells do not sum to totals as iavesbneDt company &mi1ies ID8J spmmultipte iavesbneDt company tJpes. lotter on DSK11XQN23PROD with RULES2 e. Transfer Agents Transfer agents maintain records of security ownership and are responsible for processing changes of ownership (‘‘transfers’’), communicating information from the firm to its securityholders (e.g., sending annual reports), replacing lost stock certificates, etc. However, in practice, most securities registered in the U.S. are held in ‘‘street name,’’ where the ultimate ownership information is not maintained by the transfer agent but rather in a hierarchal ledger. In this structure, securities owned by individuals are not registered in the name of the individual with the transfer agent. Rather, the individual’s broker maintains the records of the individual’s ownership claim on securities. Brokers, in turn, have claims on securities held by a single nominee owner who maintains records of the VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 claims of the various brokers.662 In such cases, the transfer agent is not aware of the ultimate owner of the securities and therefore does not hold sensitive information belonging to those owners, as only the broker holds this information. Despite the prevalence of securities held in street name, a large number of individuals nonetheless hold securities directly through a transfer agent. Securities held directly may be held either in the form of a physical stock certificate or in book-entry form through the Direct Registration System (‘‘DRS’’). In either case, the transfer agent would need to maintain sensitive information about the individuals who own the securities. For example, to handle a request for replacement certificate, the transfer agent would need to confirm the identity of the individual making 662 In the U.S., this owner is generally Cede & Co., a partnership organized by the Depository Trust & Clearing Corporation. PO 00000 Frm 00060 Fmt 4701 Sfmt 4700 such a request and to maintain a record of such confirmation. Similarly, to effect DRS transfers, a transfer agent would need to provide a customer’s identification information in the message to the DRS. In 2023, there were 251 transfer agents registered with the Commission, with an additional 64 registered with the Banking Agencies.663 As discussed above,664 differences in the baseline regulation of these transfer agents affect their current notification obligations.665 Among the 315 transfer agents, 132 are considered small entities.666 By registration, 100 of these small transfer 663 Form TA–1 (as of Sept. 30, 2023). supra footnotes 601 and 604 and accompanying text. 665 See infra sections IV.D.2.b and IV.E (discussing benefits and costs, and competitive effects, relative to the baseline). 666 See infra section VI.C. Estimate based on the number of transfer agents that reported a value of fewer than 1,000 for items 4(a) and 5(a) on Form TA–2 collected by the Commission as of Sept. 30, 2023. 664 See E:\FR\FM\03JNR2.SGM 03JNR2 ER03JN24.007</GPH> BILLING CODE 8011–01–C Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations agents are registered with the Commission and 32 are registered with the Banking Agencies.667 On average, each transfer agent reported around 1 million individual 47747 Approximately one third of registered transfer agents reported no individual accounts,669 and 58 percent reported fewer than ten thousand individual accounts.670 accounts, with the largest reporting 61 million.668 Figure 8 plots the cumulative distribution of the number of individual accounts reported by registered transfer agents. 1.0- 0.8 0.6 0.4 0.2 0.0 I I I I I I I 10 100 lK l0K lO0K lM l0M l00M # Individual Accounts Figure 8: Cumulative distribution of the number of individual accounts (logarithmic scale) across registered transfer agents. Data source: Form TA-2, Items S(a) (as of Sept. 30, 2023). The final amendments require that a covered institution’s incident response program include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers. These policies and procedures must be reasonably designed to ensure service providers take appropriate measures to protect against unauthorized access to or use of customer information and to notify covered institutions of an applicable breach in security.671 These requirements on a covered institution will affect a service provider that ‘‘receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to [the] covered institution.’’ 672 667 Id. lotter on DSK11XQN23PROD with RULES2 668 Form TA–2 Items 5(a) (as of Sept. 30, 2023). This analysis is limited to the 265 transfer agents that filed form TA–2. For the 205 transfer agents registered with the Commission that filed form TA– 2, the average number of individual accounts is 1.2 million; for the 60 transfer agents registered with the Banking Agencies that filed form TA–2, the average number of individual accounts is 69 thousand. 669 Some registered transfer agents outsource many functions—including tracking the ownership of securities in individual accounts—to other VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Covered institutions’ relationships with a wide range of service providers will be affected. Specialized service providers with offerings geared toward outsourcing of covered institutions’ core functions will generally fall under the requirements. Those offering customer relationship management, customer billing, portfolio management, customer portals (e.g., customer trading platforms), customer acquisition, tax document preparation, proxy voting, and regulatory compliance (e.g., AML/ KYC) will likely fall under the requirements. Some of these specialized service providers will be themselves covered institutions.673 In addition, various less-specialized service providers might potentially fall under the requirements. Service providers offering Software-as-a-Service (SaaS) solutions for email, file storage, and similar general-purpose services might potentially be in a position to receive, maintain, or process customer transfer agents (‘‘service companies’’). See Form TA–1 Item 6 (as of June 20, 2022). 670 Form TA–2, Items 5(a) (as of Sept. 30, 2023). 671 See final rule 248.30(a)(5). 672 Final rule 248.30(d)(10). 673 For example, many investment companies rely on third-party investment advisers and transfer agents. 674 See Proposing Release at section III.C.3.e; see also Bank for International Settlements, Outsourcing in Financial Services (Feb. 15, 2005), available at https://www.bis.org/publ/joint12.htm. PO 00000 Frm 00061 Fmt 4701 Sfmt 4700 information. Similarly, providers of Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), as well as those offering more ‘‘traditional’’ consulting services (e.g., IT contractors) will in many cases be ‘‘otherwise [ ] permitted access to customer information’’ and might fall under the provisions. In the Proposing Release, we stated that the financial services industry is increasingly relying on service providers through various forms of outsourcing.674 We also stated that we were unable to quantify or characterize in much detail the structure of the relevant service provider markets due to data limitations.675 One commenter stated that this resulted in an analysis that fails to meaningfully address the associated costs.676 While this commenter did not identify any additional data sources, in response we have conducted a further review of industry literature.677 While we 675 See Proposing Release at section III.C.3.e. IAA Comment Letter 1. 677 In addition, in response to this commenter, we have added further details on the current regulatory framework, in particular with respect to the obligations of covered institutions regarding their service providers and the notification obligations of service providers. See supra section IV.C.2. Also, we have supplemented the analysis of the benefits and costs of the final amendments’ service provider requirements. See infra section IV.D.1.c. The 676 See E:\FR\FM\03JNR2.SGM Continued 03JNR2 ER03JN24.008</GPH> f. Service Providers 47748 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 continue to find certain data limitations, we also have identified certain additional informative data points on covered institutions’ reliance on service providers.678 A recent notice issued by FINRA states that FINRA’s members, which include broker-dealers, ‘‘are increasingly using third-party vendors to perform a wide range of core business and regulatory oversight functions,’’ a trend that has accelerated with the COVID–19 pandemic.679 One report describes the results of a 2022 survey of 248 advisers and independent brokerdealers.680 The survey found that 32 percent of the registered investment advisers and 50 percent of the independent broker-dealers that responded to the survey reported outsourcing investment management functions, and that while these proportions had not changed significantly in the past decade, half of the respondents who do outsource some of these functions reported an increase in their use of service providers. In addition, a different recent report finds that 33 percent of asset managers surveyed outsource their entire backoffice function and 20 percent outsource their entire middle-office function.681 By the nature of their business models, most of the operations of investment companies are carried out by service providers.682 Finally, many transfer agents outsource many functions.683 Hence, all types of covered institutions affected by the final amendments supplemental review described here is designed to help us analyze and respond to commenters, and also to provide additional context for this analysis. 678 Potential service providers include a wide range of firms fulfilling a variety of functions. The internal organization of covered institutions, including their reliance on service providers, is not generally publicly observable. Although certain regulatory filings shed a limited light on the use of third-party service providers (e.g., transfer agents’ reliance on third parties for certain functions and investment advisers’ reliance on third parties for recordkeeping), we are unaware of any data sources that provide detail on the reliance of covered institutions on service providers. 679 See FINRA, Regulatory Notice 21–29, supra footnote 515. 680 See FlexShares, The Race to Scalability 2022 (July 2022). 681 See Cerulli Associates, Asset Managers Turn to Outsourcing Providers for Operating Model Sustainability (Nov. 22, 2022), available at https:// www.cerulli.com/press-releases/asset-managersturn-to-outsourcing-providers-for-operating-modelsustainability (‘‘Cerulli Report’’). 682 See Investment Company Institute, How USRegistered Investment Companies Operate and the Core Principles Underlying Their Regulation (May 2022), available at https://www.ici.org/system/files/ 2023-06/us-reg-funds-principles.pdf. 683 See supra footnote 670. See also Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920, 37937 (June 9, 2023), which may cover some transfer agents registered with a regulatory agency other than the Commission. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 commonly retain service providers to some extent. D. Benefits and Costs of the Final Rule Amendments The final amendments can be divided into four main components. First, they create a requirement for covered institutions to adopt policies and procedures for the protection of customer information. The policies and procedures must include an incident response program to address unauthorized access to or use of customer information, including by providing notification to individuals affected by an incident during which their sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. The response program must also include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight of service providers, including to ensure service providers take appropriate measures to protect against unauthorized access to or use of customer information. Second, the amendments define the information covered by the safeguards rule and the disposal rule,684 and extend the application of the safeguards rule to transfer agents. Third, the amendments require covered institutions (other than funding portals) to maintain and retain records documenting compliance with the amended rules.685 Fourth, they incorporate into regulation an existing statutory exemption for annual privacy notices. Below we discuss the benefits and the costs of each component in turn. Some commenters criticized, generally, the discussion of benefits and costs in the Proposing Release. One commenter stated that the Commission should ‘‘undertake a more expansive, accurate, and quantifiable assessment of the specific and cumulative costs, burdens, and economic effects that would be placed on investment advisers by the proposed requirements, as well as of the potential unintended consequences for their clients.’’ 686 Another commenter stated a need for more in-depth analysis of how the 684 See final rule 248.30(a)(1), 248.30(b), 248.30(d)(1), and 248.30(d)(5). 685 As discussed above, funding portals are not subject to the recordkeeping obligations found under Rule 17a-4. Funding portals are instead obligated, pursuant to Rule 404 of Regulation Crowdfunding, to make and preserve all records required to demonstrate their compliance with Regulation S–P for five years, the first two years in an easily accessible place. See supra footnote 385; see also 17 CFR 227.404(a)(5). 686 See IAA Comment Letter 1. PO 00000 Frm 00062 Fmt 4701 Sfmt 4700 proposed amendments might impact transfer agents, their customers (issuers of securities), and securityholders.687 Other commenters did not directly disagree with the analysis in the Proposing Release, but stated that the proposed amendments would place a high overall burden on covered institutions, including smaller institutions.688 In response to these commenters, we have supplemented the analysis of the benefits and the costs of the final amendments regarding the timing requirement for notification of customers affected by a breach, including by providing more details on how the requirements differ from the baseline; 689 different elements required to be included in a notice to affected individuals; 690 different requirements relating to service providers; 691 and the extension of the rule’s scope to include all transfer agents.692 As discussed below, we have also made changes to the final amendments that will reduce compliance costs for all covered institutions, including those that are smaller in size.693 Several commenters stated that the Commission should consider the cumulative costs of implementing the proposed amendments and other recent Commission rules and proposed rules.694 Specifically, one commenter stated that ‘‘there can be no doubt that the costs of compliance—direct and indirect—rise with each regulation and directly impact the ability of [covered institutions] to invest in other aspects of their businesses’’ and that the Commission should ‘‘consider the cumulative effects that’’ the final amendments and other adopted rules will have on covered institutions’ ‘‘operational limitations and, more importantly, resource constraints, in determining the compliance dates.’’ 695 That commenter and others mentioned proposals which culminated in several adopted rules.696 Consistent with its long-standing practice, the Commission’s economic analysis in each adopting release 687 See STA Comment Letter 2. e.g., SIFMA Comment Letter 2; ASA Comment Letter. 689 See infra section IV.D.1.b(2); see also supra section IV.C.2.a(2). 690 See infra section IV.D.1.b(5); see also supra section IV.C.2.a(2). 691 See infra section IV.D.1.c; see also supra sections IV.C.2.a(3) and IV.C.3.f. 692 See infra section IV.D.1.b; see also supra section IV.C.2.a(3). 693 See infra footnote 1058 and accompanying text. 694 See supra footnote 482. 695 See IAA Comment letter 2. 696 See supra footnotes 483–493. 688 See, E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 considers the incremental benefits and costs for the specific rule—that is, the benefits and costs stemming from that rule compared to the baseline. The Commission acknowledges the possibility that complying with more than one rule may entail costs that could exceed the costs if the rules were to be complied with separately. Four of the rules identified by commenters have compliance dates that occur before the effective date of the final amendments,697 such that there is no overlap in compliance periods. The compliance periods for the other rules overlap in part, but the compliance dates adopted by the Commission in recent rules are generally spread out over an approximately three-year period from 2023 to 2026,698 which could limit the number of implementation activities occurring simultaneously. Where overlap in compliance periods exists, the Commission acknowledges that there may be additional costs on those covered institutions subject to one or more other rules as well as implications of those costs, such as impacts on entities’ ability to invest in other aspects of their businesses.699 Covered institutions subject to the final amendments in this rulemaking may be subject to one or more of the other adopted rules commenters named depending on whether those institutions’ activities fall within the scope of the other rules. Specifically, the rules and amendments in the February 2024 Form PF Adopting Release, and those rules and amendments in the Private Fund Advisers Adopting Release for which the compliance dates have not already passed, apply to advisers to private funds: as private fund advisers are a subset of the covered institutions affected by the amendments, only a subset of covered institutions face compliance costs associated with these recent rules and amendments.700 The Public Company Cybersecurity Rules apply only to public companies, not all 697 The compliance dates for the Electronic Recordkeeping Adopting Release occurred in 2023, and the compliance date for the Settlement Cycle Adopting Release is May 28, 2024. The compliance dates for the May 2023 SEC Form PF Adopting Release and the Form N–PX Adopting Release are June 11, 2024, and July 1, 2024, respectively. 698 See supra section IV.C. In addition, we adopted longer compliance periods for all covered institutions relative to the proposal, and an even longer compliance period for smaller covered institutions. See supra section II.F. 699 See, e.g., IAA Comment letter 2 (describing the types of implementation activities, such as updating internal controls, and training). 700 See Private Fund Advisers Adopting Release, at section VI.C.1; February 2024 Form PF Adopting Release, at section IV.B.2. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 covered institutions.701 The amendments adopted in the Money Market Fund Adopting Release place a compliance burden on money market funds and certain liquidity fund advisers registered with the Commission, which are also a subset of covered institutions.702 The Investment Company Names Adopting Release amended requirements for those registered investment companies and BDCs with names with terms suggesting that the fund has particular characteristics, which are a subset of the funds affected by the final amendments.703 The Beneficial Ownership Adopting Release amended disclosure requirements that apply only to persons who beneficially own more than five percent of a covered class of equity securities.704 The rule adopted in the Securitization Conflicts Adopting Release affects only certain entities (and their affiliates and subsidiaries) that participate in securitization transactions.705 We acknowledge that covered institutions subject to multiple rules may still experience increased costs associated with implementing multiple rules at once as well as implications of those costs, such as impacts on those institutions’ ability to invest in other aspects of their businesses. 1. Written Policies and Procedures In this section, we discuss the effects of written policies and procedures requirements in the final amendments, focusing on those relating to the incident response program required under the final amendments. Specifically, while the final amendments require covered institutions to develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information,706 general written policies and procedures to protect customer 701 See Public Company Cybersecurity Rules, at section IV.B.2. One commenter also suggested the Commission should consider the relationship between reporting obligations in the proposed amendments and the Public Company Cybersecurity Rules. See ASA Comment Letter. We modified the final amendments, relative to the proposal, to align with the Public Company Cybersecurity Rules with regard to disclosure delays for national security or public safety reasons. See supra section II.A.(d)(2). 702 See Money Market Fund Adopting Release, at section IV.B. 703 See Investment Company Names Adopting Release, at section IV.C. 704 See Beneficial Ownership Adopting Release, at section IV.B.3. 705 See Securitization Conflicts Adopting Release, at section IV.B.2. 706 See final rule 248.30(a)(1). PO 00000 Frm 00063 Fmt 4701 Sfmt 4700 47749 information are already part of the baseline.707 The primary new requirements pertain to written policies and procedures that must include an incident response program to address unauthorized access to or use of customer information. We expect that requiring written policies and procedures for the response program will improve the effectiveness of response programs in multiple ways, which will benefit covered institutions and their customers. Written policies and procedures are a practical prerequisite for organizations to implement standard operating procedures and have been recognized as effective at improving outcomes in critical environments.708 We expect that this will also be the case for response programs for data breach incidents. Written policies and procedures can help ensure that the covered institution’s personnel know what corrective actions to take and when in the event of a data breach. Written policies and procedures can also help ensure that the incident is handled in an optimal manner. Moreover, establishing incident response procedures ex ante can facilitate discussion among the covered institution’s staff and expose flaws in the incident response procedures before they are used in a real response. This may also lead to covered institutions improving their customer information safeguards, which could reduce the likelihood of unauthorized access to or use of customer information in the first place.709 707 Prior to this adoption, Regulation S–P already required covered institutions to adopt policies and procedures reasonably designed to protect customer information. See supra section IV.C.2.b. Transfer agents were not previously covered by the safeguards rule and were not, before this adoption, required by the Commission to have such written policies and procedures in place. We analyze the benefits and costs that are specific to transfer agents in section IV.D.2.b. 708 Other Commission regulations, such as the Investment Company Act and Investment Advisers Act compliance rules, require policies and procedures. 17 CFR 270.38a–1(a)(1), 275.206(4)– 7(a). The utility of written policies and procedures is recognized outside the financial sector as well; for example, standardized written procedures have been increasingly embraced in the field of medicine. See, e.g., Robert L. Helmreich, Error Management as Organizational Strategy, In Proceedings of the IATA Human Factors Seminar, Vol. 1., Citeseer (1998); see also Joseph Alex, Chaparro Keebler, Elizabeth Lazzara & Anastasia Diamond, Checklists: A Review of Their Origins, Benefits, and Current Uses as a Cognitive Aid in Medicine, Ergonomics in Design, 2019 Q. Hum. Fac. App. 27 (2019). We are not aware of any studies that assess the efficacy of written policies and procedures specifically in the context of financial regulation, and no commenter provided such sources. 709 See infra section IV.D.1.b(3) for examples of how covered institutions could enhance their customer information safeguards. E:\FR\FM\03JNR2.SGM 03JNR2 47750 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations We do not anticipate that the final requirement for written policies and procedures will result in substantial new benefits from its application to large covered institutions, those with a national presence, or those already subject to comparable Federal regulations. As stated above,710 all States and the District of Columbia generally require businesses to notify their customers when certain customer information is compromised. States do not typically require the adoption of written policies and procedures for the handling of such incidents.711 However, despite the lack of explicit statutory requirements, covered institutions— especially those with a national presence—may have developed and implemented written policies and procedures for a response program that incorporates various standard elements, including for assessment, containment, and notification.712 Given the numerous and distinct State data breach laws, it would be difficult for larger covered institutions operating in multiple States to comply effectively with existing State laws without having some written policies and procedures in place. As such covered institutions are generally larger, they are more likely to have compliance staff dedicated to designing and implementing regulatory policies and procedures, which could include policies and procedures regarding incident response. Moreover, to the extent that covered institutions that have already developed written policies and procedures for incident response have based such policies and procedures on common cyber incident response frameworks (e.g., NIST Computer Security Incident Handling Guide, CISA Cybersecurity Incident Response Playbook),713 generally accepted industry best practices, or other applicable regulatory guidelines,714 these large covered institutions’ written policies and procedures are likely to include the 710 See supra section IV.C.2. States do, however, require businesses to have procedures to protect personal information. See, e.g., Cal. Civil Code section 1798.81.5 and N.Y. Gen. Bus. Law. section 899–BB. 712 Various industry guidebooks, frameworks, and government recommendations share many common elements, including the ones included in the final amendments. See, e.g., NIST Computer Security Incident Handling Guide and CISA Incident Response Playbook. 713 See supra footnote 625. 714 For example, the Banking Agencies’ Incident Response Guidance states that covered institutions that are subsidiaries of U.S. bank holdings companies should develop response programs that include assessment, containment, and notification elements. See supra discussion of Banking Agencies’ Incident Response Guidance in text accompanying footnote 605. lotter on DSK11XQN23PROD with RULES2 711 Some VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 elements of assessment, containment, and notification, and to be substantially consistent with the requirements of the final amendments. Thus, we do not anticipate that the final requirement for written policies and procedures will result in substantial new benefits from its application to these institutions. For the same reasons, this requirement is unlikely to impose significant new costs for these institutions. As discussed below, we estimate that certain costs associated with developing and implementing policies and procedures to comply with the final amendments will be, on average, $15,445 per year per covered institution.715 Here, we expect the main costs associated with the final requirement to be the costs of reviewing, and possibly updating, existing policies and procedures to ensure that they satisfy the new requirements. Hence, we expect these reviews and updates will result in these covered institutions incurring direct compliance costs generally smaller than the costs of developing and implementing new policies and procedures. If covered institutions respond to this requirement by improving their customer information safeguards beyond what is required by the final amendments, they will incur additional costs.716 We expect that the costs incurred by these covered institutions as a result of this requirement will ultimately be passed on to customers of these institutions.717 We expect that the final written policies and procedures requirements will have more substantial benefits and 715 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $5,425 per year per covered institution. See infra section V. We expect that for some institutions, the actual costs might be lower than these estimates. For example, there may be some portability between funds belonging to the same family of investment companies, which could mitigate costs per investment company. See supra section IV.C.3.d. We estimate that these costs will be higher for transfer agents because transfer agents were not, before this adoption, covered by the safeguards rule. In addition, transfer agents registered with a regulatory agency other than the Commission were not, before this adoption, covered by the disposal rule. See infra footnote 1003 and accompanying text. 716 Because covered institutions could decide to enhance their customer information safeguards in many different ways, we are unable to quantify expected costs resulting from such enhancements. See infra section IV.D.1.b(3) for examples of how covered institutions could enhance their customer information safeguards as a result of the final amendments. 717 Costs incurred by larger covered institutions as a result of the final amendments will generally be passed on to their customers in the form of higher fees. However, smaller covered institutions—which are likely to face higher costs relative to their size—may not be able to do so. See infra section IV.E. PO 00000 Frm 00064 Fmt 4701 Sfmt 4700 costs for smaller covered institutions without a national presence, such as small registered investment advisers and broker-dealers who cater to a clientele based on geography, as compared to larger covered institutions. Before this adoption, some of these covered institutions may have had lower incentives to develop and implement written policies and procedures for a response program and may therefore have been less likely to have such policies and procedures in place for several reasons. First, the incentives to develop and implement policies and procedures for a response program may vary for covered institutions of different sizes. Some smaller covered institutions may already prioritize response programs, for example because the firm views reputational costs of a cybersecurity breach or other type of unauthorized access to or use of customer information as posing the potential for serious harm to the firm. However, for other smaller covered institutions, the firm and its managers may view response programs as lower priority because, for example, the potential reputational cost of an unauthorized access to or use of customer information may be relatively smaller than it would be for a larger firm. This would be the case to the extent that the firm and its managers perceive that the firm has a lower franchise value (the present value of the future profits that a firm is expected to earn as a going concern) and lower brand equity (the value of potential customers’ perceptions of the firm). Thus, the costs of potential reputational harm may be perceived to be lower than at larger firms. Moreover, the cost of developing and implementing written policies and procedures for a response program is proportionately large compared to larger covered institutions since it involves fixed costs. Second, some covered institutions could potentially have, before this adoption, complied effectively with the relevant State data breach notification laws without adopting written policies and procedures to deal with customer notification: they may only have needed to consider—on an ad hoc basis—the notification requirements of the small number of States in which their customers reside.718 Hence, for such covered institutions, the cost of developing policies and procedures will be relatively larger, but the benefits for 718 As discussed above, many registered investment advisers have clients in only a few States. See supra section IV.C.3.c. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 the customers of these institutions will also be larger. We expect that for such covered institutions, the final amendments will likely impose additional compliance costs related to written policies and procedures for safeguarding customer information.719 Certain costs associated with developing and implementing policies and procedures to comply with the final amendments are estimated to be $15,445 generally per year per covered institution, but may vary depending on the size of the institution and the current state of their existing policies and procedures.720 Furthermore, as for larger covered institutions, if these covered institutions respond to this requirement by improving their customer information safeguards beyond what is required by the final amendments, they will incur additional costs. While these smaller covered institutions might potentially pass some of the costs resulting from the final amendments on to customers in the form of higher fees, their ability to do so may be limited due to the presence of larger competitors with more customers across which to spread costs.721 In addition, covered institutions that improve their customer notification procedures in response to the final amendments might suffer reputational costs resulting from the additional notifications.722 719 The existing policies and procedures were already required under Regulation S–P before this adoption; see 17 CFR 248.30. The final amendments may also generate additional costs to covered institutions who decide to improve their customer information safeguards to avoid the potential reputational harm associated with the customer notification requirements. However, one commenter stated that the FTC has often noted that reasonable security measures are a relatively low cost. See EPIC Comment Letter. Such improvements in customer information safeguards would also provide potential benefits to customers in addition to reducing the risk of reputational harm for the covered institutions. 720 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $5,425 per year per covered institution. See infra section V. We expect that for some institutions, the actual costs might be lower than these estimates. For example, there may be some portability between funds belonging to the same family, which could mitigate costs. See supra section IV.C.3.d. 721 See supra section IV.C.3. Developing and implementing written policies and procedures for a response program involves fixed costs. Larger institutions can spread these costs over a larger number of customers, resulting in a smaller increase in the price that each customer pays. Smaller institutions must spread these costs over a smaller number of customers, resulting in a larger price increase per customer. This could result in smaller institutions losing more customers as a result of the increase in price. Hence, smaller institutions could decide to absorb more of the costs compared to large institutions in order to avoid losing customers. 722 See supra section IV.B; see also infra section IV.D.1.b. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Some commenters stated that many covered institutions already had policies and procedures in place.723 These commenters also stated that these policies and procedures would need to be reviewed and updated to comply with the amendments, but to different extents. On the one hand, one commenter stated that its members already complied with much of the proposal’s content through State regulations, such as the requirements that companies maintain written cybersecurity policies and procedures, respond to cyber incidents, notify authorities and consumers of certain cyber incidents, and dispose of consumer data.724 A second commenter stated that the customer notification requirements would need to be incorporated into existing policies and procedures.725 These commenters’ perspectives are consistent with our view that the final rules will impose a fairly limited burden for covered institutions bringing existing policies and procedures into compliance with the new requirements. On the other hand, a different commenter stated that written incident response program policies and procedures and recordkeeping requirements would need to be created and implemented,726 indicating higher potential burden. Hence, we continue to expect that the policies and procedures requirements will potentially have different effects on different covered institutions.727 In a change from the proposal and after considering commenters’ concerns, we are now adopting a longer compliance period for all covered institutions relative to the proposal, and an even longer compliance period of 24 months for smaller covered institutions, which are less likely to already have policies and procedures broadly consistent with the final amendments.728 Two commenters discussed how the proposed amendments would affect an entity that is dually registered as an investment adviser and broker-dealer. One commenter stated that it 723 See, e.g., IAA Comment Letter 1; SIFMA Comment Letter 2. 724 See ACLI Comment Letter. 725 See SIFMA Comment Letter 2. 726 See IAA Comment Letter 1. 727 For example, some covered institutions, such as transfer agents, may not have existing notification procedures since they may not have been required, under State law, to notify customers in case of a breach. See supra section IV.C.2.a(3); infra section IV.D.2.b. 728 The compliance period for larger institutions under the final amendments is 18 months from the date of publication in the Federal Register. The proposed compliance period for all covered institutions was 12 months from the effective date of the final amendments. See supra section II.F. PO 00000 Frm 00065 Fmt 4701 Sfmt 4700 47751 appreciated the approach of the proposal, which applies uniformly to the two types of covered institutions and would allow for streamlining of processes.729 Another commenter stated that bringing both sides of the entity into compliance with the proposed amendments would impose a significant burden and require a dual registrant to modify both sides of the entity’ compliance frameworks.730 We do not expect a significant burden, because we expect that these institutions could generally implement a single set of procedures to comply with many of the provisions of the final amendments, which would limit these additional burdens.731 To the extent entities registered as more than one category of covered institution arrange their business such that there are separate policies and procedures for each category, those entities may encounter additional cost burden when complying with the final amendments. For example, an entity that creates two different incident response programs for its advisory and broker-dealer operations could bear as much as twice the cost burden as the same entity would bear when creating one incident response program,732 although there may be efficiencies to the extent that development of one program informs the other. The final amendments, however, do not prevent that entity from using the same incident response program across its categories of covered institutions. In the remainder of this section, we first consider the benefits and costs associated with requiring covered institutions to have a response program generally. We then analyze the benefits and the costs of the notification requirements vis-à-vis the notification requirements already in force under the various existing State laws. We conclude this section with an analysis of the benefits and costs of the response program’s service provider provisions. a. Response Program The final amendments require covered institutions’ written policies and procedures to include a response program ‘‘reasonably designed to detect, respond to, and recover from unauthorized access to or use of 729 See FSI Comment Letter. Cambridge Comment Letter. 731 For example, we expect that these institutions will be able to implement a single set of procedures to satisfy the customer notification requirements. 732 For example, annual average costs of $30,890 associated with preparation of written policies and procedures instead of annual average costs of $15,445. See, e.g., infra footnote 856 and accompanying text. 730 See E:\FR\FM\03JNR2.SGM 03JNR2 47752 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations customer information, including customer notification procedures.’’ 733 The response program must address incident assessment, containment, as well as customer notification and oversight of service providers.734 The question of how best to structure the response to an incident resulting in unauthorized access to or use of customer information has received considerable attention from firms, IT consultancies, government agencies, standards bodies, and industry groups, resulting in numerous reports with recommendations and summaries of best practices.735 While the emphasis of these reports varies, certain key components are common across many incident response programs. For example, NIST’s Computer Security Incident Handling Guide identifies four main phases to cyber incident handling: (1) preparation; (2) detection and analysis; (3) containment, eradication, and recovery; and (4) post-incident activity.736 The assessment, containment, and notification prongs of the final policies and procedures requirements correspond to the latter three phases of the NIST recommendations. Similar analogues are found in other reports, recommendations, and other regulators’ guidelines.737 Thus, the required procedures of the incident response program are substantially consistent with industry best practices and these other regulatory documents that seek to develop effective policies and procedures in this area. While some commenters suggested that some specific provisions of the amendments be better aligned with existing regulation,738 other commenters stated that the Commission’s proposal would generally align the amendments with other regulatory frameworks such as the Banking Agencies’ Incident Response Guidance.739 One of these commenters stated that consistency across regulatory requirements facilitates firms’ operations, provides for efficiencies in their operations, and better serves customers.740 In the final amendments, we have revised some requirements from the proposal to better align them with existing regulatory framework. For example, one 733 Final rule 248.30(a)(3). final rule 248.30(a)(3). 735 See supra section IV.C.1. 736 See NIST Computer Security Incident Handling Guide. 737 See supra text accompanying footnote 604. 738 See SIFMA Comment Letter 2; Computershare Comment Letter. 739 See, e.g., ICI Comment Letter 1; Nasdaq Comment Letter. 740 See ICI Comment Letter 1. lotter on DSK11XQN23PROD with RULES2 734 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 commenter stated that a 72-hour deadline would improve alignment with other existing requirements and that this would significantly reduce complexity and compliance burdens for covered institutions and their service providers.741 Consistent with other regulatory frameworks,742 the final amendments require that covered institutions ensure that their service providers take appropriate measures to provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred.743 Similar to the written policies and procedures requirement, we expect the benefits and the costs of the response program requirements to vary across covered institutions. In general, costs will be larger for entities that do not have any related incident response programs or related policies and procedures. For those entities, costs may include needing to familiarize themselves with the new requirements, initial set-up costs for new systems to monitor when customers need to be notified, new notification systems, and development and implementation of new policies and procedures associated with response programs. Therefore, on the one hand, the effects of the requirements are likely to be small for covered institutions with a national presence who are likely to already have such programs in place.744 For such institutions, we expect direct compliance costs to be largely limited to reviews and, if needed, updates of existing policies and procedures.745 On the other hand, we expect greater benefits and costs for smaller, more geographically limited covered institutions since they are less likely to have an existing incident response program. The benefits ensuing from these institutions incorporating incident response programs to their written policies and procedures can be expected to arise from improved efficacy in notifying affected customers and—more 741 See Microsoft Comment Letter; see also supra footnote 245 and accompanying text. 742 See supra footnote 257 and accompanying text. 743 The proposed amendments instead had a requirement of 48 hours. See Proposing Release at section II.A.3. 744 In addition, as discussed above, private funds may be subject to the FTC Safeguards Rule, which requires an incident response plan. See supra footnotes 614 and 617 and accompanying text. Hence, we expect that private funds advisers that are registered with the Commission may already have an incident response plan in place. 745 We expect these reviews and updates will result in entities incurring costs generally smaller than the costs of adopting and implementing new procedures. See supra section IV.D.1. PO 00000 Frm 00066 Fmt 4701 Sfmt 4700 generally—from improvements in the manner in which such incidents are handled. The response program requirements might potentially provide substantial benefit in a specific incident, for example in the case of a data breach at an institution that does not currently have an incident response program and is unprepared to promptly respond in keeping with law and best practice. Such an institution will also bear the full costs associated with adopting and implementing procedures complying with the final amendments.746 In addition to helping ensure that customers are notified when their data are breached,747 having reasonably designed strategies for incident assessment and containment ex ante might reduce the frequency and scale of breaches through more effective intervention and improved managerial awareness, providing further indirect benefits. Any such improvements to covered institutions’ processes will benefit their customers (e.g., by reducing harms to customers resulting from data breaches), as well as the covered institutions themselves (e.g., by reducing the expected costs of handling data breaches), representing further indirect benefits of the rule. We lack data on efficacy of incident assessment, incident containment, or customer notification that would allow us to quantify the economic benefits of the final requirements, and no commenter suggested such data. Similarly, we lack data, and no commenter suggested such data, that would allow us to quantify the indirect economic costs, such as reputational cost of any potential increase in the frequency of customer notification or the indirect costs of customer information protection improvements that may be undertaken to avoid such reputational costs. In the aggregate, however, considering the amendments in the context of the baseline, these benefits and costs are likely to be limited. As we have discussed above,748 all States have previously enacted data breach notification laws with substantially similar aims and, therefore, we think it likely that many institutions have response programs to support compliance with these laws. In addition, we anticipate that larger covered institutions with a national presence—which account for the bulk of 746 See supra footnote 721 and accompanying text for a discussion of certain quantified costs associated with developing and implementing policies and procedures. See also infra section V. 747 The benefits and costs specific to the notification requirements are analyzed in detail in section IV.D.1.b below. 748 See supra section IV.C.2.a. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations covered institutions’ customers—have already developed written incident response programs consistent with the proposed requirements in most respects.749 Thus, the benefits and costs of requiring written incident response programs will be the most significant for smaller covered institutions without a national presence—institutions whose policies affect relatively few customers. In support of the proposed response program requirement, some commenters stated that response programs had benefits beyond the notification of affected individuals. One commenter stated that effective cybersecurity practices and system safeguards, including incident response and notification, were critical for the financial markets and services industry and the regulators tasked with oversight of this sector.750 Another commenter stated that the costs associated with the incident response programs and more robust notification regime served an important forcing function for entities that might otherwise not adequately invest in safeguards on the front end.751 This commenter also cited a report stating that having an incident plan is one of the steps organizations can take to protect their data.752 In addition, in support of the Proposing Release, commenters cited sources offering additional context and evidence of the benefits of incident response programs. A report cited by a commenter states that businesses with an incident response team that tested their incident response plan saw an average of $2.66 million lower breach costs compared to organizations without an incident response team and that did not test their incident response plan.753 A more 749 See supra footnote 713 and accompanying text. 750 See Google Comment Letter. EPIC Comment Letter. Potential reputational costs, and the associated potential loss of customers, that could result from customer notification will incentivize covered institutions to spend more on information safeguards. However, additional costs associated with the required response program are unlikely to provide such incentives. Once informed, the customers will have the possibility to stop doing business with covered institutions they wish to avoid. 752 See EPIC Comment Letter, citing Internet Society’s Online Trust Alliance, 2018 Cyber Incident & Breach Trends Report (July 9, 2019), available at https://www.internetsociety.org/wpcontent/uploads/2019/07/OTA-Incident-BreachTrends-Report_2019.pdf. 753 See Better Markets Comment Letter. The commenter cited the 2022 IBM Cost of Data Breach Report which finds that the cost of a data breach for organizations without an incident response team and that did not test their incident response plan was $5.92 million, while the costs for organizations with an incident response team that tested its incident response plan was $3.26 million. Equivalent numbers are not available in the 2023 version of the report. lotter on DSK11XQN23PROD with RULES2 751 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 recent version of the same report states that businesses which both had an incident response team and tested their incident response plan took 54 fewer days to identify and contain a data breach, compared to businesses that did not have a response team nor test their incident response plan (252 days as compared to 306 days).754 This information generally supports our view that incident response programs will have benefits for both covered institutions and their customers. However, because the amendments’ requirements differ from those analyzed in these reports, we are unable to use these estimates to precisely quantify the benefits of the amendments in terms of prevention of and response to data breach incidents involving customer information. Nevertheless, to the extent that different reasonably designed incident response programs yield benefits of similar magnitudes, the final amendments will have benefits of similar magnitude for the covered institutions that do not currently have an incident response program in place, with associated benefits for the customers of these institutions. b. Notification Requirements The final requirements provide for a Federal minimum standard for data breach notification, applicable to the sensitive customer information of all customers of covered institutions (including customers of other financial institutions whose information has been provided to a covered institution),755 regardless of their state of residence. The information value of a data breach notification standard is a function of its various provisions and how these provisions interact to provide customers with thorough, timely, and accurate information about how and when their information has been compromised. Customers receiving notices that are more thorough, timely, and accurate have a better chance of taking effective remedial actions, such as placing holds on credit reports, changing passwords, and monitoring account activity.756 These customers will also be better able to make informed decisions about whether to continue to do business with institutions that have been unable to prevent their information from being 754 See 2023 IBM Cost of Data Breach Report. final rule 248.30(d)(5)(i). 756 Commenters agreed that a breach notification allows customers to take mitigating actions limiting the negative effects of a breach. See, e.g., EPIC Comment Letter. One commenter also stated that the value of any required disclosure depended largely on the extent to which it conveyed clear, comprehensible, and usable information. See Better Markets Comment Letter. 755 See PO 00000 Frm 00067 Fmt 4701 Sfmt 4700 47753 compromised. Similarly, non-customers who learn of a data breach, for example from individuals notified as a result of the final amendments, might use this information to evaluate their potential use of a covered institution. As discussed above, all 50 States and the District of Columbia already have data breach notification laws that apply, in varying ways, to compromises of their residents’ information.757 Thus, the benefits of the adopted Federal minimum standard for notification of customers (vis-à-vis the baseline) will vary depending on each customer’s State of residence, with the greatest benefits accruing to customers that reside in States with the least informative customer notification requirements.758 Unfortunately, with the data available, it is not practicable to decompose the marginal contributions of the various State law provisions to the overall ‘‘strength’’ of State data breach laws. Consequently, it is not possible for us to quantify on a state-bystate basis the benefits of the adopted Federal minimum standard to customers residing in the various States. In considering the benefits of the final notification requirement, we limit consideration to the ‘‘strength’’ of individual provisions of the final amendments vis-à-vis the corresponding provisions under State laws and consider the number of customers that might potentially benefit from each. Similarly—albeit to a somewhat lesser extent—the costs to covered institutions will also vary depending on the geographical distribution of each covered institution’s customers. Generally, the costs associated with the final amendments will be greater for covered institutions whose customers reside in States with less informative customer notification laws than for those whose customers reside in States with broader and more informative notification laws. In particular, smaller covered institutions whose customers are concentrated in States where State data breach laws result in less informative customer notification are likely to face higher costs since they may have to issue additional notices to comply with the amendments. The costs 757 See supra section IV.C.2.a. In addition, some covered institutions may be required to share information with certain individuals about certain events under other Federal regulations such as Regulation SCI or the Banking Agencies’ Incident Response Guidance. See supra section IV.C.2.b. 758 In some cases, large benefits could also accrue to customers that reside in States with broader and more informative breach notification laws if they reside in States where such laws are not applicable to entities in compliance with the GLBA. See infra section IV.D.1.b(1). E:\FR\FM\03JNR2.SGM 03JNR2 47754 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 associated with notice issuance comprise both administrative costs and reputational costs. Certain costs arising from notice issuance are covered in the Paperwork Reduction Act analysis in section V and are estimated to be on average $5,178 per year per covered institution.759 We lack data, and no commenter suggested such data, that would allow us to quantify the reputational cost resulting from any potential increase in the frequency of customer notification or the indirect costs of customer information protection improvements that may be undertaken by covered institutions to avoid such reputational costs. Although some commenters stated that a Federal notification requirement was not needed given existing State law requirements,760 other commenters supported this proposed provision.761 One commenter stated that a significant advantage would be that in several States, it would relieve covered institutions from having to issue statespecific breach notices under State law.762 Another commenter further stated that a Federal breach notification requirement ‘‘would satisfy State notice laws that provide exemptions for firms subject to such a requirement, which will help to a degree to reduce the confusion and notification burdens arising from the patchwork of State data breach notification requirements.’’ 763 Another commenter stated that the benefits of a Federal minimum standard would outweigh the burden of the new notification requirements.764 In the rest of this section, we consider key provisions of the final notification requirements, their potential benefits to customers (vis-à-vis existing State notification laws), and their costs. 759 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $3,862 per year per covered institution. See infra section V. 760 See, e.g., CAI Comment Letter (stating that the proposed amendments’ requirements ‘‘would simply add another layer on top of these existing requirements and would likely go entirely unnoticed by consumers, while complicating compliance efforts for covered institutions and raising additional compliance and legal risk’’). We disagree with these commenters and discuss in detail in the subsections below the benefits of different provisions of the notification requirements over the baseline. 761 See, e.g., ICI Comment Letter 1; IAA Comment Letter 1. 762 See ICI Comment Letter 1. 763 See IAA Comment Letter 1; see also supra footnote 557 and accompanying text. Another commenter stated that the proposed notification requirements would not replace State law requirements and that covered institutions would continue to have to comply beyond the Federal minimum standard for at least 20 States. See FSI Comment Letter. 764 See FSI Comment Letter. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 (1) GLBA Safe Harbors A number of State data breach laws provide exceptions to notification for entities subject to and in compliance with the GLBA. These ‘‘GLBA Safe Harbors’’ may result in customers not receiving any data breach notification from registered investment advisers, broker-dealers, funding portals, investment companies, or transfer agents. The final amendments will help ensure customers receive notice of breach in cases where they may not currently because notice is not required under State law. Based on an analysis of State laws, we found that 19 States provide a GLBA Safe Harbor.765 Together, these States account for 24 percent of the U.S. population, or approximately 17 million potential customers who may benefit from this provision.766 While we do not have data on the exact geographical distribution of customers across all covered institutions, we are able to identify registered investment advisers whose customers reside exclusively in GLBA Safe Harbor States.767 We estimate that there are 679 such advisers, representing 4.4 percent of the registered adviser population, and that these advisers represent in total more than 97,000 clients.768 We expect that a similar percentage of broker-dealers would be found to be operating exclusively in GLBA Safe Harbor States. Changing the effect of the GLBA Safe Harbors is not likely to impose significant direct compliance costs on most covered institutions. For the reasons outlined above, many covered institutions have customers residing in States without a GLBA Safe Harbor and we therefore expect them to have existing procedures for notifying customers under State law. Additionally, some jurisdictions require 765 States with exceptions that specifically mention the GLBA include Arizona, Connecticut, the District of Columbia, Delaware, Iowa, Kentucky, Maryland, Minnesota, Missouri, Nevada, New Mexico, Oregon, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Virginia, and Wisconsin. Additional States have exceptions for compliance with a primary Federal regulator, as discussed supra. 766 Estimates of the numbers of potential customers are based on State population adjusted by the percentage of households reporting direct stock ownership (21%). See U.S. Census Bureau, Apportionment Report (2020), available at https:// www2.census.gov/programs-surveys/decennial/ 2020/data/apportionment/apportionment-2020table01.xlsx (last visited Apr. 12, 2024); see also Federal Reserve Board, Survey of Consumer Finances (2022), available at https:// www.federalreserve.gov/econres/scfindex.htm (last visited Apr. 9, 2024). 767 Based on Form ADV, Item 2.C as of Oct. 5, 2023; see also supra footnote 655. 768 Based on Form ADV, Item 5.D as of Oct. 5, 2023; see also supra footnote 650. PO 00000 Frm 00068 Fmt 4701 Sfmt 4700 notification policies or actual notification as condition of the safe harbor.769 However, covered institutions whose customer base is limited to GLBA Safe Harbor States may not have implemented any procedures to notify customers in the event of a data breach. These covered institutions may face higher costs than entities with some notification procedures already in place, but the customers of these institutions will benefit the most from the final amendments by receiving notice they may not have otherwise received. One commenter agreed that some State laws provided exemptions from their notice requirements under the GLBA but disagreed that this implied benefits for the amendments, stating that the proposed amendments would not preempt State notification requirements and would instead add another variation on existing requirements to be accounted for by covered institutions, with limited real benefits to affected individuals.770 The final amendments will create new and to various extents different notification requirements for covered institutions with customers residing in States without GLBA exemptions. However, we disagree with this commenter’s assertion that benefits to affected individuals will be limited. As discussed above, State laws vary in detail from State to State.771 We discuss below how the final amendments will impose a Federal minimum standard for customer notification and how we expect this standard to benefit customers. (2) Accelerated Timing of Customer Notification The final amendments require covered institutions to provide notice to customers in the event of some data breaches as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.772 As discussed in section IV.C.2.a, existing State laws vary in terms of notification timing. Most States (31) do not include a specific deadline for 769 See, e.g., D.C. Code section 28–3852(g). CAI Comment Letter (‘‘Although some state laws do provide exemptions from their state specific notice requirements where a notice is provided consistent with requirements under the Gramm-Leach Bliley Act (GLBA), most do not. This proposed new requirement would not serve to preempt those generally applicable state notice requirements, and would not establish a new singular standard. It would just be another variation on existing requirements to be accounted for, with limited real benefit to affected individuals.’’). 771 See supra section IV.C.2.a. 772 See final rule 248.30(a)(4)(iii). 770 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations notifying customers, but rather require that the notice be given in an expedient manner and/or that it be provided without unreasonable delay. These States account for 60 percent of the U.S. population, with approximately 42 million potential customers residing in these States.773 Four States have a 30day deadline; we estimate that close to 8 million potential customers reside in these States. The remaining 16 States provide for longer notification deadlines. For the estimated 20 million potential customers residing in these 16 States, the final amendments’ 30-day outside timeframe might tighten the notification timeframes.774 In addition, the 30-day outside timeframe is likely to tighten notification timeframes for the approximately 42 million potential customers residing in States with no specific deadline. Even though the timing language in State laws without specific deadlines generally suggests that notices must be prompt, we have evidence that the notices are frequently sent significantly later than 30 days after the affected institution learns of the breach. The Proposing Release references data from California and Washington, which we explain in more detail below. California requires that such notice be given ‘‘in the most expedient time possible and without unreasonable delay.’’ 775 Nevertheless, data from the California Office of the Attorney General, regarding notices sent to more than 500 California residents for any one incident, indicate that for the notices for which these data are available, the average time from discovery to notification was 144 days in 2022, and 91 percent of these notices were sent later than 30 days after the discovery of the breach.776 Hence, we expect that the 773 See supra Figure 2; see also supra footnote lotter on DSK11XQN23PROD with RULES2 767. 774 State deadlines are either 30, 45, or 60 days, but differ in terms of triggers of those deadlines; see supra Figure 3. 775 See Cal. Civil Code section 1798.82. 776 This analysis was performed using data from the State of California Department of Justice, Office of the Attorney General, Search Data Security Breaches (2023), available at https://oag.ca.gov/ privacy/databreach/list (last visited Apr. 8, 2024). California law requires that a sample copy of a breach notice sent to more than 500 California residents be provided to the California Attorney General. Four-hundred fifty-six such notices were reported in the year of 2022. Of those notices, 164 (36%) included both the date of the discovery of the breach and the date the notice was sent to affected individuals. For those 164 notices, the average number of days between discovery and notice was 144 and the median number of days was 107. One hundred fifty of these notices (91%) were sent more than 30 days after discovery. The minimum number of days was 0 and the maximum was 538. The Proposing Release cited an average number of days between discovery and notice of 197 (for calendar VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 aggregate effects of a 30-day notification outside timeframe might be significant for the 42 million potential customers residing in States with no specific deadline.777 In addition, because the final amendments will not provide for broad exceptions to the 30-day notification requirement,778 in many cases the amendments will tighten notification timeframes even for the 8 million potential customers residing in States with a 30-day deadline. For example, in Washington, the State law requires that the notice be given ‘‘without unreasonable delay, and no more than thirty calendar days after the breach was discovered.’’ 779 However, the law also allows for a delay ‘‘at the request of law enforcement’’ or ‘‘due to any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.’’ 780 Data from the Washington Attorney General’s Office indicate that for the notices for which these data are available, the average time from discovery to notification was 137 days in 2022 and the median time was 93 days.781 Eightyseven percent of these notices were sent later than 30 days after the discovery of the breach, presumably as a result of these exceptions.782 Hence, we expect year 2021). The correct number should be 97. This change would not have affected the Commission’s assessment, in the Proposing Release, that there would be substantial economic benefits from a new notification deadline in an amended Regulation S– P, as both estimates are substantially larger than 30 days. 777 The final amendments’ 30-day notification timeframe starts when a covered institution becomes aware that unauthorized access to or use of customer information has occurred or is likely to have occurred. See final rule 248.30(a)(4)(iii). The analysis performed here relies instead on an entity’s description of when it discovered or became aware of a breach, which could refer to a different point in time. 778 See supra footnote 544 and accompanying text. 779 See RCW 19.255.010(8). 780 See RCW 19.255.010(8). 781 This analysis was performed using data from the Washington State Office of the Attorney General, Data Breach Notifications, available at https://www.atg.wa.gov/data-breach-notifications (last visited Apr. 8, 2024). Washington law requires that any business, individual, or public agency that is required to issue a security breach notification to more than 500 Washington residents as a result of a single security breach shall electronically submit a single sample copy of that security breach notification. One hundred and eighty-five such notices were reported in the year 2022. For 121 (65%) of those notices, data is available for both the date of the discovery of the breach and the date the notice was sent to affected individuals. For those 121 notices, the average number of days between discovery and notice was 137 and the median number of days was 93. One hundred four notices (87%) were sent more than 30 days after discovery. The minimum number of days was 4 and the maximum was 651. 782 These numbers should be interpreted with care, since what different firms describe as the time PO 00000 Frm 00069 Fmt 4701 Sfmt 4700 47755 that the timing requirements of the final amendments will result in many notices being sent earlier even in some States with a 30-day deadline. Tighter notification deadlines should increase customers’ ability to take effective measures to counter threats resulting from their sensitive information being compromised. Such measures may include placing holds on credit reports or engaging in more active monitoring of account and credit report activity. In practice, however, when it takes a long time to discover a data breach, a relatively short delay between discovery and customer notification may have little impact on customers’ ability to take effective countermeasures.783 Based on the data from the California Office of the Attorney General, the average number of days between the start of a breach and its discovery was 46 days in 2022, with a median of 7 days and a standard deviation of 126 days.784 In addition, data from the Washington Attorney General’s Office show that in 2022, there were on average 94 days between the time a breach occurred and its discovery, with a median of 10 days and a standard deviation of 319 days.785 at which they ‘‘discover’’ a breach could vary. See also supra footnote 778. 783 In other words, the utility of a notice is likely to exhibit decay. For example, if a breach is discovered immediately, the utility of receiving a notification within 1 day is considerably greater than the utility of receiving a notification in 30 days. However, if a breach is discovered only after 200 days, the difference in expected utility from receiving a notification on day 201 versus day 231 is smaller: with each passing day some opportunities to prevent the compromised information from being exploited are lost (e.g., unauthorized wire transfer), with each passing day opportunities to discover the compromise grow (e.g., noticing an unauthorized transaction), and with each passing day the compromised information becomes less valuable (e.g., passwords, account numbers, addresses, etc., generally change over time). 784 See supra footnote 777 describing the methodology. Many breaches, for example in the case of ransomware attacks or compromises of physical equipment, are discovered on the day that they happen or shortly thereafter. 785 See supra footnote 782 describing the methodology. A few factors could influence the estimated length of time between a breach and its discovery by the notifying entity. First, the two States discussed here (California and Washington) require firms to report the date on which the breach started. In instances where firms do not know this information, they could report the discovery date instead. This would result in an underestimate of the time between when a breach occurs and its discovery. Second, as discussed above, different firms could interpret the meaning of discovery differently. See supra footnote 783. Third, the discovery date used for this estimate is the date on which the notifying entity discovers the breach. If the breach happened at a service provider, it is possible that the service provider discovered the breach earlier and notified its client later. Hence, the numbers reported here likely overestimate the E:\FR\FM\03JNR2.SGM Continued 03JNR2 47756 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations This suggests that time to discovery is likely to prevent issuance of timely customer notices in many but not all cases. As plotted in Figure 9, while some firms take many months—even years—to discover a data breach, others do so in a matter of days: 66 percent of firms were able to detect a breach within 2 weeks and 77 percent were able to do so within 30 days.786 Thus, 100 0 200 300 Days to Identify Breach while the adopted 30-day notification outside timeframe may not always substantially improve the timeliness of customer notices, in many cases it may improve timeliness. 400 While we do not expect that the 30day outside timeframe for customer notification will impose significant direct costs relative to a longer timeframe (or relative to having no fixed timeframe), the shorter outside timeframe might potentially lead to indirect costs arising from notification potentially interfering with incident containment efforts. Based on data from the Washington Attorney General’s Office for the fiscal year of 2022, ‘‘containment’’ of data breaches generally occurs quickly—7.6 days on average.787 However, according to IBM’s study for 2022, it takes an average of 70 days to ‘‘contain’’ a data breach.788 The discrepancy suggests that there exists some ambiguity in the interpretation of ‘‘containment,’’ raising the possibility that the 30-day notification outside timeframe might require customer notification to occur before some aspects of incident containment have been completed and potentially interfering with efforts to do so.789 amount of time the affected entity took to discover the breach when the breach affected an entity different from the notifying entity. For comparison, according to IBM, in 2023 it took an average of 207 days to identify a data breach. See 2023 IBM Cost of Data Breach Report. 786 Based on data from the State of California Department of Justice, Office of the Attorney General. See supra footnote 777; footnote 785 and accompanying text. The equivalent numbers for Washington are 56% and 73%, based on data from the Washington State Office of the Attorney General. See supra footnote 782; footnote 786 and accompanying text. 787 In the data provided by the Washington Attorney General, ‘‘containment’’ (data field DaysToContainBreach) is defined as ‘‘the total number of days it takes a notifying entity to end the exposure of consumer data, after discovering the breach.’’ See supra footnote 782. 788 In the IBM study, ‘‘containment’’ refers to ‘‘the time it takes for an organization to resolve a situation once it has been detected and ultimately restore service.’’ See 2022 IBM Cost of Data Breach Report. We use the 2022 average here (70 days) to align with the date of the Washington and California State data, but note that IBM reports for 2021 and 2023 reported averages of 75 and 73 days, respectively. See Proposing Release at n.466; 2023 IBM Cost of Data Breach Report. Some of the discrepancy may be due to variation in how entities report the date at which the breach started in the data for Washington; see supra footnote 786. 789 For example, the notice may prompt the attacker to accelerate efforts to obtain or use sensitive information before the vulnerability can be completely contained. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 PO 00000 Frm 00070 Fmt 4701 Sfmt 4700 E:\FR\FM\03JNR2.SGM 03JNR2 ER03JN24.009</GPH> lotter on DSK11XQN23PROD with RULES2 Figure 9: Cumulative distribution of the number of days between a breach and its discovery based on breaches reported in California in 2022. Data source: State of California Department of Justice, Office of Attorney General. Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 Some commenters opposed the proposed timeframe for customer notifications.790 One commenter stated that the proposed outside timeframe of 30 days after becoming aware of a breach was insufficient time to provide a meaningful notification to impacted individuals, particularly in complex cases.791 Another commenter stated that the proposed 30-day outside timeframe was ‘‘unjustified and arbitrary’’ and that it was ‘‘likely to be insufficient for proper investigation and notification.’’ 792 Another commenter stated that the proposed timing requirement was overly rigid and did not account for the wide variety and complexity of cybersecurity incidents, and that 30 days after becoming aware of a possible incident was not enough time to accomplish the many steps required to be able to issue notifications to affected individuals.793 This commenter detailed these steps as ‘‘needing to respond to and remediate the security incident directly, conduct a forensic investigation to determine what information may have been affected, analyze the affected data to determine what sensitive customer information is contained in affected data, extract or obtain the information needed to make notification to affected users, hire vendors and arrange identity protection services for affected individuals, and actually send the notifications.’’ 794 These commenters, as well as other commenters, suggested longer or less specific timeframes.795 A different commenter instead stated that the final required timeframe should not be longer than 30 days, citing an article stating that ‘‘an analysis of the current State data breach notification laws shows that requiring notification within thirty days of a breach to affected consumers would be appropriate.’’ 796 790 See, e.g., ACLI Comment Letter; IAA Comment Letter 1. 791 See ACLI Comment Letter. See also Cambridge Comment Letter; IAA Comment Letter 1. 792 See Federated Comment Letter. 793 See CAI Comment Letter. 794 See CAI Comment Letter. 795 See, e.g., FSI Comment Letter (‘‘We recommend that the notification requirement under Reg S–P be revised from ‘as soon as practicable, but not later than 30-days’ to ‘as soon as practicable, but not later than 60-days’ after a firm becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to occur.’’); Cambridge Comment Letter (‘‘A period of, for example, 60 days would be more realistic, while achieving the Proposals’ same goals.’’); IAA Comment Letter 1 (‘‘We recommend a 45-day rather than a 30-day notification requirement to provide a more reasonable amount of time for advisers to perform investigation and risk assessments, collect the information necessary to include in client notices, and provide notices in complex cases.’’). 796 See Better Markets Comment Letter, citing Gregory S. Gaglione Jr., The Equifax Data Breach: VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 This article further adds that a ‘‘thirtyday time limit will give an organization ample time to conduct a full investigation’’ and ‘‘ensure that consumers are notified of a breach in a timely manner so they can take the proper steps to mitigate any losses and protect their personal information from further exposure to cybercriminals through credit freezes, credit monitoring, and the like.’’ The same commenter suggested that the deadline be shortened to 14 days after becoming aware of an incident.797 After considering these comments, we are adopting the notification timeframe as proposed. Under the final amendments, covered institutions will be required to provide notice to affected customers as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. Commenters stated that this notification timeframe may result in customers receiving notices that are less accurate or receiving some notices that are unnecessary. The final amendments’ notification timeframe may, in some cases, result in customers receiving less informative notices than they would have received under a longer notification timeframe, since covered institutions will have less time to understand the incident before sending the notice. This 30-day timeframe may also result in instances where a notification will be sent but, had the covered institution been able to fully investigate the breach in the prescribed timeframe, the covered institution would have been able to determine that notification was not required.798 If unnecessary notifications are sent, as commenters suggest could occur, these instances may result in customers taking unnecessary mitigating actions, and the costs of these actions will be a cost of the final amendments.799 These instances will also result in additional costs associated with customer notification, such as administrative costs related to preparing and distributing notices and potential reputational costs (including indirect costs of customer information protection improvements that may be undertaken An Opportunity to Improve Consumer Protection and Cybersecurity Efforts in America, 67 Buff. L. Rev. 1133 (2019). 797 See Better Markets Comment Letter. 798 Longer investigations are likely to correlate with more complicated incidents and are less likely to result in a determination that notice is not required. We therefore do not expect that a longer notification outside timeframe would have led to significantly fewer required notices. 799 See infra section IV.D.1.b(4) for a discussion of the effect of unnecessary notification. PO 00000 Frm 00071 Fmt 4701 Sfmt 4700 47757 to avoid such reputational costs) for covered institutions; we have accounted for these additional costs associated with notification in our estimates of some of the costs arising from notice issuance.800 However, the 30-day notification timeframe preserves the benefits of the proposed, relatively short notification timeframe and allows customers to take rapid and effective mitigating actions.801 In some circumstances, requiring customers to be notified within 30 days may hinder law enforcement investigation of an incident by potentially making an attacker aware of the attack’s detection.802 It could also make other threat actors aware of vulnerabilities in a covered institution’s systems, which they could then try to exploit. The final amendments allow a covered institution to delay notification of customers if the Attorney General determines that the notice required poses a substantial risk to national security or public safety and notifies the Commission of such determination in writing.803 The main benefit of this delay is to decrease the likelihood of the potential situations described above where law enforcement is hindered. The delay might, in some cases, lead to a better protection of national security and public safety. Another benefit of the delay is that it might give covered institutions more time to assess the scope of the incident and gather the information to be included in the notice to customers in particularly complex cases. However, the delay provisions might also, in some cases, result in customers being notified later, which 800 Certain costs arising from notice issuance are covered in the Paperwork Reduction Act analysis in section V and are estimated to be on average $5,178 per year per covered institution. This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $3,862 per year per covered institution. See infra section V. We have increased these estimates from the proposal in response to commenters. See infra section V. 801 We have further reviewed, in response to commenters, evidence that customers prefer an early notification. A survey of U.S. individuals found that notifying customers immediately was one of main steps the respondents would recommend to firms after a data breach, providing evidence that extending the timeframe is likely to therefore reduce the benefits of the notification requirement. See Lillian Ablon et al., Consumer Attitudes Toward Data Breach Notifications and Loss of Personal Information, RAND Corporation (2016), available at https://www.rand.org/pubs/ research_reports/RR1187.html. Customers who receive notices faster are better able to take appropriate mitigating actions. 802 The attacker could then work to remove evidence on the covered institution’s systems, thereby making the identity of the attacker harder to uncover by law enforcement. 803 See final rule 248.30(a)(4)(iii). E:\FR\FM\03JNR2.SGM 03JNR2 47758 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations would decrease the benefits of such notification, as described above.804 Where investigations do not rise to the level of meeting the prescribed conditions for delayed notification, customer notification could alert attackers that their intrusion has been detected and could potentially impact law enforcement’s investigation. Because we do not have data on the frequency with which an investigation will rise to the level of meeting the final amendments’ conditions for delayed notification, and because we do not have data on the scope of the effect on national security or public safety of breaches being revealed to the attackers, nor did commenters identify such data, we are unable to precisely estimate the costs and benefits of this provision. However, we expect that such events will be relatively rare.805 (3) Broader Scope of Information Triggering Notification In the final amendments, ‘‘sensitive customer information’’ is defined more broadly than in most State laws, yielding a customer notification trigger that is broader in scope than the various State law notification triggers included under the baseline.806 The broader scope of information triggering the notice requirements will cover more data breaches impacting customers than the notice requirements under the baseline. This broader scope might benefit customers who will be made aware of more cases where their information has been compromised. At the same time, the broader scope might lead to false alarms—cases where the ‘‘sensitive customer information’’ divulged does not ultimately harm the customer. Such false alarms might be problematic if they reduce customers’ responsiveness to data breach notices. In addition, the scope will also likely 804 See supra text following footnote 783. SIFMA comment letter 2 (‘‘The Commission should be aware that under present practice and experience, the number of cases where delay is requested or mandated by other government entities, or court orders, is quite limited—so the SEC need not assume or fear that notification delays would become routine or be otherwise abused.’’). In addition, the State of California requires that, if a notice sent to individuals affected by a breach was delayed at the request of law enforcement agency, the notice mention such delay. See Cal. Civil Code section 1798.82. Of the 456 notices reported in 2022, only 4 indicated that they were delayed at the request of law enforcement. See supra footnote 777 for a description of these data. Because the final amendments’ conditions for a notification delay are stricter than those under California law, we expect that the frequency at which covered institutions will delay notifications for national security and public safety reasons will be even lower. 806 See final rule 248.30(d)(9) and supra section IV.C.2.a(1). lotter on DSK11XQN23PROD with RULES2 805 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 imply additional costs for covered amendments will significantly enhance the notification requirements applicable institutions, which may need to adapt to these customers. their processes for safeguarding States adopting enhanced definitions information to encompass a broader for information triggering notice range of customer information and may requirements extend the basic definition need to issue additional notices.807 to include username/password and In the final amendments, ‘‘sensitive username/security question customer information’’ is defined as combinations.812 These definitions may ‘‘any component of customer also include additional enumerated information alone or in conjunction items whose compromise (when linked with any other information, the with the customer’s name) can trigger compromise of which could create a the notice requirement (e.g., biometric reasonably likely risk of substantial harm or inconvenience to an individual data, tax identification number, and identified with the information.’’ 808 The passport number).813 For the estimated 55 million potential customers residing definition’s basis in ‘‘any component of customer information’’ creates a broader in the States with enhanced definitions,814 the benefits from the scope than under State notification final amendments will be somewhat laws. In addition to identification more limited. However, even for these numbers, PINs, and passwords, many customers, the amendments will tighten other pieces of nonpublic information the effective notification requirement. have the potential to satisfy this There are many pieces of information standard. For example, many financial not covered by the enhanced definitions institutions have processes for whose compromise might potentially establishing identity that require the lead to substantial harm or user to provide a number of pieces of information that—on their own—are not inconvenience. For example, under California law, the compromise of especially sensitive (e.g., mother’s information such as a customer’s email maiden name, name of a first pet, make address in combination with a security and model of first car), but which— question and answer would only trigger together—could allow access to a customer’s account. The compromise of the notice requirement if that information would—in itself—permit some subset of such information will access to an online account. Under thus potentially require a covered institution to notify customers under the many such State laws, the compromise of information such as a customer’s final amendments. name, combined with his or her The definitions of information transaction history, account balance, or triggering notice requirements under other information not specifically State laws are generally much more enumerated would not necessarily circumscribed and can be said to fall trigger the notice requirement. into one of two types: basic and The broader scope of information enhanced. Basic definitions are used by triggering a notice requirement under 14 States, which account for 21 percent the final amendments will benefit of the U.S. population.809 In these customers. As discussed above, many States, only the compromise of a pieces of information not covered under customer’s name together with one or State data breach laws could, when more enumerated pieces of information compromised, cause substantial harm or triggers the notice requirement. inconvenience. Under the amendments, Typically, the enumerated information data breaches involving such is limited to Social Security number, a information might require customer driver’s license number, or a financial notification in cases where State law account number combined with an does not, and thus potentially increase access code. For the estimated 15 customers’ ability to take actions to million potential customers residing in mitigate the effects of such breaches. At 810 these States, a covered institution’s the same time, there is some risk that compromise of the customer’s account the broader minimum standard will lead login and password would not to notifications resulting from data necessarily result in a notice, nor would compromises that—while troubling—are a compromise of his credit card number ultimately less likely to cause and PIN.811 Such compromises could substantial harm or inconvenience.815 A nonetheless lead to substantial harm or inconvenience. Thus, the final 812 See supra section IV.C.2.a(1). 807 Estimates of certain costs related to notice issuance are discussed in section V. 808 Final rule 248.30(d)(9). 809 See supra section IV.C.2.a(1). 810 See supra footnote 767. 811 See supra text accompanying footnote 532. PO 00000 Frm 00072 Fmt 4701 Sfmt 4700 813 See id. supra footnote 767. 815 This may be the case even though the amendments include an exception from notification when the covered institution determines, after investigation, that the sensitive customer information has not been, and is not reasonably 814 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 large number of such unnecessary notices might undermine the effectiveness of the notice regime.816 The broader minimum standard for notification is likely to result in higher costs for covered institutions. There will be increased administrative costs related to preparing and distributing notices for covered institutions who will send out additional notices as a result of the scope of information triggering a notice requirement under the final amendments. As discussed below, we estimate that certain costs associated with the preparation and distribution of notices will be, on average, $5,178 per year per covered institution.817 In addition, it is possible that covered institutions have developed processes and systems designed to provide enhanced information safeguards for the specific types of information enumerated in the various State laws. For example, it is likely that IT systems deployed by financial institutions only retain information such as passwords or answers to security questions in hashed form, reducing the potential for such information to be compromised. Similarly, it is likely that such systems limit access to information such as Social Security numbers to a limited set of employees. It may be costly for covered institutions to upgrade these systems to expand the scope of enhanced information safeguards.818 In some cases, it may be impractical to expand the scope of such systems. For example, while it may be feasible for covered institutions to strictly limit access to Social Security numbers, passwords, or answers to secret questions, it may not be feasible to apply such limits to account numbers, transaction histories, account balances, related accounts, or other potentially sensitive customer information. In these cases, the adopted minimum standard might not have a significant prophylactic effect and might lead to an likely to be, used in a manner that would result in substantial harm or inconvenience. For example, the covered institution could decide to forgo investigations and always notify, or it could investigate but not reach a conclusion that satisfied the terms of the exception. 816 See infra section IV.D.1.b(4) for a discussion of the effects of notification specifically. 817 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $3,862 per year per covered institution. See infra section V. 818 We lack data, and no commenter suggested such data, that would allow us to quantify the indirect costs resulting from any potential upgrade to customer information safeguards that covered institutions could choose to implement as a result of the final amendments in order to avoid potential reputational costs associated with customer notification following a breach. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 increase in reputation and litigation costs for covered institutions resulting from more frequent breach notifications. Furthermore, because the definition of sensitive customer information is based on a determination that the compromise of this information could create a ‘‘reasonably likely risk of substantial harm or inconvenience to an individual identified with the information,’’ 819 it could increase costs related to incident evaluation, outside legal services, and litigation risk. While we lack data, and no commenter suggested such data, that would allow us to quantify all of these costs, we discuss below certain costs associated with developing and implementing policies and procedures to comply with the final amendments, including costs for internal and external counsel.820 This subjectivity could reduce consistency in the propensity of covered institutions to provide notice to customers, reducing the utility of such notices in customers’ inferences about covered institutions’ safeguarding efforts. Some commenters opposed the proposed amendments’ definition of sensitive customer information, suggesting either a better alignment with existing regulation,821 or that the final amendments specify a list of customer information included in the definition.822 Covered institutions will have to devote some resources determining what specific pieces of information are included in the scope of the final notification requirements. However, different types of covered institutions may keep different types of customer information, the information collected by covered institutions might change in the future, and the type of information that could create a reasonably likely risk of substantial harm or inconvenience to an individual might also change in the future. Thus, having a wide and general range of sensitive customer information trigger the amendments’ notice requirement will provide benefits to the affected customers, who may not receive a notice under the baseline. In addition, as discussed above, existing regulations adopt widely different definitions of customer information triggering a breach notification, making alignment difficult.823 819 Final rule 248.30(d)(9). See supra section II.A.3.c; infra section IV.D.1.b(4). 820 See infra section V. 821 See Computershare Comment Letter; ICI Comment Letter 1; SIFMA Comment Letter 2. 822 See CAI Comment Letter; SIFMA Comment Letter 2. 823 See supra section IV.C.2.a(1). PO 00000 Frm 00073 Fmt 4701 Sfmt 4700 47759 (4) Notification Trigger The final amendments include a requirement for a covered institution to provide notice to individuals whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, the covered institution has determined that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.824 As discussed above, the final amendments reflect a presumption of notification: a covered institution must provide a notice unless it determines notification is not required following a reasonable investigation.825 Moreover, if the covered institution is unable to determine which customers are affected by a data breach, a notice to all potentially affected customers is required.826 The resulting presumptions of notification are important because although it is usually possible to determine what information could have been compromised in a data breach, it is often not possible to determine what information was compromised or to estimate the potential for such information to be used in a way that is likely to cause harm.827 Because of this, it may not be feasible to establish the likelihood of sensitive customer information being used in a manner that would result in substantial harm or inconvenience or of sensitive customer information pertaining to a specific individual being accessed or used without authorization. Consequently, in the absence of the presumptions of notification, it may be possible for covered institutions to avoid notifying customers in cases where it is unclear what information was compromised or whether sensitive customer information was or is reasonably likely to be used in 824 See final rule 248.30(a)(4)(i). supra section II.A.3. A covered institution’s determination that there is no risk of harm or inconvenience may also take into consideration whether the compromised data was encrypted. See supra section II.A.3.b. We expect that this could mitigate the risk of unnecessary notification. We considered a safe harbor from the definition of sensitive customer information for encrypted information. See infra section IV.F.3. 826 See final rule 248.30(a)(4)(ii); see also supra section II.A.3.a. 827 Many covered institutions, especially smaller investment advisers and broker-dealers, are unlikely to have elaborate software for logging and auditing data access. For such entities, it may be impossible to determine what specific information was exfiltrated during a data breach. 825 See E:\FR\FM\03JNR2.SGM 03JNR2 47760 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations a manner that would result in substantial harm or inconvenience. Currently, 20 States’ notification laws do not include a presumption of notification.828 We do not have data with which to estimate reliably the effect of these presumptions on the propensity of covered institutions to issue customer notifications, and no commenter suggested such data. However, we expect that for the estimated 20 million potential customers residing in the 20 States without a presumption of notification,829 some notifications that will be required under the final amendments would not occur under the baseline. Thus, we anticipate that the final amendments will improve these customers’ ability to take actions to mitigate the effects of data breaches. In addition, the final amendments’ presumptions for notification rest on a concept of ‘‘substantial harm or inconvenience’’ that is likely to be wider than the equivalent concept of ‘‘harm’’ used in some State laws.830 Hence, we also expect that the presumptions of notification will have potential benefits even for the customers residing in some of the States with a presumption of notification. The increased sensitivity of the notification trigger resulting from the presumptions of notification will result in additional costs for covered institutions, who will bear higher reputational costs (including indirect costs of customer information protection improvements that may be undertaken to avoid such reputational costs) as well as some additional direct compliance costs (e.g., mailing notices, responding to customer questions, etc.) due to more breaches requiring customer notification. While we are unable to quantify all of these additional costs,831 we estimate that certain costs associated with the preparation and distribution of 828 See supra section IV.C.2.a(1). id.; see also supra footnote 767. 830 See supra section II.A.3.c for a discussion of the concept of ‘‘substantial harm or inconvenience.’’ Some states use a narrower definition of harm, for example including only fraud or financial harm. See supra section IV.C.2.a(1); see also Fla. Stat. section 501.171(4)(c) and Iowa Code section 715C.2(6) for examples of States with a presumption for notification but a narrower concept of harm. 831 As stated above, we do not have data with which to estimate reliably the effect of these presumptions on the propensity of covered institutions to issue customer notifications, and no commenter suggested such data. In addition, as stated above, we lack data, and no commenter suggested such data, that would allow us to quantify the indirect economic costs, such as reputational cost of any potential increase in the frequency of customer notification. See supra section IV.D.1.a. lotter on DSK11XQN23PROD with RULES2 829 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 notices will be, on average, $5,178 per year per covered institution.832 Some commenters disagreed with the proposed requirement that if a covered institution were unable to determine which customers were affected by a data breach, it would have had to notify all individuals whose sensitive customer information resided in the customer information system that was, or was reasonably likely to have been, accessed or used without authorization.833 One commenter stated that this would result in significant over-notification of individuals, and that this would unnecessarily disturb and frighten individuals who likely were not affected.834 The commenter also stated that the proposed requirements would significantly increase costs and litigation risk for covered institutions and possibly their service providers and other financial institutions whose information resides on the system.835 Another commenter stated that this proposed provision would create reputational risks for transfer agents and that it believed resources would be better spent investigating the incident and determining the impacted securityholders.836 Another commenter stated that this proposed requirement would be unnecessarily burdensome for covered institutions and that it could have negative consequences for clients, noting that there would be a risk that too much information could be overwhelming and lead to desensitization.837 Another commenter disagreed with the proposed requirement that a covered institution would have had to notify customers whose information was compromised unless the covered institution could determine that the event would not result in a risk of substantial harm or inconvenience for these individuals, suggesting instead that the standard be harmonized further with the Banking Agencies’ Incident Response Guidance and with many State laws so as to require notification only if the covered institution affirmatively could find risk of harm.838 This commenter stated that the proposed presumption of notification could lead to excessive and unnecessary 832 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $3,862 per year per covered institution. See infra section V. 833 See, e.g., CAI Comment Letter; IAA Comment Letter 1. 834 See CAI Comment Letter. 835 See CAI Comment Letter. 836 See Computershare Comment Letter. 837 See IAA Comment Letter 1. 838 See SIFMA Comment Letter 2. PO 00000 Frm 00074 Fmt 4701 Sfmt 4700 notifications to consumers where a low likelihood of harm were present, which could result in consumers spending time and effort needlessly monitoring accounts or taking actions such as instituting a credit freeze, and simultaneously desensitize consumers to a notification for an actual breach where significant harm could result.839 After considering these comments, we have determined that the presumptions of notification should be included in the final amendments. On the one hand, we acknowledge, as commenters stated,840 that unnecessary notifications could occur and negatively affect covered institutions and their customers as a result of these presumptions. Unnecessary notifications will result in costs for covered institutions, including the costs associated with notification such as administrative costs related to preparing and distributing notices as well as reputational costs, litigation risk, or diversion of resources identified by commenters.841 More broadly, as stated by commenters,842 unnecessary notification could reduce customers’ responsiveness to data breach notices, for example by decreasing customers’ ability to discern which notices require action. Unnecessary notification could also desensitize customers to notices, thereby leading to a decrease in the reputational costs of notification. This could decrease covered institutions’ incentives to invest in customer information safeguards in order to avoid such reputational costs.843 However, the risks of unnecessary notification reducing the benefits of the rule are mitigated by the fact that notification is not required in cases where the covered institution can determine, after a reasonable investigation, that there is no risk of substantial harm or inconvenience for the customers whose information has been compromised. In addition, in a change from the proposal, the final amendments explicitly provide that a covered institution need not provide notice to an individual whose sensitive customer information resides in the customer information system that was, or was reasonably likely to have been, accessed or used without authorization if the covered institution reasonably determines that this individual’s sensitive customer 839 See SIFMA Comment Letter 2. supra footnotes 834–840 and accompanying text. 841 Id. 842 See IAA Comment Letter 1; SIFMA Comment Letter 2. 843 Estimates of certain costs related to notice issuance are discussed above. See supra footnote 833 and accompanying text. 840 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations information was not accessed or used without authorization.844 On the other hand, adopting these presumptions of notification will allow potentially affected customers to take appropriate mitigating actions. In support of the proposed presumption of notification, another commenter stated that any risk that a presumption to notify individuals could lead to a volume of notices that would inure affected individuals to the notices and result in their not taking proactive action would be outweighed by the risk that individuals would not be notified at all and would not have the opportunity to decide for themselves whether to take action.845 To support this statement, this commenter referenced a study stating that requiring a determination of misuse to trigger disclosure permits additional discretion to the breached entity which, coupled with the existence of a disclosure disincentive,846 might bias an institution’s investigation of a data leak and might lead to a conclusion that consumer notification was not required.847 We agree with this commenter. In addition, as discussed above, allowing covered institutions to conduct a full investigation before determining whether customers need to be notified could significantly reduce the benefits of such notification, and thus of the final amendments, by delaying the notice.848 (5) Content and Method of Notice The proposed amendments included a list of information that would have had to be included in a customer notice.849 Many of these content requirements remain in the final amendments.850 While some commenters agreed generally with the proposed notice content requirements,851 other commenters disagreed with the proposed inclusion of some elements 844 See final rule 248.30(a)(4)(ii). Better Markets Comment Letter. 846 See supra section IV.B. 847 See Better Markets Comment Letter, citing Paul M. Schwartz and Edward J. Janger, Notification of Data Security Breaches, 105 Mich. L. Rev. 913, 939 (2007). In addition, a report cited by the same commenter discusses the frequency of notification and how it relates to specific notification trigger. The report links higher frequency of notification to a requirement that a government official participate in the determination that a data breach creates risk for the affected parties, and therefore that notification is required. See IRTC Data Breach Annual Report; see also supra footnote 518 and accompanying text. 848 See supra section II.A.3.a; see also supra section IV.D.1.b(2) for a discussion of the benefits of timely notification. 849 See proposed rule 248.30(b)(4)(iv). 850 See final rule 248.30(a)(4)(iv). 851 See, e.g., Better Markets Comment Letter. lotter on DSK11XQN23PROD with RULES2 845 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 and stated that our analysis of these requirements in the Proposing Release was insufficient.852 In response to these commenters, we conducted supplemental analysis of the frequency at which different items are required in existing State laws, and are including a supplemental analysis of the costs and benefits of each of the required elements vis-à-vis this baseline.853 The main benefit of requiring specific content to be included in the notice is to help ensure that customers residing in different States receive similar information when their information is compromised in the same breach. Because State law requirements differ in terms of required content, covered institutions may send different notices to different individuals.854 The final amendments will help ensure that all customers receive a minimum of information regarding a given breach affecting their information and are therefore equally able to take appropriate mitigating actions. The final amendments provide that the notice must include a description of the incident, including the information that was breached and the approximate date at which it occurred, as well as contact information where customers can inquire about the incident. In addition, the notice must include information on recommended actions affected customers can take. We expect that these required items will help customers take appropriate mitigating action to protect themselves from further effect of the breach. Including these elements might require some covered institutions to modify their existing processes for notification, which will incur some costs.855 We expect that these costs will be passed on to customers. The first required item is a general description of the incident and the type of sensitive customer information that was or is reasonably believed to have been accessed or used without 852 See, e.g., CAI Comment Letter. supra section IV.C.2.a(2). 854 See ICI Comment Letter 1 (‘‘In discussing breach notices with our members, we understand it is not uncommon for their current breach response programs to include separate notification letters depending upon the state the individual resides in.’’). 855 These costs are included in the policies and procedures costs discussed in section IV.D.1 above. As discussed below, we estimate that certain costs associated with developing and implementing policies and procedures to comply with the final amendments will be, on average, $15,445 per year per covered institution. This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $5,425 per year per covered institution. See infra section V. 853 See PO 00000 Frm 00075 Fmt 4701 Sfmt 4700 47761 authorization.856 We received no comment on this specific requirement. Obtaining this information is crucial for customers as it will allow them to assess the level of risk and to take appropriate mitigating actions. This will also allow them to avoid spending time and resources on mitigating actions related to information that was not affected by the breach. We expect that most covered institutions who already have notification processes already include this information, since 22 States require that the notice describe the type of information affected by the breach and 13 States require a description of the incident to be included.857 As a result, we expect that the benefits will be the greatest for customers of institutions who do not operate nationally and operate only in States without such requirements. We estimate that there are approximately 51 million potential customers residing in the 38 States that do not require a description of the incident, and 35 million potential customers residing in the 29 States that do not require the type of customer information compromised to be included in the notice.858 We expect the costs to be the highest for the covered institutions operating only in those States. The second item required by the final amendments is the date of the incident, the estimated date of the incident, or the date range within which the incident occurred, if the information is reasonably possible to determine at the time the notice is provided.859 One commenter disagreed with this proposed requirement, stating that it would imply that covered institutions subject to both Regulation S–P and the Banking Agencies’ Incident Response Guidance would have to revise their long-standing breach notices to add the information.860 This commenter also stated that the Proposing Release did not detail a basis for this inclusion. Including the date of the breach, even if it is the approximate date, will provide useful information to the affected customers and help them make better decisions about the mitigating actions to take. In particular, customers could review their account statements back to the date where the breach happened.861 An additional benefit of this inclusion will be to provide information to customers about how effectively a 856 See final rule 248.30(a)(4)(iv)(A). supra section IV.C.2.a(2). 858 See supra footnote 767. 859 See final rule 248.30(a)(4)(iv)(B). 860 See ICI Comment Letter 1. 861 See supra footnote 210 and accompanying text. 857 See E:\FR\FM\03JNR2.SGM 03JNR2 lotter on DSK11XQN23PROD with RULES2 47762 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations covered institution was able to detect and assess a breach. This will help reduce the information asymmetry about a covered institution’s customer information safeguards and help customers be better informed when deciding which covered institutions to retain for their financial services needs. There are 13 States requiring the notice to include an approximate date (or date range) for the breach, and 38 States without such a requirement.862 These 38 States account for 70 percent of the U.S. population and 49 million estimated potential customers.863 For these customers, the final amendments might result in their receiving information they would not have otherwise received. Because 13 States already require that the notice include an approximate date, we expect that the costs will be minimal for the covered institutions that operate nationally. For the covered institutions that do not operate nationally, the final amendments might require them to adapt their procedures to include additional information in the notices to customers. The third item required by the final amendments is ‘‘contact information sufficient to permit an affected individual to contact the covered institution to inquire about the incident, including the following: a telephone number (which should be a toll-free number if available), an email address or equivalent method or means, a postal address, and the name of a specific office to contact for further information and assistance.’’ 864 One commenter disagreed with this proposed requirement, stating that it was unclear what purpose or benefit this requirement would have for the affected individuals and adding that it would place significant burdens on the internal operations of the covered institution.865 Another commenter also disagreed with this proposed requirement, stating that covered institutions should have flexibility in determining the contact information to provide, based on how they normally interact with their customers, and suggesting that the final amendments only require one of the listed contact methods.866 The requirement to include multiple contact methods provides valuable options for affected customers, who may have differing preferences and aptitudes in 862 See supra section IV.C.2.a(2). supra footnote 767. 864 Final rule 248.30(a)(4)(iv)(C). 865 See CAI Comment Letter. 866 See SIFMA Comment Letter 2. 863 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 their use of contact methods.867 We do not expect that this requirement will overly burden covered institutions, even for those institutions that will need to adapt their processes to the new requirements.868 In addition, nothing in this requirement prevents a covered institution from providing additional contact methods. The final amendments also require the notice to include a recommendation that the customer review account statements and immediately report suspicious activity to the covered institution (if the individual has an account with the covered institution); an explanation of what a fraud alert is and how an individual may place one; a recommendation that the individual periodically obtain credit reports; an explanation of how the individual may obtain a credit report free of charge; and information about the availability of online guidance from the FTC and usa.gov regarding steps an individual can take to protect against identity theft, a statement encouraging the individual to report any incidents of identity theft to the FTC, and the FTC’s website address.869 One commenter supported these proposed requirements, stating that the proposed notice requirements avoided common problems with the content of many data breach notifications, such as confusing language, a lack of details, and insufficient attention to the practical steps customers should take in response.870 We expect that these additional elements will provide useful information to affected customers regarding potential mitigating actions to take and help ensure that these customers are able to react appropriately to the notice. We expect that while these requirements will impose costs on covered institutions whose notification process does not already include these elements,871 these costs will be limited and passed on to the customers.872 We 867 In addition, the final amendments will not preclude a covered institution from providing the contact information of a third-party service provider. See supra footnote 211. 868 Ten States require the notice to include a phone number as contact information while two States require the notice to include a physical address. See supra section IV.C.2.a(2). 869 See final rule 248.30(a)(4)(iv)(D) through (H). 870 See Better Markets Comment Letter. 871 Because some States require some of these elements to be included in the notification to affected individuals, we expect that many covered institutions already have procedures similar to those required by the final amendments. See supra section IV.C.2.a(2). 872 As discussed above, these costs will represent only a fraction of the policies and procedures costs discussed in section IV.D.1 above. See supra footnote 856 and accompanying text. PO 00000 Frm 00076 Fmt 4701 Sfmt 4700 received no comments opposing these requirements. The proposed amendments included a provision that would have required the notice to include a description of what has been done by the covered institution to protect the sensitive customer information from further unauthorized access or use. One commenter disagreed with this proposed requirement, stating that it ‘‘would be extremely useful to threat actors and not particularly useful to clients.’’ 873 After considering this comment, we have decided to exclude this provision from the final amendments.874 In addition to reducing the perceived risk of providing a roadmap for threat actors, we expect that this change will accelerate the process of preparing the notice, thereby reducing the associated costs. The final amendments require that notice must be transmitted by a means designed to ensure that each affected individual can reasonably be expected to receive actual notice in writing.875 Some commenters discussed the alignment between the requirements of the final amendments and those of existing regulation affecting covered institutions. In particular, one commenter stated that a Federal notification requirement would complicate compliance efforts for covered institutions already complying with similar State laws.876 On the other hand, another commenter stated that the proposed amendments’ alignment with existing requirements would allow covered institutions to leverage existing programs.877 We analyze here the expected benefits and costs of this provision of the final amendments visà-vis the baseline.878 We expect that the main benefit of this provision will be to help ensure that customers whose sensitive personal information has been breached receive the required information. We expect that the costs of this provision will be limited for most covered institutions since most States require similar methods of notification.879 Hence, we expect that most covered institutions will not have to significantly modify their procedures and processes for notice issuance in order to satisfy this provision of the final amendments. However, we do expect some benefits in some instances. First, 26 States allow 873 See IAA Comment Letter 1. supra section II.A.3.e. 875 See final rule 248.30(a)(4)(i). Under the final amendments, the notice can be sent electronically. See supra footnote 200 and accompanying text. 876 See CAI Comment Letter. 877 See FSI Comment Letter. 878 See supra section IV.C.2.a(2). 879 See id. 874 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations a notice to be made over the telephone.880 While 7 of these States require direct contact with the affected individuals when the notice is given using this method, 19 do not have such requirements.881 We expect that for the 21 million potential customers residing in the 19 States allowing for telephonic notices but without such requirements,882 receiving a written notice may result in clearer information and in a higher likelihood of taking appropriate mitigating actions. Second, many States allow for electronic notifications. While most of these States require that this be done only under certain conditions that are similar to the final amendments’ conditions, some States have conditions that are significantly looser. The final amendments provide that the notice can be provided through electronic means to customers who have agreed to receive information electronically.883 In contrast, five States allow electronic notification without restriction, and two States require only that the institution has an email address for the affected individuals.884 We expect that for the 11 million potential customers residing in these seven States 885—that allow electronic notification even to customers who have not explicitly agreed to receiving electronic notification—the final amendments will help ensure that they receive a notice in a format that they are expecting.886 Third, all States allow for a substitute notice under certain conditions.887 Substitute notification requirements vary across States but must generally include an email notification to affected individuals, a notice on the entity’s website, and notification to major statewide media.888 The final amendments do not provide for such substitute notice and instead have the same notice requirements in all cases. We expect that the final amendments will strengthen the benefits of 880 See 881 See id. supra footnote 568 and accompanying text. 882 See 883 See supra footnote 767. supra footnote 200 and accompanying text. 889 See lotter on DSK11XQN23PROD with RULES2 884 See supra footnotes 565 and 566 and accompanying text. 885 See supra footnote 767. 886 We acknowledge that the final amendments may result in some customers receiving a notice in a format that they do not prefer. For example, customers could agree to an electronic notice but still receive a notice by mail, which they may be less likely to see or respond to. 887 These conditions often include a certain minimum number of affected individuals to notify and a minimum dollar cost to notify these individuals. See supra footnote 569 and accompanying text. 888 See supra section IV.C.2.a(2). VerDate Sep<11>2014 notification by helping ensure that affected individuals are made aware of the relevant information regarding a breach of their sensitive information. Examples of customers who would benefit include customers who: interact infrequently with the covered institution, thereby not visiting the institution’s website regularly; who do not consume local or State news sources; or who may be wary or skeptical of receiving such information by email if they have not given their prior informed consent (for example, customers who are used to receiving communications from the covered institution by mail only or who interact with the covered institution very rarely). In other States, the requirements for substitute notice include fewer elements.889 We expect that for the customers residing in these States, the final amendments will help ensure that they are made aware of the breach and provided an appropriate notice. The final amendments require written notification, which may be provided electronically if certain conditions are met, such as if the customer has agreed to receive information electronically.890 Not all State notification provisions include similar consent conditions for electronic communication.891 Therefore, the final amendments may result in additional compliance costs in the instances where, prior to the final amendments, the covered institutions would have sent email notices or used substitute notification, but will instead have to obtain customer consent for electronic notification or else send individual notices by mail because their methods of electronic delivery are not consistent with existing Commission guidance on electronic delivery, for example if they have not obtained customer consent to receive electronic communications.892 However, given the variety of State law conditions and requirements, we expect that most notices being sent already satisfy many of these provisions and we therefore expect that these provisions will result in limited additional costs.893 19:34 May 31, 2024 Jkt 262001 supra footnote 571 and accompanying text. 890 See 891 See supra section II.A.3.e. and footnote 200. supra footnote 885 and accompanying text. 892 Id. Because some States have conditions for sending an electronic notice that are different from those under the final amendments, we expect that there might be some cases where a covered institution will be required to send a notice by mail when it could have sent an electronic notice under State law. See supra footnotes 884 through 888 and accompanying text. 893 An analysis of the notices sent to residents of California and Washington suggests that notices are frequently sent by postal mail. Both States allow for PO 00000 Frm 00077 Fmt 4701 Sfmt 4700 47763 c. Service Provider Provisions The final amendments require that a covered institution’s incident response program include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers. Specifically, these written policies and procedures must be reasonably designed to ensure the service providers take appropriate measures to protect against unauthorized access to or use of customer information and provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system. Upon receipt of such notification, a covered institution must initiate its incident response program.894 In the final amendments, ‘‘service provider’’ is defined as ‘‘any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution.’’ 895 Thus, the requirements might affect arrangements with a broad range of entities, including potentially email providers, customer relationship management systems, cloud applications, and other technology vendors. As modern business processes increasingly rely on service providers,896 ensuring consistency in regulatory requirements increasingly requires consideration of the functions performed by service providers and how these functions interact with the regulatory regime.897 Ignoring such aspects could incentivize covered institutions to attempt to outsource functions to service providers to avoid the requirements that would apply if the electronic notification if the notice is consistent with the Electronic Signatures in Global and National Commerce Act (15 U.S.C. 7001). Nevertheless, we have found that in California, at least 90% of the notices appear to be sent by mail. The equivalent number is 89% for Washington. We identified the notices sent by mail (as opposed to those sent by email or satisfying other substitute notice requirements) as those including a redacted or mock recipient address, an address for a return mail processing center, or an explicit mention such as ‘‘Via First-Class Mail.’’ It is possible that notices containing none of these elements are sent by mail, and therefore we expect that the true percentages are likely to be higher than those reported here. See supra footnotes 777 and 782 and accompanying text for details on the notice data used for this analysis. 894 See final rule 248.30(a)(5)(i). 895 Final rule 248.30(d)(10). 896 See supra section IV.C.3.f 897 See supra section IV.C.2.a(3). E:\FR\FM\03JNR2.SGM 03JNR2 47764 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 functions were performed in-house. Thus, the service provider requirements will strengthen the benefits of the final amendments by helping ensure that they have similar effects regardless of how a covered institution chooses to implement its business processes (i.e., whether those processes are implemented in-house or outsourced). Commenters supported the proposal’s objective to safeguard customer information in the case where this information rests with service providers.898 One commenter stated that third-party service providers were specifically a favored attack vector, adding that the Commission’s attention to this risk was well-directed.899 Another commenter stated that it did not disagree that service providers should protect sensitive customer information and be required to provide timely notification of a breach to the covered institution.900 Another commenter stated that service providers that have access to customer information should be contractually required to take appropriate risk-based measures and diligence designed to protect against unauthorized access to or use of customer information, including notification of a covered institution in the event of certain types of breaches in security.901 Another commenter recognized and supported the importance of covered institutions having appropriate policies and procedures to manage the cybersecurity and privacy risks posed by service providers that process their customer information.902 Some commenters criticized the analysis of the proposed service provider provisions.903 One commenter stated, referring to the proposed service provider written agreement obligation, that the Commission had failed to address the costs in any meaningful way and was thus dismissive of them.904 Another commenter stated that the Proposing Release included no discussion or estimate of the costs that renegotiating contracts with service providers or hiring new service providers would impose on brokers.905 898 See, e.g., EPIC Comment Letter; SIFMA Comment Letter 2. 899 See EPIC Comment Letter. 900 See IAA Comment Letter 1. 901 See SIFMA Comment Letter 2. 902 See CAI Comment Letter. 903 See, e.g., IAA Comment Letter 1; ASA Comment Letter. 904 See IAA Comment Letter 1. 905 See ASA Comment Letter. In the Proposing Release, we requested data that could help us quantify the costs and benefits that we were unable to quantify. We did not receive data or estimates from commenters that could help us quantify the costs of renegotiating contracts or hiring new VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 In addition, some commenters disagreed with our analysis of specific parts of the requirements, stating that the analysis in the Proposing Release did not identify why a 48-hour reporting period was optimal,906 or stating that the breadth of the definition of service providers was disproportionate to the benefits and risks presented.907 In response to these commenters, we have modified this aspect of the amendments, as discussed in greater detail above.908 These modifications mitigate, but may not eliminate entirely, commenters’ concerns regarding the costs associated with the service provider provisions of the proposed amendments. We also have supplemented the economic analysis of the service provider provisions in response to comments as follows. First, we have supplemented the analysis of the potential costs to covered institutions. This includes an analysis of the indirect effects of the final amendments on covered institutions’ service providers, and how these effects may affect covered institutions and their customers,909 for example where costs to service providers are passed on to covered institutions, and ultimately to covered institutions’ customers,910 or have negative competitive effects that impact covered institutions.911 Second, we are providing supplemental analysis specifically on the timeline requirement and the definition of service providers.912 The costs to covered institutions of implementing the final amendments will be influenced by the potential burdens on service providers that may result from the amendments. If implementing procedures that satisfy covered institutions’ requirements were costless for them, service providers would be likely to agree to implement the requirements without much negotiation and the costs to covered institutions would be minimal. If, instead, such procedures were costly to implement for service providers, more negotiation would be required, which service providers. See Proposing Release at section III.G, question 110. 906 See Microsoft Comment Letter. 907 See IAA Comment Letter 1 (‘‘We believe the proposed definition of Service Provider is unrealistically and unnecessarily broad, reaching service providers where there are little or no marginal benefits to their inclusion and the costs (time, money, personnel, etc.) to advisers would be substantial.’’). 908 See supra section II.A.4. 909 See infra footnotes 928–936 and accompanying text. 910 See infra text accompanying footnote 933. 911 See infra section IV.E. 912 Additional context for this analysis is provided in section IV.C.3.f. PO 00000 Frm 00078 Fmt 4701 Sfmt 4700 would be costlier for all parties involved. In addition, in this case, the service providers might increase the price of their services, further increasing the costs for covered institutions.913 We discuss further below the expected indirect effects of the final amendments on service providers and how these effects may affect covered institutions.914 However, even if, as in the scenario described above, the cost per service provider turns out to be minimal for covered institutions, the total cost might still become significant for covered institutions that have a large number of service providers. Even in this case, covered institutions will need to devote time and resources to verify that they satisfy the final requirements with respect to each of their service providers. In addition, covered institutions will need to devote time and resources to oversee their service providers throughout their relationship with these service providers.915 We are unable to quantify these costs, as the range would be too wide to be informative and commenters did not provide any data that would yield an estimation of such a range. The range of costs for covered institutions is likely to be wide given the varied nature of the uses of service providers by financial institutions. For instance, the cost for covered institutions that do not rely on service providers is likely to be minimal. However, for those covered institutions that have more complex arrangements with service providers, the cost would be significantly higher. The cost depends on a large number of factors that vary across covered institutions.916 For example, the cost 913 Because we are not aware of any data, and no commenter suggested any data, that could be used to estimate how much service providers will pass through increased costs to covered institutions, we are unable to quantify the magnitude of the potential increased costs for covered institutions. 914 See infra text accompanying footnote 927. 915 See supra section II.A.4. For PRA purposes, we have identified certain types of staff who we anticipate would be involved in implementing the rules. See infra section V.B. It is possible that those staff members may also be involved in oversight of service providers. 916 In a proposing release pertaining to service providers, the Commission anticipated a range of compliance costs associated with required oversight of service providers by registered investment advisers. For example, in the proposing release, the Commission estimated a range of $44,106.67– $132,320 in ongoing annual costs per adviser associated with the proposed due diligence requirements (and further costs associated with proposed monitoring requirements and other aspects of the proposed rule). We do not believe those ranges of cost estimates are determinative in the context of the final amendments here. In particular, the scope of the final amendments differs substantially from the scope of that proposal. Those cost estimates pertained to a service E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 would depend on the number of service providers used, the extent to which service providers are used for multiple functions, each service provider’s access to relevant customer information, as well as the staffing needs of the covered institutions. The definition of service provider in the final amendments will affect the costs to covered institutions by determining the number of service providers for which covered institutions will have to perform these tasks. The final amendments adopt a definition of service provider to mean ‘‘any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution.’’ 917 Many commenters opposed the proposed definition of service provider.918 These commenters suggested narrower definitions which would exclude a covered institution’s affiliates.919 In addition, one commenter stated that the proposed definition was unrealistically and unnecessarily broad, reaching service providers where there would be few or no marginal benefits to their inclusion and the costs (time, money, personnel, etc.) to covered institutions would be substantial.920 This commenter suggested that the definition of service provider be limited to persons provider’s performance of outsourced functions that meet two elements: (1) those necessary for the adviser to provide its investment advisory services in compliance with the Federal securities laws; and (2) those that, if not performed or performed negligently, would be reasonably likely to cause a material negative impact on the adviser’s ability to provide investment advisory services. By contrast, the final amendments here pertain to the protection of customer information in the case of all outsourced functions to all service providers. See Outsourcing by Investment Advisers, Release No. 6176 (Oct. 26, 2022) [87 FR 68816, 68821 (Nov. 16, 2022)]. 917 Final rule 248.30(d)(10). 918 See, e.g., IAA Comment Letter 1; Schulte Comment Letter. The definition of service provider in the final amendments is identical to the definition that was in the proposal. See supra section II.A.4. 919 See IAA Comment Letter 1 (stating that ‘‘the IAA believes that it is neither appropriate nor necessary to treat affiliates that provide services to an affiliated firm through a shared services or similar model as Service Providers’’); Schulte Comment Letter (‘‘We believe that the proposed definition of ‘service provider’ should exclude a Covered Institution’s affiliates.’’); SIFMA Comment Letter 2 (‘‘The associations also recommend that the Commission exclude affiliates of covered institutions from the definition of service providers, as affiliates are part of the same enterprise information/cybersecurity oversight as the covered institutions.’’); CAI Comment Letter (‘‘The Committee requests that proposed Rule 30(e)(10) be revised to specifically exclude affiliates and other entities under common control with the covered institution.’’). 920 See IAA Comment Letter 1. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 or entities with permitted access to sensitive customer information only.921 We acknowledge that fulfilling the requirements for each of their service providers will impose costs on the covered institutions. However, the potential benefits are also large given the increasing reliance of covered institutions on service providers.922 Individual customers have no control over a covered institution’s decisions to perform activities in-house or to outsource them. As such, these customers have little control over who has access to their information. A broad definition of service providers will contribute to safeguard customers’ information and will help ensure that customers are notified in the event their sensitive information is compromised, no matter where this information resides. Furthermore, the modifications in the final amendments to require covered institutions to establish, maintain, and enforce written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, instead of requiring written contracts as was proposed,923 will alleviate the commenters’ concerns over the potential inclusion of affiliates. Since affiliates are likely to have policies and procedures similar to those of covered institutions,924 we expect that both the benefits and the costs of implementing this provision of the requirements will be minimal. The indirect effects of the final amendments on service providers might also affect the costs borne by covered institutions and, ultimately, their customers. In particular, these indirect effects may generate costs to service providers, which may be passed on (at least partly) to covered institutions and ultimately to covered institutions’ 921 See IAA Comment Letter 1. This commenter also requested, if the proposed written contract requirement were to be kept in the final amendments, that it apply only to those service providers that have physical or virtual access to a covered institution’s customer information system. 922 See supra section IV.C.3.f. 923 See proposed rule 248.30(b)(5)(i). 924 See IAA Comment Letter 1 (‘‘Many advisers are structured in a manner that makes it administratively beneficial for them to obtain services from affiliates. These services often are provided by affiliates in a manner established by the organization’s policies without the need for formal contracts because the affiliates are typically subject to company-wide policies and standards relating to safeguarding PII. Moreover, the information security policies of affiliates are typically subject to oversight by an organizational component that monitors compliance.’’) and Schulte Comment Letter (‘‘We note that affiliates are typically included within the scope of a Covered Institution’s cybersecurity policies and procedures and would also be covered by an applicable incident response plan.’’). PO 00000 Frm 00079 Fmt 4701 Sfmt 4700 47765 customers,925 or may result in negative competitive effects on service provider industries that then impact the services offered to covered institutions and their customers.926 The potential indirect effects on service providers that will result from the final amendments can be divided into three parts.927 First, entities that meet the definition of service providers will likely take appropriate measures to protect against unauthorized access to or use of customer information to facilitate covered institutions’ compliance with the final amendments. We expect that many service providers already take such measures.928 Hence, we expect that the number of service providers who will modify their business processes for this specific requirement is limited. Such modifications will benefit not only the customers whose information is being better protected and the covered institutions relying on the service providers, but also the service providers themselves, to the extent that the modifications decrease the likelihood of unauthorized access to their customer information systems which could affect their operations or reputation. 925 See infra text accompanying footnote 933. infra section IV.E. 927 We are unable to quantify the indirect costs associated with these indirect effects that would be incurred by service providers as a result of the final amendments, as the cost range would be too wide to be informative. The uncertainty around these costs is due to a number of factors, including variation in complexity of service provider functions provided to covered institutions, the degree of market concentration across service provider markets (and hence the number of covered institutions a service provider may need to work with to comply with the rule), and variation in current service provider practices. The costs to any single service provider of meeting the burden for any single function for any single covered institution may therefore have substantial variance. For example, in certain cases a few service providers may perform the same function for many covered institutions and hence benefit from economies of scale. By contrast, service providers in less concentrated industries would potentially face higher costs. 928 For example, many States impose some form of requirements regarding the safeguard and the disposal of customer information. See supra footnote 603. In addition, the FTC Safeguards Rule requires financial institutions to take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards for customer information and to require those service providers by contract to implement and maintain such safeguards. See supra footnote 618 and accompanying text. Hence, we expect that the service providers of private funds subject to the FTC Safeguards Rule already have customer information safeguards in place. This could lower the costs of the service provider provisions of the final amendments for the private funds advisers that are registered with the Commission and that are therefore covered institutions. See supra footnote 614 and accompanying text. Furthermore, service providers that are subject to other regimes such as the GDPR or DORA may already have appropriate safeguards in place. 926 See E:\FR\FM\03JNR2.SGM 03JNR2 47766 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 Second, covered institutions’ policies and procedures will need to be reasonably designed to ensure that service providers take appropriate measures to provide notification of unauthorized access to a customer information system to the covered institutions as soon as possible, but no later than 72 hours after becoming aware that the breach has occurred. This provision might also result in a number of service providers adapting their businesses processes. However, considering that 24 States require entities that maintain but do not own or license customer information data to notify the entity that owns or licenses such data ‘‘immediately’’ in case of a breach of security, we expect that many service providers already have processes in place to ensure that such notification is made.929 For the service providers who do not already have such processes in place, this approach will create benefits for the customers who will be informed in a timely manner in the event their sensitive information is compromised. Third, because the final amendments require covered institutions to establish, maintain, and enforce written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers who have access to their customers’ information, these service providers will face requests for information from covered institutions or otherwise participate in the covered institutions’ oversight activities. This will impose costs on service providers, but it will also strengthen the benefits of the amendments by helping ensure that customer information is appropriately protected even when it is residing in service providers’ systems. For service providers that provide specialized services aimed at covered institutions, the final amendments may create market pressure to enhance service offerings that facilitate covered institutions’ compliance with the requirements.930 Such enhancement will entail costs for specialized service providers, including the actual cost of adapting business processes, as discussed above, to accommodate the requirements.931 That said, we do not 929 In addition, other existing regulations have 72hour reporting or notification deadlines. See supra footnote 257 and accompanying text; see also supra footnote 245. 930 A service provider involved in any businesscritical function likely ‘‘receives, maintains, processes, or otherwise is permitted access to customer information.’’ See final rule 248.30(d)(10). 931 We have no data on the number of specialized service providers used by covered institutions and on the frequency with which these service providers already adapt their business processes to VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 expect that these costs will represent an undue burden as both the specialized service providers and the covered institutions are operating in a highly regulated industry and might be accustomed to adapting their business processes to meet regulatory requirements. Moreover, more specialized service providers may be likely to have particularly sensitive or valuable information about the customers of covered institutions, and therefore the investor protection benefits in those cases may be substantial. With respect to service providers providing services aimed at a broad range of institutions, such as those providing email or customerrelationship management services, covered institutions are likely to represent a small fraction of their customer base. These service providers may be unwilling to adapt their business processes to the regulatory requirements of a small subset of their customers if they do not already have such processes in place. For the service providers that already have in place processes satisfying the covered institutions’ requirements, we expect that the costs to both the service providers and the covered institutions will be minimal and will mostly result from covered institutions’ oversight duties. If service providers modify their business processes to facilitate covered institutions’ compliance with the final amendments’ requirements, we anticipate they likely will pass costs on to covered institutions, and ultimately covered institutions may pass these costs on to customers.932 We also expect that there might be a fraction of service providers who will be unwilling to take the steps necessary to facilitate covered institutions’ compliance with the final amendments. In such cases, the covered institutions will need to either switch service providers and bear the associated switching costs or perform the functions in-house and establish the appropriate processes as a result.933 We expect that these costs will be particularly acute for smaller covered regulatory changes, and no commenter suggested such data. 932 See supra footnote 718. 933 Such switching costs could include the time and other resources necessary to find an alternative service provider, conduct appropriate due diligence, and negotiate prices and services provided. Performing the functions in-house may also be more costly than outsourcing them for covered institutions. A recent report finds that 73% of surveyed asset managers cite cost considerations when deploying outsourcing solutions. See Cerulli Report. The competitive effects associated with the cases where service providers choose to stop providing services to covered institutions as a result of the final amendments are discussed below. See infra section IV.E. PO 00000 Frm 00080 Fmt 4701 Sfmt 4700 institutions which lack bargaining power with large service providers, and that these costs might be passed on to customers.934 However, the amendments will create benefits arising from enhanced efficacy of the regulation.935 The proposal included a requirement that a covered institution’s response program must include written policies and procedures requiring the institution, pursuant to a written contract between the covered institution and its service providers, to require that service providers take appropriate measures that are designed to protect against unauthorized access to or use of customer information.936 While one commenter supported this proposed requirement,937 other commenters suggested that the final amendments not require written contracts with service providers,938 stating that doing so would impose significant costs on covered institutions.939 After considering these comments, we are requiring that covered institutions establish, maintain, and enforce written policies and procedures to require oversight of service providers instead of requiring written contracts.940 This change, while enhancing the policies and procedures obligations, will provide covered institutions with greater flexibility in achieving compliance with the requirements, which could reduce compliance costs without significantly reducing the benefits of the final 934 We expect that smaller covered institutions may be less able to pass these costs to customers. See supra footnote 718. 935 From the perspective of current or potential customers, the implications of customer information safeguard failures are similar whether the failure occurs at a covered institution or at one of its service providers. 936 See proposed rule 248.30(b)(5)(i). 937 See ICI Comment Letter 1. 938 See, e.g., SIFMA Comment Letter 2; IAA Comment Letter 1. 939 See, e.g., SIFMA Comment Letter 2 (‘‘Requiring each service provider to revise its contract with a covered institution within 12 months of the Proposal’s finalization would add an unnecessary burden to both covered institutions and service providers, as well as a potential significant cost.’’); IAA Comment Letter 1 (‘‘Even if Service Providers agreed to enter into written agreements with advisers as proposed, advisers and Service Providers would both likely incur significant negotiation and implementation costs, which we do not believe are justified, especially when an alternative and less burdensome approach is available.’’); STA Comment Letter 2 (stating that ‘‘transfer agents, because of their relatively small size, simply do not have the negotiating power to demand contractual terms requiring third party service providers to maintain certain policies and procedures, or to demand permission to perform due diligence on a service provider’s systems, policies, and procedures.’’). 940 See supra section II.A.4 and final rule 248.30(a)(5). E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 amendments.941 Providing this flexibility will also help address commenters’ concerns that requiring a written contractual agreement could harm covered institutions, particularly those that are relatively small and may not have sufficient negotiating power or leverage to demand specific contractual provisions from a larger third-party service provider.942 However, in a scenario where a covered institution has an existing contract with a service provider that is renegotiated as a result of the final amendments, the covered institution may incur additional costs.943 In addition, in a scenario where a service provider would have agreed to a written contract under the proposed amendments but will not under the final amendments, a covered institution may have to exert greater efforts to oversee this service provider than would have been necessary had it signed a written contract with this service provider.944 We also proposed that the measures taken by service providers include notification to the covered institution as soon as possible, but no later than 48 hours after becoming aware of a breach in security resulting in unauthorized access to a customer information system maintained by the service provider.945 While one commenter supported this proposed requirement,946 other commenters stated that a longer deadline would be preferable.947 One 941 See supra section II.A.4; see also, e.g., AWS Comment Letter. 942 See, e.g., IAA Comment Letter 1. 943 It is difficult for us to quantify these costs, as we have no data on the provisions of existing contracts between covered institutions and their service providers relating to customer information safeguards, and no commenter suggested such data. Such costs are likely to be contract specific, as they will depend on the degree to which each existing contract may be revised as a result of the final amendments. Many such contracts may not be revised at all, while others may undergo more revisions. Moreover, in many cases, even where a contract could be revised as a means of complying with the final requirements, the covered institution may pursue compliance by other means. 944 There are a variety of ways in which covered institutions will be able to satisfy the oversight requirement. See supra section II.A.4. 945 See proposed rule 248.30(b)(5)(i). 946 See ICI Comment Letter 1 (‘‘We concur with the Commission requiring service providers to notify a covered institution notice within 48 hours of a breach impacting the covered institution or its affected individuals.’’). 947 See, e.g., Microsoft Comment Letter (‘‘Specifically, where the SEC determines that a cybersecurity incident reporting requirement is appropriate, the applicable rule should provide that the entity with the notification responsibility shall provide the required notice to the recipient as soon as possible but no later than 72 hours. The reporting deadline should begin to run once the entity with notification responsibilities has a reasonable basis to conclude that a notifiable incident has occurred or is occurring.’’); ACLI Comment Letter (‘‘In the VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 commenter also suggested a change from ‘‘becoming aware’’ to ‘‘determining’’ that a breach has occurred in order to minimize pressure to report on service providers while an investigation is being conducted.948 After considering these comments, we have changed this provision. The final amendments require covered institutions to ensure that their service providers notify them of a breach as soon as possible, but no later than 72 hours after becoming aware that an applicable breach has occurred.949 We expect that the change to 72 hours will reduce the cost to service providers not only because it will give them more time to assess an incident before notifying the covered institution, but also because it aligns with existing regulation.950 Hence, we expect that this change will decrease compliance costs for covered institutions by making service providers more likely to agree to the requirements, which will decrease negotiation and switching costs for covered institutions.951 We also expect that this will alleviate some of the commenters’ concerns about having insufficient negotiating power to negotiate specific with service providers.952 While this change may result in a longer period of time before customers receive notification of a breach, thereby decreasing the benefits of such notification,953 it might also reduce the number of unnecessary notifications to covered institutions and, in turn, to customers.954 The final amendments provide, as proposed, that a covered institution may enter into a written agreement with a service provider to notify individuals affected by a breach on the covered institution’s behalf.955 Some early days of containment and remediation it is often difficult to determine exactly what data has been compromised, making the 48-hour timeframe overly short and burdensome.’’). 948 See Google Comment Letter. 949 See final rule 248.30(a)(5)(i). 950 See supra footnote 257 and accompanying text. 951 Alignment with existing regulation makes it more likely that service providers already have policies and procedures in place to comply with this requirement. 952 See, e.g., STA Comment Letter 2. 953 See supra section IV.D.1.b(2) for a discussion of the benefits of a timely notice to customers. 954 See Microsoft Comment Letter (‘‘Premature reporting according to a 48-hour or shorter deadline, in our experience, increases the likelihood of reporting inaccurate or incomplete information, which is of little-to-no value and tends to create confusion and uncertainty.’’). See also supra section IV.D.1.b(4) for a discussion of the effects of unnecessary notification. We expect that the change made to the notification timing requirements for service providers will mitigate these effects. 955 See final rule 248.30(a)(5)(ii). PO 00000 Frm 00081 Fmt 4701 Sfmt 4700 47767 commenters supported this proposed requirement.956 We expect that this provision could reduce the compliance costs of the amendments, especially in the case where the breach happens at the service provider. In this case, the service provider may be in a better position to collect the relevant information and provide the required notice to customers.957 It is possible that a breach that will trigger a notification obligation might occur at a covered institution that will also be a service provider to another covered institution.958 The final amendments provide that the obligation to ensure that affected individuals are notified rests with the covered institution where the breach occurred.959 If this covered institution is also a service provider to another covered institution, it retains the obligation, as a service provider, to notify this other covered institution of the breach.960 This will allow the other covered institution to initiate its own incident response program and to perform its oversight duties on its service providers, and contribute to enhance the protection of customer information. We modified the final amendments such that only one covered institution needs to notify the affected customers.961 By requiring only one 956 See Schulte Comment Letter (‘‘Covered Institutions should be permitted to reach commercial agreements that delegate notice obligations to service providers, as long as the notice actually provided to customers with potentially impacted data satisfies the Covered Institution’s notice obligations.’’); ICI Comment Letter 1 (‘‘We also concur with the Commission that covered institutions should be permitted to have their service providers send breach notices to affected individuals on behalf of the covered institution.’’). 957 One commenter stated that ‘‘if the service provider was the victim of a cyber attack that included unauthorized access to Covered Institution sensitive customer information, then the service provider would be better situated to notify the affected customers.’’ See Schulte Comment Letter. Even when the service provider notifies customers directly, the obligation to ensure that the affected individuals are notified rests with the covered institution. See supra section II.A.4 and final rule 248.30(a)(5)(iii). 958 For additional discussions of the cases where multiple covered institutions are involved in the same incident, see supra section II.A.3.a and infra section IV.D.2.a. 959 The amendments allow the two covered institutions to coordinate with each other as to which institution will send the notice to the affected individuals. See supra section II.A.3.a. 960 Because this service provider is itself a covered institution, it will have appropriate policies and procedures in place. Hence, we do not expect that notifying the other covered institution will imply significant costs. 961 See supra section II.A.3.a. Some commenters stated that the proposed amendments could be interpreted to lead to duplicative notices. See, e.g., CAI Comment Letter (‘‘This dynamic could also E:\FR\FM\03JNR2.SGM Continued 03JNR2 47768 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations notice to be sent for a given incident, this modification will reduce compliance costs—since only one covered institution will have to devote resources to preparing and sending the notice—and reduce potential confusion for the affected customers.962 We do not expect this modification to reduce the benefit for such customers, who will still receive a timely notice. 2. Extending the Scope of the Safeguards Rule and the Disposal Rule lotter on DSK11XQN23PROD with RULES2 a. Definition of Customer Information The final amendments more closely align the scope of the safeguards rule with the scope of the disposal rule. They also broaden the scope of information covered by the rules to all customer information, regardless of whether the customers are a covered institution’s own, or those of another financial institution whose customer information has been provided to the covered institution.963 The final amendments define customer information, for any covered institution other than a transfer agent, as ‘‘any record containing nonpublic personal information’’ about a customer of a financial institution, whether in paper, electronic or other form, that is in the possession of a covered institution or that is handled or maintained by the covered institution or on its behalf. Such information is customer information regardless of whether it pertains to (a) individuals with whom the covered institution has a customer relationship or (b) the customers of other financial institutions where such information has been provided to the covered institution.964 For transfer agents, customer information is defined as any record containing nonpublic personal information ‘‘identified with any natural person, who is a securityholder of an issuer for which the transfer agent acts or has acted as transfer agent, that is handled or maintained by the transfer agent or on its behalf.’’ 965 While some commenters supported the proposed scope of the rules create duplicative notification obligations where there is unauthorized access to sensitive customer information that is held or maintained by one financial institution on behalf of another, since proposed Rule 30 [sic—rule 248.30] notification obligations would appear to apply to both financial institutions simultaneously even though only one set of customer information was accessed.’’). The revisions specify that only one notification is required in that circumstance. 962 Duplicative notices may nevertheless happen as a result of different requirements from other existing regulations. See supra section IV.C.2.a(3). 963 See supra section II.A.3.a. 964 Final rule 248.30(d)(5)(i). 965 Final rule 248.30(d)(5)(ii). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 regarding the definition of customer information,966 one commenter stated that the rule should focus on sensitive customer information, and that the breadth of the proposed amendments was disproportionate to the risks of disclosure.967 This commenter also stated that applying the service provider requirements to all service providers that have access to any customer information would be disproportionate to the benefits and risk presented and suggested that it apply only to service providers with access to sensitive customer information.968 We acknowledge that applying the policies and procedures requirements to all customer information will impose costs that would not be incurred if the amendments covered only sensitive customer information. However, this approach creates important benefits. For example, the disclosure of customer information could be used for phishing attacks or similar efforts to access sensitive customer information. Moreover, with respect to policies and procedures specifically, the costs of creating policies and procedures for all information should not be much larger than the cost of creating them for only sensitive customer information, because the cost is in the creation of the policies and procedures rather than in their application. We acknowledge, however, that in some organizations the sensitive customer information could be located in different systems or accessible to different employees, such that policies and procedures for non-sensitive information would be different. In addition, covered institutions’ existing policies and procedures may be less likely to meet the new requirements as a result of the breadth of the definition and would thus require modifications. Because the final amendments extend the scope of customer information subject to protection to information possessed by a covered institution regardless of whether the customers are a covered institution’s own, or those of another financial institution whose customer information has been provided to the covered institution, the benefits of the final amendments will extend to a wide range of individuals such as prospective customers, account beneficiaries, recipients of wire transfers, or any other individual whose customer information a covered institution comes to possess, so long as the individuals are customers of a 966 See, e.g., EPIC Comment Letter; Better Markets Comment Letter. 967 See IAA Comment Letter 1. 968 See IAA Comment Letter 1. PO 00000 Frm 00082 Fmt 4701 Sfmt 4700 financial institution.969 We anticipate that, in many instances, the preventative measures taken by covered institutions to safeguard customer information in response to the final amendments will generally also protect these additional individuals.970 Hence, while we expect that these measures could have potential significant benefits for these additional individuals, we do not expect them to result in significant additional costs for the covered institutions. However, we acknowledge that, in certain instances, this may not be the case. For example, information about prospective customers used for sales or marketing purposes may be housed in separate systems from the covered institution’s ‘‘core’’ customer account management systems and require additional efforts to secure. Regarding the measures taken by covered institutions to comply with the final amendments’ incident response program requirements, following a data breach, we do not anticipate that extending the scope of information covered by the final amendments to include these additional individuals will have a significant effect. These costs will include additional reputational harm and litigation as well as increased notice delivery costs. However, given that the distinction between customers and other individuals is generally not relevant under existing State notification laws— which apply to information pertaining to residents of a given State—we expect that most covered institutions will have already undertaken to protect and provide notification of data breaches to these additional individuals. Some commenters agreed that covered institutions should safeguard the customer information they receive from other financial institutions.971 Other commenters disagreed with the proposed requirement that a covered institution would have to notify individuals whose sensitive customer information was compromised even when these individuals were not the covered institution’s customers.972 Some commenters stated that it would be impractical for covered institutions to identify and contact such individuals, or that it could confuse these 969 See final rule 248.30(d)(5). example, measures aimed at strengthening information safeguards such as improved user access control or staff training will likely protect a covered institution’s customer information systems regardless of whether they house the information of the covered institution’s own customers or those of another financial institution. 971 See, e.g., ICI Comment Letter 1; Better Markets Comment Letter. 972 See, e.g., SIFMA Comment Letter 2; CAI Comment Letter. 970 For E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations individuals.973 However, such individuals will benefit from their information being included in the scope of the amendments’ requirements. Another commenter stated that this provision of the requirement could lead to duplicative notification obligations if the two financial institutions involved— that is, the institution that received the information and the institution that provided the information—were both covered institutions.974 After considering comments, we have modified the amendments to avoid requiring that multiple covered institutions notify the same affected individuals for a given incident.975 The final amendments require that when an incident occurs at a covered institution or at one of its service providers that is not itself a covered institution, the covered institution has the obligation to ensure that a notice is provided to affected individuals, regardless of whether this covered institution has a customer relationship with the individuals. If this covered institution received the customer information from another covered institution, the two covered institutions can coordinate with each other to decide who will send the notice. As discussed above,976 we expect that this modification will reduce compliance costs without reducing the benefits of the final amendments. lotter on DSK11XQN23PROD with RULES2 b. Extension To Cover All Transfer Agents The final amendments extend both the safeguards rule and the disposal rule to apply to any transfer agent registered with the Commission or another appropriate regulatory agency. Before this adoption, the safeguards rule did not apply to any transfer agents, and the disposal rule only applied to transfer agents registered with the Commission.977 In addition to requiring transfer agents to design an incident response program, the benefits and costs of which are discussed separately above,978 the amendments create an additional obligation on transfer agents to develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information.979 Moreover, the final amendments create an obligation 973 See ACLI Comment Letter; SIFMA Comment Letter 2; Federated Comment Letter. 974 See CAI Comment Letter. 975 See final rule 248.30(a)(4); see also supra sections II.A.3.a and IV.D.1.c. 976 See supra section IV.D.1.c. 977 See supra section II.B.2. 978 See supra section IV.D. 979 See final rule 248.30(a). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 on transfer agents registered with a regulatory agency other than the Commission to develop, implement, and maintain written policies and procedures that address the proper disposal of customer information.980 As discussed in sections II.B.2 and IV.C.3.e, in the U.S., transfer agents provide the infrastructure for tracking ownership of securities. Maintaining such ownership records necessarily entails holding or accessing non-public information about a large swath of the U.S. investing public.981 Given the highly concentrated nature of the transfer agent market,982 a general failure of customer information safeguards at a transfer agent could negatively impact large numbers of customers.983 One commenter stated that because transfer agents’ customers are not the individuals whose information they hold but the issuers of securities, the proposed amendments were ill-fitting, which decreased their efficacy and increased their complications.984 This commenter also stated that the proposed amendments were not well-suited for transfer agents, and that this highlighted the need for a more in-depth analysis of how the final amendments may impact transfer agents, their customers (the issuers of securities), and securityholders.985 In response to this commenter, we have supplemented below the analysis of the benefits and costs of extending the scope of Regulation S–P to transfer agents.986 The final amendments extend the scope of the safeguards rule to cover any transfer agent registered with the Commission or another appropriate regulatory agency. As discussed above,987 the safeguards rule requires covered institutions to develop written policies and procedures, including a response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of 980 See 17 CFR 248.30(a). commenter disagreed with this notion, stating that many transfer agents do not have the type or scope of personal information which could lead to further complications for shareholders. See STA Comment Letter 2. Transfer agents that do not possess customer information as defined in final rule 248.30(d)(5) will not be covered by the amendments and as such will not be subject to its associated costs. 982 See supra section IV.C.3.e. 983 More than 40% of registered transfer agents maintain records for more than 10,000 individual accounts. See supra Figure 8. 984 See STA Comment Letter 2. 985 See STA Comment Letter 2. 986 Additional context is provided in section IV.C.3.f. See also supra section II.B.2 for a discussion of why the amendments are appropriate for transfer agents. 987 See supra section IV.D.1. 981 One PO 00000 Frm 00083 Fmt 4701 Sfmt 4700 47769 customer information, including customer notification procedures. The benefits and costs of the response program, as detailed above,988 will also apply to transfer agents. Additionally, because transfer agents may be considered service providers under State law, or may maintain but not own or license customer information data, they are likely to be required by State law to notify the entity that owns or licenses the data (the issuer of the securities), which in turn could be required to notify the affected individuals (the holders of the securities).989 Hence, it is possible that the final amendments will result in two notices being sent for the same incident—one by the issuer of the securities, as required by State law, and one by the issuer’s transfer agent, as required by the final amendments. Some commenters stated that a second notification would have negative consequences for customers without providing any benefits.990 One commenter stated that the proposed requirements would not provide shareholders with helpful, new information but rather that two different notices, from two different entities, concerning the same breach would likely result in shareholder confusion.991 Another commenter added that this second notice could potentially result in confusion, questions, and unnecessary costs to the transfer agent and the issuer.992 We disagree that no helpful, new information will be provided to the affected customers. In the situation where State law requires a notification from the issuer and the final amendments require a notification from the transfer agent as a covered institution, the final amendments will help ensure that the individuals whose information has been breached receive an informative and timely notice, with the benefits over the baseline described above.993 Securityholders will benefit by potentially receiving additional and more timely information on a given breach.994 In addition, in response to 988 See supra section IV.D.1.a; see also infra footnote 1003 and accompanying text for a discussion on additional costs for transfer agents. 989 See supra section IV.C.2.a(3). 990 See, e.g., STA Comment Letter 2. 991 See STA Comment Letter 2. 992 See Computershare Comment Letter. 993 See supra section IV.D.1.b. 994 See supra section IV.D.1.b. Commenters stated that issuers may already have adopted policies and procedures to adhere to the strictest standards thereby already notifying securityholders consistent with the proposed amendments. See Computershare Comment Letter; STA Comment Letter 2. We acknowledge that this may be the case. E:\FR\FM\03JNR2.SGM 03JNR2 47770 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 commenters’ concerns, we have modified the final amendments such that, for the cases where multiple notifying entities are covered institutions, only one notice needs to be sent to satisfy the amendments’ requirements.995 Furthermore, some States allow for the entity that is the victim of a breach, but does not own or license the data, to notify individuals directly.996 Hence, we expect that in some instances, the notice required by the final amendments will satisfy the State law requirements and only one notice will be sent. In these instances, additional costs related to the second notice will be avoided. For the instances where two notices will nevertheless be sent, we acknowledge that a second notification will impose costs on the transfer agent or its customer the issuer. As discussed below, we estimate that certain costs associated with the preparation and distribution of notices will be, on average, $5,178 per year per covered institution.997 We understand it is possible that, in some cases, customers may be confused when receiving a notice from an entity they do not recognize and may read the notification as a phishing attempt or another nefarious scheme. However, we do not expect that a second notice will impose significant costs on the affected customers, and we expect that this confusion will be mitigated by the content of the notice. As discussed in section IV.D.1.b(5), the notice is required to include a description of the incident in general terms. We expect that this description will help explain the situation in the case where customers do not have a direct relationship with the transfer agent sending the notice and, therefore, that it will reduce potential customer confusion from duplicative notification, as discussed above.998 Before this adoption, transfer agents that are registered with the Commission were not required to notify customers directly in case of a breach under 995 See supra sections IV.D.1.c and IV.D.2.a for additional discussions of the case where two covered institutions are involved in the same incident. 996 See, e.g., Wyo. Stat. section 40–12–502(g) (‘‘The person who maintains the data on behalf of another business entity and the business entity on whose behalf the data is maintained may agree which person or entity will provide any required notice as provided in subsection (a) of this section, provided only a single notice for each breach of the security of the system shall be required.’’). See also supra section IV.C.2.a(3). 997 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $3,862 per year per covered institution. See infra section V. 998 See supra section II.B.2. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Federal law.999 As discussed above, we also expect that, under State law, transfer agents are likely to be considered service providers (or entities that use or maintain but do not own or license data) and as such are typically only required to notify the issuer of securities in case of breach.1000 Hence, we expect that to satisfy the amendments’ requirements, these transfer agents might need to design and implement a response program and notification procedures, which will require some resources.1001 As discussed below, we estimate that certain costs associated with developing and implementing policies and procedures, which include the response program and notification procedures, to comply with the final amendments will be, on average, $17,950 per year per transfer agent.1002 In addition, as for other types of covered institutions, if transfer agents respond to this requirement by improving their customer information safeguards beyond what is required by the final amendments, they will incur additional costs.1003 We expect that the different costs resulting from the written policies and procedures requirement will be passed on to the transfer agents’ customers (the issuers of securities) and ultimately to the holders of these securities. Transfer agents that are registered with an appropriate regulatory agency other than the Commission may already 999 In 2023, there were 251 such transfer agents. See supra section IV.C.3.e. 1000 However, there are some States where transfer agents may be required by State law to notify the affected individuals directly. See supra footnote 574 and accompanying text. 1001 Transfer agents registered with the Commission may already have such procedures in place and may already be notifying customers. See ICI Comment Letter 1 (‘‘We understand that this is a common practice today for investment companies wherein their transfer agents assume responsibility for sending affected customers breach notices.’’). However, we do not have data on how common such arrangements are and commenters did not provide such data. 1002 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $5,425 per year per transfer agent. See infra section V. These estimated costs are higher than for other types of covered institutions because transfer agents were not, before this adoption, covered by the safeguards rule. In addition, transfer agents registered with a regulatory agency other than the Commission were not, before this adoption, covered by the disposal rule. The final amendments extend both the safeguards rule and the disposal rule to apply to any transfer agent registered with the Commission or another appropriate regulatory agency. The additional costs that could be incurred by transfer agents as a result are discussed below. See infra text accompanying footnote 1021. 1003 We are unable to quantify expected costs resulting from such enhancements. See supra footnote 717 and accompanying text. PO 00000 Frm 00084 Fmt 4701 Sfmt 4700 be required to notify affected individuals in case of a breach under the Banking Agencies’ Incident Response Guidance.1004 As discussed above, although the notification requirement under the final amendments is largely aligned with the Banking Agencies’ Incident Response Guidance, there are some differences.1005 Hence, for these institutions, we expect that the costs of the requirements will primarily be to review and, if needed, update their notification procedures to ensure consistency with the amendments, though there may be some costs associated with updating procedures to achieve consistency with the final amendments.1006 As discussed below, we estimate that certain costs associated with developing and implementing policies and procedures to comply with the final amendments will be, on average, $17,950 per year per transfer agent.1007 One commenter supported the proposed inclusion of transfer agents in the safeguards rule, stating that it would eliminate the asymmetry between the transfer agents registered with the Commission and those registered with another regulatory agency and that it would promote investor protection, regulatory parity, and fair competition among firms.1008 We agree with this commenter. Another commenter stated that expanding the regulation’s scope to include transfer agents was long overdue.1009 Other commenters opposed the proposed inclusion.1010 One commenter 1004 In 2023, there were 64 such transfer agents; see supra section IV.C.3.e; see also supra section IV.C.2.b. 1005 For example, the Banking Agencies’ Incident Response Guidance requires entities to notify customers ‘‘as soon as possible,’’ but does not specify a precise deadline, whereas the final amendments require that the notice be sent as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of sensitive customer information has occurred or is reasonably likely to have occurred. In addition, the Banking Agencies’ Incident Response Guidance has a different definition of ‘‘sensitive customer information’’ and has different requirements regarding an entity’s service providers. See supra section IV.C.2.b for a description of the Banking Agencies’ Incident Response Guidance’s requirements. 1006 We expect these reviews and updates will result in the entities incurring costs generally smaller than the costs of adopting and implementing new policies and procedures, as discussed in Section V. 1007 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $5,425 per year per transfer agent. See infra section V. 1008 See Better Markets Comment Letter. 1009 See ICI Comment Letter 1. 1010 See STA Comment Letter 2; Computershare Comment Letter. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 stated that requiring transfer agents to notify customers directly would create undue costs for transfer agents, that the proposed amendments included a potential for conflicting regulations where there are overlapping State and Federal regulations, and that this would lead to unnecessary expenses as transfer agents attempt to develop policies and procedures capable of addressing these potentially conflicting regulations.1011 This commenter suggested that the Commission either preempt State law or prepare and produce a cost-benefit analysis identifying the specific ways in which the amendments would be an improvement over existing regulations.1012 Another commenter—a transfer agent—stated that it already had policies and procedures to notify issuers of securities in accordance with State law and that notifying the securityholders directly could violate some of its existing contracts with issuers.1013 In response to commenters and as discussed above,1014 we have modified the final amendments to minimize the likelihood of multiple notices being sent for the same incident, which will decrease compliance costs.1015 The final amendments do not necessarily require covered institutions to notify affected customers directly in case of breach, but instead provide that a covered institution must ensure that the required notice is sent.1016 Hence, if a transfer agent has a contract with an issuer that prevents it from notifying securityholders directly, the transfer agent will be able to, under the final amendments, enter into an agreement with the issuer so that the issuer sends the notice on its behalf.1017 In 1011 See STA Comment Letter 2. The commenter did not describe such conflicts. 1012 See STA Comment Letter 2. 1013 See Computershare Comment Letter (‘‘However, as state breach notification laws have been in effect for nearly two decades, Computershare has long-standing policies and procedures for notification, and contractual obligations to clients that are designed to track state law requirements. Such contract provisions may specifically prohibit Computershare as the transfer agent from notifying securityholders as the issuers have the requirement to notify their securityholders under state law.’’). 1014 See supra section IV.D. 1015 See also supra section II.B.2 for a discussion of how the final amendments permit transfer agents and issuers to develop arrangements to address potentially conflicting regulations. 1016 See final rule 248.30(a)(4). 1017 Such contract renegotiation will involve some costs for the transfer agents. It is difficult for us to quantify these costs, as we have no data on the provisions of existing contracts between transfer agents and security issuers relating to customer notification of data breaches, and no commenter suggested such data. Such costs are likely to be contract specific, as they will depend on the degree to which each existing contract may be revised as VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 consideration of the commenter’s request for an analysis that considers the incremental effects of the rule over existing regulations, we have (i) conducted supplemental analyses of the baseline regarding State law requirements,1018 and (ii) supplemented the analysis of the benefits and costs of the final amendments over this baseline, highlighting the different areas where the final amendments will improve over existing regulations.1019 The final amendments to the safeguards rule also require transfer agents to develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information.1020 In general, transfer agents with written policies and procedures to safeguard customer information would be at reduced risk of experiencing such safeguard failures.1021 Because some State laws require written policies and procedures to protect customer information,1022 and because transfer agents, by the nature of their business models, are likely to hold information about individuals residing in a large number of States, we expect that most transfer agents already have policies and procedures in place.1023 In addition, transfer agents registered with a regulatory agency other than the Commission may also be subject to the Banking Agencies’ Safeguards Guidance or other Federal regulation.1024 Hence, we expect the costs of this requirement to be limited and to consist mostly of reviewing and updating existing policies and procedures to ensure consistency with the safeguards rule.1025 As discussed below, we estimate that certain costs associated with developing and implementing policies and procedures to comply with a result of the final amendments. Many such contracts may not be revised at all, while others may undergo more revisions. Moreover, in many cases, even where a contract could be revised as a means of complying with the final requirements, the covered institution may pursue compliance by other means. 1018 See supra section IV.C.2. 1019 See supra section IV.D.1.b. 1020 See final rule 248.30(a)(1). 1021 See supra section IV.D.1 for a discussion of the benefits of written policies and procedures generally. 1022 See supra section IV.C.2.b. 1023 In addition, some transfer agents may also be subject to other regulations, such as the GDPR, and already have customer information safeguards in place as a result. See supra section IV.C.2.b. 1024 See supra footnote 604 and accompanying text. 1025 We expect these reviews and updates will result in the entities incurring costs generally smaller than the costs of adopting and implementing new policies and procedures, as discussed in section V. PO 00000 Frm 00085 Fmt 4701 Sfmt 4700 47771 the final amendments will be, on average, $17,950 per year per transfer agent.1026 The final amendments extend the disposal rule to transfer agents registered with a regulatory agency other than the Commission.1027 The amendments require these transfer agents to properly dispose of customer information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.1028 Because these transfer agents are subject to regulatory requirements and to State laws which require proper disposal of customer information,1029 we expect that they are likely to already have procedures in place for the disposal of customer information. Therefore, to the extent that transfer agents already have in place procedures that are consistent with these provisions of the final amendments, the benefits and costs relating to this requirement will be reduced for these institutions and for the customers whose information is covered by this requirement. Hence, we expect the costs of this requirement to be limited and to consist mostly of reviewing and updating existing policies and procedures to ensure consistency with the safeguards rule.1030 As discussed below, we estimate that certain costs associated with developing and implementing policies and procedures to comply with the final amendments will be, on average, $17,950 per year per transfer agent.1031 1026 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $5,425 per year per transfer agent. See infra section V. As discussed above, these estimates reflect all of the policies and procedures required by the final amendments, including those regarding the incident response program. See supra footnote 1003 and accompanying text. 1027 Transfer agents registered with the Commission were already subject to the disposal rule before this adoption. See 17 CFR 248.30(b). 1028 See 17 CFR 248.30(b). 1029 The Banking Agencies’ Safeguards Guidance requires that a covered entity’s information security program be designed to ensure the proper disposal of customer information and consumer information. See supra footnote 612 and accompanying text; see also supra section IV.C.2.b for a discussion of State law disposal requirements. 1030 We expect these reviews and updates will result in the entities incurring costs generally smaller than the costs of adopting and implementing new policies and procedures, as discussed in section V. 1031 This estimate is an annual average for the first three years. The corresponding ongoing annual costs beyond the first three years are estimated to be on average $5,425 per year per transfer agent. See infra section V. As discussed above, these estimates reflect all of the policies and procedures required E:\FR\FM\03JNR2.SGM Continued 03JNR2 47772 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 3. Recordkeeping The recordkeeping provisions of the final amendments require covered institutions (other than funding portals) to make and maintain written records documenting compliance with the requirements of the safeguards rule and of the disposal rule.1032 Each covered institution (other than funding portals) is required to make and maintain written records documenting its compliance with, among other things: its written policies and procedures required under the final amendments, including those relating to its service providers and its consumer information and customer information disposal practices; its assessments of the nature and scope of any incidents involving unauthorized access to or use of customer information; any notifications of such incidents received from service providers; steps taken to contain and control such incidents; and, where applicable, any investigations into the facts and circumstances of an incident involving sensitive customer information, and the basis for determining that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.1033 These recordkeeping requirements will help facilitate the Commission’s inspection and enforcement capabilities. Covered institutions may react to this enhanced ability of the Commission staff to detect deficiencies and impose sanctions against non-compliance due to the recordkeeping requirements by taking more care to comply with the substance of the amendments, which may result in material improvement in the response capabilities of covered institutions and mitigate potential harm resulting from the lack of an adequate response program. As such, the amendments’ recordkeeping requirements might benefit customers through channels described in section IV.D.1. One commenter supported the proposed recordkeeping requirements.1034 Another commenter requested a clarification of the proposed requirements, suggesting that the text in the final amendments include more by the final amendments, including those regarding the incident response program. See supra footnote 1003 and accompanying text. 1032 See final rule 248.30(c). As discussed above, funding portals have recordkeeping requirements that are different from those of other covered institutions under the final amendments. See supra footnote 385. 1033 See the various provisions of final rule 248.30(a) and 248.30(b)(2). 1034 See ICI Comment Letter 1. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 detail.1035 In response to this commenter, we have provided a more detailed description of the requirements in the rule text of the final amendments.1036 We expect that this change will mitigate compliance costs for covered institutions. We do not expect the final recordkeeping requirements to impose substantial compliance costs. As covered institutions are currently subject to similar recordkeeping requirements applicable to other required policies and procedures, we do not anticipate that covered institutions will need to invest in new recordkeeping staff, systems, or procedures to satisfy the new recordkeeping requirements.1037 The incremental administrative costs arising from maintaining additional records related to these provisions using existing systems are covered in the Paperwork Reduction Act analysis in section V and are estimated to be $420 per year per covered institution other than funding portals, and $630 per year per funding portal.1038 4. Exception From Annual Notice Delivery Requirement The final amendments incorporate into the regulation an existing statutory exception to the requirement that a broker-dealer, investment company, or registered investment adviser deliver an annual privacy notice to its customers.1039 An institution may rely on the exception to forgo notice if it has not changed its policies and practices with regard to disclosing nonpublic personal information from those it most recently provided to the customer via privacy notice.1040 The effect of the exception is to eliminate the requirement to send the same privacy policy notice to customers on multiple occasions. As such notices would provide no new information, receiving 1035 See IAA Comment Letter 1. supra section II.C and final rule 240.30(d)(1). 1037 See, e.g., 17 CFR 240.17a–3; 17 CFR 275.204– 2; 17 CFR 270.31a–1; and 17 CFR 240.17Ad–7. Where permitted, entities may choose to use thirdparty providers in meeting their recordkeeping obligations. See, e.g., 17 CFR 275.204–2(e)(2). 1038 See infra section V. As discussed above, funding portals have recordkeeping requirements that are different from those of other types of covered institutions. See supra footnote 385. 1039 See supra section II.D; see also 15 U.S.C. 6803(f). Additionally, under existing statutory exceptions notice is not required when the institution provides certain information to a third party to perform services for or functions on behalf of the institution, such as information sharing necessary to perform transactions on behalf of the customer, information sharing directed by the customer, or reporting to credit reporting agencies. See 15 U.S.C. 6802(e). 1040 See final rule 248.5(e)(1)(ii). 1036 See PO 00000 Frm 00086 Fmt 4701 Sfmt 4700 multiple copies of such notices is unlikely to provide any significant benefit to customers. Moreover, we expect that widespread reliance on the proposed exception is more likely to benefit customers, by providing clearer signals of when privacy policies have changed.1041 At the same time, reliance on the exception will reduce costs for covered institutions. However, we expect these cost savings to be limited to the administrative burdens discussed in section V.1042 We received one comment supporting the proposed exception.1043 We did not receive any comments suggesting alternatives to the proposed exception or suggesting that we not proceed with it. Because the exception became effective when the statute was enacted, the aforementioned benefits are likely to have already been realized. Consequently, we do not expect that its inclusion will have any economic effects relative to the current status quo. E. Effects on Efficiency, Competition, and Capital Formation As discussed above, market imperfections might lead to underinvestment in customer information safeguards, and to information asymmetry about incidents resulting in unauthorized access to or use of customer information.1044 This information asymmetry might prevent customers whose sensitive information was compromised from taking timely mitigating actions. The final amendments aim to mitigate the inefficiency resulting from these imperfections by imposing mandates for policies and procedures. Specifically, the amendments require covered institutions to include a response program for incidents involving unauthorized access to or use of customer information. This response program must address assessment and containment of such incidents, and might thereby reduce potential underinvestment in these areas, improving customer information safeguards as a result.1045 In addition, by requiring notification to customers about certain safeguard failures, the amendments could reduce the aforementioned information asymmetry and help customers choose a covered 1041 In other words, reducing the number of privacy notices with no new content allows customers to devote more attention to parsing notices that do contain new content. 1042 See infra footnote 1119. 1043 See ICI Comment Letter 1. 1044 See supra section IV.B. 1045 See supra section IV.D (discussing the benefits and costs of the response program requirements). E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations institution that meets their needs or preferences. The notification requirement, by imposing reputational costs on institutions whose safeguards of customer information fail, might also provide covered institutions with greater incentives to improve their safeguards, contributing to lowering the probability of a breach even further. While the amendments have the potential to mitigate these inefficiencies, the scale of the overall effect is difficult to estimate. Due to the presence of existing regulations, including State notification laws, and existing security practices,1046 these inefficiencies are likely to be of limited magnitude. However, to the extent that they remain, the amendments might contribute to reduce them.1047 Insofar as the proposed amendments alter covered institutions’ practices, the improvement—in terms of the effectiveness of covered institutions’ response to incidents, customers’ ability to respond to breaches of their sensitive customer information, and in reduced information asymmetry about covered institutions’ efforts to safeguard this information—is impracticable to quantify due to data limitations discussed previously.1048 The final provisions will not have first order effects on channels typically associated with capital formation (e.g., taxation policy, financial innovation, capital controls, investor disclosure, market integrity, intellectual property, rule-of-law, and diversification). Thus, the final amendments are unlikely to lead to significant effects on capital formation.1049 Because the amendments are likely to impose proportionately larger direct and indirect costs on smaller and more geographically limited covered institutions, these institutions’ competitiveness vis-à-vis their larger peers might be affected. Such covered institutions—which may be less likely to have written policies and procedures for incident response programs already in place—will face disproportionately higher costs resulting from the proposed 1046 See supra sections IV.C.1 and IV.C.2. IV.D.1.b discusses in detail how the amendments’ requirements differ from existing State notification laws. 1048 See, e.g., supra sections IV.A. and IV.D.1. 1049 While we do not expect first-order effects on capital formation, we agree with one commenter who stated that the amendments would contribute to promote transparency and consistency on capital markets, which would benefit investors, issuers, and other market participants. See Nasdaq Comment Letter. In addition, as discussed below, there might be incremental effects on the capital formation associated with issuers relying on funding portals. See infra text accompanying footnote 1053. amendments.1050 Thus, the amendments might have negative effects on competition, to the extent these higher costs represent a barrier to entry or limit smaller institutions’ viability as a competitive alternative to larger institutions. However, given the considerable competitive challenges arising from economies of scale and scope already faced by smaller firms, we do not anticipate that the costs associated with this adoption will significantly alter these challenges and therefore expect the incremental effects of these amendments on competition to be limited. On the other hand, the amendments may have positive competitive effects also. Because safeguarding customer information, including through cybersecurity, is disproportionately more expensive for smaller institutions,1051 customers today may already suspect that smaller institutions have more severe under-investments in cybersecurity than larger institutions and may therefore avoid smaller institutions. If disproportionately large costs faced by smaller institutions cause existing and potential customers to suspect that these institutions are more likely to avoid such costs, the existing information asymmetry may be greater for these institutions. Smaller institutions may be unable to overcome these suspicions on their own absent regulatory policy, and so asymmetries of information may represent a barrier to entry for smaller institutions. In this case, if the amendments result in customers having better information on the covered institutions’ efforts towards protecting customer information, there will be a positive effect on competition. Hence, the overall effect on smaller and more geographically limited covered institutions’ competitiveness remains difficult to predict. With respect to funding portals, the situation could be different. As discussed above, the final amendments are likely to impose proportionately larger costs on smaller covered institutions,1052 including smaller funding portals. At the margin, it is possible that the final amendments will lotter on DSK11XQN23PROD with RULES2 1047 Section VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 1050 The development of policies and procedures entails a fixed cost component that imposes a proportionately larger burden on smaller firms. We expect smaller broker-dealers and investment advisers will be most affected. See supra sections IV.C.3.a and IV.C.3.c. 1051 See, e.g., Anna Cartwright et al., Cascading Information On Best Practice: Cyber Security Risk Management in UK Micro and Small Businesses and the Role of IT Companies, Computers & Security 131 (2023) for a list of articles discussing the cybersecurity challenges faced by small businesses. 1052 See supra footnote 1051. PO 00000 Frm 00087 Fmt 4701 Sfmt 4700 47773 result in a smaller number of funding portals, which could result in a smaller number of crowdfunding intermediaries available to potential issuers. Crowdfunding intermediaries facilitate capital raising by smaller issuers relying upon Regulation Crowdfunding to offer or sell securities. To the extent that the final amendments result in a decrease in the availability of funding portals or in an increase in the costs of utilizing crowdfunding intermediaries for issuers or investors, they may have incremental negative effects on capital formation associated with issuers relying on such intermediaries. However, we expect the incremental negative effect on competition that could result from this to be mitigated by the already significant degree of concentration among crowdfunding intermediaries observed today.1053 We further expect these effects to be mitigated to the extent that issuers may be able to switch to using other intermediaries for their Regulation Crowdfunding offerings, such as larger funding portals. Lastly, the amendments may have a positive effect on capital formation in offerings under Regulation Crowdfunding to the extent that the additional procedural requirements in the final amendments increase protection of customer information and thereby attract additional potential investors. Hence, the overall effect remains difficult to predict. Two commenters raised concerns about barriers to entry disproportionately affecting smaller covered institutions. One commenter stated that smaller advisers had been significantly affected by ‘‘one-size-fitsall’’ regulations that effectively require substantial fixed investments in infrastructure, personnel, technology, and operations, adding that they were concerned that these stressors and barriers would negatively affect smaller advisers’ ability to continue to serve their clients.1054 Another commenter stated that we had done ‘‘little analysis’’ about the impact of recent proposals on small broker-dealers, competition within the brokerage industry, and whether the proposals could contribute to barriers for new entrants into the markets.1055 We acknowledge these 1053 See supra section IV.C.3.b. IAA Comment Letter 1. 1055 See ASA Comment Letter. In the Proposing Release, we discussed that the compliance costs of the proposed amendments could be higher for smaller covered institutions such as small brokerdealers who do not have a national presence. See Proposing Release at section III.D.1.a. We also discussed the potential negative competitive effects of the proposed amendments on smaller covered institutions and requested comments on the way we 1054 See E:\FR\FM\03JNR2.SGM Continued 03JNR2 47774 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 commenters’ concerns about smaller covered institutions and, as discussed above, understand that smaller covered institutions might be disproportionately affected by the final amendments.1056 In response to these concerns, we have changed the final amendments from the proposal. We expect that some of these changes may mitigate costs and may reduce, but not eliminate, the degree to which the final amendments act as a barrier to entry.1057 We have also responded to commenters’ concerns by adopting longer compliance periods for all covered institutions relative to the proposal and an even longer compliance period for smaller covered institutions.1058 The final amendments provide 24 months for smaller covered institutions to comply with the final amendments after the date of publication in the Federal Register, compared to 18 months for larger covered institutions.1059 Since smaller covered institutions are those most likely to exit the market in response to high compliance costs, this longer compliance period will mitigate the negative effect of the final amendments on competition, for example by giving smaller covered institutions opportunities to learn about compliance with the final requirements from larger covered institutions’ earlier compliance.1060 With respect to competition among transfer agents, the situation could be characterized the effects on competition. See Proposing Release at sections III.F. and III.G. We received no comment letter discussing specifically how the proposed amendments would affect the level of competition in the different markets in which covered institutions operate. 1056 See supra footnote 1051 and accompanying text. 1057 These changes include (1) requiring that a service provider notify the affected covered institution of a breach in a period of 72 hours instead of 48 hours; and (2) requiring that covered institutions oversee, monitor, and conduct due diligence on their service providers to ensure that they take appropriate measures to protect customer information and notify the covered institution in case of breach instead of requiring written contracts. See supra section IV.D.1.c on the expected effects of these changes. Because smaller covered institutions are more likely to have limited bargaining power when negotiating with their service providers, we expect that these changes may particularly reduce the burdens on those entities and may reduce, but will not eliminate, the extent to which these requirements act as a barrier to entry. 1058 The proposed compliance period was 12 months from effective date for all covered institutions. See Proposing Release at section II.I. 1059 See supra Table 3 for a description of small covered institutions for the purposes of the final amendments’ tiered compliance period. 1060 See FSI Comment Letter (‘‘We propose a longer implementation period for smaller brokerdealers and investments advisers to allow these firms to benefit from implementation for larger industry participants.’’). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 different. Because transfer agents registered with a regulatory agency other than the Commission may already have been required to notify customers in case of breach,1061 whereas the transfer agents registered with the Commission may, before this adoption, have only been required, by State law, to notify the security issuer, the latter group may face disproportionately high compliance costs compared to the former group since they might have to design and implement new policies and procedures, including the required incident response program and notification procedures.1062 This might affect their competitiveness vis-à-vis the transfer agents registered with a regulatory agency other than the Commission.1063 Because transfer agents registered with the Commission may already have procedures in place to notify individuals affected by a data breach,1064 the magnitude of this effect is difficult to estimate. One commenter supported the proposed extension of the scope of the safeguard and disposal rules to all transfer agents and stated that it would promote fair competition among these firms by reducing asymmetry in the requirements with which different types of transfer agents must comply.1065 We agree with this commenter that including all transfer agents in the scope of both the safeguards rule and the disposal rule will contribute to enhanced competition in the market for transfer agents.1066 With respect to efficiency and competition among covered institutions’ service providers, the overall effects of the final amendments are difficult to predict. The final amendments require covered institutions to ensure that their 1061 See supra section IV.C.2.b. 2023, there were 251 transfer agents registered with the Commission and 64 transfer agents registered with another appropriate regulatory agency. See supra section IV.C.3.e. 1063 In addition, because designing and implementing new policies and procedures entails fixed costs, competition among transfer agents registered with the Commission may be affected. See supra discussion of potential competition effects on covered institutions of different sizes. 1064 See supra footnote 1002. In addition, we expect that many transfer agents already have some processes in place to contact customers since communicating information from the issuer to its security-holders is one of the core functions of transfer agents. 1065 See Better Markets Comment Letter. 1066 In particular, applying the final amendments to all transfer agents may be beneficial for competition, to the extent that applying different regulations to different entities could exacerbate existing differences in the competitive landscape. See supra section IV.C.3.e (discussing that transfer agents registered with the Banking Agencies are on average smaller than transfer agents registered with the Commission). 1062 In PO 00000 Frm 00088 Fmt 4701 Sfmt 4700 service providers protect against unauthorized access to or use of customer information and notify the covered institution in case of a breach. The final amendments also require covered institutions to oversee their service providers to ensure that these measures are enforced.1067 As discussed above,1068 we expect that most service providers will continue their relationships with covered institutions, but some service providers might not. We expect that four possible scenarios may happen: • Scenario 1: The service provider already has the processes and procedures in place to satisfy the covered institution’s obligations under the final amendments and is willing to cooperate with the oversight activities of the covered institution. • Scenario 2: The service provider does not have the necessary processes and procedures in place but is willing to adapt them to satisfy the covered institution’s obligations under the final amendments and to cooperate with the oversight activities of the covered institution. • Scenario 3: The service provider does not have the necessary processes and procedures in place and is not willing to adapt to satisfy the covered institution’s obligation under the final amendments.1069 • Scenario 4: The service provider already has the processes and procedures in place to satisfy the covered institution’s obligations under the final amendments but is not willing to cooperate with the oversight activities of the covered institution. Under scenarios 1 and 2, the relationship between the covered institution and its service provider is maintained. Hence, we do not expect significant effects on efficiency and competition in these cases.1070 On the other hand, scenarios 3 and 4 imply that the covered institution will have to either switch to a new service provider or perform the former service provider’s functions in-house. If the covered institution is unable to find a new service provider that is equivalent in its ability to provide the services, this is likely to result in a second-best outcome for the covered institution and therefore to result in a loss of efficiency.1071 1067 See final rule 248.30(a)(5). supra section IV.D.1.c. 1069 See supra section IV.C.3.f. Because taking the appropriate measures to satisfy the amendments’ requirements entails fixed costs, we expect that smaller service providers are more likely to exit (or not enter) this market than larger service providers. 1070 The other benefits and costs of these scenarios are discussed in section IV.D.1.c. 1071 Under scenario 3, we expect this effect on efficiency to be limited since the service providers 1068 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 Scenario 4 could also lead to covered institutions being forced to switch away from large, established service providers and instead to rely on smaller, less established providers that may be less capable of addressing the vulnerabilities within its control. This situation could result in a reduced ability to protect customer information. Commenters identified service providers exiting the market as a significant potential cost of the proposed requirements.1072 We expect that the changes that we have made to the final amendments, including the change from a written contract requirement to a requirement to oversee service providers and the change to an extended notification deadline of 72 hours, will reduce the likelihood of scenario 4 by giving covered institutions more flexibility in how they choose to satisfy the service provider requirements of the final amendments.1073 This will reduce the likelihood of this potential negative outcome. However, such an outcome is still possible and to the extent that it occurs, it will represent a cost of the final amendments. Because scenarios 3 and 4 result in service providers exiting the market, they also have effects on competition. While scenario 3 would result in an overall decrease in the number of service providers available to covered institutions, it would not necessarily reduce competition among service providers who are able and willing to who are the most efficient at the outsourced function are likely to also be more effective at protecting customer information. We expect this effect to be more significant under scenario 4. 1072 See ACLI Comment Letter (‘‘If service providers are unable or unwilling to change their practices, this requirement could cause regulated entities to end essential service provider arrangements with inadequate alternatives’’); SIFMA Comment Letter 2 (‘‘Indeed, some service providers may not agree to the contemplated new terms, which could limit the number of service providers that agree to such requirements, causing an undue reliance on a small group of service providers in the industry. Another possible result is that the least commercially savvy service providers would agree to these terms, which could increase unqualified providers working in the industry.’’); CAI Comment Letter (‘‘In practice, this will often force covered institutions to choose between either using the best and most dependable service providers or complying with these regulatory requirements, since many leading service providers (such as cloud service providers) do not negotiate the standard terms of their services with customers and those standard terms generally would not meet the proposed contractual requirements.’’). 1073 See supra section II.A.4. In addition, some commenters mentioned costs associated specifically with written contracts. See, e.g., ASA Comment Letter; IAA Comment Letter 1. These contracting costs could also apply to service providers and potentially result in these service providers terminating their relationship with covered institutions. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 satisfy covered institutions’ requirements. In fact, the final amendments will prevent service providers that are not willing to satisfy the minimum requirements from operating in that market and from potentially undercutting service providers who do satisfy the requirements. This will improve the competitiveness of the service providers who are able and willing to satisfy the requirements. The situation is different for scenario 4, which would result in a decrease in the number of service providers with adequate customer information safeguards and notification procedures. This would result in a decrease in competition, and this is a potential cost of the regulation. One commenter stated that the proposed amendments could lead to service providers not agreeing with the new requirements, adding that it could result in covered institutions relying on a small group of service providers in the industry.1074 This commenter also stated that some service providers may choose not to enter into agreements with covered institutions as a result of the proposed amendments.1075 We acknowledge that this is a risk of the final amendments. However, we expect that the modifications that we have made to the service provider provisions of the final amendments will reduce the costs to service providers of satisfying covered institutions’ requirements,1076 and might therefore reduce the likelihood of this potential negative outcome. Because of the reasons described above,1077 we are unable to estimate the likelihood of the different scenarios and, therefore, we are unable to quantify the efficiency and competition effects of the service provider provisions of the final amendments. Some commenters requested that the Commission consider interactions between the effects of the proposed rule and other recent Commission rules, as well as practical realities such as implementation timelines.1078 As discussed above, the Commission acknowledges that overlapping compliance periods may in some cases increase costs, particularly for smaller entities with more limited compliance resources.1079 This effect can negatively impact competition because these entities may be less able to absorb or pass on these additional costs, making 1074 See SIFMA Comment Letter 2. id. 1076 See supra section IV.D.1.c. 1077 See id. 1078 See supra section IV.C. 1079 See supra section IV.D. 1075 See PO 00000 Frm 00089 Fmt 4701 Sfmt 4700 47775 it difficult for them to remain in business or compete. We acknowledge that to the extent overlap occurs, there could be costs that could affect competition. However, we do not expect these costs to be significant, for two reasons. First, the final amendments mitigate overall costs relative to the proposal,1080 including by adopting longer compliance periods for all covered institutions, and an even longer compliance period for smaller covered institutions because they may have more limited compliance resources. The final amendments also reduce costs for both larger and smaller entities, relative to the proposal, notably by removing the proposed requirement to have a written contract with service providers. Thus, any higher costs or potential negative effects on competition due to overlapping compliance periods raised in the context of the proposal may be mitigated under the final amendments. Second, as explained in section IV.D, many of the rules commenters named affect limited sets of covered institutions, and the compliance dates are generally spread out over a more than three-year period, including several that precede the compliance dates of the final amendments. These factors will limit the incidence of covered institutions affected by overlapping compliance dates. Additionally, we anticipate that neither the recordkeeping provisions nor the exception from annual privacy notice delivery requirements will have a notable impact on efficiency, competition, or capital formation due to their limited economic effects.1081 As discussed elsewhere, we do not expect the recordkeeping requirements to impose material compliance costs, and we therefore expect the economic effects of the exception to be limited. And, as the economic effects of the recordkeeping provisions are limited, any overlapping compliance dates involving recordkeeping will likewise have limited effect on competition. F. Reasonable Alternatives Considered In formulating the final amendments, we have considered various reasonable alternatives. These alternatives are discussed below. 1. Reasonable Assurances From Service Providers Rather than requiring the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to 1080 See supra section IV.B. final rule 248.30(c) and final rule 248.5; see also supra sections IV.D.3 and IV.D.4. 1081 See E:\FR\FM\03JNR2.SGM 03JNR2 47776 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations require oversight, including through due diligence and monitoring, of service providers to ensure service providers take appropriate measures to protect against unauthorized access to or use of customer information and provide notification to the covered institution if a breach of security occurs,1082 the Commission considered requiring covered institutions to obtain ‘‘reasonable assurances’’ from service providers instead. One commenter supported this alternative for some service providers.1083 This alternative requirement would be a lower threshold than the final provisions requiring the establishment, maintenance, and enforcement of written policies and procedures designed to require oversight, and as such would be less costly to reach but also less protective for customers. Under this alternative we would have used the final amendments’ definition of ‘‘service provider,’’ which is ‘‘any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution.’’ 1084 Thus, similar to the final amendments, this alternative could affect a broad range of service providers including, potentially: email providers, customer relationship management systems, cloud applications, and other technology vendors. Depending on the States where they operate, these service providers may already be subject to State laws applicable to businesses that ‘‘maintain’’ computerized data containing private information.1085 Additionally, it is likely that any service provider that offers a service involving the maintenance of customer information to U.S. financial firms generally, or to any specific financial firm with a national presence, has processes in place to ensure compliance with these State laws. For those service providers that provide specialized services aimed at covered institutions, this alternative would, like the final amendments, create market pressure to enhance service offerings so as to provide the requisite assurances and facilitate covered institutions’ compliance with 1082 See final rule 248.30(a)(5)(i). SIFMA Comment letter 2. Other commenters also suggested alternative thresholds that would be lower than the final amendments’ provisions. See, e.g., IAA Comment Letter 1; AWS Comment Letter. 1084 Final rule 248.30(d)(10). 1085 See, e.g., Cal. Civil Code section 1798.81.5(b) and 1798.82(b); N.Y. Gen. Bus. Law section 899– AA(3). lotter on DSK11XQN23PROD with RULES2 1083 See VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 the requirements.1086 These service providers might have little choice other than to adapt their services to provide the required assurances, which would result in additional costs for the service providers related to adapting business processes to accommodate the requirements. In general, we expect these costs would be limited in scale in the same ways the costs of the final amendments are limited in scale: specialized service providers are adapted to operating in a highly regulated industry and are likely to have policies and procedures in place to facilitate compliance with State data breach laws. And, as with the final amendments, we generally anticipate that such costs would largely be passed on to covered institutions and ultimately their customers. As compared to the final amendments’ requirements, we expect that ‘‘reasonable assurances’’ would in many cases require fewer changes to business processes and, accordingly, lower costs.1087 However, this alternative— without more—could also be less protective than the final amendments. With respect to service providers providing services aimed at a broad range of institutions (e.g., email, or customer-relationship management), the situation could be different. For these providers, covered institutions are likely to represent a small fraction of their customer base. As under the final service provider provisions, these service providers may again be unwilling to adapt their business processes to the regulatory requirements of a small subset of their customers under this alternative.1088 Some may be unwilling to make the assurances needed, although we anticipate that they would be generally more willing to make assurances than to participate in the covered institutions’ oversight activities.1089 If the covered institution could not obtain the reasonable assurances required under this alternative, the covered institution would need to switch service providers and bear the associated switching costs, 1086 A service provider involved in any businesscritical function likely ‘‘receives, maintains, processes, or otherwise is permitted access to customer information.’’ See final rule 248.30(d)(10). 1087 See supra section II.A.4 for a discussion of sufficient safeguards for ensuring compliance with covered institution’s obligations under the final amendments. 1088 See supra section IV.D.1.c (discussing the final requirement for covered institutions to require policies and procedures reasonably designed to oversee, monitor, and conduct due diligence on service providers). 1089 See id. Additionally, the service provider’s standard terms and conditions might in some situations provide reasonable assurances adequate to meet the requirement. PO 00000 Frm 00090 Fmt 4701 Sfmt 4700 while the service providers would suffer loss of customers. Although the costs of obtaining reasonable assurances would likely be lower than under the final service provider provisions, and the need to switch providers less frequent, these costs could nonetheless be particularly acute for smaller covered institutions who lack bargaining power with some service providers. And, as outlined above, this alternative would be less protective than the final amendments’ requirements. 2. Lower Threshold for Customer Notice The Commission considered lowering the threshold for customer notice, such as one based on the ‘‘possible misuse’’ of sensitive customer information (rather than the adopted threshold requiring notice when sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization), or even requiring notification of any breach without exception. One commenter suggested that the final amendments require notification when the unauthorized access to or use of sensitive customer information was ‘‘reasonably possible’’ instead of ‘‘reasonably likely.’’ 1090 A lower threshold would increase the number of notices customers receive. Although more frequent notices could potentially reveal incidents that warrant customers’ attention and thereby potentially increase the benefits accruing to customers from the notice requirement discussed in section IV.D.1.b, they would also increase the number of false alarms. Such false alarms could be problematic if they reduce customers’ ability to discern which notices require action. Although a lower threshold could impose some additional compliance costs on covered institutions (due to additional notices being sent), we would not anticipate the additional direct compliance costs to be significant.1091 Of more economic significance to covered institutions would be the resulting reputational effects.1092 However, the direction of these effects is difficult to predict. On the one hand, increased notices resulting from a lower threshold can be expected to lead to additional reputational costs for firms 1090 See NASAA Comment Letter. In addition, another commenter suggested requiring customer notification for any incident of unauthorized access to or use of sensitive customer information regardless of the risk of use in a manner that would result in substantial harm or inconvenience. See Better Markets Comment Letter. 1091 The direct compliance costs of notices are discussed in section V. 1092 See supra section IV.B. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations required to issue more of such notices. On the other hand, lower thresholds could result in customers receiving a large number of notices. In this case, notices could become no longer notable, likely leading to the negative reputation effects associated with such notices being reduced. lotter on DSK11XQN23PROD with RULES2 3. Encryption Safe Harbor The Commission considered including a safe harbor to the notification requirement for breaches in which only encrypted information was compromised. Several commenters supported an encryption safe harbor.1093 An encryption safe harbor would also align with many existing State laws.1094 Assuming that such an alternative safe harbor would be sufficiently circumscribed to prevent its application to insecure encryption algorithms, or to secure algorithms used in a manner as to render them insecure, the economic effects of its inclusion would be largely indistinguishable from the final amendments. This is because under the final amendments, notification is triggered by the ‘‘reasonable likelihood’’ that sensitive customer information was accessed or used without authorization.1095 Given the computational complexity involved in deciphering information encrypted using modern encryption algorithms and secure procedures,1096 the compromise of such encrypted information would generally not give rise to ‘‘a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information.’’ 1097 It would thus not constitute ‘‘sensitive customer information,’’ meaning that the threshold for providing notice would not be met. In addition, when determining that the compromised sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience, a covered institution may consider encryption as a factor.1098 Hence, in some cases, an explicit encryption safe harbor would be superfluous. In certain 1093 See, e.g., SIFMA Comment Letter 2; AWS Comment Letter 1. See also supra section II.A.3.b for a discussion of the comments received on this matter. 1094 See supra section IV.C.2.a(1). 1095 See final rule 248.30(a)(3)(iii). 1096 Here, ‘‘secure procedures’’ refers to the secure implementation of encryption algorithms and encompasses proper key generation and management, timely patching, user access controls, etc. 1097 See final rule 248.30(d)(9); see also supra footnotes 139 and 141 and accompanying text. 1098 See final rule 248.30(a)(4); see also supra footnote 138 and accompanying text. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 other cases, however, an explicit encryption safe harbor may not be as protective as the final amendments’ Federal minimum standard for determining whether the compromise of customer information could create ‘‘a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information.’’ 1099 It may also become outdated as technologies and security practices evolve. Thus, while an explicit (and appropriately circumscribed) safe harbor could provide some procedural efficiencies from streamlined application, it could also be misapplied. 4. Longer Customer Notification Deadlines The Commission considered incorporating longer customer notification deadlines, such as 60 or 90 days instead of the adopted 30 days, as well as providing no fixed customer notification deadline. Several commenters suggested longer customer notification deadlines.1100 Although longer notification deadlines would provide more time for covered institutions to rebut the presumption of notification discussed in section II.A.3.a, we expect that longer investigations would, in general, correlate with more serious or complicated incidents and would therefore be unlikely to end in a determination that sensitive customer information has not been and is not reasonably likely to be used in a manner that would result in substantial harm or inconvenience. We therefore do not expect that longer notification deadlines would ultimately lead to significantly fewer required notifications. 1099 See final rule 248.30(d)(9). The Aug. 2022 breach of the LastPass cloud-based password manager provides an illustrative example. In this data breach a large database of website credentials belonging to LastPass customers was exfiltrated. The customer credentials in this database were encrypted using a secure algorithm and the encryption keys could not have been exfiltrated in the breach, so an encryption safe harbor could be expected to apply in such a case. Nonetheless, customers whose encrypted passwords were divulged in the breach became potential targets for brute force attacks (i.e., attempts to decrypt the passwords by guessing a customer’s master password) and to phishing attacks (i.e., attempts to induce an affected customer to divulge the master password). See Karim Toubba, Notice of Recent Security Incident, LastPass (Dec. 22, 2022), available at https://blog.lastpass.com/2022/12/ notice-of-recent-security-incident/; see also Craig Clough, LastPass Security Breach Drained Bitcoin Wallet, User Says, Portfolio Media (Jan. 4, 2023), available at https://www.law360.com/articles/ 1562534/lastpass-security-breach-drained-bitcoinwallet-user-says. 1100 See, e.g., FSI Comment Letter; IAA Comment Letter 1. See also supra footnote 796 and accompanying text and supra section II.A.3.d(1) for a discussion of the comments received on this matter. PO 00000 Frm 00091 Fmt 4701 Sfmt 4700 47777 Compliance costs conditional on notices being required (i.e., the actual furnishing of notices to customers) would be largely unchanged under alternative notice deadlines. That said, costs related to incident assessment would likely be somewhat lower due to the reduced urgency of determining the scope of an incident and a reduced likelihood that notifications would need to be made before an incident has been contained.1101 Arguably, longer notification deadlines may increase reputational costs borne by covered institutions that choose to take advantage of the longer deadlines. Overall, however, we do not expect that longer notification deadlines would lead to costs for covered institutions that differ significantly from the costs of the adopted 30-day outside timeframe. Providing for longer notifications deadlines would likely reduce the promptness with which some covered institutions issue notifications to customers, potentially reducing their customers’ ability to take effective mitigating actions. In particular, as discussed in section IV.D.1.b(2), some breaches are discovered very quickly. For customers whose sensitive customer information is compromised in such breaches, a longer notification deadline could significantly reduce the timeliness—and value—of the notice.1102 On the other hand, where a public announcement could hinder containment efforts, a longer notification timeframe could yield benefits to the broader public (and/or to the affected investors).1103 5. Broader National Security and Public Safety Delay in Customer Notification The Commission considered providing for a broader delay to the 30day notification outside timeframe by extending its applicability to cases where any appropriate law enforcement agency requests the delay.1104 This alternative delay would more closely align with the delays adopted by other regulators, such as the Banking 1101 See 1102 See supra section IV.D.1.b(2). supra footnote 784 and accompanying text. 1103 See supra footnote 803 and accompanying text. 1104 The final amendments differ from the proposal in that they allow for a longer national security and public safety delay under certain circumstances and allow for a delay if the notice poses a substantial risk to either public safety or national security (the proposal referred to national security risk only). However, the final amendments allow for such a delay only if the Attorney General informs the Commission, in writing, of such risk. See supra section II.A.3.d(2). E:\FR\FM\03JNR2.SGM 03JNR2 47778 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 Agencies,1105 and by many States.1106 Several commenters suggested broader delays.1107 On the other hand, another commenter stated that the Commission should not allow for any law enforcement delay.1108 The principal function of a law enforcement delay is to allow a law enforcement or national security agency to prevent cybercriminals from becoming aware of their detection. Observing a cyberattack that is in progress can allow investigators to take actions that can assist in revealing the attacker’s location, identity, or methods.1109 Notifying affected customers has the potential to alert attackers that their intrusion has been detected, hindering these efforts.1110 Thus, a broader delay could generally be expected to enhance law enforcement’s efficacy in cybercrime investigations, which would potentially benefit affected customers through damage mitigation and benefit the general public through improved deterrence and increased recoveries, and by enhancing law enforcement’s knowledge of attackers’ methods. It would also potentially reduce compliance costs for covered institutions by aligning more closely with the existing regulations discussed above.1111 That said, use of the delay provisions would necessarily result in customers affected by a cyberattack being notified later, reducing the value to customers of such notices.1112 Incidents where law enforcement would like to delay customer notifications are likely to involve numerous customers, who— without timely notice—may be unable to take timely mitigating actions that could prevent additional harm.1113 Law enforcement investigations can also take time to resolve and, even when successful, their benefits to affected customers (e.g., recovery of criminals’ ill-gotten gains) may be limited. Information about cybercrime investigations is often confidential. The 1105 See Banking Agencies’ Incident Response Guidance. 1106 See, e.g., RCW 19.255.010(8); Fla. Stat. section 501.171(4)(b). 1107 See, e.g., Nasdaq Comment Letter; ICI Comment Letter 1. 1108 See Better Markets Comment Letter. 1109 Cybersecurity Advisory: Technical Approaches to Uncovering and Remediating Malicious Activity, Cybersecurity & Infrastructure Sec. Agency (Sept. 24, 2020), available at https:// www.cisa.gov/news-events/cybersecurity-advisories/ aa20-245a (explaining how and why investigators may ‘‘avoid tipping off the adversary that their presence in the network has been discovered’’). 1110 Id. 1111 See supra section IV.C.2. 1112 See supra footnote 784 and accompanying text. 1113 See supra section IV.D.1.b(2). VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Commission does not have data on the prevalence of covert cybercrime investigations, their success or lack of success, their deterrent effect if any, or the impact of customer notification on investigations.1114 No commenter suggested such data. Thus, we are unable to quantify the costs and benefits of this alternative.1115 V. Paperwork Reduction Act A. Introduction Certain provisions of the final amendments contain ‘‘collection of information’’ requirements within the meaning of the Paperwork Reduction Act of 1995 (‘‘PRA’’).1116 We are submitting the final collection of information to the Office of Management and Budget (‘‘OMB’’) for review in accordance with the PRA.1117 The safeguards rule and the disposal rule we are amending will have an effect on the currently approved existing collection of information under OMB Control No. 3235–0610, the title of which is, ‘‘Rule 248.30, Procedures to safeguard customer records and information; disposal of consumer report information.’’ 1118 An agency may not conduct or sponsor, and a person is not required to respond to, a collection 1114 We do, however, have evidence that requests by law enforcement to delay customer notification are relatively rare events. See supra footnote 806. 1115 We requested public comment on these topics in the Proposing Release but did not receive any. 1116 44 U.S.C. 3501 through 3521. 1117 44 U.S.C. 3507(d); 5 CFR 1320.11. 1118 The paperwork burden imposed by Regulation S–P’s notice and opt-out requirements, 17 CFR 248.1 to 248.18, is currently approved under a separate OMB control number, OMB Control No. 3235–0537. The final amendments will implement a statutory exception that has been in effect since late 2015. We do not believe that the amendment to implement the statutory exception makes any substantive modifications to this existing collection of information requirement or imposes any new substantive recordkeeping or information collection requirements within the meaning of the PRA. Similarly, we do not believe that the final amendments to: (i) Investment Company Act rules 31a–1(b) (OMB control number 3235–0178) and 31a–2(a) (OMB control number 3235–0179) for investment companies that are registered under the Investment Company Act, (ii) Investment Advisers Act rule 204–2 (OMB control number 3235–0278) for investment advisers, (iii) Exchange Act rule 17a–4 (OMB control number 3235–0279) for brokerdealers, and (iv) Exchange Act rule 17Ad–7 (OMB control number 3235–0291) for transfer agents, makes any modifications to this existing collection of information requirement or imposes any new recordkeeping or information collection requirements. Accordingly, we believe that the current burden and cost estimates for the existing collection of information requirements remain appropriate, and we believe that the final amendments should not impose substantive new burdens on the overall population of respondents or affect the current overall burden estimates for this collection of information. We are, therefore, not revising any burden and cost estimates in connection with these amendments. PO 00000 Frm 00092 Fmt 4701 Sfmt 4700 of information unless it displays a currently valid OMB control number. The amended requirement to adopt policies and procedures constitutes a collection of information requirement under the PRA. The collection of information associated with the final amendments will be mandatory, and responses provided to the Commission in the context of its examination and oversight program concerning the final amendments will be kept confidential subject to the provisions of applicable law. A description of the final amendments, including the need for the information and its use, as well as a description of the types of respondents, can be found in section II above, and a discussion of the expected economic effects of the final amendments can be found in section III above. The Commission published notice soliciting comments on the collection of information requirements in the Proposing Release and submitted the proposed collections of information to OMB for review in accordance with 44 U.S.C. 3507(d) and 5 CFR 1320.11. The Commission did not receive any comments that specifically addressed the estimated PRA analysis in the Proposing Release but did receive comments regarding the costs and burdens of the proposed rules generally. Those comments are discussed in more detail in section IV above. In particular, several commentators raised concerns regarding the costs associated with negotiating and renegotiating written contracts with service providers.1119 One commenter did support the proposed written contract provision due to its very narrow scope.1120 In response to commenters’ concerns about the costs of negotiating contracts, we have replaced the proposed requirement for a covered institution to have a written contract with a service provider with a requirement to implement written policies and procedures to oversee, monitor, and conduct due diligence on the service provider. In a modification from the proposal, rather than requiring written policies and procedures requiring the covered institution to 1119 See STA and ComputerShares Comment Letters (transfer agents don’t have the leverage to negotiate contracts with service providers); ASA Comment Letter (no discussion or estimate of the costs the written contract requirement would impose on brokers); IAA Comment Letter (individual advisers, particularly smaller advisers, lack leverage to engage in contractual negotiations with many service providers); ACLI Comment Letter; Cambridge Comment Letter; CAI Comment Letter; AWS Comment Letter; Google Comment Letter. Other commenters raised this issue but suggested extending the implementation period as a remedy. See NASDAQ Comment Letter; FIF Comment Letter; SIFMA Comment Letter 2. 1120 See ICI Comment Letter. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations enter into a written contract with its service providers to take certain appropriate measures, the policies and procedures required by the final amendments must be reasonably designed to ensure service providers take appropriate measures to: (A) protect against unauthorized access to or use of customer information; and (B) provide notification to the covered institution regarding an incident affecting customer information in the timeframes and circumstances discussed above. The modifications to the proposal are designed to address many of commenters’ concerns regarding the costs associated with the service provider provisions of the proposed amendments. We have not reduced the Proposing Release’s PRA estimates, however, because the final amendments still require policies and procedures regarding service providers that we estimate will involve PRA burdens consistent with those we estimated for the proposed requirement. As discussed above, some commenters urged for more time to investigate incidents, suggesting that failing to do so would result in an increase in the amount of notices being provided.1121 We are increasing the estimates associated with the final rule with regards to the preparation and distribution of notices because these comments seem to suggest a view that the proposed estimates related to these burdens were too low. We have also adjusted the proposal’s estimated annual burden hours and total time costs to reflect updated wage rates. B. Amendments to the Safeguards Rule and Disposal Rule As discussed above, the final amendments to the safeguards rule will require covered institutions to develop, implement, and maintain written policies and procedures that include incident response programs reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures. The response program must include procedures to assess the nature and scope of any incident involving unauthorized access to or use of customer information; take appropriate steps to contain and control the incident; and provide notice to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization (unless the covered institution makes certain determinations as specified in the final amendments). The final amendments to the disposal rule will require covered institutions that maintain or otherwise possess customer information, or consumer information to adopt and implement written policies and procedures that address proper disposal of such information, which will include taking 47779 reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. Finally, the final amendments will require covered institutions other than funding portals to make and maintain written records documenting compliance with the requirements of the safeguards rule and the disposal rule. Under the final amendments, the time periods for preserving records will vary by covered institution to be consistent with existing recordkeeping rules.1122 Based on FOCUS Filing, Form BD Filing, and Form BD–N data, as of the third quarter of 2023, there were 3,476 brokers or dealers, other than noticeregistered brokers or dealers or funding portals. Based on Investment Adviser Registration Depository data, as of Oct. 5, 2023, there were 15,565 investment advisers registered with the Commission. As of Sept. 30, 2023, there were 13,766 investment companies.1123 Based on Form TA–1, as of Sept. 30, 2023, there were 251 transfer agents registered with the Commission and 64 transfer agents registered with the Banking Agencies. Based on staff analysis and publicly available filings, as of Dec. 31, 2023, there were 92 funding portals. Table 5 below summarizes our PRA initial and ongoing annual burden estimates associated with the final amendments to the safeguards rule and the disposal rule. TABLE 5—AMENDMENTS TO SAFEGUARDS RULE AND DISPOSAL RULE—PRA Internal initial burden hours Internal annual burden hours 1 Wage rate 2 Annual external cost burden Internal time cost lotter on DSK11XQN23PROD with RULES2 PROPOSED ESTIMATES Adopting and implementing policies and procedures. 60 hours ....... 25 hours 3 ........................... Preparation and distribution of notices. 9 hours ......... 8 hours 5 ............................. Recordkeeping ..................... 1 hour ........... 1 hour ................................. Total new annual burden per covered institution. ...................... Number of covered institutions. Total new annual aggregate burden. ...................... 34 hours (equal to the sum of the above three boxes). × 32,897 covered institutions 7. 1,118,498 hours ................. ...................... 1121 See, e.g., supra footnote 165 and accompanying text. 1122 The final amendments will also broaden the scope of information covered by the safeguards rule and the disposal rule (to include all customer information in the possession of a covered institution or is handled or maintained on its behalf, and all consumer information that a covered VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 $455 (blended rate for compliance attorney and assistant general counsel). $300 (blended rate for senior compliance examiner and compliance manager). $381 (blended rate for compliance attorney and senior programmer). ............................................ ............................................ ............................................ $11,375 (equal to the internal annual burden × the wage rate). $2,655.4 $2,400 (equal to the internal annual burden × the wage rate). $2,018.6 $381 ................................... $0. $14,156 (equal to the sum of the above three boxes). × 32,897 covered institutions. $465,689,932 ..................... $4,673 (equal to the sum of the above two boxes). institution maintains or otherwise possesses for a business purpose) and extend the application of the safeguards provisions to transfer agents registered with the Commission or another appropriate regulatory agency. These amendments do not contain collections of information beyond those related to the incident response program analyzed above. PO 00000 Frm 00093 Fmt 4701 Sfmt 4700 16,449.8 $76,866,177. 1123 Data on investment companies registered with the Commission comes from Form N–CEN filings; data on BDCs comes from LSEG BDC Collateral; and data on employees’ securities companies comes from Form 40–APP. See supra Table 4. E:\FR\FM\03JNR2.SGM 03JNR2 47780 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations TABLE 5—AMENDMENTS TO SAFEGUARDS RULE AND DISPOSAL RULE—PRA—Continued Internal initial burden hours Internal annual burden hours 1 Wage rate 2 Annual external cost burden Internal time cost FINAL ESTIMATES Broker-dealers other than notice registered broker-dealers, investment advisers registered with the Commission and investment companies Adopting and implementing policies and procedures. 60 hours ....... 25 hours 3 ........................... Preparation and distribution of notices. 12 hours ....... 9 hours 5 ............................. Recordkeeping ..................... 1 hour ........... 1 hour ................................. Total new annual burden per applicable covered institution. Number of applicable covered institutions. New annual applicable covered institutions aggregate burden. ...................... 35 hours (equal to the sum of the above three boxes). × 32,807 covered institutions 11. 1,148,245 hours ................. ...................... ...................... $501 (blended rate for compliance attorney and assistant general counsel). $329 (blended rate for senior compliance examiner and compliance manager). $420 (blended rate for compliance attorney and senior programmer). ............................................ ............................................ ............................................ $12,525 (equal to the internal annual burden × the wage rate). $2,920.9 $2,961 (equal to the internal annual burden × the wage rate). $2,217.10 $420 ................................... $0. $15,906 (equal to the sum of the above three boxes). × 32,807 covered institutions. $521,828,142 ..................... $5,137 (equal to the sum of the above two boxes). 16,404.8 $84,267,348. Transfer Agents Adopting and implementing policies and procedures. 75 hours ....... 30 hours 12 ......................... Preparation and distribution of notices. 12 hours ....... 9 hours 5 ............................. Recordkeeping ..................... 1 hour ........... 1 hour ................................. Total new annual burden per transfer agent. ...................... Number of transfer agents ... New annual transfer agent aggregate burden. ...................... ...................... 40 hours (equal to the sum of the above three boxes). × 315 13 ............................... 12,600 ................................ $501 (blended rate for compliance attorney and assistant general counsel). $329 (blended rate for senior compliance examiner and compliance manager). $420 (blended rate for compliance attorney and senior programmer). ............................................ ............................................ ............................................ $15,030 (equal to the internal annual burden × the wage rate). $2,920.9 $2,961 (equal to the internal annual burden × the wage rate). $2,217.10 $420 ................................... $0. $18,411 (equal to the sum of the above three boxes). × 315 ................................... $5,799,465 ......................... $5,137 (equal to the sum of the above two boxes). 158.8 $811,646. Funding Portals Adopting and implementing policies and procedures. 60 hours ....... 25 hours 3 ........................... Preparation and distribution of notices. 12 hours ....... 9 hours 5 ............................. Recordkeeping ..................... 1.5 hours 14 .. 1.5 hours ............................ Total new annual burden per funding portal. ...................... Number of funding portals ... New annual funding portal aggregate burden. ...................... ...................... 35.5 hours (equal to the sum of the above three boxes). × 92 ..................................... 3,266 .................................. $501 (blended rate for compliance attorney and assistant general counsel). $329 (blended rate for senior compliance examiner and compliance manager). $420 (blended rate for compliance attorney and senior programmer). ............................................ ............................................ ............................................ $12,525 (equal to the internal annual burden × the wage rate). $2,920.9 $2,961 (equal to the internal annual burden × the wage rate). $2,217.10 $630 ................................... $0. $16,116 (equal to the sum of the above three boxes). × 92 ..................................... $1,482,672 ......................... $5,137 (equal to the sum of the above two boxes). 46.8 $236,302. Total Estimated Burdens of the Final Amendments Total new annual aggregate burden. ...................... 1,164,111 hours ................. ............................................ $529,110,279 ..................... $85,315,296. lotter on DSK11XQN23PROD with RULES2 TOTAL ESTIMATED BURDENS INCLUDING AMENDMENTS Current aggregate annual burden estimates. Revised aggregate annual burden estimates. ...................... +65,760 hours .................... ............................................ ............................................ +$0. ...................... 1,229,871 hours ................. ............................................ $529,110,279 ..................... $85,315,296. Notes: 1 Includes initial burden estimates annualized over a 3-year period. 2 The Commission’s estimates of the relevant wage rates are based on the SIFMA Wage Report. The estimated figures are modified by firm size, employee benefits, overhead, and adjusted to account for the effects of inflation. 3 Includes initial burden estimates annualized over a three-year period, plus 5 hours of ongoing annual burden hours. The estimate of 25 hours is based on the following calculation: ((60 initial hours/3) + 5 hours of additional ongoing burden hours) = 25 hours. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 PO 00000 Frm 00094 Fmt 4701 Sfmt 4700 E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations 47781 4 This estimated burden is based on the estimated wage rate of $531/hour, for 5 hours, for outside legal services. The Commission’s estimates of the relevant wage rates for external time costs, such as outside legal services, takes into account staff experience, a variety of sources including general information websites, and adjustments for inflation. 5 Includes initial burden estimate annualized over a three-year period, plus 5 hours of ongoing annual burden hours. The estimate of 9 hours is based on the following calculation: ((12 initial hours/3 years) + 5 hours of additional ongoing burden hours) = 9 hours. 6 This estimated burden is based on the estimated wage rate of $531/hour, for 3 hours, for outside legal services and $85/hour, for 5 hours, for a senior general clerk. 7 Total number of covered institutions is calculated as follows: 3,401 broker-dealers other than notice registered broker-dealers + 15,129 investment advisers registered with the Commission + 13,965 investment companies + 335 transfer agents registered with the Commission + 67 transfer agents registered with the Banking Agencies = 32,897 covered institutions. 8 We estimate that 50% of covered institutions will use outside legal services for these collections of information. This estimate takes into account that covered institutions may elect to use outside legal services (along with in-house counsel), based on factors such as budget and the covered institution’s standard practices for using outside legal services, as well as personnel availability and expertise. 9 This estimated burden is based on the estimated wage rate of $584/hour, for 5 hours, for outside legal services. The Commission’s estimates of the relevant wage rates for external time costs, such as outside legal services, takes into account staff experience, a variety of sources including general information websites, and adjustments for inflation. 10 This estimated burden is based on the estimated wage rate of $584/hour, for 3 hours, for outside legal services and $93/hour, for 5 hours, for a senior general clerk. 11 Total number of applicable covered institutions is calculated as follows: 3,476 broker-dealers other than notice-registered broker-dealers or funding portals + 15,565 investment advisers registered with the Commission + 13,766 investment companies = 32,807 covered institutions. The burdens for funding portals and transfer agents are calculated separately. 12 Includes initial burden estimates annualized over a three-year period, plus 5 hours of ongoing annual burden hours. The estimate of 30 hours is based on the following calculation: ((75 initial hours/3) + 5 hours of additional ongoing burden hours) = 30 hours. 13 The number of transfer agents includes 251 transfer agents registered with the Commission + 64 transfer agents registered with the Banking Agencies = 315 transfer agents. 14 Funding portals are not subject to the recordkeeping obligations for brokers found under Rule 17a–4. Instead, they are obligated, pursuant to Rule 404 of Regulation Crowdfunding, to make and preserve all records required to demonstrate their compliance with, among other things, Regulation S–P. While the final amendments do not modify funding portals’ recordkeeping requirements to include the same enumerated list of obligations as those applied to brokers under the amendments to Rule 17a–4, funding portals generally should look to make and preserve the same scope of records in connection with demonstrating their compliance with this portion of Regulation S–P. Further, Rule 404 requires funding portals to preserve these records for a longer period of time than brokers are required to preserve records under Rule 17a–4. Due to this longer required period for records preservation, the estimated burden for funding portals is higher than for brokers. VI. Final Regulatory Flexibility Act Analysis The Regulatory Flexibility Act (‘‘RFA’’) requires the Commission, in promulgating rules under Section 553 of the Administrative Procedure Act,1124 to consider the impact of those rules on small entities. We have prepared this Final Regulatory Flexibility Analysis (‘‘FRFA’’) in accordance with Section 604 of the RFA.1125 An Initial Regulatory Flexibility Analysis (‘‘IRFA’’) was prepared in accordance with the RFA and was included in the Proposing Release.1126 lotter on DSK11XQN23PROD with RULES2 A. Need for, and Objectives of, the Final Amendments The purpose of the final amendments is to limit potential harmful impacts to customers by enhancing and modernizing the protection of customer information. Among other things, the amendments update the rule’s requirements to address the expanded use of technology and corresponding risks. The need for, and objectives of, the final amendments are described in Sections I and II above. We discuss the economic impact and potential alternatives to the amendments in Section IV, and the estimated compliance costs and burdens of the amendments under the PRA in Section V. B. Significant Issues Raised by Public Comments In the Proposing Release, the Commission requested comment on any aspect of the IRFA, and particularly on the number of small entities that would be affected by the proposed amendments, the existence or nature of the potential impact of the proposed amendments on small entities discussed in the analysis, how the proposed amendments could further lower the burden on small entities, and how to quantify the impact of the proposed amendments. One commenter urged the Commission to conduct a more holistic cost-benefit analysis, and in particular consider the disproportionate costs on smaller advisers.1127 The commenter noted that smaller advisers have been significantly burdened by one-size-fitsall regulations—both in isolation and cumulatively—that effectively require substantial fixed investments in infrastructure, personnel, technology, and operations.1128 Another commenter stated that the Commission did little analysis about the impact of these proposals on small broker-dealers, competition within the brokerage industry, and whether they could contribute to barriers for new entrants into the markets.1129 We discuss the cost-benefit analysis and challenges small entities may face above.1130 Additionally, multiple commenters discussed the burden small entities would face. For instance, several commenters stated that an increased compliance cost for implementing new systems, training employees, and conducting audits, may disproportionately affect smaller firms, 1127 See 1124 5 U.S.C. 553. 1125 5 U.S.C. 604.6. 1126 Proposing Release at section V. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 IAA Comment Letter 2. IAA Comment Letter 1. 1129 See ASA Comment Letter. 1130 See supra section IV. 1128 See PO 00000 Frm 00095 Fmt 4701 Sfmt 4700 inhibiting their ability to compete and grow.1131 Multiple commenters asserted small covered institutions, who may not have the negotiating power or leverage to demand specific contract provisions from large third-party service providers, would potentially be harmed by the written contract requirement for service providers.1132 Another commenter noted the outsized impact small brokerdealers face.1133 However, another commenter noted while small firms may be impacted by increased costs, this should not come at the expense of customer protection, and stated that driving competition towards better protections will ultimately benefit customers and promote a healthier market.1134 Commenters proposed multiple alternatives to lower the burden on small entities. One commenter urged the Commission to provide a longer time to transition for smaller advisers.1135 Additionally, the commenter stated that it has frequently called on the Commission to take steps to tailor its rules to minimize impacts the proposed amendments would have on smaller advisers, for example through preserving a flexible, risk- and principles-based approach, excluding or exempting smaller advisers from specific requirements where the burdens on those advisers outweigh the benefits, and tiering and staggering 1131 See Grey Comment Letter, Robinson Comment Letter, and Scouten Comment Letter; see also ASA Comment Letter. 1132 See IAA Comment Letter 2; see also STA Comment Letter 2 and Computershare Comment Letter. 1133 See FSI Comment Letter. 1134 See Wohlfahrt Comment Letter. 1135 See IAA Comment Letter 1. E:\FR\FM\03JNR2.SGM 03JNR2 47782 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 compliance timetables.1136 Likewise, another commenter proposed a longer implementation period for smaller broker-dealers and investments advisers to allow these firms to benefit from implementation for larger industry participants.1137 We expect the benefits and the costs of the final amendments to vary across covered institutions.1138 For example, because smaller covered institutions are less likely to have an existing incident response program than larger covered institutions, some small entities may be more likely to face greater costs but also expect greater benefits complying with the final amendments, because they must adopt and implement new procedures. Creating new programs will likely cost more, but the new programs would result in improved efficacy in notifying customers and improve the manner incidents are handled. Smaller entities may have less negotiating power than larger entities, so requiring contracts with service providers could potentially be more detrimental to them than other entities. Additionally, smaller covered institutions are less likely to have a national presence, so small entities whose customers are concentrated in States with less informative customer notification laws are likely to face higher costs to comply with the final amendments. These costs and benefits may have an effect on competition for smaller entities.1139 We have revised the final amendments in several ways to mitigate potential compliance costs that small entities may face, as raised by commenters. As previously discussed, the changes made to the service provider provisions of the amendments requiring that the covered institution’s policies and procedures are reasonably designed to oversee, monitor, and conduct due diligence on service providers instead of requiring written contracts between covered institutions and their service providers, and requiring that the covered institution’s policies and procedures be reasonably designed to ensure service providers take appropriate measures to notify covered institutions of an applicable breach in security within 72 hours instead of 48 hours) may reduce some costs relative to the proposal and facilitate their implementation, especially for smaller covered 1136 See IAA Comment Letter 2; see also STA Comment Letter suggesting exempting transfer agents that do not maintain a threshold number of shareholder accounts. See supra section IV.E for further discussion of exemption based upon size. 1137 See FSI Comment Letter. 1138 See supra section IV. 1139 See supra section IV.E. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 institutions.1140 For example, it could potentially reduce compliance costs by reducing the number of notices being sent (e.g., if the covered institution is able to determine that a notice is not needed or if it is able to determine with more precision which individuals must be notified).1141 Additionally, we are now adopting a longer compliance period of 24 months for smaller covered institutions, who are less likely to already have policies and procedures broadly consistent with the final amendments. Moreover, the final amendments still maintain that the incident response program must include policies and procedures containing certain general elements but will not prescribe specific steps a covered institution must undertake when carrying out incident response activities, thereby enabling covered institutions to create policies and procedures best suited to their particular circumstances, including size. This design balances the necessity of maintaining general elements to achieve the investor protection objectives the amendments are designed to achieve, while still providing covered institutions the ability to tailor policies to their individual needs. We will not exempt small entities from any specific requirements, because entities of all sizes are vulnerable to the types of data security breach incidents we are trying to address, and therefore, no entity should be exempted from requirements, regardless of size.1142 Additionally, one commenter argued that the Commission does not accurately analyze the impact of its regulations on small advisers as required under the RFA because according to the commenter, virtually no SEC-registered advisers fall under the ‘‘asset-based’’ definition of small adviser adopted by the Commission.1143 However, the commenter believes that the vast majority of advisers are small businesses.1144 The commenter stated that the Commission adopted Rule 0–7 under the Advisers Act defining ‘‘small business’’ or ‘‘small organization’’ for purposes of treatment as a ‘‘small entity’’ under the RFA as including an investment adviser that has less than $25 million in assets under management, but with few exceptions, advisers are not permitted to register with the Commission unless they have at least $100 million in assets under 1140 See supra section IV. supra section IV. 1142 See infra section VI.E for further discussion of exemption based upon size. 1143 See IAA Comment Letter 2. 1144 See IAA Comment Letter 2. 1141 See PO 00000 Frm 00096 Fmt 4701 Sfmt 4700 management.1145 The commenter argued that this makes any analysis the Commission does regarding the impact on smaller advisers virtually meaningless.1146 As discussed below, we estimate that approximately 872 broker-dealers,1147 132 transfer agents, 81 investment companies, and 579 registered investment advisers may be considered small entities under the Regulatory Flexibility Act.1148 The Commission takes seriously the potential impact of any new rule on these advisers who meet this definition and on other smaller advisers that do not meet the definition of small entity under the Regulatory Flexibility Act, as considered and discussed throughout this release. C. Small Entities Subject to Final Amendments The final amendments to Regulation S–P will affect brokers, dealers, registered investment advisers, investment companies, and transfer agents, including entities that are considered to be a small business or small organization (collectively, ‘‘small entity’’) for purposes of the RFA. For purposes of the RFA, under the Exchange Act a broker or dealer is a small entity if it: (i) had total capital of less than $500,000 on the date in its prior fiscal year as of which its audited financial statements were prepared or, if not required to file audited financial statements, on the last business day of its prior fiscal year; and (ii) is not affiliated with any person that is not a small entity.1149 A transfer agent is a small entity if it: (i) received less than 500 items for transfer and less than 500 items for processing during the preceding six months; (ii) transferred items only of issuers that are small entities; (iii) maintained master shareholder files that in the aggregate contained less than 1,000 shareholder accounts or was the named transfer agent for less than 1,000 shareholder accounts at all times during the preceding fiscal year; and (iv) is not affiliated with any person that is not a small entity.1150 Under the Investment Company Act, investment companies are considered small entities if they, together with other funds in the same 1145 See IAA Comment Letter 2. IAA Comment Letter 2. 1147 This 872 broker-dealers includes 89 funding portals. 1148 See infra section VI.C. 1149 17 CFR 240.0–10. Funding portals, who are considered ‘‘brokers’’ for purposes of this release unless otherwise noted, are also included in this definition. See 17 CFR 227.403(b); See also supra footnote 5. 1150 Id. 1146 See E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations group of related funds, have net assets of $50 million or less as of the end of its most recent fiscal year.1151 Under the Investment Advisers Act, a small entity is an investment adviser that: (i) manages less than $25 million in assets; (ii) has total assets of less than $5 million on the last day of its most recent fiscal year; and (iii) does not control, is not controlled by, and is not under common control with another investment adviser that manages $25 million or more in assets, or any person that has had total assets of $5 million or more on the last day of the most recent fiscal year.1152 Based on Commission filings, we estimate that approximately 872 brokerdealers,1153 132 transfer agents,1154 81 investment companies,1155 and 579 registered investment advisers 1156 may be considered small entities. D. Projected Reporting, Recordkeeping, and Other Compliance Requirements The final amendments to Regulation S–P will require covered institutions to develop incident response programs for unauthorized access to or use of customer information, as well as imposing a customer notification obligation in instances where sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. The final amendments also would include new mandatory recordkeeping requirements and language conforming Regulation S– P’s annual privacy notice delivery provisions to the terms of a statutory exception. Under the final amendments, covered institutions would have to develop, implement, and maintain, within their written policies and procedures designed to comply with Regulation S– P, a program that is reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including 1151 17 CFR 270.0–10. CFR 275.0–7. 1153 Estimate based on Q3 2023 FOCUS Report data, staff analysis and public filings. This 872 broker-dealers includes 89 funding portals. 1154 Estimate based on the number of transfer agents that reported a value of fewer than 1,000 for items 4(a) and 5(a) on Form TA–2 collected by the Commission as of September 30, 2023. 1155 Based on Commission staff approximation that approximately 41 open-end funds (including 10 exchange-traded funds), 23 closed-end funds, 3 UITs and 14 business development companies are small entities. This estimate is derived from an analysis of data obtained from Morningstar Direct and data reported to the Commission (e.g., N– PORT, N–CSR, 10–Q and 10–K) for the second quarter of 2023. 1156 Based on SEC-registered adviser responses to Items 5.F. and 12 of Form ADV as of October 5, 2023. lotter on DSK11XQN23PROD with RULES2 1152 17 VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 customer notification procedures. Such policies and procedures will also need to require that covered institutions oversee, monitor, and conduct due diligence on service providers and ensure that service providers take appropriate measures to notify covered institutions of an applicable breach in security within 72 hours. Upon receipt of such notification, the covered institution must initiate its incident response program. As part of its incident response program, a covered institution may also enter into a written agreement with its service provider to have the service provider notify affected individuals on its behalf. However, the covered institution’s obligation to ensure that affected individuals are notified in accordance with paragraph (a)(4) of the final amendments rests with the covered institution. In addition, covered institutions will be required to make and maintain specified written records designed to evidence compliance with these requirements.1157 Such records will be required to be maintained starting from when the record was made, or from when the covered institution terminated the use of the written policy or procedure, for the time periods stated in the amended recordkeeping regulations for each type of covered institution. Some covered institutions, including covered institutions that are small entities, will incur increased costs involved in reviewing and revising their current safeguarding policies and procedures to comply with these obligations, including their cybersecurity policies and procedures. Initially, this will require covered institutions to develop as part of their written policies and procedures under the safeguards rule, a program reasonably designed to detect, respond to, and recover from any unauthorized access to or use of customer information, including customer notification procedures, in a manner that provides clarity for firm personnel. Further, in developing these policies and procedures, covered institutions will need to include policies and procedures requiring the covered institution to ensure its service providers take appropriate measures to protect against unauthorized access to or use of customer information, and notify the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in 1157 With regard to funding portals, please see discussion as to their applicable recordkeeping obligations supra footnote 385 and accompanying discussion. PO 00000 Frm 00097 Fmt 4701 Sfmt 4700 47783 unauthorized access to a customer information system maintained by the service provider, and upon receipt of such notification, the covered institution must initiate its response program. However, as the Commission recognizes the number and varying characteristics (e.g., size, business, and sophistication) of covered institutions, these final amendments would help covered institutions to tailor these policies and procedures and related incident response program based on the individual facts and circumstances of the firm, and provide flexibility in addressing the general elements of the response program requirements based on the size and complexity of the covered institution and the nature and scope of its activities. In addition, the Commission acknowledges that the final amendments will impose greater costs on those transfer agents that are registered with another appropriate regulatory agency, if they are not currently subject to Regulation S–P, as well as those transfer agents registered with the Commission who are not currently subject to the safeguards rule. Such costs will include the development and implementation of necessary policies and procedures, the ongoing costs of required recordkeeping and maintenance requirements, and, where necessary, the costs to comply with the customer notification requirements of the final amendments. Such costs will also include the same minimal costs for employee training or establishing clear procedures for consumer report information disposal that are imposed on all covered institutions. To the extent that such costs are being applied to a transfer agent for the first time as a result of new obligations being imposed, the final amendments would incur higher present costs on those transfer agents than those covered institutions that are already subject to the safeguards rule and the disposal rule. To comply with these amendments on an ongoing basis, covered institutions will need to respond appropriately to incidents that entail the unauthorized access to or use of customer information. This will entail carrying out the established response program procedures to (i) assess the nature and scope of any incident involving unauthorized access to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization; (ii) take appropriate steps to contain and control the incident to prevent further unauthorized access to E:\FR\FM\03JNR2.SGM 03JNR2 47784 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 or use of customer information; and (iii) notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. Where the covered institution determines notice is required, the covered institution will need to provide a clear and conspicuous notice, or ensure that such notice is provided, to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. This notice must be provided as soon as reasonably practicable, but not later than 30 days, after the covered institution becomes aware that unauthorized access to or use of sensitive customer information has, or is reasonably likely to have, occurred, absent an applicable request from the Attorney General. This notice will need to be transmitted by a means designed to ensure that each affected individual can reasonably be expected to receive actual notice in writing. Further, the covered institution will need to satisfy the specified content requirements of that notice,1158 the preparation of which 1158 See final rule 248.30(a)(4)(iv). In particular, the covered institution would need to: (i) describe in general terms the incident and the type of sensitive customer information that was or is reasonably believed to have been accessed or used without authorization; (ii) include, if the information is reasonably possible to determine at the time the notice is provided, any of the following: the date of the incident, the estimated date of the incident, or the date range within which the incident occurred; (iii) include contact information sufficient to permit an affected individual to contact the covered institution to inquire about the incident, including the following: a telephone number (which should be a toll-free number if available), an email address or equivalent method or means, a postal address, and the name of a specific office to contact for further information and assistance; (iv) if the individual has an account with the covered institution, recommend that the customer review account statements and immediately report any suspicious activity to the covered institution; (v) explain what a fraud alert is and how an individual may place a fraud alert in the individual’s credit reports to put the individual’s creditors on notice that the individual may be a victim of fraud, including identity theft; (vi) recommend that the individual periodically obtain credit reports from each nationwide credit reporting company and that the individual have information relating to fraudulent transactions deleted; (vii) explain how the individual may obtain a credit report free of charge; and (viii) include information about the availability of online VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 will incur some incremental additional costs on covered institutions. Finally, covered institutions will also face costs in complying with the new recordkeeping requirements imposed by these amendments that are incrementally more than those costs covered institutions already incur from their existing regulatory recordkeeping obligations, in light of their already existing record retention systems. However, the record maintenance provisions align with those most frequently employed as to each covered institution subject to this rulemaking, partially in an effort to minimize these costs to firms. Overall, incremental costs will be associated with the final amendments to Regulation S–P.1159 Some proportion of large or small institutions would be likely to experience some increase in costs to comply with the amendments. More specifically, we estimate that many covered institutions will incur one-time costs related to reviewing and revising their current safeguarding policies and procedures to comply with these obligations, including their cybersecurity policies and procedures. Additionally, some covered institutions, including transfer agents, may incur costs associated with establishing such policies and procedures as these amendments require if those covered institutions do not already have such policies and procedures. We also estimate that the ongoing, long-term costs associated with the final amendments could include costs of responding appropriately to incidents that entail the unauthorized access to or use of customer information. E. Agency Action To Minimize Effect on Small Entities The RFA directs us to consider alternatives that would accomplish our stated objectives, while minimizing any significant adverse impact on small entities. Accordingly, we considered the following alternatives: 1. Establishing different compliance or reporting standards that take into account the resources available to small entities; guidance from the FTC and usa.gov regarding steps an individual can take to protect against identity theft, a statement encouraging the individual to report any incidents of identity theft to the FTC, and include the FTC’s website address where individuals may obtain government information about identity theft and report suspected incidents of identity theft. 1159 Covered institutions are currently subject to similar recordkeeping requirements applicable to other required policies and procedures. Therefore, covered institutions will generally not need to invest in new recordkeeping staff, systems, or procedures to satisfy the new recordkeeping requirements. PO 00000 Frm 00098 Fmt 4701 Sfmt 4700 2. The clarification, consolidation, or simplification of the reporting and compliance requirements under the rule for small entities; 3. Use of performance rather than design standards; and 4. Exempting small entities from coverage of the rule, or any part of the rule. With regard to the first alternative, the final amendments to Regulation S–P that will continue to permit institutions substantial flexibility to design safeguarding policies and procedures appropriate for their size and complexity, the nature and scope of their activities, and the sensitivity of the personal information at issue. However, it is necessary to require that covered institutions, regardless of their size, adopt a response program for incidents of unauthorized access to or use of customer information, which will include customer notification procedures.1160 The amendments to Regulation S–P arise from our concern with the increasing number of information security breaches that have come to light in recent years, particularly those involving institutions regulated by the Commission. Establishing different compliance or reporting requirements for small entities could lead to less favorable protections for these entities’ customers and compromise the effectiveness of the amendments. However, we are providing smaller covered institutions a longer compliance period to establish and implement processes to comply with the final amendments. With regard to the second alternative, the final amendments will, by their operation, simplify reporting and compliance requirements for small entities. Small covered institutions are likely to maintain personal information on fewer individuals than large covered institutions, and they are likely to have relatively simple personal information systems. The amendments will not prescribe specific steps a covered institution must take in response to a data breach, but instead would give the institution flexibility to tailor its policies and procedures to its individual facts and circumstances. The amendments therefore are intended to give covered institutions the flexibility to address the general elements in the response program based on the size and complexity of the institution and the nature and scope of its activities. Accordingly, the requirements of the amendments already will be simplified for small entities. In addition, the requirements of the amendments could 1160 See E:\FR\FM\03JNR2.SGM final rule 248.30(a)(3). 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations not be further simplified, or clarified or consolidated, without compromising the investor protection objectives the amendments are designed to achieve. With regard to the third alternative, the final amendments are design based. Rather than specifying the types of policies and procedures that an institution would be required to include in its response program, the amendments will require a response program that is reasonably designed to detect, respond to, and recover from both unauthorized access to and unauthorized use of customer information. With respect to the specific requirements regarding notifications in the event of a data breach, institutions provide only the information that seems most relevant for an affected customer to know in order to assess adequately the potential damage that could result from the breach and to develop an appropriate response. Finally, with regard to alternative four, an exemption for small entities would not be appropriate. Small entities are as vulnerable as large ones to the types of data security breach incidents we are trying to address. In this regard, the specific elements the final amendments must be considered and incorporated into the policies and procedures of all covered institutions, regardless of their size, to mitigate the potential for fraud or other substantial harm or inconvenience to investors. Exempting small entities from coverage of the amendments or any part of the amendments could compromise the effectiveness of the amendments and harm investors by lowering standards for safeguarding investor information maintained by small covered institutions. Excluding small entities from requirements that would be applicable to larger covered institutions also could create competitive disparities between large and small entities, for example by undermining investor confidence in the security of information maintained by small covered institutions. lotter on DSK11XQN23PROD with RULES2 Statutory Authority The Commission is amending Regulation S–P pursuant to authority set forth in sections 17, 17A, 23, and 36 of the Exchange Act [15 U.S.C. 78q, 78q– 1, 78w, and 78mm], sections 31 and 38 of the Investment Company Act [15 U.S.C. 80a–30 and 80a–37], sections 204, 204A, and 211 of the Investment Advisers Act [15 U.S.C. 80b–4, 80b–4a, and 80b–11], section 628(a) of the FCRA [15 U.S.C. 1681w(a)], and sections 501, 504, 505, and 525 of the GLBA [15 U.S.C. 6801, 6804, 6805, and 6825]. VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 47785 List of Subjects (ii) The written documentation of any detected unauthorized access to or use 17 CFR Part 240 of customer information, as well as any Reporting and recordkeeping response to, and recovery from such requirements; Securities. unauthorized access to or use of customer information required by 17 CFR Part 248 § 248.30(a)(3) of this chapter for three Brokers, Consumer protection, years from the date when the records Dealers, Investment advisers, were made; Investment companies, Privacy, (iii) The written documentation of any Reporting and recordkeeping investigation and determination made requirements, Securities, Transfer regarding whether notification is agents. required pursuant to § 248.30(a)(4) of this chapter, including the basis for any 17 CFR Parts 270 and 275 determination made, any written Reporting and recordkeeping documentation from the United States requirements; Securities. Attorney General related to a delay in notice, as well as a copy of any notice Text of Rule Amendments transmitted following such For the reasons set out in the determination, for three years from the preamble, title 17, chapter II of the Code date when the records were made; of Federal Regulations is amended as (iv) The written policies and follows: procedures required to be adopted and implemented pursuant to PART 240—GENERAL RULES AND § 248.30(a)(5)(i) of this chapter until REGULATIONS, SECURITIES three years after the termination of the EXCHANGE ACT OF 1934 use of the policies and procedures; (v) The written documentation of any ■ 1. The authority citation for part 240 contract or agreement entered into and the sectional authorities for pursuant to § 248.30(a)(5) of this chapter §§ 240.17a–14 and 240.17Ad–7 are until three years after the termination of revised to read, as follows: such contract or agreement; and Authority: 15 U.S.C. 77c, 77d, 77g, 77j, (vi) The written policies and 77s, 77z–2, 77z–3, 77eee, 77ggg, 77nnn, procedures required to be adopted and 77sss, 77ttt, 78c, 78c–3, 78c–5, 78d, 78e, 78f, implemented pursuant to § 248.30(b)(2) 78g, 78i, 78j, 78j–1, 78j–4, 78k, 78k–1, 78l, of this chapter until three years after the 78m, 78n, 78n–1, 78o, 78o–4, 78o–10, 78p, 78q, 78q–1, 78s, 78u–5, 78w, 78x, 78dd, 78ll, termination of the use of the policies 78mm, 80a–20, 80a–23, 80a–29, 80a–37, 80b– and procedures; 3, 80b–4, 80b–11, 1681w(a)(1), 6801–6809, * * * * * 6825, 7201 et seq., and 8302; 7 U.S.C. 2(c)(2)(E); 12 U.S.C. 5221(e)(3); 18 U.S.C. 1350; Pub. L. 111–203, 939A, 124 Stat. 1376 (2010); and Pub. L. 112–106, sec. 503 and 602, 126 Stat. 326 (2012), unless otherwise noted. * * * * * Section 240.17a–14 is also issued under Public Law 111–203, sec. 913, 124 Stat. 1376 (2010). * * * * * Section 240.17ad–7 is also issued under 15 U.S.C. 78b, 78q, and 78q–1. * * * * * 2. Amend § 240.17a–4 by adding a reserved paragraph (e)(13) and adding paragraph (e)(14) to read as follows: ■ § 240.17a–4 Records to be preserved by certain exchange members, brokers and dealers. * * * * * (e) * * * (13) [Reserved] (14)(i) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(1) of this chapter until three years after the termination of the use of the policies and procedures; PO 00000 Frm 00099 Fmt 4701 Sfmt 4700 § 240.17Ad–7 [Redesignated as § 240.17ad–7]. 3. Redesignate § 240.17Ad–7 as § 240.17ad–7. ■ 4. Amend newly redesignated § 240.17ad–7 by: ■ a. Revising the section heading; ■ b. Adding a reserved paragraph (j); and ■ c. Adding paragraph (k). The revision and additions read as follows: ■ § 240.17ad–7 retention. * (Rule 17Ad–7) Record * * * * (j) [Reserved] (k) Every registered transfer agent shall maintain in an easily accessible place: (1) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(1) of this chapter for no less than three years after the termination of the use of the policies and procedures; (2) The written documentation of any detected unauthorized access to or use of customer information, as well as any E:\FR\FM\03JNR2.SGM 03JNR2 47786 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations response to, and recovery from such unauthorized access to or use of customer information required by § 248.30(a)(3) of this chapter for no less than three years from the date when the records were made; (3) The written documentation of any investigation and determination made regarding whether notification is required pursuant to § 248.30(a)(4) of this chapter, including the basis for any determination made, any written documentation from the United States Attorney General related to a delay in notice, as well as a copy of any notice transmitted following such determination, for no less than three years from the date when the records were made; (4) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(5)(i) of this chapter until three years after the termination of the use of the policies and procedures; (5) The written documentation of any contract or agreement entered into pursuant to § 248.30(a)(5) of this chapter until three years after the termination of such contract or agreement; and (6) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(b)(2) of this chapter for no less than three years after the termination of the use of the policies and procedures. PART 248—REGULATIONS S–P, S– AM, and S–ID 5. The authority citation for part 248 continues to read as follows: ■ Authority: 15 U.S.C. 78q, 78q–1, 78o–4, 78o–5, 78w, 78mm, 80a–30, 80a–37, 80b–4, 80b–11, 1681m(e), 1681s(b), 1681s–3 and note, 1681w(a)(1), 6801–6809, and 6825; Pub. L. 111–203, secs. 1088(a)(8), (a)(10), and sec. 1088(b), 124 Stat. 1376 (2010). * * * * * 6. Amend § 248.5 by revising paragraph (a)(1) and adding paragraph (e) to read as follows: ■ lotter on DSK11XQN23PROD with RULES2 § 248.5 Annual privacy notice to customers required. (a)(1) General rule. Except as provided by paragraph (e) of this section, you must provide a clear and conspicuous notice to customers that accurately reflects your privacy policies and practices not less than annually during the continuation of the customer relationship. Annually means at least once in any period of 12 consecutive months during which that relationship exists. You may define the 12consecutive-month period, but you must VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 apply it to the customer on a consistent basis. * * * * * (e) Exception to annual privacy notice requirement—(1) When exception available. You are not required to deliver an annual privacy notice if you: (i) Provide nonpublic personal information to nonaffiliated third parties only in accordance with § 248.13, § 248.14, or § 248.15; and (ii) Have not changed your policies and practices with regard to disclosing nonpublic personal information from the policies and practices that were disclosed to the customer under § 248.6(a)(2) through (5) and (9) in the most recent privacy notice provided pursuant to this part. (2) Delivery of annual privacy notice after financial institution no longer meets the requirements for exception. If you have been excepted from delivering an annual privacy notice pursuant to paragraph (e)(1) of this section and change your policies or practices in such a way that you no longer meet the requirements for that exception, you must comply with paragraph (e)(2)(i) or (ii) of this section, as applicable. (i) Changes preceded by a revised privacy notice. If you no longer meet the requirements of paragraph (e)(1) of this section because you change your policies or practices in such a way that § 248.8 requires you to provide a revised privacy notice, you must provide an annual privacy notice in accordance with the timing requirement in paragraph (a) of this section, treating the revised privacy notice as an initial privacy notice. (ii) Changes not preceded by a revised privacy notice. If you no longer meet the requirements of paragraph (e)(1) of this section because you change your policies or practices in such a way that § 248.8 does not require you to provide a revised privacy notice, you must provide an annual privacy notice within 100 days of the change in your policies or practices that causes you to no longer meet the requirement of paragraph (e)(1) of this section. (iii) Examples. (A) You change your policies and practices in such a way that you no longer meet the requirements of paragraph (e)(1) of this section effective April 1 of year 1. Assuming you define the 12-consecutive-month period pursuant to paragraph (a) of this section as a calendar year, if you were required to provide a revised privacy notice under § 248.8 and you provided that notice on March 1 of year 1, you must provide an annual privacy notice by December 31 of year 2. If you were not required to provide a revised privacy PO 00000 Frm 00100 Fmt 4701 Sfmt 4700 notice under § 248.8, you must provide an annual privacy notice by July 9 of year 1. (B) You change your policies and practices in such a way that you no longer meet the requirements of paragraph (e)(1) of this section, and so provide an annual notice to your customers. After providing the annual notice to your customers, you once again meet the requirements of paragraph (e)(1) of this section for an exception to the annual notice requirement. You do not need to provide additional annual notice to your customers until such time as you no longer meet the requirements of paragraph (e)(1) of this section. § 248.17 [Amended] 7. Amend § 248.17 in paragraph (b) by removing the words ‘‘Federal Trade Commission’’ and adding in their place ‘‘Consumer Financial Protection Bureau’’ and removing the words ‘‘Federal Trade Commission’s’’ and adding in their place ‘‘Consumer Financial Protection Bureau’s’’. ■ 8. Revise § 248.30 to read as follows: ■ § 248.30 Procedures to safeguard customer information, including response programs for unauthorized access to customer information and customer notice; disposal of customer information and consumer information. (a) Policies and procedures to safeguard customer information—(1) General requirements. Every covered institution must develop, implement, and maintain written policies and procedures that address administrative, technical, and physical safeguards for the protection of customer information. (2) Objectives. These written policies and procedures must be reasonably designed to: (i) Ensure the security and confidentiality of customer information; (ii) Protect against any anticipated threats or hazards to the security or integrity of customer information; and (iii) Protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer. (3) Response programs for unauthorized access to or use of customer information. Written policies and procedures in paragraph (a)(1) of this section must include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information, including customer notification procedures. This response program must include procedures for the covered institution to: (i) Assess the nature and scope of any incident involving unauthorized access E:\FR\FM\03JNR2.SGM 03JNR2 lotter on DSK11XQN23PROD with RULES2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations to or use of customer information and identify the customer information systems and types of customer information that may have been accessed or used without authorization; (ii) Take appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information; and (iii) Notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization in accordance with paragraph (a)(4) of this section unless the covered institution determines, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information, that the sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience. (4) Notifying affected individuals of unauthorized access or use—(i) Notification obligation. Unless a covered institution has determined, after a reasonable investigation of the facts and circumstances of the incident of unauthorized access to or use of sensitive customer information that occurred at the covered institution or one of its service providers that is not itself a covered institution, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience, the covered institution must provide a clear and conspicuous notice, or ensure that such notice is provided, to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. The notice must be transmitted by a means designed to ensure that each affected individual can reasonably be expected to receive actual notice in writing. (ii) Affected individuals. If an incident of unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, but the covered institution is unable to identify which specific individuals’ sensitive customer information has been accessed or used without authorization, the covered institution must provide notice to all individuals whose sensitive customer information resides in the customer information system that was, or was reasonably likely to have been, accessed or used without authorization. Notwithstanding the foregoing, if the covered institution reasonably determines that a specific individual’s sensitive customer information that VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 resides in the customer information system was not accessed or used without authorization, the covered institution is not required to provide notice to that individual under this paragraph. (iii) Timing. A covered institution must provide the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred unless the United States Attorney General determines that the notice required under this rule poses a substantial risk to national security or public safety, and notifies the Commission of such determination in writing, in which case the covered institution may delay providing such notice for a time period specified by the Attorney General, up to 30 days following the date when such notice was otherwise required to be provided. The notice may be delayed for an additional period of up to 30 days if the Attorney General determines that the notice continues to pose a substantial risk to national security or public safety and notifies the Commission of such determination in writing. In extraordinary circumstances, notice required under this section may be delayed for a final additional period of up to 60 days if the Attorney General determines that such notice continues to pose a substantial risk to national security and notifies the Commission of such determination in writing. Beyond the final 60-day delay under this paragraph (a)(4)(iii), if the Attorney General indicates that further delay is necessary, the Commission will consider additional requests for delay and may grant such delay through Commission exemptive order or other action. (iv) Notice contents. The notice must: (A) Describe in general terms the incident and the type of sensitive customer information that was or is reasonably believed to have been accessed or used without authorization; (B) Include, if the information is reasonably possible to determine at the time the notice is provided, any of the following: the date of the incident, the estimated date of the incident, or the date range within which the incident occurred; (C) Include contact information sufficient to permit an affected individual to contact the covered institution to inquire about the incident, including the following: a telephone number (which should be a toll-free number if available), an email address or equivalent method or means, a postal address, and the name of a specific PO 00000 Frm 00101 Fmt 4701 Sfmt 4700 47787 office to contact for further information and assistance; (D) If the individual has an account with the covered institution, recommend that the customer review account statements and immediately report any suspicious activity to the covered institution; (E) Explain what a fraud alert is and how an individual may place a fraud alert in the individual’s credit reports to put the individual’s creditors on notice that the individual may be a victim of fraud, including identity theft; (F) Recommend that the individual periodically obtain credit reports from each nationwide credit reporting company and that the individual have information relating to fraudulent transactions deleted; (G) Explain how the individual may obtain a credit report free of charge; and (H) Include information about the availability of online guidance from the Federal Trade Commission and usa.gov regarding steps an individual can take to protect against identity theft, a statement encouraging the individual to report any incidents of identity theft to the Federal Trade Commission, and include the Federal Trade Commission’s website address where individuals may obtain government information about identity theft and report suspected incidents of identity theft. (5) Service providers. (i) A covered institution’s response program prepared in accordance with paragraph (a)(3) of this section must include the establishment, maintenance, and enforcement of written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including to ensure that the covered institution notifies affected individuals as set forth in paragraph (a)(4) of this section. The policies and procedures must be reasonably designed to ensure service providers take appropriate measures to: (A) Protect against unauthorized access to or use of customer information; and (B) Provide notification to the covered institution as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system maintained by the service provider. Upon receipt of such notification, the covered institution must initiate its incident response program adopted pursuant to paragraph (a)(3) of this section. (ii) As part of its incident response program, a covered institution may enter into a written agreement with its E:\FR\FM\03JNR2.SGM 03JNR2 lotter on DSK11XQN23PROD with RULES2 47788 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations service provider to notify affected individuals on the covered institution’s behalf in accordance with paragraph (a)(4) of this section. (iii) Notwithstanding a covered institution’s use of a service provider in accordance with paragraphs (a)(5)(i) and (ii) of this section, the obligation to ensure that affected individuals are notified in accordance with paragraph (a)(4) of this section rests with the covered institution. (b) Disposal of consumer information and customer information—(1) Standard. Every covered institution, other than notice-registered brokerdealers, must properly dispose of consumer information and customer information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. (2) Written policies, procedures, and records. Every covered institution, other than notice-registered broker-dealers, must adopt and implement written policies and procedures that address the proper disposal of consumer information and customer information according to the standard identified in paragraph (b)(1) of this section. (3) Relation to other laws. Nothing in this paragraph (b) shall be construed: (i) To require any covered institution to maintain or destroy any record pertaining to an individual that is not imposed under other law; or (ii) To alter or affect any requirement imposed under any other provision of law to maintain or destroy records. (c) Recordkeeping. (1) Every covered institution that is an investment company under the Investment Company Act of 1940 (15 U.S.C. 80a), but is not registered under section 8 thereof (15 U.S.C. 80a–8), must make and maintain: (i) The written policies and procedures required to be adopted and implemented pursuant to paragraph (a)(1) of this section; (ii) The written documentation of any detected unauthorized access to or use of customer information, as well as any response to, and recovery from such unauthorized access to or use of customer information required by paragraph (a)(3) of this section; (iii) The written documentation of any investigation and determination made regarding whether notification is required pursuant to paragraph (a)(4) of this section, including the basis for any determination made, any written documentation from the United States Attorney General related to a delay in notice, as well as a copy of any notice VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 transmitted following such determination; (iv) The written policies and procedures required to be adopted and implemented pursuant to paragraph (a)(5)(i) of this section; (v) The written documentation of any contract or agreement entered into pursuant to paragraph (a)(5) of this section; and (vi) The written policies and procedures required to be adopted and implemented pursuant to paragraph (b)(2) of this section. (2) In the case of covered institutions described in paragraph (c)(1) of this section, such records, apart from any policies and procedures, must be preserved for a time period not less than six years, the first two years in an easily accessible place. In the case of policies and procedures required under paragraphs (a) and (b)(2) of this section, covered institutions described in paragraph (c)(1) of this section must maintain a copy of such policies and procedures in effect, or that at any time within the past six years were in effect, in an easily accessible place. (d) Definitions. As used in this section, unless the context otherwise requires: (1) Consumer information means: (i) Any record about an individual, whether in paper, electronic or other form, that is a consumer report or is derived from a consumer report, or a compilation of such records, that a covered institution maintains or otherwise possesses for a business purpose regardless of whether such information pertains to: (A) Individuals with whom the covered institution has a customer relationship; or (B) To the customers of other financial institutions where such information has been provided to the covered institution. (ii) Consumer information does not include information that does not identify individuals, such as aggregate information or blind data. (2) Consumer report has the same meaning as in section 603(d) of the Fair Credit Reporting Act (15 U.S.C. 1681a(d)). (3) Covered institution means any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency (‘‘ARA’’) as defined in section 3(a)(34)(B) of the Securities Exchange Act of 1934. (4) Customer. (i) Customer has the same meaning as in § 248.3(j) unless the covered institution is a transfer agent PO 00000 Frm 00102 Fmt 4701 Sfmt 4700 registered with the Commission or another ARA. (ii) With respect to a transfer agent registered with the Commission or another ARA, for purposes of this section, customer means any natural person who is a securityholder of an issuer for which the transfer agent acts or has acted as a transfer agent. (5) Customer information. (i) Customer information for any covered institution other than a transfer agent registered with the Commission or another ARA means any record containing nonpublic personal information as defined in § 248.3(t) about a customer of a financial institution, whether in paper, electronic or other form, that is in the possession of a covered institution or that is handled or maintained by the covered institution or on its behalf regardless of whether such information pertains to: (A) Individuals with whom the covered institution has a customer relationship; or (B) To the customers of other financial institutions where such information has been provided to the covered institution. (ii) With respect to a transfer agent registered with the Commission or another ARA, customer information means any record containing nonpublic personal information as defined in § 248.3(t) identified with any natural person, who is a securityholder of an issuer for which the transfer agent acts or has acted as transfer agent, that is in the possession of a transfer agent or that is handled or maintained by the transfer agent or on its behalf, regardless of whether such information pertains to individuals with whom the transfer agent has a customer relationship, or pertains to the customers of other financial institutions and has been provided to the transfer agent. (6) Customer information systems means the information resources owned or used by a covered institution, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of customer information to maintain or support the covered institution’s operations. (7) Disposal means: (i) The discarding or abandonment of consumer information or customer information; or (ii) The sale, donation, or transfer of any medium, including computer equipment, on which consumer information or customer information is stored. E:\FR\FM\03JNR2.SGM 03JNR2 Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules and Regulations lotter on DSK11XQN23PROD with RULES2 (8) Notice-registered broker-dealer means a broker or dealer registered by notice with the Commission under section 15(b)(11) of the Securities Exchange Act of 1934 (15 U.S.C. 78o(b)(11)). (9) Sensitive customer information. (i) Sensitive customer information means any component of customer information alone or in conjunction with any other information, the compromise of which could create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information. (ii) Examples of sensitive customer information include: (A) Customer information uniquely identified with an individual that has a reasonably likely use as a means of authenticating the individual’s identity, including (1) A Social Security number, official State- or government-issued driver’s license or identification number, alien registration number, government passport number, employer or taxpayer identification number; (2) A biometric record; (3) A unique electronic identification number, address, or routing code; (4) Telecommunication identifying information or access device (as defined in 18 U.S.C. 1029(e)); or (B) Customer information identifying an individual or the individual’s account, including the individual’s account number, name or online user name, in combination with authenticating information such as information described in paragraph (d)(9)(ii)(A) of this section, or in combination with similar information that could be used to gain access to the customer’s account such as an access code, a credit card expiration date, a partial Social Security number, a security code, a security question and answer identified with the individual or the individual’s account, or the individual’s date of birth, place of birth, or mother’s maiden name. (10) Service provider means any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a covered institution. (11) Transfer agent has the same meaning as in section 3(a)(25) of the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(25)). PART 270—RULES AND REGULATIONS, INVESTMENT COMPANY ACT OF 1940 9. The authority citation for part 270 is revised to read as follows: ■ VerDate Sep<11>2014 19:34 May 31, 2024 Jkt 262001 Authority: 15 U.S.C. 80a–1 et seq., 80a– 34(d), 80a–37, 80a–39, 1681w(a)(1), 6801– 6809, 6825, and Pub. L. 111–203, sec. 939A, 124 Stat. 1376 (2010), unless otherwise noted. * * * * * Section 270.31a–2 is also issued under 15 U.S.C. 80a–30. 10. Amend § 270.31a–1 by adding paragraph (b)(13) to read as follows: ■ § 270.31a–1 Records to be maintained by registered investment companies, certain majority-owned subsidiaries thereof, and other persons having transactions with registered investment companies. * * * * * (b) * * * (13)(i) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(1); (ii) The written documentation of any detected unauthorized access to or use of customer information, as well as any response to, and recovery from such unauthorized access to or use of customer information required by § 248.30(a)(3); (iii) The written documentation of any investigation and determination made regarding whether notification is required pursuant to § 248.30(a)(4), including the basis for any determination made, any written documentation from the United States Attorney General related to a delay in notice, as well as a copy of any notice transmitted following such determination; (iv) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(5)(i); (v) The written documentation of any contract or agreement entered into pursuant to § 248.30(a)(5); and (vi) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(b)(2). * * * * * ■ 11. Amend § 270.31a–2 by: ■ a. In paragraph (a)(7), removing the period at the end of the paragraph and adding ‘‘; and’’ in its place; and ■ b. Adding paragraph (a)(8). The addition reads as follows: § 270.31a–2 Records to be preserved by registered investment companies, certain majority-owned subsidiaries thereof, and other persons having transactions with registered investment companies. (a) * * * (8) Preserve for a period not less than six years, the first two years in an easily accessible place, the records required by § 270.31a–1(b)(13) apart from any policies and procedures thereunder and, in the case of policies and procedures required under § 270.31a–1(b)(13), PO 00000 Frm 00103 Fmt 4701 Sfmt 9990 47789 preserve a copy of such policies and procedures in effect, or that at any time within the past six years were in effect, in an easily accessible place. * * * * * PART 275—RULES AND REGULATIONS, INVESTMENT ADVISERS ACT OF 1940 12. The authority citation for part 275 is revised to read as follows: ■ Authority: 15 U.S.C. 80b–2(a)(11)(G), 80b– 2(a)(11)(H), 80b–2(a)(17), 80b–3, 80b–4, 80b– 4a, 80b–6(4), 80b–6a, 80b–11, 1681w(a)(1), 6801–6809, and 6825, unless otherwise noted. * * * * * Section 275.204–2 is also issued under 15 U.S.C. 80b–6. * * * * * 13. Amend § 275.204–2 by adding paragraph (a)(25) to read as follows: ■ § 275.204–2 Books and records to be maintained by investment advisers. (a) * * * (25)(i) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(1); (ii) The written documentation of any detected unauthorized access to or use of customer information, as well as any response to, and recovery from such unauthorized access to or use of customer information required by § 248.30(a)(3) of this chapter; (iii) The written documentation of any investigation and determination made regarding whether notification is required pursuant to § 248.30(a)(4) of this chapter, including the basis for any determination made, any written documentation from the United States Attorney General related to a delay in notice, as well as a copy of any notice transmitted following such determination; (iv) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(a)(5)(i) of this chapter; (v) The written documentation of any contract or agreement entered into pursuant to § 248.30(a)(5) of this chapter; and (vi) The written policies and procedures required to be adopted and implemented pursuant to § 248.30(b)(2) of this chapter. * * * * * By the Commission. Dated: May 16, 2024. Vanessa A. Countryman, Secretary. [FR Doc. 2024–11116 Filed 5–31–24; 8:45 am] BILLING CODE 8011–01–P E:\FR\FM\03JNR2.SGM 03JNR2

Agencies

SECURITIES AND EXCHANGE COMMISSION

[Federal Register Volume 89, Number 107 (Monday, June 3, 2024)]
[Rules and Regulations]
[Pages 47688-47789]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2024-11116]



[[Page 47687]]

Vol. 89

Monday,

No. 107

June 3, 2024

Part II





Securities and Exchange Commission





-----------------------------------------------------------------------





17 CFR Parts 240, 248, 270, et al.





 Regulation S-P: Privacy of Consumer Financial Information and 
Safeguarding Customer Information; Final Rule

Federal Register / Vol. 89, No. 107 / Monday, June 3, 2024 / Rules 
and Regulations

[[Page 47688]]


-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Parts 240, 248, 270, and 275

[Release Nos. 34-100155; IA-6604; IC-35193; File No. S7-05-23]
RIN 3235-AN26


Regulation S-P: Privacy of Consumer Financial Information and 
Safeguarding Customer Information

AGENCY: Securities and Exchange Commission.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'' or 
``SEC'') is adopting rule amendments that will require brokers and 
dealers (or ``broker-dealers''), investment companies, investment 
advisers registered with the Commission (``registered investment 
advisers''), funding portals, and transfer agents registered with the 
Commission or another appropriate regulatory agency (``ARA'') as 
defined in the Securities Exchange Act of 1934 (``transfer agents'') to 
adopt written policies and procedures for incident response programs to 
address unauthorized access to or use of customer information, 
including procedures for providing timely notification to individuals 
affected by an incident involving sensitive customer information with 
details about the incident and information designed to help affected 
individuals respond appropriately. In addition, the amendments extend 
the application of requirements to safeguard customer records and 
information to transfer agents; broaden the scope of information 
covered by the requirements for safeguarding customer records and 
information and for properly disposing of consumer report information; 
impose requirements to maintain written records documenting compliance 
with the amended rules; and conform annual privacy notice delivery 
provisions to the terms of an exception provided by a statutory 
amendment to the Gramm-Leach-Bliley Act (``GLBA'').

DATES: 
    Effective date: This rule is effective August 2, 2024.
    Compliance date: The applicable compliance dates are discussed in 
section II.F of this rule.

FOR FURTHER INFORMATION CONTACT: Emily Hellman, James Wintering, 
Special Counsels; Edward Schellhorn, Branch Chief; Devin Ryan, 
Assistant Director; John Fahey, Deputy Chief Counsel; Emily Westerberg 
Russell, Chief Counsel; Office of Chief Counsel, Division of Trading 
and Markets, (202) 551-5550; Kevin Schopp, Senior Special Counsel; 
Moshe Rothman, Assistant Director; Office of Clearance and Settlement, 
Division of Trading and Markets, (202) 551-5550, Susan Ali and Andrew 
Deglin, Counsels; Michael Khalil and Y. Rachel Kuo, Senior Counsels; 
Blair Burnett and Bradley Gude, Branch Chiefs; or Brian McLaughlin 
Johnson, Assistant Director, Investment Company Regulation Office, 
Division of Investment Management, (202) 551-6792, Securities and 
Exchange Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION: The Commission is adopting amendments to 17 
CFR 248.1 through 248.100 (``Regulation S-P'') under Title V of the 
GLBA [15 U.S.C. 6801 through 6827], the Fair Credit Reporting Act 
(``FCRA'') [15 U.S.C. 1681 through 1681x], the Securities Exchange Act 
of 1934 (``Exchange Act'') [15 U.S.C. 78a et seq.], the Investment 
Company Act of 1940 (``Investment Company Act'') [15 U.S.C. 80a-1 et 
seq.], and the Investment Advisers Act of 1940 (``Investment Advisers 
Act'') [15 U.S.C. 80b-1 et seq.].

Table of Contents

I. Introduction and Background
II. Discussion
    A. Incident Response Program Including Customer Notification
    1. Assessment
    2. Containment and Control
    3. Notice to Affected Individuals
    4. Service Providers
    B. Scope of Safeguards Rule and Disposal Rule
    1. Scope of Information Protected
    2. Extending the Scope of the Safeguards Rule and the Disposal 
Rule To Cover All Transfer Agents
    3. Maintaining the Current Regulatory Framework for Notice-
Registered Broker-Dealers
    C. Recordkeeping
    D. Exception From Requirement To Deliver Annual Privacy Notice
    E. Existing Staff No-Action Letters and Other Staff Statements
    F. Compliance Period
III. Other Matters
IV. Economic Analysis
    A. Introduction
    B. Broad Economic Considerations
    C. Baseline
    1. Safeguarding Customer Information: Risks and Practices
    2. Regulations and Guidelines
    3. Market Structure
    D. Benefits and Costs of the Final Rule Amendments
    1. Written Policies and Procedures
    2. Extending the Scope of the Safeguards Rule and the Disposal 
Rule
    3. Recordkeeping
    4. Exception From Annual Notice Delivery Requirement
    E. Effects on Efficiency, Competition, and Capital Formation
    F. Reasonable Alternatives Considered
    1. Reasonable Assurances From Service Providers
    2. Lower Threshold for Customer Notice
    3. Encryption Safe Harbor
    4. Longer Customer Notification Deadlines
    5. Broader National Security and Public Safety Delay in Customer 
Notification
V. Paperwork Reduction Act
    A. Introduction
    B. Amendments to the Safeguards Rule and Disposal Rule
VI. Final Regulatory Flexibility Act Analysis
    A. Need for, and Objectives of, the Final Amendments
    B. Significant Issues Raised by Public Comments
    C. Small Entities Subject to Final Amendments
    D. Projected Reporting, Recordkeeping, and Other Compliance 
Requirements
    E. Agency Action To Minimize Effect on Small Entities
Statutory Authority

I. Introduction and Background

    Regulation S-P is a set of privacy rules adopted pursuant to the 
GLBA and the Fair and Accurate Credit Transactions Act of 2003 (``FACT 
Act'') that govern the treatment of nonpublic personal information 
about consumers by certain financial institutions.\1\ The Commission is 
adopting rule amendments that are designed to modernize and enhance the 
protections that Regulation S-P provides by addressing the expanded use 
of technology and corresponding risks that have emerged since the 
Commission originally adopted Regulation S-P in 2000. The amendments in 
particular update the requirements of the ``safeguards'' and 
``disposal'' rules. The safeguards rule requires brokers, dealers, 
investment companies,\2\ and registered investment advisers to adopt 
written policies and procedures that address administrative, technical, 
and physical safeguards to protect customer records and information.\3\ 
The disposal rule, which applies to transfer agents

[[Page 47689]]

registered with the Commission in addition to the institutions covered 
by the safeguards rule, requires proper disposal of consumer report 
information.\4\ In addition, under Regulation Crowdfunding, funding 
portals must comply with the requirements of Regulation S-P as they 
apply to brokers.\5\ Thus, funding portals will also be required to 
comply with the applicable amendments to Regulation S-P adopted in this 
release.
---------------------------------------------------------------------------

    \1\ See 17 CFR 248.1.
    \2\ Regulation S-P applies to investment companies as the term 
is defined in section 3 of the Investment Company Act (15 U.S.C. 
80a-3), whether or not the investment company is registered with the 
Commission. See 17 CFR 248.3(r). Thus, a business development 
company, which is an investment company but is not required to 
register as such with the Commission, is subject to Regulation S-P. 
Similarly, employees' securities companies--including those that are 
not required to register under the Investment Company Act--are 
investment companies and are, therefore, subject to Regulation S-P. 
By contrast, issuers that are excluded from the definition of 
investment company--such as private funds that are able to rely on 
section 3(c)(1) or 3(c)(7) of the Investment Company Act--are not 
subject to Regulation S-P.
    \3\ 17 CFR 248.30(a). References in this release to ``rule 
248.30'' are to 17 CFR 248.30.
    \4\ Rule 248.30(b).
    \5\ See 17 CFR 227.403(b). Accordingly, unless otherwise stated 
(for example, see infra sections IV and V), references in this 
release to ``brokers'' or ``broker-dealers'' include funding 
portals.
---------------------------------------------------------------------------

    The final Regulation S-P amendments are needed to provide enhanced 
protection of customer or consumer information and help ensure that 
customers of covered institutions receive timely and consistent 
notifications in the event of unauthorized access to or use of their 
information.\6\ In evaluating amendments to Regulation S-P, we have 
considered developments in how firms obtain, share, and maintain 
individuals' personal information since the Commission originally 
adopted Regulation S-P, which correspond with an increasing risk of 
harm to individuals.\7\ This environment of expanded risks and the 
importance of reducing or mitigating the potential for harm also 
supports our amendments to Regulation S-P.
---------------------------------------------------------------------------

    \6\ See Proposing Release at section II.A.4.
    \7\ See, e.g., Federal Bureau of Investigation, 2022 internet 
Crime Report (Mar. 27, 2023), at 7-8, available at: https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf (stating that 
the FBI's internet Crime Complaint Center received 800,944 
complaints in 2022 (an increase from 351,937 complaints in 2018). 
The complaints included 58,859 related to personal data breaches (an 
increase from 50,642 breaches in 2018)); the Financial Industry 
Regulatory Authority (``FINRA''), 2022 Report on FINRA's Examination 
and Risk Monitoring Program: Cybersecurity and Technology Governance 
(Feb. 2022), available at: https://www.finra.org/rules-guidance/guidance/reports/2022-finras-examination-and-risk-monitoring-program 
(noting increased number and sophistication of cybersecurity attacks 
and reminding firms of their obligations to oversee, monitor, and 
supervise cybersecurity programs and controls of third-party 
vendors); Office of Compliance Inspections and Examinations (now the 
Division of Examinations) (``EXAMS''), Risk Alert, Cybersecurity: 
Safeguarding Client Accounts against Credential Compromise (Sept. 
15, 2020), available at https://www.sec.gov/files/Risk%20Alert%20-%20Credential%20Compromise.pdf (describing increasingly 
sophisticated methods used by attackers to gain access to customer 
accounts and firm systems). This Risk Alert, and any other 
Commission staff statements represent the views of the staff. They 
are not a rule, regulation, or statement of the Commission. 
Furthermore, the Commission has neither approved nor disapproved 
their content. These staff statements, like all staff statements, 
have no legal force or effect. They do not alter or amend applicable 
law; and they create no new or additional obligations for any 
person.
---------------------------------------------------------------------------

    In March 2023, the Commission proposed amendments to Regulation S-
P.\8\ In particular, the proposed amendments would amend the safeguards 
rule to require any broker or dealer, investment company, registered 
investment adviser, or transfer agent (collectively, ``covered 
institutions'') to develop, implement, and maintain written policies 
and procedures for an incident response program reasonably designed to 
detect, respond to, and recover from unauthorized access to or use of 
customer information. The proposal included a further requirement that, 
as part of this incident response program, covered institutions would 
provide notices to individuals whose sensitive customer information 
was, or is reasonably likely to have been, accessed or used without 
authorization as soon as practicable, but not later than 30 days, after 
becoming aware that the incident occurred or is reasonably likely to 
have occurred. The proposed notice requirement included provisions that 
addressed the use of service providers by covered institutions and 
included a provision that would permit covered institutions to delay 
providing notice after receiving a written request from the United 
States Attorney General (``Attorney General'') that this notice poses a 
substantial risk to national security.
---------------------------------------------------------------------------

    \8\ See Regulation S-P: Privacy of Consumer Financial 
Information and Safeguarding Customer Information, Securities 
Exchange Act Release No. 97141 (Mar. 15, 2023) [88 FR 20616 (Apr. 6, 
2023)] (``Proposing Release'' or ``proposal''). The Commission voted 
to issue the Proposing Release on Mar. 15, 2023. The release was 
posted on the Commission website that day, and comment letters were 
received beginning the same day. The comment period closed on June 
5, 2023. We have considered all comments received since Mar. 15, 
2023.
---------------------------------------------------------------------------

    The Commission also proposed other amendments to Regulation S-P to 
enhance the protection of customers' nonpublic personal information. 
The proposed amendments included provisions to expand the scope of the 
protections of the safeguards and disposal rules, including extending 
the safeguards rule to transfer agents. The proposed amendments also 
included requirements for covered institutions to maintain written 
records documenting compliance with the proposed amended rules. 
Finally, the Commission proposed amendments to conform annual privacy 
notice delivery provisions to the terms of an exception provided by a 
statutory amendment to the GLBA.
    The Commission received comment letters on the proposal from a 
variety of commenters, including financial services firms and their 
service providers, law firms, investor advocacy groups, professional 
and trade associations, public policy research institutes, academics, 
and interested individuals.\9\ Most individual and public interest 
group commenters and some industry groups generally supported the 
proposed amendments.\10\ A few commenters urged the Commission to 
consider taking additional steps to strengthen the proposed 
requirements, for example, by shortening the period for customer 
notification.\11\ Many industry commenters expressed concern with 
specific elements of the proposed amendments, however, suggesting that 
these amendments would pose operational difficulties.\12\
---------------------------------------------------------------------------

    \9\ The comment letters on the proposal are available at https://www.sec.gov/comments/s7-05-23/s70523.htm.
    \10\ See, e.g., Comment Letter of the Investment Adviser 
Association (June 5, 2023) (``IAA Comment Letter 1''); Comment 
Letter of the Investment Company Institute (May 23, 2023) (``ICI 
Comment Letter 1''); Comment Letter of Better Markets (June 5, 2023) 
(``Better Markets Comment Letter''); Comment Letter of North 
American Securities Administrators Association (May 22, 2023) 
(``NASAA Comment Letter''). Some commenters suggested more tailored 
requirements for smaller covered institutions. See, e.g., IAA 
Comment Letter 1; Comment Letter of the Securities Transfer 
Association (June 2, 2023) (``STA Comment Letter 2''); Comment 
Letter of the Committee of Annuity Insurers (June 5, 2023) (``CAI 
Comment Letter''). As discussed in more detail below, the final 
amendments apply to all covered institutions because entities of all 
sizes are vulnerable to the types of data security breach incidents 
we are trying to address. See infra section VI.
    \11\ See, e.g., Better Markets Comment Letter.
    \12\ See, e.g., Comment Letter of the Securities Industry and 
Financial Markets Association, et al. (June 5, 2023) (``SIFMA 
Comment Letter 2''); Comment Letter of the Financial Services 
Institute (May 22, 2023) (``FSI Comment Letter''); Comment Letter of 
Federated Hermes, Inc. (June 6, 2023) (``Federated Comment 
Letter'').
---------------------------------------------------------------------------

    Comments on specific aspects of the proposed amendments focused on 
a few key themes. First, commenters urged the Commission to take a more 
holistic regulatory approach to harmonize the proposed amendments with 
other Commission rules and proposals to avoid creating redundant, 
overlapping, or conflicting obligations for covered institutions.\13\ 
We have modified the

[[Page 47690]]

rule from the proposal to address comments.\14\
---------------------------------------------------------------------------

    \13\ See, e.g., IAA Comment Letter 1; ICI Comment Letter 1; 
Comment Letter of Nasdaq Stock Market LLC (June 2, 2023) (``Nasdaq 
Comment Letter''). Commenters also raised these concerns about other 
proposed rulemakings that the Commission has not adopted. See, e.g., 
Comment Letter of the Investment Adviser Association (June 17, 2023) 
(``IAA Comment Letter 2''); ICI Comment Letter 1. Other commenters 
requested more specific guidance regarding how the various policies 
and procedure requirements in other Commission proposals would 
interact with each other. See, e.g., CAI Comment Letter; SIFMA 
Comment Letter 2; IAA Comment Letter 2. To the extent that those 
proposals are adopted, the baseline in those subsequent rulemakings 
will reflect the existing regulatory requirements at that time.
    \14\ Since the publication of the proposing release, the 
Commission adopted new rules to enhance and standardize disclosures 
regarding cybersecurity risk management, strategy, governance, and 
incidents by public companies that are subject to the reporting 
requirements of the Securities Exchange Act of 1934 (``Public 
Company Cybersecurity Rules''). See Cybersecurity Risk Management, 
Strategy, Governance, and Incident Disclosure, Securities Act 
Release No. 11216 (July 26, 2023) [88 FR 51896 (Aug. 4, 2023)].
---------------------------------------------------------------------------

    For example, covered institutions may be required to adopt written 
policies and procedures on similar issues under other provisions of the 
Federal securities laws.\15\ A covered institution can, however, adopt 
a single set of policies and procedures covering Regulation S-P and 
other rules, provided that the policies and procedures meet the 
requirements of each rule.\16\ Additionally, we have changed the 
proposed requirement to delay providing customer notices when that 
notice poses a substantial risk to national security or public safety 
in order to align with a similar provision contained in the Public 
Company Cybersecurity Rules.\17\
---------------------------------------------------------------------------

    \15\ See, e.g., 15 U.S.C. 80b-4a (requiring each adviser 
registered with the Commission to have written policies and 
procedures reasonably designed to prevent misuse of material non-
public information by the adviser or persons associated with the 
adviser); 17 CFR 270.38a-1(a)(1) (requiring investment companies to 
adopt compliance policies and procedures); 275.206(4)-7(a) 
(requiring investment advisers to adopt compliance policies and 
procedures); and Regulation S-ID, 17 CFR part 248, subpart C 
(requiring financial institutions subject to the Commission's 
jurisdiction with covered accounts to develop and implement a 
written identity theft prevention program that is designed to 
detect, prevent, and mitigate identity theft in connection with 
covered accounts, which must include, among other things, policies 
and procedures to respond appropriately to any red flags that are 
detected pursuant to the program).
    \16\ Two commenters addressed the proposal's application to 
dually-registered investment advisers and broker-dealers or firms 
operating both business models (collectively, ``dual registrants''). 
One of these commenters stated that the proposed amendments to 
Regulation S-P allow for streamlining of process because they would 
apply uniformly to broker-dealers and investment advisers. FSI 
Comment Letter. The other commenter addressed collectively other 
Commission cyber proposals and the proposed amendments to Regulation 
S-P. The commenter stated that these proposals collectively would 
involve significant burden for a dual registrant to bring both 
broker-dealer and investment adviser entities into compliance, 
urging the Commission to provide an extended compliance period for 
all of the proposed rules to provide time for dual registrants to 
come into compliance and ``identify some synergies that might make 
compliance more effective and economical.'' Cambridge Comment 
Letter. As one of these commenters stated, Regulation S-P's 
requirements apply uniformly to broker-dealers and advisers, 
although each covered institution--including a dual registrant--will 
have to tailor its policies and procedures to its business.
    \17\ See infra section II.A.3.d(2).
---------------------------------------------------------------------------

    Commenters also questioned the need for the proposed amendments in 
light of existing State laws that also address data breaches and raised 
concerns about differences between the proposed amendments and State 
regulatory requirements. One commenter stated that the proposed 
amendments were not needed because existing State laws already require 
firms to provide notice to individuals in the event of a data 
breach.\18\ Some commenters stated that parts of the proposed 
amendments would conflict with certain provisions of State laws,\19\ 
while other commenters stated that parts of the proposed amendments 
would duplicate existing State laws.\20\
---------------------------------------------------------------------------

    \18\ See CAI Comment Letter.
    \19\ See, e.g., IAA Comment Letter 1; Letter from Computershare 
(June 5, 2023) (``Computershare Comment Letter''); SIFMA Comment 
Letter 2.
    \20\ See, e.g., CAI Comment Letter.
---------------------------------------------------------------------------

    As discussed more fully later in this section, while we recognize 
that existing State laws require covered institutions to notify State 
residents of data breaches in some cases, State laws are not consistent 
on this point and exclude some entities from certain requirements.\21\ 
The final amendments will require notification to all customers of a 
covered institution affected by a data breach (regardless of State 
residency), in order to provide timely and consistent disclosure of 
important information to help affected customers respond to a data 
breach.\22\ To that end, the final amendments will enhance investor 
protection in a number of ways, including by covering a broader scope 
of customer information than many States; \23\ providing for a 30-day 
notification deadline that is shorter than the timing currently 
mandated by many States (including States that have no deadline or 
those allowing for various notification delays); \24\ and providing for 
a more robust notification trigger than in many States.\25\
---------------------------------------------------------------------------

    \21\ See infra section IV.C.2.
    \22\ With respect to the interaction of the final rule with 
State law, Section 15(i)(1) of the Exchange Act (15 U.S.C. 
78o(i)(1)) provides that no law, rule, regulation, or order, or 
other administrative action of any State or political subdivision 
thereof shall establish capital, custody, margin, financial 
responsibility, making and keeping records, bonding, or financial or 
operational reporting requirements for brokers, dealers, municipal 
securities dealers, government securities brokers, or government 
securities dealers that differ from, or are in addition to, the 
requirements in those areas established under the Exchange Act.
    \23\ See infra section IV.D.1.b(3).
    \24\ See infra section IV.D.1.b(2).
    \25\ See infra section IV.D.1.b(4).
---------------------------------------------------------------------------

    Commenters also raised concerns with differences between the 
proposed amendments and other Federal regulators' safeguarding 
standards that also include a requirement for a data breach response 
plan or program.\26\ The GLBA and FACT Act oblige us to adopt 
regulations, to the extent possible, that are consistent and comparable 
with those adopted by the Banking Agencies, the Consumer Financial 
Protection Bureau (``CFPB''), and the FTC.\27\ Accordingly, the 
Commission has also been mindful of the need to set standards for 
safeguarding customer records and information that are consistent and 
comparable with the corresponding standards set by these agencies in 
developing the amendments.\28\ To this end, we have modified the final 
amendments from the proposal to promote greater consistency with other 
applicable Federal safeguard standards to the extent they do not affect 
the investor protection purposes of this rulemaking, as discussed in 
more detail below. For example, the final amendments require covered 
institutions to ensure that their service providers provide 
notification as soon

[[Page 47691]]

as possible, but no later than 72 hours after becoming aware that an 
applicable breach has occurred, which is informed by the 72-hour 
deadline that is required under the Cyber Incident Reporting for 
Critical Infrastructure Act of 2022 (``CIRCIA'').\29\
---------------------------------------------------------------------------

    \26\ The Federal Trade Commission (``FTC'') in 2021 amended its 
Safeguards Rule (16 CFR part 314 (``FTC Safeguards Rule'')) by, 
among other things, adding a requirement for financial institutions 
under the FTC's GLBA jurisdiction to establish a written incident 
response plan designed to respond to information security events. 
See FTC, Standards for Safeguarding Customer Information, 86 FR 
70272 (Dec. 9, 2021). As amended, the FTC's rule requires that a 
response plan address security events materially affecting the 
confidentiality, integrity, or availability of customer information 
in the financial institution's control, and that the plan include 
specified elements that would include procedures for satisfying an 
institution's independent obligation to perform notification as 
required by State law. See id. at n.295. The ``Banking Agencies'' 
include the Office of the Comptroller of the Currency (``OCC''), the 
Board of Governors of the Federal Reserve System (``FRB''), the 
Federal Deposit Insurance Corporation (``FDIC''), and the former 
Office of Thrift Supervision. In 2005, the Banking Agencies and the 
National Credit Union Administration (``NCUA'') jointly issued 
guidance on responding to incidents of unauthorized access to or use 
of customer information. See Interagency Guidance on Response 
Programs for Unauthorized Access to Customer Information and 
Customer Notice, 70 FR 15736 (Mar. 29, 2005) (``Banking Agencies' 
Incident Response Guidance''). The Banking Agencies' Incident 
Response Guidance provides, among other things, that when an 
institution becomes aware of an incident of unauthorized access to 
sensitive customer information, the institution should conduct a 
reasonable investigation to determine promptly the likelihood that 
the information has been or will be misused. If the institution 
determines that misuse of the information has occurred or is 
reasonably possible, it should notify affected customers as soon as 
possible.
    \27\ See generally 15 U.S.C. 6804(a) (directing the agencies 
authorized to prescribe regulations under title V of the GLBA to 
assure to the extent possible that their regulations are consistent 
and comparable); 15 U.S.C. 1681w(a)(2)(A) (directing the agencies 
with enforcement authority set forth in 15 U.S.C. 1681s to consult 
and coordinate so that, to the extent possible, their regulations 
are consistent and comparable).
    \28\ See Proposing Release at the text following n.37.
    \29\ See final rule 248.30(a)(5)(i); see also infra footnote 245 
and accompanying text (discussing how a 72-hour reporting deadline 
would align with other regulatory standards). Under CIRCIA, the 72-
hour reporting deadline is for entities to report cyber incidents to 
the Cybersecurity and Infrastructure Security Agency (``CISA'').
---------------------------------------------------------------------------

    We recognize, however, that there are some areas of divergence 
between the final amendments and other Federal regulators' GLBA 
safeguarding standards, and we discuss the basis for each provision of 
the final rules below, including cases where the amendments differ from 
analogous requirements under State law or other Federal 
regulations.\30\
---------------------------------------------------------------------------

    \30\ Among the changes being adopted, we are revising as 
proposed the requirements of 17 CFR 248.17 (``rule 248.17'') to 
refer to determinations made by the CFPB rather than the FTC, 
consistent with changes made to section 507 of the GLBA by the Dodd-
Frank Wall Street Reform and Consumer Protection Act. See Public Law 
111-203, sec. 1041, 124 Stat. 1376 (2010). Upon its adoption, rule 
248.17 essentially restated the then-current text of section 507 of 
the GLBA, and as such, referenced determinations made by the FTC. 
See Privacy of Consumer Financial Information (Regulation S-P), 
Exchange Act Release No. 42974 (June 22, 2000) [65 FR 40334 (June 
29, 2000)].
---------------------------------------------------------------------------

    Many commenters also urged the Commission to coordinate with other 
Federal agencies, particularly on reporting deadlines.\31\ For example, 
a number of commenters suggested that the Commission coordinate with 
CISA as it develops regulations pursuant to CIRCIA.\32\ We have 
consulted and coordinated with CISA and, consistent with the 
requirements of the GLBA and other statutory requirements,\33\ other 
relevant agencies and their representatives for the purpose of 
ensuring, to the extent possible, that the amendments are consistent 
and comparable with the regulations prescribed by other relevant 
agencies.\34\
---------------------------------------------------------------------------

    \31\ See, e.g., Comment Letter of Amazon Web Services (June 5, 
2023) (``AWS Comment Letter''); Comment Letter of Google Cloud (June 
5, 2023) (``Google Comment Letter''); and Nasdaq Comment Letter.
    \32\ See, e.g., SIFMA Comment Letter 2; Cambridge Comment 
Letter; Google Comment Letter. CISA has provided a notice of 
proposed rulemaking that would implement the CIRCIA requirements but 
they have not yet been adopted. See also Cyber Incident Reporting 
for Critical Infrastructure Act (CIRCIA) Reporting Requirements, 89 
FR 23644 (Apr. 4, 2024).
    \33\ See Exchange Act Section 17A(d)(3)(A), 15 U.S.C. 78q-
1(d)(3)(A) (providing that ``[w]ith respect to any clearing agency 
or transfer agent for which the Commission is not the appropriate 
regulatory agency, the Commission and the appropriate regulatory 
agency for such clearing agency or transfer agent shall consult and 
cooperate with each other . . .'').
    \34\ See 15 U.S.C. 6804(a)(2). The relevant agencies include the 
OCC, FRB, FDIC, CFPB, FTC, CISA, Commodity Futures Trading 
Commission (``CFTC''), Department of Justice (``DOJ''), and the 
National Association of Insurance Commissioners.
---------------------------------------------------------------------------

    We are adopting amendments to Regulation S-P substantially as 
proposed, with some changes in response to comments. The principal 
elements of the final amendments, as discussed in more detail below, 
are as follows:
     Incident Response Program. The final safeguards rule 
requires covered institutions to develop, implement, and maintain 
written policies and procedures for an incident response program that 
is reasonably designed to detect, respond to, and recover from 
unauthorized access to or use of customer information. The final 
amendments will require that a response program include procedures to 
assess the nature and scope of any incident and to take appropriate 
steps to contain and control the incident to prevent further 
unauthorized access or use.
     Notification Requirement. The response program procedures 
in the final amendments also includes a requirement that covered 
institutions provide a notification to individuals whose sensitive 
customer information was, or is reasonably likely to have been, 
accessed or used without authorization. Notice will not be required if 
a covered institution determines, after a reasonable investigation of 
the facts and circumstances of the incident of unauthorized access to 
or use of sensitive customer information, that the sensitive customer 
information has not been, and is not reasonably likely to be, used in a 
manner that would result in substantial harm or inconvenience. Under 
the final amendments, a customer notice must be clear and conspicuous 
and provided by a means designed to ensure that each affected 
individual can reasonably be expected to receive it. This notice must 
be provided as soon as reasonably practicable, but not later than 30 
days, after the covered institution becomes aware that unauthorized 
access to or use of customer information has, or is reasonably likely 
to have, occurred. As discussed in more detail below, the final 
amendments will permit covered institutions to delay providing notice 
after the Commission receives a written request from the Attorney 
General that this notice poses a substantial risk to national security 
or public safety.\35\
---------------------------------------------------------------------------

    \35\ See infra section II.A.3.d(2).
---------------------------------------------------------------------------

     Service Providers. The final amendments to the safeguards 
rule include new provisions that address the use of service providers 
by covered institutions. Under these provisions, covered institutions 
will be required to establish, maintain, and enforce written policies 
and procedures reasonably designed to require oversight, including 
through due diligence and monitoring of service providers, including to 
ensure that affected individuals receive any required notices. The 
final amendments make clear that while covered institutions may use 
service providers to provide any required notice, covered institutions 
will retain the obligation to ensure that affected individuals are 
notified in accordance with the notice requirements.
     Scope. The final amendments will more closely align the 
information protected under the safeguards rule and the disposal rule 
by applying the protections of both rules to ``customer information,'' 
a newly defined term. The final amendments will also broaden the group 
of customers whose information is protected under both rules. Also, 
transfer agents will be required to comply with the safeguards rule.
     Recordkeeping and Annual Notice Amendments. The final 
amendments will add requirements for covered institutions, other than 
funding portals,\36\ to make and maintain written records documenting 
compliance with the requirements of the safeguards rule and the 
disposal rule. Further, the final amendments amend the existing 
requirement to provide annual privacy notices to codify a statutory 
exception.
---------------------------------------------------------------------------

    \36\ As discussed below, funding portals are already subject to 
recordkeeping requirements with regard to documenting their 
compliance with Regulation S-P, which are not being amended by these 
final amendments. See infra footnote 385 and accompanying 
discussion.
---------------------------------------------------------------------------

II. Discussion

    Since Regulation S-P was first adopted in 2000, evolving digital 
communications and information storage tools and other technologies 
have made it easier for firms to obtain, share, and maintain 
individuals' personal information. This increases the risk of 
customers' information being accessed or used without authorization, 
for example in a cyberattack or if customer information is improperly 
disposed of or stolen. In particular, as a frequently-targeted 
industry, the financial sector has observed increased exposure to 
cyberattacks that threaten not only the financial firms themselves, but 
also their customers, especially considering that customer records and 
other information that covered

[[Page 47692]]

institutions possess can be particularly sensitive.\37\ The final 
amendments will modernize and enhance the protections that Regulation 
S-P already provides to address this changed landscape.
---------------------------------------------------------------------------

    \37\ See infra section IV.C.1.
---------------------------------------------------------------------------

A. Incident Response Program Including Customer Notification

    As set forth in the proposal, security incidents may result in, 
among other things, misuse, exposure or theft of a customer's nonpublic 
personal information, and potentially leave affected individuals 
vulnerable to having their information further compromised. Threat 
actors can use customer information to cause harm in a number of ways, 
such as by stealing customer identities to sell to other threat actors 
on the dark web, publishing customer information on the dark web, using 
customer identities to carry out fraud themselves, or taking over a 
customer's account for malevolent purposes.
    To help protect against harms that may result from a security 
incident involving customer information, the Commission proposed and is 
adopting amendments to the safeguards rule largely as proposed, with 
certain modifications to the notification requirement as discussed 
further below.\38\ The amendments will require that covered 
institutions' safeguards policies and procedures include an incident 
response program for unauthorized access to or use of customer 
information, including customer notification procedures.\39\ The 
amendments will require the incident response program to be reasonably 
designed to detect, respond to, and recover from both unauthorized 
access to and unauthorized use of customer information (for the 
purposes of this release, an ``incident'').\40\ Any instance of 
unauthorized access to or use of customer information will trigger a 
covered institution's incident response program. The amendments will 
also require that the response program include procedures for notifying 
affected individuals whose sensitive customer information was, or is 
reasonably likely to have been, accessed or used without 
authorization.\41\
---------------------------------------------------------------------------

    \38\ See infra section II.A.3.
    \39\ See final rule 248.30(a)(3). For clarity, when the 
amendments to the safeguards rule refer to ``unauthorized access to 
or use'', the word ``unauthorized'' modifies both ``access'' and 
``use.''
    \40\ See final rule 248.30(a)(3). See also infra section II.B.1 
for a discussion of ``customer information.''
    \41\ See final rule 248.30(d)(9) for the definition of 
``sensitive customer information.'' See also infra section II.A.3.b, 
which includes a discussion of ``sensitive customer information.'' 
Notice must be provided unless a covered institution determines, 
after a reasonable investigation of the facts and circumstances of 
the incident of unauthorized access to or use of sensitive customer 
information that occurred at the covered institution or one of its 
service providers that is not itself a covered institution, that 
sensitive customer information has not been, and is not reasonably 
likely to be, used in a manner that would result in substantial harm 
or inconvenience.
---------------------------------------------------------------------------

    In this regard, requiring covered institutions to have incident 
response programs will help mitigate the risk of harm to affected 
individuals stemming from incidents where a customer's information has 
been accessed or used without authorization. For example, incident 
response programs will help covered institutions to be better prepared 
to respond to such incidents, and providing notice to affected 
individuals will aid those individuals in taking protective measures 
that could mitigate harm that might otherwise result from unauthorized 
access to or use of their information. Further, a reasonably designed 
incident response program will help facilitate more consistent and 
systematic responses to customer information security incidents and 
help avoid inadequate responses based on a covered institution's 
initial impressions of the scope of the information involved in the 
compromise. Requiring the incident response program to address any 
incident involving customer information can help a covered institution 
better contain and control these incidents and facilitate a prompt 
recovery.
    As proposed, the amendments will require that a covered 
institution's incident response program include policies and procedures 
containing certain general elements but will not prescribe specific 
steps a covered institution must undertake when carrying out incident 
response activities, thereby enabling covered institutions to create 
policies and procedures best suited to their particular circumstances. 
Specifically, a covered institution's incident response program will be 
required to have written policies and procedures to:
    (i) Assess the nature and scope of any incident involving 
unauthorized access to or use of customer information and identify the 
customer information systems and types of customer information that may 
have been accessed or used without authorization; \42\
---------------------------------------------------------------------------

    \42\ See final rule 248.30(a)(3)(i). The term ``customer 
information systems'' would mean the information resources owned or 
used by a covered institution, including physical or virtual 
infrastructure controlled by such information resources, or 
components thereof, organized for the collection, processing, 
maintenance, use, sharing, dissemination, or disposition of customer 
information to maintain or support the covered institution's 
operations. See final rule 248.30(d)(6).
---------------------------------------------------------------------------

    (ii) Take appropriate steps to contain and control the incident to 
prevent further unauthorized access to or use of customer information; 
\43\ and
---------------------------------------------------------------------------

    \43\ See final rule 248.30(a)(3)(ii).
---------------------------------------------------------------------------

    (iii) Notify each affected individual whose sensitive customer 
information was, or is reasonably likely to have been, accessed or used 
without authorization in accordance with the notification obligations 
discussed below,\44\ unless the covered institution determines, after a 
reasonable investigation of the facts and circumstances of the incident 
of unauthorized access to or use of sensitive customer information, 
that the sensitive customer information has not been, and is not 
reasonably likely to be, used in a manner that would result in 
substantial harm or inconvenience.\45\
---------------------------------------------------------------------------

    \44\ See infra section II.A.3.
    \45\ See final rule 248.30(a)(3)(iii).
---------------------------------------------------------------------------

    The Commission received multiple comments regarding the proposed 
requirement for an incident response program generally.\46\ One 
commenter supported requiring the incident response program and 
appreciated its similarity to the Banking Agencies' Incident Response 
Guidance.\47\ Another commenter stated that there should not be a one-
size-fits-all approach to incident response programs, stating that an 
adviser should have discretion to determine how the incident response 
program should be implemented, and requested that any final rule make 
clear that specific steps for incident response are not required.\48\ 
Moreover, this commenter requested that the final rule expressly 
indicate that in developing their programs, advisers should employ a 
principles- and risk-based approach.\49\ This commenter also opposed 
the addition of any requirement in the policies and procedures for an 
adviser to designate an employee with specific qualifications and 
experience (or hire a similarly qualified third party) to coordinate 
its incident response program.\50\
---------------------------------------------------------------------------

    \46\ Comments for specific components of the incident response 
program are discussed in more depth separately. See infra sections 
II.A.1-4.
    \47\ See ICI Comment Letter 1; see also supra footnote 26 
(discussing the Banking Agencies' Incident Response Guidance).
    \48\ See IAA Comment Letter 1.
    \49\ See id.; see also CAI Comment Letter stating that policies 
and procedures should be based on the specific risks of the 
particular covered institution and commensurate with the size and 
complexity of the covered institution's activities.
    \50\ See id.
---------------------------------------------------------------------------

    Covered institutions need the flexibility to develop policies and 
procedures suited to their size and

[[Page 47693]]

complexity and the nature and scope of their activities. Therefore, we 
did not propose, and are not adopting, specific steps a covered 
institution must take when carrying out its incident response program, 
and we are not specifically designating who must undertake oversight 
responsibilities, thus providing covered institutions flexibility to 
determine whether and how to appropriately assign or divide such 
responsibilities. As proposed and adopted, the amendments will require 
that a covered institution's incident response program include policies 
and procedures containing certain general elements, so covered 
institutions may tailor their policies and procedures to their 
individual facts and circumstances. Additionally, advisers, like other 
covered institutions, can continue to use a risk-based approach to 
tailor their assessment and containment policies and procedures if they 
choose to do so, as long as the required elements of the incident 
response program are met.
    Two commenters opposed the scope of the proposed incident response 
program.\51\ Specifically, these commenters stated that, consistent 
with the notification requirements, the assessment and containment and 
control components of the incident response program should be limited 
to sensitive customer information (and not encompass all nonpublic 
customer information).\52\ According to one commenter, because 
sensitive customer information is the information likely to cause 
substantial harm or inconvenience to a customer and that requires 
notification to customers, it follows that incident response programs 
should be tailored to sensitive customer information.\53\ The other 
commenter stated that clients would view the protection of their 
sensitive customer information as a critically important aspect of 
their relationship with their adviser and that an adviser's efforts and 
resources should appropriately be focused on this information.\54\
---------------------------------------------------------------------------

    \51\ See Comment Letter of Schulte Roth & Zabel LLP (June 5, 
2023) (``Schulte Comment Letter'') and IAA Comment Letter 1.
    \52\ See Schulte Comment Letter; IAA Comment Letter 1.
    \53\ See Schulte Comment Letter.
    \54\ See IAA Comment Letter 1.
---------------------------------------------------------------------------

    We are adopting as proposed final rules which require the incident 
response program's assessment and containment and control components to 
cover a broader scope of information than the notification 
requirements. The scope of information covered by the assessment and 
containment and control requirements is designed to help ensure all 
information covered by the requirements of the GLBA \55\ are 
appropriately safeguarded and that sufficient information is assessed 
to fulfill the more narrowly tailored obligation to notify affected 
individuals. For example, assessment of any incident involving 
unauthorized access to or use of customer information will help 
facilitate the evaluation of whether sensitive customer information has 
been accessed or used without authorization, which informs whether 
notice has to be provided. Additionally, a covered institution's 
assessment may also be useful for collecting other information that is 
required to populate the notice, such as identifying the date or 
estimated date of the incident, among other details. Therefore, the 
scope of the incident response program is appropriate, and we are 
adopting as proposed.
---------------------------------------------------------------------------

    \55\ The GLBA directs the Commission to establish standards to 
insure the security and confidentiality of customer records and 
information; to protect against any anticipated threats or hazards 
to the security or integrity of such records; and to protect against 
unauthorized access to or use of records or information which could 
result in substantial harm or inconvenience to any customer. 15 
U.S.C. 6801(b).
---------------------------------------------------------------------------

1. Assessment
    The final amendments will require that the incident response 
program include procedures for: (1) assessing the nature and scope of 
any incident involving unauthorized access to or use of customer 
information, and (2) identifying the customer information systems and 
types of customer information that may have been accessed or used 
without authorization.\56\ We did not receive comments addressing the 
assessment portion of the incident response program and are adopting it 
as proposed.\57\
---------------------------------------------------------------------------

    \56\ See final rule 248.30(a)(3)(i). The proposed requirements 
related to assessing the nature and scope of a security incident are 
consistent with the components of a response program as set forth in 
the Banking Agencies' Incident Response Guidance. See Banking 
Agencies' Incident Response Guidance.
    \57\ Although no comments discussed only the assessment 
requirement, multiple comments discussed the incident response 
program generally, which includes the assessment requirement. These 
comments are discussed in section II.A.
---------------------------------------------------------------------------

    The assessment requirement is designed to require a covered 
institution to identify both the customer information systems and types 
of customer information that may have been accessed or used without 
authorization during the incident, as well as the specific customers 
affected, which would be necessary to fulfill the obligation to notify 
affected individuals.\58\ Information developed during the assessment 
process may also help covered institutions develop a contextual 
understanding of the circumstances surrounding an incident, as well as 
enhance their technical understanding of the incident, which should be 
helpful in guiding incident response activities such as containment and 
control measures. The assessment process may also be helpful for 
identifying and evaluating existing vulnerabilities that could benefit 
from remediation in order to prevent such vulnerabilities from being 
exploited in the future. Further, covered institutions generally should 
consider reviewing and updating the assessment procedures periodically 
to ensure that the procedures remain reasonably designed.\59\
---------------------------------------------------------------------------

    \58\ For example, a covered institution's assessment may include 
gathering information about the type of access, the extent to which 
systems or other assets have been affected, the level of privilege 
attained by any unauthorized persons, the operational or 
informational impact of the breach, and whether any data has been 
lost or exfiltrated.
    \59\ See also 17 CFR 270.38a-1, 275.206(4)-7.
---------------------------------------------------------------------------

2. Containment and Control
    The final amendments will require that the response program have 
procedures for taking appropriate steps to contain and control a 
security incident, in order to prevent further unauthorized access to 
or use of customer information.\60\ We did not receive comments 
discussing the containment and control portion of the incident response 
program and are adopting as proposed.\61\
---------------------------------------------------------------------------

    \60\ See final rule 248.30(a)(3)(ii). These proposed 
requirements are consistent with the components of a response 
program as set forth in the Banking Agencies' Incident Response 
Guidance. See Banking Agencies' Incident Response Guidance at 15752.
    \61\ Although no comments discussed only the containment and 
control requirements, multiple comments discussed the incident 
response program generally, which includes the containment and 
control requirement. These comments are discussed in section II.A.
---------------------------------------------------------------------------

    As set forth in the proposal, the objective of containment and 
control is to prevent additional damage from unauthorized activity and 
to reduce the immediate impact of an incident by removing the source of 
the unauthorized activity.\62\ Strategies for containing and 
controlling an incident vary depending upon the type of incident and 
may include, for example, isolating

[[Page 47694]]

compromised systems or enhancing the monitoring of intruder activities, 
searching for additional compromised systems, changing system 
administrator passwords, rotating private keys, and changing or 
disabling default user accounts and passwords, among other 
interventions. Because incident response may involve making complex 
judgment calls, such as deciding when to shut down or disconnect a 
system, developing and implementing written containment and control 
policies and procedures will provide a framework to help facilitate 
improved decision making at covered institutions during potentially 
high-pressure incident response situations. Further, covered 
institutions generally should consider reviewing and updating the 
containment and control procedures periodically to ensure that the 
procedures remain reasonably designed.\63\
---------------------------------------------------------------------------

    \62\ See Proposing Release at Section II.A.2. For a further 
discussion of the purposes and practices of such containment 
measures, see generally CISA Incident Response Playbook, at 14; see 
also Federal Financial Institutions Examination Council (``FFIEC''), 
Information Technology Examination Handbook--Information Security 
(Sept. 2016), at 52, available at https://ithandbook.ffiec.gov/media/274793/ffiec_itbooklet_informationsecurity.pdf.
    \63\ See also 17 CFR 270.38a-1, 275.206(4)-7.
---------------------------------------------------------------------------

3. Notice to Affected Individuals
    As part of their incident response programs, covered institutions 
will be required under the final amendments to provide a clear and 
conspicuous notice to affected individuals under certain 
circumstances.\64\ We are adopting this requirement substantially as 
proposed, with some changes in response to comments.
---------------------------------------------------------------------------

    \64\ See final rule 248.30(a)(4).
---------------------------------------------------------------------------

    We are adopting as proposed, a requirement for a covered 
institution to notify each affected individual whose sensitive customer 
information was, or was reasonably likely to have been, accessed or 
used without authorization, unless the covered institution has 
determined, after a reasonable investigation of the incident, that 
sensitive customer information has not been, and is not reasonably 
likely to be, used in a manner that would result in substantial harm or 
inconvenience. The covered institution will be required to provide a 
clear and conspicuous notice to each affected individual by a means 
designed to ensure that the individual can reasonably be expected to 
receive actual notice in writing. Also as proposed, the final 
amendments require the notice to be provided as soon as practicable, 
but not later than 30 days, after the covered institution becomes aware 
that unauthorized access to or use of customer information has occurred 
or is reasonably likely to have occurred. Lastly, in a modification 
from the proposal, the final amendments provide for an incrementally 
longer period of time than the proposal for a covered institution to 
delay providing notice to affected individuals in cases where the 
Attorney General has determined that providing the notice would pose a 
substantial risk to national security or public safety. These 
requirements are discussed in detail below.
a. Standard for Providing Notice and Identification of Affected 
Individuals
    We are adopting as proposed a requirement for a covered institution 
to provide notice to individuals whose sensitive customer information 
was, or is reasonably likely to have been, accessed or used without 
authorization, unless, after a reasonable investigation of the facts 
and circumstances of the incident of unauthorized access to or use of 
sensitive customer information, it determines that sensitive customer 
information has not been, and is not reasonably likely to be, used in a 
manner that would result in substantial harm or inconvenience.\65\ The 
final amendments reflect a presumption of notification: a covered 
institution must provide a notice unless it determines notification is 
not required following a reasonable investigation. Also as proposed, if 
an incident of unauthorized access to or use of customer information 
has occurred or is reasonably likely to have occurred, but a covered 
institution is unable to identify which specific individuals' sensitive 
customer information has been accessed or used without authorization, 
the final amendments require the covered institution to provide notice 
to all individuals whose sensitive customer information resides in the 
customer information system that was, or was reasonably likely to have 
been, accessed without authorization (``affected individuals'').\66\
---------------------------------------------------------------------------

    \65\ Final rule 248.30(a)(4)(i).
    \66\ Final rule 248.30(a)(4)(ii). This proposed provision was 
not intended to require notification of customers whose sensitive 
customer information resided in the affected customer information 
system if the covered institution has reasonably determined that 
such customers' sensitive customer information was not accessed or 
used without authorization. Accordingly, we have modified the final 
rule to reflect this intended result. See infra footnote 102 and 
accompanying text.
---------------------------------------------------------------------------

    While the incident response program is generally required to 
address information security incidents involving any form of customer 
information,\67\ notification is only required when there has been 
unauthorized access to or use of sensitive customer information, a 
subset of customer information, because it presents increased risks to 
affected individuals.\68\ This notice standard is designed to give 
affected individuals an opportunity to mitigate the risk of substantial 
harm or inconvenience arising from an information security incident 
that potentially implicates their sensitive customer information by 
affording them an opportunity to take timely responsive actions, such 
as monitoring credit reports for unauthorized activity, placing fraud 
alerts on relevant accounts, or changing passwords used to access 
accounts. At the same time, the final amendments provide a mechanism 
for covered institutions to avoid making unnecessary notifications in 
cases where, following a reasonable investigation, the institution 
determines that sensitive customer information has not been, and is not 
reasonably likely to be, used in a manner that would result in 
substantial harm or inconvenience to the affected individual.\69\
---------------------------------------------------------------------------

    \67\ See infra section II.B.1.
    \68\ See infra section II.A.3.b. Additionally, customer 
information that is not disposed of properly could trigger the 
requirement to notify affected individuals under final rule 
248.30(a)(4)(i). For example, a covered institution whose employee 
leaves un-shredded customer files containing sensitive customer 
information in a dumpster accessible to the public would be required 
to notify affected customers, unless the institution has determined 
that sensitive customer information has not been, and is not 
reasonably likely to be, used in a manner that would result in 
substantial harm or inconvenience.
    \69\ See infra section II.A.3.c.
---------------------------------------------------------------------------

    Whether an investigation is reasonable will depend on the 
particular facts and circumstances of the unauthorized access or use. 
For example, unauthorized access or use that is the result of 
intentional intrusion by a threat actor may warrant more extensive 
investigation than inadvertent unauthorized access or use by an 
employee. The investigation may occur in parallel with an initial 
assessment and scoping of the incident and may build upon information 
generated from those activities. The scope of the investigation 
generally should be refined by using available data and the results of 
ongoing incident response activities. Information related to the nature 
and scope of the incident may be relevant to determining the extent of 
the investigation, such as whether the incident is the result of 
internal unauthorized access or use of sensitive customer information 
or an external intrusion, the duration of the incident, what accounts 
have been compromised and at what privilege level, and whether and what 
type of customer information may have been copied, transferred, or 
retrieved without authorization.\70\
---------------------------------------------------------------------------

    \70\ For example, depending on the nature of the incident, it 
may be necessary to consider how a malicious intruder might use the 
underlying information based on current trends in identity theft.
---------------------------------------------------------------------------

    A covered institution cannot avoid its notification obligations in 
cases where

[[Page 47695]]

an investigation's results are inconclusive. Instead, the notification 
requirement is excused only where a reasonable investigation supports a 
determination that sensitive customer information has not been and is 
not reasonably likely to be used in a manner that would result in 
substantial harm or inconvenience. Thus, in a case where a threat actor 
has gained access to a customer information system that stores 
sensitive customer information, and the covered institution lacks 
information indicating that any particular individual's sensitive 
customer information stored in that customer information system was or 
was not used in a manner that would result in substantial harm or 
inconvenience, a covered institution will be required to provide notice 
to affected individuals even though it may not have a sufficient basis 
to determine whether the breach would result in substantial harm or 
inconvenience.\71\ Pursuant to the amendments, as proposed and adopted, 
for any determination that a covered institution makes that notice is 
not required, covered institutions other than funding portals will be 
required to maintain a record of the investigation and basis for its 
determination.\72\
---------------------------------------------------------------------------

    \71\ See final rule 248.30(a)(4)(ii).
    \72\ See infra section II.C; see also infra footnote 385.
---------------------------------------------------------------------------

    As further described below,\73\ a number of commenters supported 
the proposal's requirement for covered institutions to provide notices 
promptly, emphasizing the importance of ensuring that customers receive 
timely notification when their sensitive customer information is 
reasonably likely to have been subject to unauthorized access or use so 
they have an opportunity to effectively respond to the incident.\74\ 
One commenter stated that timeliness is key because any delay will 
impact consumers' ability to take steps to protect themselves from 
identify theft, account compromise, and other downstream impacts 
resulting from the initial harm of the unauthorized access or use.\75\ 
According to this commenter, a breach notification regime is 
fundamentally deficient if it does not empower consumers with the 
information and tools necessary to take action to protect themselves or 
understand what risks they may face as a result of a breach.\76\
---------------------------------------------------------------------------

    \73\ See infra section II.A.3.d.
    \74\ See, e.g., Better Markets Comment Letter; EPIC Comment 
Letter; NASAA Comment Letter; ICI Comment Letter 1; Nasdaq Comment 
Letter.
    \75\ See EPIC Comment Letter; see also Better Markets Comment 
Letter (customers whose information has been exposed need 
appropriate and timely notifications to decide for themselves 
whether and how to address the breach to avoid being ``victimized 
twice'': first when the breach occurs, and then again when ``bad 
actors use the information to steal their identity, drain their bank 
accounts, or run up their credit cards'').
    \76\ See EPIC Comment Letter.
---------------------------------------------------------------------------

    Several commenters proposed alternative notification standards, 
some expanding the circumstances requiring customer notification, and 
others suggesting a narrower notification regime.\77\ One commenter 
suggested we require notification for any incident of unauthorized 
access to or use of sensitive information, regardless of the risk of 
harm or inconvenience.\78\ According to this commenter, customers 
should always be notified when their sensitive information is accessed 
or used without authorization, which would allow customers to determine 
for themselves whether they believe there is a risk of substantial harm 
or inconvenience that should prompt action on their part. Similarly, 
another commenter suggested that the notification standard should be 
expanded from a ``reasonably likelihood'' standard to a ``reasonably 
possible'' standard with regard to whether an individual's sensitive 
customer information was accessed or used without authorization.\79\ 
This commenter stated that this change was necessary to protect against 
the possibility that a covered institution might conclude it lacked 
sufficient information to find the reasonably likely standard satisfied 
if, for example, it knows it has been hacked but is unable to determine 
the scope of the hack. According to these commenters, the seemingly 
higher threshold proposed by the Commission, coupled with their belief 
that businesses want to avoid making disclosures that could incur 
liability or lose customers, leaves open the potential that customers 
will not be notified of some information security compromises that 
could threaten their investments.\80\ One commenter suggested that, in 
addition to requiring notifications to affected individuals, the rules 
should be modified to also require that covered institutions provide 
notice to the Commission whenever they are providing notice to affected 
individuals.\81\
---------------------------------------------------------------------------

    \77\ See, e.g., Better Markets Comment Letter, NASAA Comment 
Letter (proposing more expansive standards); SIFMA Comment Letter 2, 
CAI Comment Letter, IAA Comment Letter 1 (proposing narrower 
standards).
    \78\ See Better Markets Comment Letter.
    \79\ See NASAA Comment Letter.
    \80\ See Better Markets Comment Letter; NASAA Comment Letter; 
see also EPIC Comment Letter (``EPIC agrees that businesses have a 
natural tendency to want to avoid making disclosures that could 
incur liability or lose customers'').
    \81\ See Better Markets Comment Letter.
---------------------------------------------------------------------------

    By contrast, with regard to narrowing the standard, some commenters 
suggested eliminating the presumption of notification altogether, such 
that covered institutions would have a notification obligation only 
after having affirmatively determined, following an investigation, a 
likelihood of a breach or resulting harm to customers.\82\ These 
commenters suggested that eliminating the notification presumption, and 
allowing for the completion of an investigation, would provide covered 
institutions with additional time to respond to and mitigate an 
incident as opposed to spending time deliberating over notification 
obligations, and would allow for more informed notifications. These 
commenters also suggested that this approach would be more consistent 
with certain State law regimes that only require notification where an 
investigation shows a risk of harm and the Banking Agencies' Incident 
Response Guidance.\83\ To address the concern that lengthy 
investigations might unduly delay customer notifications, one commenter 
suggested revising the rule to separately require covered institutions 
``to conduct a prompt investigation of potential incidents,'' which the 
commenter stated would better align with certain existing State law 
standards while still providing a mechanism for timely 
notifications.\84\
---------------------------------------------------------------------------

    \82\ See, e.g., SIFMA Comment Letter 2 (notification should only 
be required if the covered institution makes an affirmative finding 
of substantial harm or inconvenience); CAI Comment Letter (proposing 
revised notification trigger to no later than 30 days from a 
determination that actual or reasonably likely unauthorized access 
to sensitive customer information has occurred); ACLI Comment Letter 
(suggesting trigger should instead be only after the completion of a 
reasonable investigation and conclusion of the incident response 
process).
    \83\ The Banking Agencies' Incident Response Guidance advises 
that a covered institution should provide notice to affected 
customers if, following the conclusion of a reasonable 
investigation, it has determined that misuse of sensitive customer 
information has occurred or is reasonably possible. See Banking 
Agencies' Incident Response Guidance. See also section II.A.3.d(1) 
(responding to commenters' concerns that the proposed notification 
timing requirements provide an insufficient amount of time for 
covered institutions to conduct a reasonable investigation of a data 
breach incident and prepare and send notices to affected 
individuals).
    \84\ See CAI Comment Letter.
---------------------------------------------------------------------------

    We considered the alternative approaches suggested by commenters 
but determined that adopting the standard as proposed strikes an 
appropriate balance in accommodating the relevant competing concerns. 
The suggestions to expand the circumstances requiring notification 
(either by requiring notification regardless of the risk of harm, or by 
expanding notification to include cases where it is ``reasonably 
possible'' that an

[[Page 47696]]

individual's sensitive customer information was accessed or used 
without authorization) raise over-notification concerns, particularly 
given that the adopted standard already has a presumption towards 
notification.\85\ We also disagree that the ``reasonably likely'' 
standard would allow a covered institution that knows it suffered a 
breach to avoid providing notice simply by pointing to a lack of 
information about the scope of the breach as the commenter recommending 
this approach suggested.\86\ To the contrary, under the proposed and 
final amendments, if it is reasonably likely that a malicious actor 
gained access to a covered institution's information system containing 
sensitive customer information but the scope of the breach is unclear 
(i.e., the covered institution is unable to determine which specific 
individuals' sensitive customer information has been accessed or used 
without authorization and cannot make the determinations required under 
the rule to avoid sending notices), the covered institution would be 
required to provide notice to each individual whose sensitive customer 
information resides in the customer information system.\87\ In 
addition, providing notice of every incident, regardless of the risk of 
harm to affected individuals or the need to take protective measures, 
could diminish the impact and effectiveness of the notice in a 
situation where enhanced vigilance is necessary. Utilizing a 
``reasonably possible'' standard raises similar concerns, as it could 
require covered institutions to provide notice in situations where it 
is possible, but not reasonably likely, that sensitive customer 
information was compromised. This could result in over-notification 
where, for example, a customer's sensitive information ultimately was 
not accessed or used without authorization, but it was not possible to 
rule out that possibility at the time of the incident or in the course 
of a reasonable investigation during the 30-day period for notices.
---------------------------------------------------------------------------

    \85\ See supra footnotes 78-80 and accompanying text.
    \86\ See NASAA Comment Letter.
    \87\ See final rule 248.30(a)(4)(i) and (ii).
---------------------------------------------------------------------------

    Additionally, we are not adopting a commenter's recommendation that 
the Commission require covered institutions to provide notices to the 
Commission when they are required to send notices to affected 
individuals, as one commenter suggested.\88\ A primary reason for these 
amendments was to require a reasonably designed incident response 
program, including policies and procedures for assessment, control and 
containment, and customer notification, in order to mitigate the 
potential harm to individuals whose sensitive information is exposed or 
compromised in a data breach.\89\ Providing timely notices to affected 
individuals accomplishes this goal without the need for covered 
institutions also to provide copies of the notice to the Commission.
---------------------------------------------------------------------------

    \88\ See Better Markets Comment Letter.
    \89\ Proposing Release at section I.
---------------------------------------------------------------------------

    Conversely, the narrower alternative standards suggested by 
commenters (i.e., that covered institutions have a notification 
obligation only after an investigation, and only if they affirmatively 
determine a likelihood of a breach or resulting harm to customers) 
could result in an unreasonable risk of significant delays in providing 
notice and in notification not being provided to affected individuals. 
A principal purpose of these amendments is to provide a notification 
regime that allows affected individuals to take actions to avoid or 
mitigate the risk of substantial harm or inconvenience.\90\ If customer 
notification of a potential breach was delayed to allow a covered 
institution to complete an investigation that comes to a definitive 
conclusion about the precise details of the breach, even if done 
promptly, it would frustrate this goal by postponing (or potentially 
limiting or foreclosing) the ability of affected individuals to take 
mitigating actions pending the conclusion of that investigation. For 
these same reasons, we were not persuaded by those commenters who 
suggested that we should allow for the completion of an investigation 
in order to align with the Banking Agencies' Incident Response 
Guidance. After considering the comments, we continue to believe the 
notification standard we proposed (and are adopting in the final 
amendments) is necessary to enable affected individuals to make their 
own determinations on needed self-protections regarding the 
incident.\91\
---------------------------------------------------------------------------

    \90\ See Proposing Release at nn.97-98 and accompanying text.
    \91\ See Proposing Release at n.100 (discussing reasons for 
divergence from Banking Agencies' Incident Response Guidance); see 
also infra sections II.A.3.b, II.A.3.e, II.A.4, II.B.2, and IV.C 
(also discussing the Banking Agencies' Incident Response Guidance).
---------------------------------------------------------------------------

    Regarding commenters' concerns about harmonizing Regulation S-P 
with State law requirements, State law notification standards vary 
widely such that broad harmonization would be impracticable, and a 
benefit of the final amendments is that they provide a consistent 
minimum Federal notification standard to protect affected individuals 
in an environment of enhanced risk. This will, for example, provide 
additional protections for customers in States whose laws do not 
mandate notification without an affirmative determination of harm or 
provide an outside time by which notification must be provided.\92\ 
This standard will protect all customers, regardless of their State of 
residence and reduce the potential confusion that could result from 
customers in one State receiving notice of an incident while customers 
in another State do not. Moreover, to the extent a covered institution 
will have a notification obligation under both the final amendments and 
a similar State law, a covered institution may be able to provide one 
notice to satisfy notification obligations under both the final 
amendments and the State law, provided that the notice includes all 
information required under both the final amendments and the State law, 
which may reduce the number of notices an individual receives.\93\
---------------------------------------------------------------------------

    \92\ See Proposing Release at nn.107-108 and accompanying text 
(discussing variation in State laws); see also infra section IV.C.2 
for a fuller discussion of State law variations, and infra section 
IV.D.1.b(2) discussing timing of State law notification regimes.
    \93\ See also infra section IV.C.2.a(2) (discussing States that 
excuse covered entities from individual notification under State law 
if the entities comply with the notification requirements of another 
regulator).
---------------------------------------------------------------------------

    Relatedly, some commenters suggested eliminating or narrowing the 
concept of ``affected individuals'' entitled to notification in 
situations where a covered institution is unable to identify which 
specific individuals' sensitive customer information has been accessed 
or used without authorization. Instead of the proposed requirement that 
the covered institution must provide notice to all individuals whose 
sensitive customer information resides in the customer information 
system that was, or was reasonably likely to have been, accessed or 
used without authorization, commenters urged narrowing notification to 
individuals whose sensitive customer information was, or was reasonably 
likely to have been, accessed or used without authorization based on 
the covered institution's reasonable investigation.\94\

[[Page 47697]]

These commenters stated that, by requiring a covered institution to 
provide all affected individuals notice prior to the conclusion of an 
investigation and particularized determination, the proposed 
notification standard could result in the over-notification of 
individuals whose sensitive customer information may not have been 
accessed but was residing on a system that was compromised.\95\ For 
example, one commenter posited a situation where a threat actor was 
able to compromise an employee's email account through a phishing 
email, and access documents accessible through that account's shared 
file server. According to this commenter, if the covered institution 
were unable to determine which files containing personal information 
actually were accessed, the institution would be required to provide 
notice in connection with millions of records, even though the ``vast 
majority of files and data on that file server would not have been 
accessible to the employee or to the threat actor.'' \96\ These 
commenters stated that the resulting over-notification could, in turn, 
desensitize or unnecessarily disturb individuals whose information was 
not actually compromised, and might increase costs and litigation and 
reputational risks for the covered institution, its service providers, 
or other financial institutions whose contracts reside on the 
system.\97\
---------------------------------------------------------------------------

    \94\ See, e.g., IAA Comment Letter 1 (suggesting the rule's 
affected individuals' provision be modified to remove the reference 
to situations where an institution is unable to identify which 
specific individual's sensitive customer information has been 
accessed or used without authorization, as well as the presumption 
that affected individuals include individuals whose sensitive 
customer information resides in the breached customer information 
system); CAI Comment Letter (suggesting the provision be revised to 
remove the requirement to notify all individuals whose information 
is on an affected system, and instead require the institution to 
notify individuals whose information it reasonably believes was, or 
reasonably could have been, subject to unauthorized access based on 
the finding of its investigation).
    \95\ See, e.g., CAI Comment Letter; Computershare Comment 
Letter; IAA Comment Letter 1.
    \96\ CAI Comment Letter.
    \97\ See also infra section IV.D.1.b.(4) (discussing 
reputational costs).
---------------------------------------------------------------------------

    For similar reasons to those discussed above,\98\ we were not 
persuaded by commenter suggestions to narrow the scope of affected 
individuals entitled to notification in cases where a breach has or is 
reasonably likely to have occurred, but the covered institution is 
unable to identify which specific individuals' sensitive customer 
information has been accessed or used without authorization.\99\ 
Because of the potential that customers might be adversely affected by 
the breach, covered institutions should be required to provide notice 
to affected individuals in these circumstances so they may make their 
own determination as to whether to take remedial actions.
---------------------------------------------------------------------------

    \98\ See supra footnotes 90-93 and accompanying text.
    \99\ See supra footnotes 94-97 and accompanying text.
---------------------------------------------------------------------------

    Contrary to the concerns expressed by some commenters, under the 
proposed and final amendments, a covered institution would not need to 
provide notice in connection with files or data residing on a system 
where it knows that information was not used or accessed.\100\ Rather, 
a covered institution is only required to provide notification to an 
affected individual where her sensitive customer information was, or is 
reasonably likely to have been, accessed or used without 
authorization.\101\ Additionally, a covered institution need not 
provide notice where, after a reasonable investigation of the facts and 
circumstances of the incident, it has determined that sensitive 
customer information has not been, and is not reasonably likely to be, 
used in a manner that would result in substantial harm or 
inconvenience. To address these commenters' concerns, in a change from 
the proposal, the final amendments explicitly provide that, in cases 
where a covered institution reasonably determines that a specific 
individual's sensitive customer information that resides in the 
customer information system was not accessed or used without 
authorization, the covered institution need not provide notice to that 
individual.\102\ Thus, a covered institution would not have an 
obligation to provide notice to an affected individual whose files 
happened to reside on a breached information system if it was able to 
reasonably conclude that those files were not subject to unauthorized 
use or access.
---------------------------------------------------------------------------

    \100\ See supra footnote 96 and accompanying text.
    \101\ See final rule 248.30(a)(4)(i).
    \102\ See final rule 248.30(a)(4)(ii).
---------------------------------------------------------------------------

    The notification standard should help to improve security outcomes 
by incentivizing covered institutions to conduct more thorough 
investigations after an incident occurs because the rule does not 
permit a covered institution to rebut the presumption of notification 
without conducting a reasonable investigation. Further, the rule's 
requirement that a covered institution provide notice to all affected 
individuals where it is unable to identify which specific individuals' 
sensitive customer information has been accessed or used without 
authorization should incentivize covered institutions to establish 
procedures (for themselves and their service providers) that provide 
robust protections for sensitive customer information. For example, it 
may encourage covered institutions to employ a principle of least 
privilege, so that users' access rights to sensitive customer 
information on a particular information system are limited to the 
information strictly required to do their jobs.\103\ Protections that 
limit the scope of any breaches reduce the investigation and 
notification costs (and as a consequence, the potential harm) resulting 
from a breach.
---------------------------------------------------------------------------

    \103\ See, e.g., Defend Privileges and Accounts, National 
Security Agency Cybersecurity Information (``Least privilege is the 
restriction of privileges to only those accounts that require them 
to perform their duties, while limiting accounts to only those 
privileges that are truly necessary. Doing this reduces the exposure 
of those privileges to a smaller, more easily manageable set of 
accounts. Local administrative accounts and accounts for software 
program management and installation are particularly powerful, but 
have small scopes of control and should be restricted as much as 
possible'') (available at https://media.defense.gov/2019/Sep/09/2002180330/-1/-1/0/Defend%20Privileges%20and%20Accounts%20-%20Copy.pdf).
---------------------------------------------------------------------------

    For a covered institution's customer notification procedures to 
remain reasonably designed to notify each affected individual whose 
sensitive customer information was reasonably likely to have been 
compromised, as required by the final amendments, the covered 
institution's policies and procedures generally should be designed to 
include revisiting notification determinations whenever the covered 
institution becomes aware of new facts that are potentially relevant to 
the determination.\104\ For example, if at the time of the incident, a 
covered institution determines that risk of use in a manner that would 
result in substantial harm or inconvenience is not reasonably likely 
based on the use of encryption in accordance with industry standards, 
but subsequently the encryption is compromised or it is discovered that 
the decryption key was also obtained by the threat actor, the covered 
institution generally should revisit its determination.
---------------------------------------------------------------------------

    \104\ See final rule 248.30(a)(3).
---------------------------------------------------------------------------

    As discussed in more detail below, the scope of the final 
amendments will apply to customer information in a covered 
institution's possession or that is handled or maintained on the 
covered institution's behalf, regardless of whether such information 
pertains to (a) individuals with whom the covered institution has a 
customer relationship or (b) to the customers of other financial 
institutions where such information has been provided to the covered 
institution.\105\ Some commenters expressed concern that, as a result 
of this scope, covered institutions would be required to provide 
notification to customers of other institutions with whom they do not 
have a preexisting

[[Page 47698]]

relationship.\106\ One of these commenters suggested that it was 
unclear how a third-party service provider's notice to a covered 
institution of a breach would affect that covered institution's 
obligations.\107\ Additionally, some commenters addressed circumstances 
where multiple covered institutions would all be required to notify 
affected individuals concerning the same incident, asserting that 
requiring all covered institutions involved to provide notices to 
customers would be burdensome, duplicative, and confusing to 
customers.\108\
---------------------------------------------------------------------------

    \105\ See infra section II.B.1.
    \106\ See ACLI Comment Letter; Federated Hermes Comment Letter; 
ICI Comment Letter; SIFMA Comment Letter 2.
    \107\ See ACLI Comment Letter.
    \108\ See CAI Comment Letter; Computershare Comment Letter.
---------------------------------------------------------------------------

    Where a covered institution experiences an incident involving 
sensitive customer information related to the customers of another 
covered institution, commenters generally suggested that the covered 
institution that has the customer relationship with the customer whose 
information was affected should be responsible for providing the 
required notice.\109\ These commenters asserted that this would be more 
efficient because, if the covered institution that experienced the 
incident did not have a customer relationship with an affected 
individual, that covered institution might not have contact information 
for the individual necessary to send a notice.
---------------------------------------------------------------------------

    \109\ See SIFMA Comment Letter 2; ACLI Comment Letter; Federated 
Hermes Comment Letter; CAI Comment Letter. Two of these commenters 
suggested that the covered institution with the customer 
relationship may make arrangements with other institutions to 
provide the notice on its behalf. SIFMA Comment Letter 2; ACLI 
Comment Letter.
---------------------------------------------------------------------------

    After considering comments, we are modifying the proposal to avoid 
requiring multiple covered institutions to notify the same affected 
individuals about a given incident. In an effort to minimize 
duplicative notices, rather than requiring the covered institution with 
the customer relationship to send the notice as some commenters 
suggested, the final amendments only require a covered institution to 
provide notice where unauthorized access to or use of sensitive 
customer information has occurred at the covered institution or one of 
its service providers that is not itself a covered institution.\110\ 
That covered institution will have information about the incident 
itself that is necessary to properly inform affected individuals. Thus, 
in response to the commenter question about the relationship between a 
covered institution's receipt of a breach notification from a third 
party service provider and the covered institution's own 
obligations,\111\ where a service provider (that is not itself a 
covered institution) provides notice to a covered institution that a 
breach in security has occurred resulting in unauthorized access to a 
customer information system maintained by the service provider,\112\ 
that covered institution will be required to initiate its incident 
response program under the final amendments \113\ and thereafter, if 
applicable, provide notice to affected individuals.\114\ While we 
appreciate, as offered by commenters,\115\ that a covered institution 
may not have access to the contact information for some customers, it 
can coordinate with the covered institution that has a customer 
relationship to receive contact information as needed for the 
notices.\116\
---------------------------------------------------------------------------

    \110\ Final rule 248.30(a)(4). If a covered institution is 
acting as a service provider, in addition to its own obligations 
under rule 248.30, it must provide notification to the other covered 
institution as required by the policies and procedures required in 
rule 248.30(a)(5)(i).
    \111\ See ACLI Comment Letter.
    \112\ See final rule 248.30(a)(5)(i)(B).
    \113\ See id.; see also infra Section II.A.4.a.
    \114\ See final rule 248.30(a)(4)(iii). As described above, a 
covered institution need not provide notice where, after a 
reasonable investigation of the facts and circumstances of the 
incident, it has determined that sensitive customer information has 
not been, and is not reasonably likely to be, used in a manner that 
would result in substantial harm or inconvenience. See final rule 
248.30(a)(4)(i).
    \115\ See ACLI Comment Letter, SIFMA Comment Letter 2.
    \116\ Further, as discussed below, a covered instituition will 
be permitted to enter into a written agreement with its service 
provider to notify affected individuals on its behalf in accordance 
with the notice requirements. See final rule 248.30(a)(5)(ii); see 
also supra section II.A.4.
---------------------------------------------------------------------------

    Moreover, in another modification from the proposal, the final 
amendments also provide that a covered institution that is required to 
notify affected individuals may satisfy that obligation by ensuring 
that the notice is provided.\117\ Accordingly, if a covered institution 
experiences an incident affecting another covered institution's 
customers, although the covered institution that experienced the 
incident is responsible for notification under the final amendments, 
the two covered institutions can coordinate with each other as to which 
institution will send the notice.
---------------------------------------------------------------------------

    \117\ Final rule 248.30(a)(4) (requiring covered institutions to 
either provide notice or ensure that such notice is provided).
---------------------------------------------------------------------------

b. Definition of ``Sensitive Customer Information''
    As discussed above, covered institutions will be required to notify 
customers when ``sensitive customer information'' was, or is reasonably 
likely to have been, accessed or used without authorization, subject to 
a reasonable investigation. As proposed and as adopted, the final 
amendments define the term ``sensitive customer information'' to mean 
``any component of customer information alone or in conjunction with 
any other information, the compromise of which could create a 
reasonably likely risk of substantial harm or inconvenience to an 
individual identified with the information.'' \118\ This definition is 
calibrated to include types of information that, if exposed, could put 
affected individuals at a higher risk of suffering substantial harm or 
inconvenience through, for example, fraud or identity theft enabled by 
the unauthorized access to or use of the information.\119\ As with the 
proposal, the final amendments provide examples of the types of 
information that will be considered sensitive customer 
information.\120\ These examples include certain customer information 
identified with an individual that, without any other identifying 
information, could create a substantial risk of harm or inconvenience 
to an individual identified with the information,\121\ along with 
examples of combinations of identifying information and authenticating 
information that could create such a risk to an individual identified 
with the information.\122\
---------------------------------------------------------------------------

    \118\ See final rule 248.30(d)(9)(i). The definition is limited 
to information identified with customers of financial institutions. 
See final rule 248.30(d)(5)(i); infra section II.B.1. As proposed, 
information pertaining to a covered institution's customers and to 
customers of other financial institutions that the other 
institutions have provided to the covered institution are subject to 
the safeguards rule under the final amendments, including the 
incident response program and customer notice requirements. See 
final rule 248.30(a); infra section II.B.1.
    \119\ See supra section II.A.3.a.
    \120\ See final rule 248.30(d)(9)(ii).
    \121\ These examples include Social Security numbers and other 
types of identifying information that can be used alone to 
authenticate an individual's identity such as a driver's license or 
identification number, alien registration number, government 
passport number, employer or taxpayer identification number, 
biometric records, a unique electronic identification number, 
address, or routing code, or telecommunication identifying 
information or access device.
    \122\ These examples include information identifying a customer, 
such as a name or online user name, in combination with 
authenticating information such as a partial Social Security number, 
access code, or mother's maiden name.
---------------------------------------------------------------------------

    One commenter supported our proposed definition of sensitive 
customer information and emphasized the benefits of a broad 
definition.\123\ According to this commenter, this breadth helps 
protect customers by ensuring that they can take the necessary steps to 
minimize their

[[Page 47699]]

exposure risks and will assist covered institutions in formulating and 
improving their security standards. Another commenter suggested the 
proposed definition might be too narrow because it includes the 
separate concept of substantial harm or inconvenience in the 
definition, resulting in under-notification.\124\ This commenter stated 
that harms can take many forms, and customers should receive notice of 
breaches involving customer information even where that information's 
compromise might not have obvious financial implications to the 
customer.
---------------------------------------------------------------------------

    \123\ See Better Markets Comment Letter.
    \124\ See EPIC Comment Letter.
---------------------------------------------------------------------------

    Conversely, a number of commenters asserted that the proposed 
definition was too broad and could lead to over-notification, 
suggesting that the definition be narrowed to focus on information 
whose exposure would be more likely to lead to tangible economic 
harms.\125\ For example, some commenters suggested that, rather than 
providing examples, the definition should list specific data elements 
that, when combined with an individual's name, are sufficiently 
sensitive to require notification.\126\ These commenters focused on 
those data elements that could be used to commit identity theft or 
access the customer's financial account, such as a Social Security 
number, driver's license or State ID number, or financial account 
number combined with information necessary to access the account. 
According to one of these commenters, by using illustrative examples 
rather than a circumscribed list, covered institutions would face 
uncertainty over the definition's meaning and would likely err on the 
side of over-inclusion, which could lead to over-notification.\127\ A 
number of commenters stated that narrowing the definition would be more 
consistent with the Banking Agencies' Incident Response Guidance and 
with various State laws.\128\ One commenter also suggested the proposed 
use of the term ``compromise'' in the definition was unclear, and 
should be replaced with ``unauthorized access or use,'' consistent with 
other authorities and language used elsewhere in the proposal.\129\
---------------------------------------------------------------------------

    \125\ See, e.g., CAI Comment Letter; IAA Comment Letter 1; SIFMA 
Comment Letter 2; ICI Comment Letter 1.
    \126\ See CAI Comment Letter; SIFMA Comment Letter 2.
    \127\ See CAI Comment Letter.
    \128\ See, e.g., SIFMA Comment Letter 2; Computershare Comment 
Letter; CAI Comment Letter.
    \129\ See CAI Comment Letter.
---------------------------------------------------------------------------

    After considering these comments, we are adopting the definition of 
``sensitive customer information'' as proposed. We recognize that this 
definition is broader than that used by some States and the Banking 
Agencies' Incident Response Guidance.\130\ However, in contrast to the 
narrower definition used in some States, the definition of sensitive 
customer information we are adopting includes identifying information 
that, in combination with authenticating information (such as a partial 
Social Security number, access code, or mother's maiden name), could 
create a substantial risk of harm or inconvenience to the customer 
because they may be widely used for authentication purposes.\131\ 
Similarly, in contrast to the definition provided in the Banking 
Agencies' Incident Response Guidance (which includes a customer's name, 
address, or telephone number, only in conjunction with other pieces of 
information that would permit access to a customer account), the 
definition in the Commission's final amendments includes customer 
information identified with an individual (such as Social Security 
numbers, driver's license numbers, biometric records) that, without any 
other identifying information, could create a substantial risk of harm 
or inconvenience to an individual identified with the information.\132\ 
Accordingly, our adopted definition could help affected individuals 
take measures to protect themselves.
---------------------------------------------------------------------------

    \130\ See Proposing Release at nn.113 and 115 (describing the 
differences). But see id. at n.115, stating that a number of States 
define the scope of personal information subject to a notification 
obligation in a manner that generally aligns with the definition of 
sensitive customer information under these final rules.
    \131\ See infra footnote 810 and surrounding text (discussing 
that 14 States more narrowly define the kind of information that 
trigger notice requirements than our adopted definition of sensitive 
customer information in that only the compromise of a customer's 
name together with one or more enumerated pieces of information 
triggers the notice requirement).
    \132\ See Proposing Release at n.114 and accompanying text, 
stating that Social Security numbers alone, without any other 
information linked to the individual, are sensitive because they 
have been used by malicious actors in ``Social Security number-
only'' or ``synthetic'' identity theft, to open new financial 
accounts, and that a similar sensitivity exists with other types of 
identifying information that can be used alone to authenticate an 
individual's identity such as a biometric record of a fingerprint or 
iris image.
---------------------------------------------------------------------------

    Given the varied and evolving nature of security practices across 
covered institutions, it would be impractical to provide an exhaustive 
list of data elements whose exposure could put affected individuals at 
risk of substantial harm or inconvenience. Further, while we are 
mindful of concerns about overbreadth and potential over-notification, 
those concerns are tempered by the definition's harm component and the 
ability of covered entities to rebut the notification presumption 
following a reasonable investigation and determination. Given these 
considerations, we are not broadening the definition of sensitive 
customer information to encompass information whose exposure does not 
pose a reasonably likely risk of substantial harm or inconvenience. Nor 
do we agree that the definition's use of the verb ``compromise,'' which 
is commonly used to mean ``to expose or make liable to danger,'' is 
ambiguous in this context or inconsistent with other Federal 
authorities.\133\ Individuals are less likely to need to take 
protective measures in cases where the exposure of their information is 
not likely to involve a substantial harm or inconvenience.\134\
---------------------------------------------------------------------------

    \133\ See, e.g., Harmonization of Cyber Incident Reporting to 
the Federal Government, Homeland Security Office of Strategy, 
Policy, and Plans, Appendix B: Federal Cyber Incident Reporting 
Requirements Inventory (Sept. 10, 2023) (summarizing cyber incident 
reporting regulations of multiple agencies that use the term 
``compromise,'' including Departments of Defense, Justice, and 
Energy, the Federal Communications Commission, the Nuclear 
Regulatory Commission, and the Federal Energy Regulatory 
Commission).
    \134\ See infra section II.A.3.c.
---------------------------------------------------------------------------

    Finally, several commenters suggested we include an exception or 
safe harbor in the definition of sensitive customer information for 
encrypted information.\135\ These commenters stated that excepting 
encrypted information would protect customers by incentivizing covered 
institutions to adopt encryption practices, limit the potential for 
voluminous over-reporting of less severe incidents, and align with 
existing State data breach notification rules. Some of these commenters 
acknowledged that an exception should not apply in cases where there is 
reason to believe that the encryption key has been compromised or that 
the encryption method is outdated.\136\ One commenter suggested that if 
we did not include an exception in the rule text, we should acknowledge 
that encryption is a factor that covered institutions may take into 
account in determining whether an incident will result in substantial 
harm or inconvenience.\137\
---------------------------------------------------------------------------

    \135\ See AWS Comment Letter; Google Comment Letter; IAA Comment 
Letter 1; SIFMA Comment Letter 2.
    \136\ See Google Comment Letter, IAA Comment Letter 1; SIFMA 
Comment Letter 2.
    \137\ See IAA Comment Letter 1.
---------------------------------------------------------------------------

    After considering these comments, we are not excepting encrypted 
information from the rule's definition of sensitive customer 
information because the rule

[[Page 47700]]

text effectively addresses encrypted information without the need for a 
provision specifically tailored to that information. Specifically, in 
applying the final rule, a covered institution may consider encryption 
as a factor in determining whether the compromise of customer 
information could create a reasonably likely harm risk to an individual 
identified with the information.\138\ Specifically, we acknowledge that 
encryption of information using current industry standard best 
practices is a reasonable factor for a covered institution to consider 
in making this determination. To the extent such encryption minimizes 
the likelihood that the cipher text could be decrypted, it would also 
reduce the likelihood that the cipher text's compromise could create a 
risk of harm, as long as the associated decryption key is secure.\139\ 
Covered institutions may also reference commonly used cryptographic 
standards to determine whether encryption, in fact, does substantially 
impede the likelihood that the cipher text's compromise could create a 
risk of harm.\140\ As industry standards continue to develop in the 
future, covered institutions generally should review and update, as 
appropriate, their encryption practices. While we agree with commenters 
that it is important to incentivize the use of encryption consistent 
with State law regimes, the final amendments' approach accomplishes 
this goal while also addressing concerns that any particular approach 
to encryption may become outdated as technologies and security 
practices evolve. Relatedly, and for the same reasons, when information 
that would otherwise constitute sensitive customer information is 
encrypted, the covered institution may consider the security provided 
by that encryption in determining whether the cipher text (i.e., the 
data rendered in a format not understood by people or machines without 
an encryption key) is sensitive customer information. Accordingly, 
while the final amendments provide illustrative examples of information 
(such as a customer's Social Security number) that can constitute 
sensitive customer information when unencrypted,\141\ a covered 
institution could nevertheless determine that the encrypted 
representation of that information is not sensitive customer 
information if the encryption renders the cipher text sufficiently 
secure, such that the compromise of that encrypted information does not 
create a reasonably likely risk of substantial harm or inconvenience to 
an individual.\142\
---------------------------------------------------------------------------

    \138\ See Proposing Release at n.116 and accompanying text.
    \139\ As discussed in the Proposing Release, most States except 
encrypted information in certain circumstances, including, for 
example, where the covered institution can determine that the 
encryption offers certain levels of protection or the decryption key 
has not also been compromised. See Proposing Release at n.117 and 
accompanying text.
    \140\ We understand that standards included in Federal 
Information Processing Standard Publication 140-3 (FIPS 140-3) are 
widely referenced by industry participants. See Proposing Release at 
n.118.
    \141\ See final rule 248.30(d)(9)(ii)(A)(1) through (4) and 
248.30(d)(9)(ii)(B).
    \142\ To the extent a covered institutioon's determination about 
the security of cipher text affects its determination about whether 
notice of a breach is required under the final rules, the covered 
institution would be required to make and maintain written 
documentation of that documentation. See final rule 
248.30(c)(1)(iii).
---------------------------------------------------------------------------

c. Substantial Harm or Inconvenience
    The GLBA directs the Commission and other Federal financial 
regulators to, among other things, establish appropriate standards 
requiring financial institutions subject to their jurisdiction to 
protect against unauthorized access to or use of customer records or 
information which could result in ``substantial harm or inconvenience'' 
to any customer, without defining what constitutes a substantial harm 
or inconvenience under the statute.\143\ The Commission proposed to 
define ``substantial harm or inconvenience'' to mean all personal 
injuries, as well as instances of financial loss, expenditure of 
effort, or loss of time when they are ``more than trivial,'' with the 
proposal also providing a non-exhaustive list of examples of included 
harms or inconveniences.\144\ This proposed definition included a broad 
range of financial and non-financial harms and inconveniences that may 
result from the failure to safeguard sensitive customer 
information.\145\ After considering comments, and as discussed further 
below, we have determined not to define the term ``substantial harm or 
inconvenience'' in the final amendments.
---------------------------------------------------------------------------

    \143\ See 15 U.S.C. 6801(b). The Banking Agencies' Incident 
Response Guidance likewise does not define the term ``substantial 
harm or inconvenience.''
    \144\ See proposed rule 248.30(e)(11).
    \145\ See Proposing Release at n.124.
---------------------------------------------------------------------------

    Commenters raised various concerns with the proposed definition. 
Some commenters proposed expanding the definition to include a broader 
array of harms requiring notification.\146\ For example, one commenter 
suggested revising it to enumerate a list of specific personal injuries 
requiring notification to help clarify to covered institutions that 
there are a range of personal injuries that can result from an exposure 
of customer data.\147\ Commenters also suggested we remove the 
requirement that personal or financial harms be nontrivial because, 
according to these commenters, there might always be some set of 
individuals to whom a particular personal or financial harm is 
material, and securities firms are not well positioned to determine 
what potential personal or financial harms to their customers are 
significant enough to require customer notice.\148\ One of these 
commenters observed that, while it made sense to apply the concept of 
nontriviality to potential harms or inconveniences that would infringe 
upon a customer's time and personal labors, risks to the customer's 
person and pocketbook are materially different from risks to the 
customer's time and energies.\149\ This commenter also suggested 
broadening the definition to include the term ``cyberattack'' as one of 
the enumerated events that could give rise to the customer notice 
obligation.
---------------------------------------------------------------------------

    \146\ See EPIC Comment Letter; NASAA Comment Letter; Better 
Markets Comment Letter.
    \147\ See EPIC Comment Letter (suggesting the definition 
specifically list as examples of personal injuries: theft, fraud, 
harassment, physical harm, psychological harm, impersonation, 
intimidation, damaged reputation, impaired eligibility for credit or 
government benefits, or the misuse of information identified with an 
individual to obtain a financial product or service, or to access, 
log onto, effect a transaction in, or otherwise misuse the 
individual's account).
    \148\ See NASAA Comment Letter; EPIC Comment Letter (agreeing 
with NASAA's comment).
    \149\ See NASAA Comment Letter.
---------------------------------------------------------------------------

    Alternatively, a number of commenters suggested that the proposed 
standard was ambiguous and urged narrowing the definition to reduce the 
types of injuries that would require notification.\150\ For example, 
one commenter suggested that we not attempt to define ``substantial 
harm or inconvenience'' at all, and further expressed concern that the 
proposed definition would require notice for harms or inconveniences 
that are unrelated to identify theft, the means to access an account 
without authority, or other ``tangible harms.'' \151\ Another commenter 
proposed narrowing the kinds of financial loss or time and effort 
cognizable under the rules from ``more than trivial'' to only 
``material'' financial loss or ``significant'' expenditure of effort or 
loss of time, suggesting that the proposed definition would be 
inconsistent with the usual meaning of the term ``substantial'' and 
could include any financial loss that is slightly

[[Page 47701]]

above trivial as substantial.\152\ Another commenter stated that the 
use of ``more than trivial'' set a very low bar that could result in 
second-guessing and over notification by covered intuitions that could 
lead to notification in practically all instances, not just instances 
of what the commenter viewed as a substantial harm or 
inconvenience.\153\ This commenter also stated that, as drafted, it was 
unclear whether the proposed ``more than trivial'' standard was meant 
to apply to instances of personal injury or financial loss and 
suggested replacing ``more than trivial'' with substantial, while 
making clear that the word substantial modified all elements of the 
definition. Other commenters suggested narrowing the proposed 
definition by removing the term ``inconvenience'' from the definition, 
with notification only required in cases of substantial harm that were 
more than trivial.\154\
---------------------------------------------------------------------------

    \150\ See, e.g., Comment Letter of Cambridge (``Cambridge 
Comment Letter''); CAI Comment Letter; IAA Comment Letter 1; SIFMA 
Comment Letter 2.
    \151\ See SIFMA Comment Letter 2.
    \152\ See IAA Comment Letter 1.
    \153\ See CAI Comment Letter (``it is hard to imagine any 
instance of unauthorized access or use of customer information that 
could not create a reasonably likely risk of more than trivial 
inconvenience, and therefore not require notification'').
    \154\ See Cambridge Comment Letter; Financial Services Institute 
Comment Letter.
---------------------------------------------------------------------------

    After considering comments, we have determined, consistent with the 
approach of the Banking Agencies, not to define the term ``substantial 
harm or inconvenience.'' As the range of commenter concerns discussed 
above reflects, commenters found the proposed definition simultaneously 
too broad and too narrow, suggesting it could consequently lead to both 
under-notification and over-notification. Eliminating the proposed 
definition avoids this result without diminishing investor protection.
    Determining whether a given harm or inconvenience rises to the 
level of a substantial harm or a substantial inconvenience would depend 
on the particular facts and circumstances surrounding an incident. As 
stated in the Proposing Release, we do not intend for covered 
institutions to design programs and incur costs to protect customers 
from harms of such trivial significance that the customer would be 
unconcerned with remediating them.\155\ At the same time, consistent 
with the GLBA, the rules are intended to protect against unauthorized 
access to or use of customer records or information which could result 
in substantial harm or inconvenience to any customer. Given the wide 
variety of ways that a data breach can injure a customer,\156\ and the 
potentially varied nature of those harms and inconveniences,\157\ the 
range of harms outlined in the proposed definition may be a useful 
starting point for this determination. A personal injury, financial 
loss, expenditure of effort, or loss of time, each could constitute a 
substantial harm or inconvenience depending on the particular facts and 
circumstances. Some examples of these harms could include theft, fraud, 
harassment, physical harm, impersonation, intimidation, damaged 
reputation, impaired eligibility for credit, or the misuse of 
information identified with an individual to obtain a financial product 
or service, or to access, log into, effect a transaction in, or 
otherwise misuse the individual's account.
---------------------------------------------------------------------------

    \155\ See Proposing Release at Section II.A.4.c.
    \156\ See Proposing Release at n.124.
    \157\ See, e.g., NASAA Comment Letter; IAA Comment Letter 1.
---------------------------------------------------------------------------

d. Timing Requirements
(1) General Timing Requirements
    Consistent with the proposal, the final amendments require covered 
institutions to provide notices to affected individuals as soon as 
practicable, but not later than 30 days, after becoming aware that 
unauthorized access to or use of customer information has occurred or 
is reasonably likely to have occurred, except under the limited 
circumstances discussed below.\158\ This approach reflects the goal of 
giving covered institutions adequate time to make an initial assessment 
of an incident and prepare and send notices to affected individuals, 
while helping to ensure that those individuals receive sufficient 
notice to protect themselves.
---------------------------------------------------------------------------

    \158\ See final rule 248.30(a)(4)(iii); see also section 
II.A.3.d(2) (discussing the national security and public safety 
delay to the notification timing requirements).
---------------------------------------------------------------------------

    A few commenters expressed support for the proposed notification 
timing requirements.\159\ As described above, these commenters viewed 
timeliness as important because any delay in notification could impact 
individuals' ability to take steps to protect themselves from the 
downstream impacts resulting from the unauthorized access to or use of 
their sensitive customer information.\160\ One commenter asserted that 
30 days after becoming aware of an incident is more than an ample 
amount of time for covered institutions to determine the scope of the 
compromised information and compile a list of affected customers that 
must be notified.\161\ Accordingly, this commenter suggested that the 
Commission should shorten the outside notification date from 30 days 
after becoming aware of a data security incident to 14 days, asserting 
that the longer an instance of identity theft goes undetected, the 
greater the damage that usually follows.
---------------------------------------------------------------------------

    \159\ EPIC Comment Letter; Better Markets Comment Letter.
    \160\ See supra section II.A.3.a.
    \161\ Better Markets Comment Letter.
---------------------------------------------------------------------------

    In contrast, some commenters objected to the proposed notification 
timing requirements because, in their view, it provided an insufficient 
amount of time to notify affected individuals.\162\ These commenters 
emphasized the logistical tasks associated with responding to an 
information breach, asserting that in some cases it would be impossible 
to accomplish these steps within 30 days.\163\ Commenters expressed 
that these steps often include remediating the security incident 
directly, conducting a risk assessment and investigation to determine 
what information may have been affected, obtaining the information 
needed to make notification to affected individuals, arranging identity 
protection services for affected individuals, and generating and 
delivering the notifications to affected individuals, all while 
simultaneously engaging in extensive communication with and oversight 
from senior management, the board of directors, and external parties 
(such as outside counsel, expert consultants, and regulators).\164\
---------------------------------------------------------------------------

    \162\ See, e.g., SIFMA Comment Letter 2; IAA Comment Letter 1; 
FSI Comment Letter; NASDAQ Comment Letter; CAI Comment Letter.
    \163\ For example, one commenter offered the example of a 
ransomware attack that successfully shuts down systems and requires 
significant remediation to recover backup systems, as well as 
rebuilding and redeploying essential systems prior to conducting a 
forensic investigation to determine the scope of data subject to 
unauthorized access or use. See CAI Comment Letter. According to 
this commenter, it would be practically impossible to accomplish 
these tasks within 30 days of becoming aware of a possible issue, as 
required under the proposed rules.
    \164\ See, e.g., CAI Comment Letter, NASDAQ Comment Letter; IAA 
Comment Letter 1.
---------------------------------------------------------------------------

    Some commenters also suggested that the proposed timing 
requirements would lead to covered institutions delivering unnecessary 
or incomplete notifications to customers, which would have the result 
of confusing or desensitizing customers to such notifications.\165\ 
Similarly, commenters expressed that requiring a covered institution to 
notify affected individuals before the covered institution has had time 
to fully assess an incident could result in incorrect or incomplete 
conclusions being drawn and

[[Page 47702]]

disclosed.\166\ One commenter suggested, for this reason, that notices 
would be subject to continuous revision during an ongoing 
investigation.\167\ Accordingly, commenters stated that the Commission 
should revise the proposal to allow more time for covered institutions 
to provide notices to affected individuals, asserting that premature, 
incomplete, or frequent notifications would ultimately mislead and 
confuse customers rather than provide clarity about an incident.\168\
---------------------------------------------------------------------------

    \165\ See, e.g., ACLI Comment Letter; AWS Comment Letter, NASDAQ 
Comment Letter.
    \166\ NASDAQ Comment Letter; AWS Comment Letter.
    \167\ AWS Comment Letter.
    \168\ ACLI Comment Letter; AWS Comment Letter, NASDAQ Comment 
Letter.
---------------------------------------------------------------------------

    Several commenters suggested alternatives to the proposed timing 
requirements.\169\ For instance, a few commenters urged the Commission 
to expand the 30-day outside date to 45 or 60 days, stating that this 
modification would allow more time for a proper investigation and 
notification process.\170\ In addition, a couple of commenters 
suggested that the rule should not specify a number of days at 
all.\171\ One of these commenters stated that simply requiring a 
covered institution to notify affected individuals as soon as possible 
after the conclusion of an investigation, without including an outside 
date timeframe, would permit appropriate notification in both simple 
cases--where notification in less than 30 days may be appropriate--and 
more complex cases--where it may take significantly longer to identify 
the appropriate notice population and prepare and deliver 
notifications.\172\
---------------------------------------------------------------------------

    \169\ See, e.g., IAA Comment Letter 1; FSI Comment Letter; 
Cambridge Comment Letter; Federated Comment Letter; SIFMA Comment 
Letter 2.
    \170\ See FSI Comment Letter; Cambridge Comment Letter; IAA 
Comment Letter 1.
    \171\ Federated Comment Letter; SIFMA Comment Letter 2.
    \172\ SIFMA Comment Letter 2.
---------------------------------------------------------------------------

    Some commenters suggested that the trigger for notification should 
be the completion of a reasonable investigation and conclusion of the 
incident response process following the actual or reasonably likely 
unauthorized access to or use of sensitive customer information, rather 
than the proposal's trigger of a covered institution ``becoming aware'' 
of a breach of customer information.\173\ These commenters stated this 
alternative would allow covered institutions sufficient time to engage 
in system and data analysis to determine what data was impacted and 
what individuals were affected. Moreover, some commenters stated that 
their suggested alternatives would harmonize the rule's approach to 
timing with existing data breach requirements and guidance, such as the 
Banking Agencies' Incident Response Guidance and some current State 
laws.\174\ Lastly, one commenter urged that the 30-day outside 
timeframe to provide notices should run from the time that the covered 
institution determines that an incident involved ``sensitive customer 
information,'' rather than ``customer information'' as proposed.\175\
---------------------------------------------------------------------------

    \173\ See SIFMA Comment Letter 2; ACLI Comment Letter; see also 
CAI Comment Letter (suggesting that a revised rule could require 
covered institutions to conduct a prompt investigation of potential 
incidents to address concerns about lengthy investigations unduly 
delaying customer notification.).
    \174\ See FSI Comment Letter; SIFMA Comment Letter 2 (suggesting 
conforming to Banking Agencies' Incident Response Guidance which 
does not mandate specific number of days to provide notices); see 
also IAA Comment Letter 1 (stating that ``over half of state data 
breach notification laws do not specify a number of days to report a 
breach and a majority of those states that do require notification 
allow for 45-60 days for reporting'').
    \175\ IAA Comment Letter 1 (suggesting that referring to 
``customer information,'' rather than ``sensitive customer 
information,'' in this part of the proposed rule was an inadvertent 
omission).
---------------------------------------------------------------------------

    After considering comments and alternatives suggested by 
commenters, we are adopting the final amendments as proposed. We 
considered the concern raised by commenters that it may be logistically 
challenging for covered institutions to provide notice to affected 
individuals within the proposed rule's notification timing 
requirements, particularly for more complex data breach incidents.\176\ 
We recognize that modifying the timing trigger in the rule to start 
after a covered institution has completed an investigation that comes 
to a definitive conclusion about the precise details of the breach, as 
suggested by some commenters, could avoid over-notification in cases 
where a covered institution is able to determine that a given 
individual's customer information ultimately was not affected after a 
lengthy investigation. We agree with commenters, however, that 
timeliness is important in the context of a breach of sensitive 
customer information because delay in notification would impact the 
ability of affected individuals to take measures to protect themselves. 
Accordingly, the final amendments maintain the proposed timing trigger 
of after the covered institution ``becomes aware'' that unauthorized 
access to or use of customer information has occurred or is reasonably 
likely to have occurred.\177\
---------------------------------------------------------------------------

    \176\ See, e.g., CAI Comment Letter; ACLI Comment Letter.
    \177\ While this ``becoming aware'' standard differs from the 
reporting trigger in the Public Company Cybersecurity Rules (which 
require public disclosure of public issuer cybersecurity incidents 
four business days from when an issuer determines that a 
cybersecurity incident that it has experienced is material), that 
difference is attributable to the different purposes underlying the 
rules. The Public Company Cybersecurity Rules were designed to 
inform investment and voting decisions and to reduce information 
asymmetry and mispricing in the market, and therefore tie public 
disclosure to an issuer making a determination that information 
about an incident would be material, meaning there would be a 
substantial likelihood that a reasonable shareholder would consider 
it important in making an investment decision. As we stated in that 
release, ``we reiterate, consistent with the standard set out in the 
cases addressing materiality in the securities laws, that 
information is material if `there is a substantial likelihood that a 
reasonable shareholder would consider it important' in making an 
investment decision, or if it would have `significantly altered the 
``total mix'' of information made available.' '' See Public Company 
Cybersecurity Rules. By contrast, the notice provisions under these 
final rules do not require covered institutions to make a 
materiality determination, and balance the need for timely 
notifications with a regime that allows for reasonable 
investigations to avoid over-notification by allowing covered 
institutions up to 30 days to conduct a reasonable investigation 
after becoming aware of an incident. In light of this 30-day window, 
and the fact that covered institutions are not required to make a 
materiality determination, there is less need for a trigger based on 
a determination standard, and greater risk of harm to affected 
individuals if customer notification were further delayed by 
requiring that a covered institution come to a determination before 
triggering the 30-day notification window.
---------------------------------------------------------------------------

    In addition, the final amendments adopt the proposed 30-day outside 
date. We disagree that the rule should not include a specified 
notification deadline, as such an approach would diminish the goal of 
providing customers (regardless of State residency) with early and 
consistent notification of data breaches so that they may take remedial 
action because many States do not have any specific deadline for 
sending notices or provide deadlines exceeding 30 days.\178\
---------------------------------------------------------------------------

    \178\ See infra section IV.D.1.b(2).
---------------------------------------------------------------------------

    We understand that there are a number of steps a covered 
institution may have to take after becoming aware of a data breach 
incident to determine if it has met the standard for providing notice. 
In the context of the final amendments, 30 days should be sufficient to 
conduct an initial assessment and notify affected individuals. While a 
covered institution may still be working towards remediating the breach 
after the 30-day timeframe, the final amendments require a covered 
institution to notify affected customers within the 30-day timeframe so 
that affected individuals may take measures to protect themselves. The 
final amendments remove the specific requirement in the proposal that 
the notice describe what has been done to protect the sensitive 
customer information from further

[[Page 47703]]

unauthorized access or use.\179\ This change will help address some of 
the timing and logistical concerns raised by commenters because the 
process of preparing the requisite notices will be less time intensive, 
such that, once a covered institution has made its initial assessment 
of the incident and determined the universe of affected individuals, it 
should possess the information necessary to provide the requisite 
notices.
---------------------------------------------------------------------------

    \179\ See final rule 248.30(a)(4)(iv); infra section II.A.3.e. 
(discussing in more detail the modification to the notice content 
requirements).
---------------------------------------------------------------------------

    In addition, with regard to the commenter concern that it may be 
logistically challenging to provide a notice within the rule's timing 
requirements in cases where a ransomware attack has denied the covered 
institution access to its systems,\180\ that comment does not account 
for the fact that, under the proposed and final amendments, covered 
institutions will now be required to have an incident response program 
that includes policies and procedures to, among other things, assess 
the nature and scope of any qualifying incidents, identify customer 
information systems and types of customer information that may have 
been accessed or used without authorization, and respond to and recover 
from those incidents.\181\ Thus, as proposed, consistent with the final 
amendments, covered institutions will need to anticipate and prepare 
for the possibility that they may be denied access to a particular 
system (such as in the ransomware example offered by one commenter) and 
have procedures in place for complying with the notice requirements 
when applicable.
---------------------------------------------------------------------------

    \180\ See CAI Comment Letter.
    \181\ See supra section II.A; final rule 248.30(a).
---------------------------------------------------------------------------

    Consistent with the proposal, the final amendments will require 
that covered institutions provide notices ``as soon as practicable,'' 
but not more than 30 days, after becoming aware that unauthorized 
access to or use of customer information has occurred or is reasonably 
likely to have occurred. The amount of time that would constitute ``as 
soon as practicable'' may vary based on several factors, such as the 
time required to assess, contain, and control the incident.\182\ The 
requirement to notify affected individuals as soon as practicable but 
not more than 30 days in the final amendments is consistent with the 
purposes of the GLBA and reflects the importance of expeditious 
notification. The amendments are designed to help ensure that customers 
receive notification in a timely manner. It would be contrary to this 
policy goal for a covered institution to unduly delay notification to 
customers, for example by delaying notice until it has definitively 
concluded that a data breach incident has occurred, because this could 
result in excessively delayed notifications that could unnecessarily 
hinder affected customers from engaging their own remedial measures to 
protect their data. A covered institution should act promptly and must 
not delay its initial assessment of the available details of the 
incident as delaying notices could deprive customers of the ability to 
take prompt action to protect themselves.
---------------------------------------------------------------------------

    \182\ For example, an incident of unauthorized access by a 
single employee to a limited set of sensitive customer information 
may take only a few days to assess, remediate, and investigate. In 
those circumstances a covered institution generally should provide 
notices to affected individuals at the conclusion of those tasks and 
as soon as the notices have been prepared. See Proposing Release at 
n.133.
---------------------------------------------------------------------------

    The 30-day outside timeframe under both the proposed and final 
rules begins following an incident involving customer information. This 
is consistent with the scope of the incident response program, which is 
required to address unauthorized access to or use of customer 
information. The outside timeframe does not begin from the time that 
the covered institution determines that an incident involved 
``sensitive customer information,'' as suggested by one commenter.\183\ 
The commenter's suggested modification would likely delay notification 
as compared to the final rule because covered institutions could take 
considerable time to determine that an incident involved sensitive 
customer information before the outside timeframe would begin and this 
could further delay any potential notice to affected individuals.
---------------------------------------------------------------------------

    \183\ IAA Comment Letter 1.
---------------------------------------------------------------------------

(2) National Security and Public Safety Delay
    The final amendments will allow covered institutions to delay 
providing notice if the Attorney General determines that the notice 
required under the final amendments poses a substantial risk to 
national security or public safety, and notifies the Commission of such 
determination in writing, in which case the covered institution may 
delay such notice for a time period specified by the Attorney General, 
up to 30 days following the date when such notice was otherwise 
required to be provided.\184\ Previously referred to as the ``law 
enforcement exception'' in the proposal, the national security and 
public safety delay has been expanded to incorporate risks related to 
public safety in addition to national security. In a modification of 
the proposal, in which the Attorney General would have informed only 
the covered institution in cases where this delay is granted, in the 
final amendments the Attorney General will instead inform the 
Commission, in writing, if the Attorney General determines that the 
notice poses a substantial risk to national security or public safety. 
This modification is designed to ensure that the Commission receives 
information related to a delay in notice in an efficient and timely 
manner. We have consulted with the Department of Justice to establish 
an interagency communication process to allow for the Attorney 
General's determination to be communicated to the Commission in a 
timely manner. The Department of Justice will notify the covered 
institution that communication to the Commission has been made so that 
the covered institution may delay providing the notice.
---------------------------------------------------------------------------

    \184\ See final rule 248.30(a)(4)(iii).
---------------------------------------------------------------------------

    In another change from the proposal, the notice may be delayed for 
an additional period of up to 30 days if the Attorney General 
determines that the notice continues to pose a substantial risk to 
national security or public safety and notifies the Commission of such 
determination in writing. In a further change in response to comments, 
in extraordinary circumstances, notice may be delayed for a final 
additional period of up to 60 days if the Attorney General determines 
that notice continues to pose a substantial risk to national security 
and notifies the Commission of such determination in writing. Beyond 
the final 60-day delay, if the Attorney General indicates that further 
delay is necessary, the Commission will consider additional requests 
for delay and may grant such delay through a Commission exemptive order 
or other action. By contrast, the proposed rules would have allowed a 
covered institution to delay notice only for an aggregate period of 30 
days following a written request from the Attorney General to the 
covered institution, upon the expiration of which the covered 
institution would have been required to provide notice immediately. The 
modification to the proposed rule is designed to respond to concerns 
raised by commenters.\185\
---------------------------------------------------------------------------

    \185\ The final amendments will align more closely with the 
Public Company Cybersecurity Rules on this point by incorporating a 
similar scope and timing for its national security and public safety 
delay.
---------------------------------------------------------------------------

    One commenter stated that a delay in notifying affected individuals 
for law enforcement activity may cause harm to

[[Page 47704]]

customers whose personal information has been exposed.\186\ In 
addition, this commenter asserted that notifying affected individuals 
would not impede a law enforcement investigation of the data security 
incident.
---------------------------------------------------------------------------

    \186\ Better Markets Comment Letter.
---------------------------------------------------------------------------

    Other commenters, however, urged the Commission to expand the 
proposed law enforcement exception because, in their view, the proposed 
exception was too narrowly drawn.\187\ Several of these commenters 
expressed concern that requests by local or State police, or even other 
Federal agencies, would not be sufficient to delay notification under 
the proposed rule.\188\ Some commenters stated concerns about the 
feasibility and process of reaching out to the Attorney General to 
request a delay in support of expanding the exception to permit other 
law enforcement agencies to direct a covered institution to delay a 
notice.\189\ Commenters also expressed particular concern around 
competing requirements, noting that many State regulations include a 
more permissive delay and that covered institutions, in an effort to 
comply with the proposed exception, may be put into the difficult and 
unnecessary position of being subject to conflicting requirements from 
the Commission and a State law enforcement entity.\190\ Further, 
commenters articulated that the proposed exception is excessively 
narrow because it only accommodates law enforcement actions that 
address concerns that rise to the level of ``national security.'' \191\
---------------------------------------------------------------------------

    \187\ See, e.g., IAA Comment Letter 1; SIFMA Comment Letter 2; 
NASDAQ Comment Letter; CAI Comment Letter; FII Comment Letter.
    \188\ See, e.g., CAI Comment Letter; ICI Comment Letter 1; FII 
Comment Letter; SIFMA Comment Letter 2 (suggesting that the proposed 
law enforcement exception should also contemplate foreign law 
enforcement and include cooperation with international authorities).
    \189\ See ICI Comment Letter; SIFMA Comment Letter 2.
    \190\ See, e.g., ICI Comment Letter 1; NASDAQ Comment Letter; 
FII Comment Letter; IAA Comment Letter 1 (viewing the proposed 
exception as creating broader security risks for clients and 
advisers and forcing an adviser to choose between disregarding a law 
enforcement request or violating the rule).
    \191\ CAI Comment Letter; ICI Comment Letter 1; SIFMA Comment 
Letter 2.
---------------------------------------------------------------------------

    In addition to concerns regarding the scope of the proposed law 
enforcement exception, several commenters opposed the length of time 
that a covered institution would be permitted to delay notice under the 
proposed rule.\192\ These commenters suggested that there should be no 
outside time limitation on the proposed law enforcement exception, 
asserting that the judgment of any law enforcement agency investigating 
a breach should be an adequate and respected basis for delaying a 
regulatory notice regarding such breach. Commenters urged the 
Commission to expand the scope and timing requirements of the proposed 
law enforcement exception, expressing that they failed to understand 
the public purpose that would be served by ignoring the request of a 
law enforcement agency to delay notification.\193\
---------------------------------------------------------------------------

    \192\ See, e.g., IAA Comment Letter 1; ICI Comment Letter 1; 
NASDAQ Comment Letter; SIFMA Comment Letter 2; CAI Comment Letter.
    \193\ See, e.g., IAA Comment Letter 1; NASDAQ Comment Letter; 
see also SIFMA Comment Letter 2 (stating its view that only for a 
limited number of cases would delay be requested or mandated by 
other government entities, or court orders, so notification delays 
would not become routine or be otherwise abused).
---------------------------------------------------------------------------

    In response to commenters' concerns, we have broadened both the 
scope and timing requirements of the delay in the final amendments. The 
final amendments will allow covered institutions to delay notice in 
cases where disclosure would pose a substantial risk to national 
security or public safety, contingent on a written notification by the 
Attorney General to the Commission.\194\ This provision has been 
expanded to incorporate risks related to public safety, and not just 
national security, as proposed. This expansion allows for notice delay 
in scenarios where there may be significant risk of harm from 
disclosure; however, there may not be a substantial risk to national 
security. This modification should make the provision sufficiently 
expansive to protect against significant risks of harm from 
disclosure--such as the risk of alerting malicious actors targeting 
critical infrastructure that their activities have been discovered--
while also helping to ensure that individuals are not unduly denied 
timely access to information about the unauthorized access to or use of 
their sensitive customer information.
---------------------------------------------------------------------------

    \194\ A covered institution requesting that the Attorney General 
determine that notification under the rule would pose a substantial 
risk to national security or public safety does not change the 
covered institution's obligation to provide notice to affected 
customers within the timing required under the final amendments. 
This is because the rule permits a delay only upon the Attorney 
General making that determination and communicating it to the 
Commission in writing.
---------------------------------------------------------------------------

    With respect to commenters who recommended that other Federal 
agencies, State and local law enforcement agencies, and foreign law 
enforcement authorities also be permitted to trigger a delay or 
suggested that the perceived limited nature of this delay would cause 
conflict with State authorities, the rule does not preclude any such 
entity from requesting that the Attorney General determine that the 
disclosure poses a substantial risk to national security or public 
safety and communicate that determination to the Commission. 
Designating a single law enforcement agency as the point of contact for 
both the covered institution and the Commission on such delays is 
critical to ensuring that the rule is administrable. Some commenters 
stated concerns about the feasibility and process of reaching out to 
the Attorney General to request a delay, urging the Commission to 
expand the delay to apply to requests made by other law enforcement 
agencies in addition to the Attorney General. The FBI, in coordination 
with the Department of Justice, has since provided guidance on how 
firms can request disclosure delays for national security or public 
safety reasons in connection with the Public Company Cybersecurity 
Rules.\195\ To the extent needed, further guidance may be issued on how 
other law enforcement agencies may contact the Department of Justice to 
request a delay.
---------------------------------------------------------------------------

    \195\ See FBI Guidance to Victims of Cyber Incidents on SEC 
Reporting Requirements, available at: https://www.fbi.gov/investigate/cyber/fbi-guidance-to-victims-of-cyber-incidents-on-sec-reporting-requirements.
---------------------------------------------------------------------------

    The final amendments also will expand the amount of time that a 
covered institution can delay notice under this provision. However, we 
are not persuaded, as some commenters suggested, that the rules should 
not incorporate a timing component at all because such an approach 
would diminish the goal of providing customers (regardless of State 
residency) with timely and consistent notification of data breaches so 
that they may take remedial action. This includes permitting, in 
extraordinary circumstances, a delay for a final additional period of 
up to 60 days--following two previous 30-day extensions--if the 
Attorney General determines that disclosure continues to pose a 
substantial risk to national security and notifies the Commission of 
such determination in writing. We are providing for this additional 
delay period in the final amendments, beyond what was originally 
proposed, and in addition to the two 30-day delays that may precede it, 
in recognition that, in extraordinary circumstances, national security 
concerns may justify additional delay beyond that warranted by public 
safety concerns, due to the relatively more critical nature of national 
security concerns.\196\ Beyond the final 60-day

[[Page 47705]]

delay, if the Attorney General indicates to the Commission in writing 
that further delay is necessary, the covered institution can request an 
additional delay that the Commission may grant through exemptive order 
or other action. These modifications acknowledge that additional time 
beyond that proposed may be necessary, as called for by commenters, 
while balancing national security and public safety concerns against 
affected individuals' informational needs.
---------------------------------------------------------------------------

    \196\ Under the proposal, in contrast, the covered institution 
could delay a notice if the Attorney General informed the covered 
institution, in writing, that the notice poses a substantial risk to 
national security. The proposal provided that the covered 
institution could delay such a notice for a time period specified by 
the Attorney General, but not for longer than 15 days, plus an 
additional period of up to 15 days if the Attorney General 
determines that the notice continues to pose a substantial risk to 
national security.
---------------------------------------------------------------------------

e. Notice Contents and Format
    The final amendments, consistent with the proposal, require that 
notices include key information with details about the incident, the 
breached data, and how affected individuals can respond to the breach 
to protect themselves. This requirement is designed to help ensure that 
covered institutions provide basic information to affected individuals 
that will help them avoid or mitigate substantial harm or 
inconvenience. In a modification from the proposal, however, the final 
amendments will not require the notice to ``[d]escribe what has been 
done to protect the sensitive customer information from further 
unauthorized access or use.''
    Some of the information required by the final amendment, including 
information regarding a description of the incident, and the type of 
sensitive customer information accessed or used without authorization, 
will provide affected individuals with basic information to help them 
understand the scope of the incident and its potential ramifications. 
As proposed, the final amendments will require covered institutions to 
include contact information sufficient to permit an affected individual 
to contact the covered institution to inquire about the incident, 
including a telephone number (which should be a toll-free number if 
available), an email address or equivalent method or means, a postal 
address, and the name of a specific office to contact for further 
information and assistance, so that affected individuals can easily 
seek additional information from the covered institution. All of this 
information may help affected individuals assess the risk posed by the 
incident and whether to take additional measures to protect against 
harm from unauthorized access or use of their information.
    Similarly, as proposed, the final amendments will require 
information regarding the date of the incident, the estimated date of 
the incident, or the date range within which the incident occurred, if 
such information is reasonably possible to determine at the time the 
notice is provided. This requirement reflects the reality that a 
covered institution may have difficulty determining a precise date 
range for certain incidents because it may only discover an incident 
well after an initial time of access.\197\
---------------------------------------------------------------------------

    \197\ See Proposing Release at n.142.
---------------------------------------------------------------------------

    In addition, as proposed, the final amendments will require that 
covered institutions include certain information to assist affected 
individuals in evaluating how they should respond to the incident. 
Specifically, if the affected individual has an account with the 
covered institution, the final amendments will require the notice to 
recommend that the customer review account statements and immediately 
report any suspicious activity to the covered institution. The final 
amendments will also require the notice to explain what a fraud alert 
is and how an affected individual may place a fraud alert in credit 
reports. Further, the final amendments will require that the notice 
recommend that the affected individual periodically obtain credit 
reports from each nationwide credit reporting company and that the 
individual have information relating to fraudulent transactions 
deleted. The notice must also explain how a credit report can be 
obtained free of charge. Lastly, the final amendments require that 
notices include information regarding FTC and usa.gov guidance on steps 
an affected individual can take to protect against identity theft, a 
statement encouraging the individual to report any incidents of 
identity theft to the FTC, and the FTC's website address. These 
specific requirements are designed to give affected individuals 
resources and additional information to help them evaluate how they 
should respond to the incident.
    As proposed, under the final rules covered institutions will be 
required to provide the information specified in the final amendments 
in each required notice. While we recognize that relevant information 
may vary based on the facts and circumstances of the incident, 
customers will benefit from the same minimum set of basic information 
in all notices. Accordingly, the final amendments will permit covered 
institutions to include additional information but will not permit 
omission of the prescribed information. In addition, the final 
amendments will require covered institutions to provide notice in a 
clear and conspicuous manner and by means designed to ensure that the 
customer can reasonably be expected to receive actual notice in 
writing.\198\ Pursuant to 17 CFR 248.3, notices will therefore be 
required to be reasonably understandable and designed to call attention 
to the nature and significance of the information required to be 
provided in the notice.\199\ To the extent that a covered institution 
includes information in the notice that is not required to be provided 
to customers under the final amendments or provides notice 
contemporaneously with other disclosures, the covered institution will 
still be required to ensure that the notice is designed to call 
attention to the important information required to be provided under 
the final amendments; the inclusion of any additional information in 
the notice may not prevent the required information from being 
presented in a clear and conspicuous manner. The requirement to provide 
notices in writing, further, will ensure that customers receive the 
information in a format appropriate for receiving important 
information, with accommodation for those customers who agree to 
receive the information electronically.\200\ These requirements are 
designed to help ensure that customers are provided informative 
notifications and alerted to their importance.
---------------------------------------------------------------------------

    \198\ See final rule 248.30(a)(4)(i); see also 17 CFR 248.9(a) 
(delivery requirements for privacy and opt out notices) and 17 CFR 
248.3(c)(1) (defining ``clear and conspicuous'').
    \199\ See 17 CFR 248.3(c)(2) (providing examples explaining what 
is meant by the terms ``reasonably understandable'' and ``designed 
to call attention'').
    \200\ This requirement to provide notice ``in writing'' could be 
satisfied either through paper or, for customers who agree to 
receive information electronically, though electronic means 
consistent with existing Commission guidance on electronic delivery 
of documents. See Use of Electronic Media by Broker Dealers, 
Transfer Agents, and Investment Advisers for Delivery of 
Information; Additional Examples Under the Securities Act of 1933, 
Securities Exchange Act of 1934, and Investment Company Act of 1940 
[61 FR 24644 (May 15, 1996)]; Use of Electronic Media, [65 FR 25843 
(May 4, 2000)].
---------------------------------------------------------------------------

    Several commenters broadly supported the proposed notice contents 
and format requirements.\201\ One commenter stated that the provision 
will lead to notices that contain important information in a clear and 
conspicuous manner, which will allow affected individuals to assess the 
risk of the incident paired with guidance on

[[Page 47706]]

potential protective measures to take.\202\ Another commenter agreed 
with the proposed approach of requiring notices to contain certain 
information but not prescribing the specific format for the notices, 
asserting that this approach will ``make it easier for covered 
institutions to fulfill all their notice obligations under Federal and 
State laws with as few notice documents as possible (ideally through a 
single notice to all affected customers nationwide).'' \203\
---------------------------------------------------------------------------

    \201\ See, e.g., Better Markets Comment Letter, IAA Comment 
Letter 1; NASAA Comment Letter.
    \202\ Better Markets Comment Letter (stating that the provision 
``avoids some common problems with the content of many data breach 
notifications, such as confusing language, a lack of details, and 
insufficient attention to the practical steps customers should take 
in response.'').
    \203\ See NASAA Comment Letter (stating that ``[b]eing 
prescriptive here could potentially create inconsistencies with 
current or future State notice laws, which in turn could cause 
covered institutions to feel compelled to deliver entirely 
duplicative notices to customers simply for reasons of form. 
Customers should not be burdened in this way, and the Reg. S-P 
Proposal rightly takes this into account.'').
---------------------------------------------------------------------------

    Conversely, a few commenters opposed certain aspects of the notice 
content and format requirements.\204\ One commenter expressed concern 
related to the proposed requirement for covered institutions to include 
in the notice specific efforts they have taken to protect the sensitive 
customer information from further unauthorized access or use.\205\ This 
commenter articulated that this information could be extremely useful 
to threat actors and not particularly useful to affected 
individuals.\206\ Another commenter urged the Commission to remove the 
requirement for covered institutions to provide ``the date of the 
incident, the estimated date of the incident, or the date range,'' 
asserting that this specific information is not required by the Banking 
Agencies' Incident Response Guidance and should not be included in an 
amended Regulation S-P.\207\ In addition, two commenters suggested that 
the final amendments should provide more flexibility for covered 
institutions to determine the manner and method in which they should be 
contacted by affected individuals inquiring about an incident.\208\ 
Lastly, one commenter urged the Commission to consider whether it 
should require specific notice obligations at all, asserting that 
Federal notice would simply add another layer on top of existing State 
data breach notice requirements and would offer limited benefits to 
affected individuals.\209\
---------------------------------------------------------------------------

    \204\ See, e.g., CAI Comment Letter; ICI Comment Letter 1; IAA 
Comment Letter.
    \205\ IAA Comment Letter 1.
    \206\ Id. (further stating that in many cases ``the adviser will 
have already remediated the vulnerability, making the information 
even less relevant to a client's decision.'').
    \207\ ICI Comment Letter 1.
    \208\ CAI Comment Letter; SIFMA Comment Letter 2 (asserting that 
the rule should not require each of a telephone number, an email 
address, a postal address and a specific office contact, but rather 
should allow covered institutions to choose one or more of those 
contact options based on how the covered institution normally 
interacts with its customers).
    \209\ See CAI Comment Letter; see also NASDAQ Comment Letter 
(asserting that covered institutions ``should be permitted to comply 
with various State and Federal cybersecurity notification 
obligations with a single streamlined form.'').
---------------------------------------------------------------------------

    After considering comments, we are removing the specific 
requirement in the proposal that the notice ``[d]escribe what has been 
done to protect the sensitive customer information from further 
unauthorized access or use.'' We agree that this information has the 
potential to advantage threat actors and does not provide actionable 
information for affected individuals. Accordingly, the provision has 
been removed from the final amendments, which should reduce the 
perceived risk of providing a roadmap for threat actors compared with 
the proposal. Covered institutions may, however, voluntarily disclose 
details related to the incident's remediation status.
    The final amendments do not modify the proposed requirement for 
covered institutions to provide information about the date of the 
incident, as suggested by one commenter.\210\ Providing this 
information to affected individuals, to the extent the information is 
reasonably possible to determine, can help affected individuals 
identify the point in time in which their sensitive customer 
information was compromised, thus providing critical details that 
affected individuals can use to take targeted protective measures 
(e.g., review account statements) to mitigate the potential harm that 
could result from the unauthorized access to or use of their sensitive 
customer information. For this reason, we disagree with the commenter 
that stated firms should not be required to provide this information in 
their notice.
---------------------------------------------------------------------------

    \210\ ICI Comment Letter 1.
---------------------------------------------------------------------------

    Similarly, the final amendments do not modify the requirement for 
notices to include the prescribed contact information sufficient to 
permit an affected individual to contact the covered institution to 
inquire about the incident. We understand that covered institutions 
communicate with their customers using many different methods and 
formats. However, providing a telephone number, an email address or 
equivalent method or means (e.g., an online submission form), a postal 
address, and the name of a specific office to contact, is designed to 
provide sufficient optionality for affected individuals, who may have 
differing preferences and aptitudes in their use of contact 
methods.\211\ Nothing in this requirement, however, prevents a covered 
institution from choosing to provide additional contact methods.
---------------------------------------------------------------------------

    \211\ In addition, the final rule's requirement to provide 
contact information sufficient to permit an affected individual to 
inquire about the incident does not preclude a covered institution 
from providing the contact information of a third-party service 
provider that has been engaged by the covered institution to provide 
specialized information or assistance about the unauthorized access 
or use of sensitive customer information on the covered 
institution's behalf. See CAI Comment Letter (asserting that it is 
current business practice for companies to hire vendors who provide 
specialized breach response call centers to handle consumer 
inquiries).
---------------------------------------------------------------------------

    Lastly, the final amendments do not prescribe a specific format for 
the notice to affected customers. We agree with the commenter that 
asserted that such flexibility will make it easier for covered 
institutions to provide notices that meet the requirements of the final 
amendments while also meeting the requirements of other notice 
obligations, such as certain State requirements, and thereby mitigates 
commenter concerns about the potential for more than one notice 
covering a given incident.
4. Service Providers
    The final amendments require that each covered institution's 
incident response program include the establishment, maintenance, and 
enforcement of written policies and procedures reasonably designed to 
require oversight, including through due diligence on and monitoring, 
of service providers, including to ensure that the covered institution 
satisfies the customer notification requirements set forth in paragraph 
(a)(4) of the final amendments.\212\ In a modification from the 
proposal, rather than requiring written policies and procedures 
requiring the covered institution to enter into a written contract with 
its service providers to take certain appropriate measures, the 
policies and procedures required by the final amendments must be 
reasonably designed to ensure service providers take appropriate 
measures to: (A) protect against unauthorized access to or use of 
customer information; and (B) provide notification to the covered 
institution as soon as possible, but no later than 72 hours after 
becoming aware of a breach in security has occurred resulting in 
unauthorized access to a customer information system maintained by the 
service provider.\213\

[[Page 47707]]

In a modification from the proposal, upon receipt of such notification, 
a covered institution must initiate its incident response program 
pursuant to paragraph (a)(3) of this section.\214\ The final amendments 
thus modify the proposal by removing the written contract requirement 
and shifting the notification deadline for the service provider's 
notification of the covered institution from 48 to 72 hours, while 
retaining the notice trigger of the service provider ``becoming aware 
of'' a breach in security resulting in unauthorized access to a 
customer information system maintained by the service provider.\215\
---------------------------------------------------------------------------

    \212\ See final rule 248.30(a)(5)(i).
    \213\ See id. In the proposal, the covered institution's written 
contract with its service provider would have needed to require the 
service providers to take appropriate measures designed to protect 
against unauthorized access to or use of customer information, 
including notification to the covered institution as soon as 
possible, but no later than 48 hours after becoming aware of a 
breach in security resulting in unauthorized access to a customer 
information system maintained by the service provider to enable the 
covered institution to implement its response program. See proposed 
rule 248.30(b)(5)(i).
    \214\ See id. As discussed further below, this modification 
responds to comments by incorporating into rule text the 
Commission's intention that covered institutions would 
``expeditiously'' implement their incident response program 
following the receipt of such notification from a service provider, 
as discussed in the Proposing Release. See infra footnote 223 and 
accompanying discussion on clarifying modifications. See also 
Proposing Release at Section II.A.3.
    \215\ See final rule 248.30(a)(5)(i).
---------------------------------------------------------------------------

    However, the Commission is adopting as proposed final amendments 
that provide that a covered institution, as part of its incident 
response program, may enter into a written agreement with its service 
provider to notify affected individuals on the covered institution's 
behalf in accordance with paragraph (a)(4) of the final 
amendments.\216\ In a modification from the proposal, the final 
amendments provide that even where a covered institution uses a service 
provider in accordance with paragraphs (a)(5)(i) and (ii) of the final 
amendments, the covered institution's obligation to ensure that 
affected individuals are notified in accordance with paragraph (a)(4) 
of the final amendments rests with the covered institution.\217\
---------------------------------------------------------------------------

    \216\ See final rule 248.30(a)(5)(ii).
    \217\ See final rule 248.30(a)(5)(iii). As discussed further 
below, this modification is intended to clarify covered 
institutions' responsibilities under the final amendments by 
incorporating into rule text the Commission's intended scope, as 
discussed in the Proposing Release. See discussion on Delegation of 
Notice and Covered Institutions' Customer Notification Obligations 
infra Section II.A.4.c. and footnote 264, including accompanying 
discussion on clarifying modifications.
---------------------------------------------------------------------------

    Finally, the Commission is also defining a ``service provider'' at 
adoption to mean any person or entity that receives, maintains, 
processes, or otherwise is permitted access to customer information 
through its provision of services directly to a covered 
institution.\218\ As discussed further below, this definition removes 
language from the proposed definition relating to third parties, but 
does so solely to make plain that the definition of a ``service 
provider'' can include affiliates of a covered institution.\219\
---------------------------------------------------------------------------

    \218\ See final rule 248.30(d)(10).
    \219\ As stated below, this modification from the proposal 
responds to comments by incorporating into rule text the 
Commission's intended scope of the ``service provider'' definition, 
as discussed in the Proposing Release. See discussion on the Service 
Provider definition infra footnote 271, including accompanying 
discussion on clarifying modifications. See also proposed rule 
248.30(e)(10).
---------------------------------------------------------------------------

a. Covered Institutions' Incident Response Program Obligations 
Regarding Service Providers
    In a change from the proposed rule, the Commission is adopting the 
final amendments without requiring covered institutions to enter into a 
written contract with their service providers.\220\ Instead, the final 
amendments require that a covered institution's incident response 
program ``include the establishment, maintenance, and enforcement of 
written policies and procedures reasonably designed to require 
oversight, including through due diligence and monitoring, of the 
covered institution's service providers, including to ensure that the 
covered institution notifies affected individuals as set forth in 
paragraph (a)(4),'' in the event of a breach at the service 
provider.\221\ Further, while the final amendments do not require 
covered institutions to enter into a written contract, the final 
amendments incorporate the protections that would have been required in 
the proposed written contract \222\ by requiring that a covered 
institution's policies and procedures be reasonably designed to ensure 
service providers take the appropriate measures to: (A) protect against 
unauthorized access to or use of customer information, and (B) provide 
notification to the covered institution in the event of a breach 
resulting in unauthorized access to a customer information system 
maintained by the service provider, in accordance with the timing and 
notice trigger conditions discussed further below. Finally, in a 
modification from the proposal, upon receipt of such notification, a 
covered institution must initiate its incident response program adopted 
pursuant to paragraph (a)(3) of this section.\223\
---------------------------------------------------------------------------

    \220\ See proposed rule 248.30(b)(5)(i). See also supra footnote 
213 and accompanying discussion.
    \221\ See final rule 248.30(a)(5)(i). In the Proposing Release, 
we requested comment on whether the proposed written contract 
requirement should instead require that a covered institution adopt 
policies and procedures that ``require due diligence of or some type 
of reasonable assurances from its service providers.'' See Proposing 
Release at section II.A.3. We also encouraged commenters to review 
our separate proposal to prohibit registered investment advisers 
from outsourcing certain services or functions without first meeting 
minimum due diligence and monitoring requirements to determine 
whether that proposal might affect their comments on the Proposing 
Release. See Proposing Release at section G.2, n.300; see also 
Outsourcing by Investment Advisers, Investment Advisers Act Release 
No. 6176 (Oct. 26, 2022) [87 FR 68816 (Nov. 16, 2022)]. The due 
diligence standards we are adopting are intended to address related 
concerns raised by commenters who requested that we adopt a more 
principles-based set of requirements.
    \222\ See supra footnote 213 and accompanying discussion of the 
substantive obligations that were included in the proposal's written 
contract requirement.
    \223\ See final rule 248.30(a)(5)(i).
---------------------------------------------------------------------------

    Two commenters expressed varying degrees of support for requiring a 
written contract between a covered institution and its service 
providers.\224\ One such commenter expressed support for requiring a 
specific contractual agreement with a service provider, stating that 
the information covered by the service provider provision is already 
subject to a contractual agreement between the covered institution and 
the service provider.\225\ The other commenter agreed that service 
providers should be contractually required to take appropriate risk-
based measures and due diligence to protect against unauthorized access 
to or use of customer information, but suggested that for flexibility 
in oversight covered institutions should be permitted to rely on 
``reasonable assurances'' from service providers that they have taken 
appropriate measures to protect customer information.\226\
---------------------------------------------------------------------------

    \224\ See ICI Comment Letter. While this commenter supported a 
written contract requirement, it did assert that the Commission 
should adopt a longer compliance period due to the necessity of 
renegotiating existing contracts with service providers to align the 
breach notification provisions in those contracts to the rule's 
requirements. This comment is separately addressed below. See also 
SIFMA Comment Letter 2.
    \225\ See ICI Comment Letter. Specifically, this commenter 
stated that the information that is covered by proposed rule 
248.30(b)(5) ``is already subject to a contractual agreement between 
the covered institution and the service provider.'' Id. This 
commenter further explained it is opposing the contractual 
requirement because of its very narrow scope, specifically stating 
that ``as drafted, [the requirement] would only apply to any service 
provider that receives, maintains, processes, or otherwise is 
permitted access to customer information through the service 
provider's provision of services directly to the covered 
institution.'' Id.
    \226\ See SIFMA Comment Letter 2.

---------------------------------------------------------------------------

[[Page 47708]]

    Several commenters opposed this proposed requirement.\227\ 
Specifically, two commenters asserted that the written contract 
requirement would harm covered institutions, which may not have the 
negotiating power or leverage to demand specific contractual provisions 
from large third-party service providers, particularly where specific 
provisions are ``inconsistent with the business imperatives'' of the 
service provider and/or in the case of small covered institutions.\228\ 
A number of commenters also suggested alternatives to either adopting a 
written contract requirement or, if such a requirement is adopted, to 
mandating specified contractual requirements.\229\ Two commenters 
suggested that rather than requiring specific practices to be included 
within a written contract, the Commission should structure the final 
amendments to enable covered institutions to take a risk-based approach 
to due diligence and third-party risk management that integrates 
reliance on independent certifications, attestations, and industry 
standards as a sufficient means of assessing and determining whether 
the service provider is appropriately addressing these risks to an 
adequate standard.\230\ Meanwhile, another commenter who opposed the 
contractual requirement suggested the Commission should provide covered 
institutions with the flexibility to oversee their service providers 
``based on the nature and size of their businesses and in light of the 
risks posed by the facts and circumstances.'' \231\ Finally, one 
commenter suggested that it was unclear how a third-party service 
provider's notice to a covered institution would affect a covered 
institution's own obligations.\232\
---------------------------------------------------------------------------

    \227\ See, e.g., AWS Comment Letter; IAA Comment Letter 1 
(stating that [covered institutions] should not be required to enter 
into written agreements with service providers); Google Comment 
Letter; STA Comment Letter 2; and CAI Comment Letter (stating that 
many leading service providers (such as cloud service providers) do 
not negotiate the standard terms of their services with customers 
and those standard terms generally would not meet the proposed 
contractual requirements).
    \228\ See IAA Comment Letter 2; see also STA Comment Letter 2.
    \229\ See SIFMA Comment Letter 2; AWS Comment Letter; Google 
Comment Letter; and IAA Comment Letter 1.
    \230\ See AWS Comment Letter (suggesting that in order to 
address the practical difficulties of compliance, the Commission 
should provide covered institutions with a flexible approach to 
achieving compliance with the service provider provisions that 
relies on the use of independent certifications, attestations, and 
adherence to industry standards); see also Google Comment Letter 
(suggesting that rather than prescribing the specific practices that 
must be included in the contract, (a) contracts should require 
service providers to implement and maintain appropriate measures 
that are consistent with industry standards, and (b) each covered 
entity should oversee its providers to assess if the provider 
addresses the relevant practices to an adequate standard--noting 
this activity can be supported with third party certifications and 
standards).
    \231\ See IAA Comment Letter 1.
    \232\ See ACLI Comment Letter.
---------------------------------------------------------------------------

    Eliminating the written contract requirement from the final 
amendments, while enhancing the policies and procedures obligation, 
strikes an appropriate balance between providing covered institutions 
with greater flexibility in achieving compliance with the requirements 
of this rule within the context of their service provider 
relationships, while also helping to ensure the investor protections 
afforded by the final amendments are maintained when covered 
institutions utilize service providers.
    In particular, as adopted, the enhanced policies and procedures 
obligations will enable covered institutions to identify and utilize 
the most appropriate means for their business of achieving compliance 
with the final amendments through policies and procedures reasonably 
designed to require oversight, including through due diligence and 
monitoring, of their service providers. Providing this flexibility will 
help address commenters' concerns about imposing a written contractual 
agreement for covered institutions, particularly those that are small 
entities, which may not have sufficient negotiating power or leverage 
to demand specific contractual provisions from a large third-party 
service provider. At the same time, the enhanced policies and 
procedures requirements will provide for effective safeguarding of 
customer information when it is received, maintained, processed, or 
otherwise accessed by a service provider, as well as timely notice to 
customers affected by a breach at a covered institution's service 
provider, by requiring that the policies and procedures be reasonably 
designed to: (1) require oversight, including through due diligence and 
monitoring, of service providers, including to ensure that the covered 
institution notifies affected individuals as required in paragraph 
(a)(4) and (2) ensure service providers take appropriate measures to 
protect against the unauthorized access to or use of customer 
information and provide covered institutions with timely notification 
of a breach so that the covered institution can carry out their 
incident response program.
    While the final amendments thus provide increased flexibility as to 
a covered institution's means of overseeing its service providers, the 
modification the Commission is making at adoption does not lower the 
standard of a covered institution's substantive oversight obligations. 
Some covered institutions may find that such oversight can be 
accomplished more easily and less expensively through less formal 
arrangements in certain circumstances, based on the covered 
institution's relationship with its service provider, as well as the 
scope of the services that are now or will be provided over the course 
of the relationship.\233\ However, regardless of the means and 
arrangements employed, the covered institution must ensure that any 
service provider it decides to utilize takes appropriate measures to 
(A) protect against unauthorized access to or use of customer 
information, and (B) provide breach notifications to the covered 
institution as required by these final amendments.
---------------------------------------------------------------------------

    \233\ Although a written contract is not required under the 
final amendments, covered institutions should generally consider 
whether a written contract that memorializes the expectations of 
both covered institutions and their service providers is 
appropriate.
---------------------------------------------------------------------------

    Further, while it may be helpful to a covered institution in 
achieving compliance with the final amendments to receive ``reasonable 
assurances'' from its service providers that they have taken 
appropriate measures to both protect customer information and provide 
timely notification to the covered institution in the event of a 
relevant breach of the service provider's customer information systems, 
reliance solely on such assurances may be insufficient depending on the 
facts and circumstances, for example when a covered institution knows, 
or has reason to know, that such assurance is inaccurate. Instead, the 
final rules require the establishment, maintenance, and enforcement of 
written policies and procedures reasonably designed to require 
oversight, including through due diligence and monitoring, of the 
service provider to ensure the covered institution will be able to 
satisfy the obligations of paragraph (a)(4). Further, covered 
institutions generally should consider reviewing and updating these 
policies and procedures periodically throughout their relationship with 
a service provider, including updates designed to address any 
information learned during the course of their monitoring.
    The final amendments provide covered institutions with flexibility 
in overseeing their service provider relationships, while helping to 
ensure the additional investor protections intended by these final 
amendments are

[[Page 47709]]

still achieved. Consistent with this risk-based approach, covered 
institutions may wish to consider employing such tools as independent 
certifications and attestations obtained from the service provider, as 
suggested by some commenters, as part of their policies and procedures 
to require oversight, including through due diligence and monitoring, 
of the service provider. However, the covered institution's written 
policies and procedures must be reasonably designed under the 
circumstances, and the covered institution's oversight of its service 
providers pursuant to those written policies and procedures generally 
should be tailored to the facts and circumstances of the two parties' 
relationship, which may or may not include the use of such tools.
    Further, as stated above, we are modifying the proposed rule to 
state that upon a covered institution's receipt of a service provider's 
notification, the covered institution must initiate its incident 
response program required by paragraph (a)(3) of the rule.\234\ The 
Commission is adopting this modification in response to comment 
requesting clarification of a covered institution's obligations upon 
receipt of service provider breach notifications.\235\ Further, this 
modification helps further align the final amendments with the intended 
purpose of the service provider's breach notifications, as discussed in 
the Proposing Release.\236\ While receipt of such notice automatically 
triggers the covered institution's obligation to initiate the 
procedures of its incident response program, such notice is not a 
necessary predicate to trigger this obligation for incidents occurring 
at the service provider. A covered institution also must initiate its 
incident response program where the covered institution has otherwise 
independently detected an incident of unauthorized access to or use of 
customer information at the service provider.\237\
---------------------------------------------------------------------------

    \234\ See final rule 248.30(a)(5)(i).
    \235\ See ACLI Comment Letter.
    \236\ This modification is consistent with the intended purpose 
of this notification, as discussed in the Proposing Release. See 
Proposing Release at Section II.A.3 stating that the purpose of 
breach notifications to be provided by service providers to a 
covered institution is ``to enable the covered institution to 
implement its incident response program expeditiously.''
    \237\ See final rule 248.30(a)(3). See also discussion on 
covered institutions' required Incident Response Program Including 
Customer Notification supra Section II.A.
---------------------------------------------------------------------------

    Finally, some commenters asked that we consider making any new 
obligations with respect to a written contract requirement forward-
looking so as not to disrupt contracts already in existence by 
requiring renegotiation, and that we should further extend the 
compliance date to address this.\238\ As we are adopting the rule 
without a written contract requirement, these comments have become 
moot.\239\
---------------------------------------------------------------------------

    \238\ See, e.g., Computershare Comment Letter; Google Comment 
Letter; ICI Comment Letter.
    \239\ See discussion of compliance date infra section II.F.
---------------------------------------------------------------------------

b. Deadline for Service Provider Notice to Covered Institutions and 
Notice Trigger
    As described above, the final amendments require that a covered 
institution's policies and procedures be reasonably designed to ensure 
service providers take appropriate measures to provide covered 
institutions with notice ``as soon as possible, but no later than 72 
hours after becoming aware of a breach in security has occurred 
resulting in unauthorized access to a customer information system 
maintained by the service provider.'' \240\ This modification extends 
the proposed timeframe for service providers to provide such notice to 
72 hours, but maintains the proposed notice triggering event to 
initiate this timeframe of the service provider becoming aware of a 
breach.'' \241\
---------------------------------------------------------------------------

    \240\ See final rule 248.30(a)(5)(i). In the proposed rule, such 
notice would have been required ``as soon as possible, but no later 
than 48 hours after becoming aware of a breach, in the event of any 
breach in security resulting in unauthorized access to a customer 
information system maintained by the service provider.'' See 
proposed rule 248.30(a)(5)(i).
    \241\ See Proposing Release at section II.A.3.
---------------------------------------------------------------------------

    Commenters addressed both the notification deadline and the 
triggering event for notifications to be provided by service providers 
to covered institutions in the event of a relevant breach involving 
unauthorized access to a customer information system maintained by the 
service provider. As to the notification deadline, one commenter 
supported requiring service providers to notify a covered institution 
within 48 hours of a breach impacting the covered institution or 
affected individuals, stating its understanding is that this is ``not 
an uncommon arrangement'' today between covered institutions and 
service providers maintaining their nonpublic personal information 
(e.g., between investment companies and transfer agents).\242\ Another 
commenter raised concerns that a standard of ``as soon as possible, but 
no later than 48 hours after becoming aware of a breach,'' when paired 
with a written contract requirement, might impose formidable challenges 
to covered institutions in mandating such contractual provisions with 
service providers who are not explicitly subject to Commission 
jurisdiction, and may have their own policies and procedures addressing 
breaches.\243\ Several commenters suggested the Commission adopt a 72-
hour notification deadline.\244\ In particular, one such commenter 
stated that this notification provision should be extended to ``as soon 
as possible but no later than 72 hours,'' to harmonize the Commission's 
standard with a number of related Federal, State, and international 
regulatory deadlines governing required service provider notification 
to financial institutions in the event of a cyber incident, and also 
further the White House's and Congress's express policy of harmonizing 
cyber incident reporting requirements.\245\ Finally, this commenter 
stated that a consistent 72-hour reporting deadline would promote more 
effective cybersecurity incident response and cyber threat information 
sharing than shorter, or varied reporting periods, and that a 48-hour 
deadline in the commenter's experience would lead to ``premature 
reporting'' that increases the likelihood of reporting inaccurate or 
incomplete information and tends to create confusion and 
uncertainty.\246\
---------------------------------------------------------------------------

    \242\ See ICI Comment Letter.
    \243\ See Computershare Comment Letter.
    \244\ See Letter from Microsoft Corporation (June 5, 2023) 
(``Microsoft Comment Letter''); AWS Comment Letter (this commenter 
``encourage[d] the Commission'' to consider a longer reporting 
deadline than 48 hours to ``support the dedication of resources 
needed to discover and mitigate potential harm caused by an 
incident,'' and highlighted the 72-hour reporting timeframe that 
``CIRCIA contemplates. . .for national critical infrastructure, 
including the financial services sector'' in the alternative.).
    \245\ See Microsoft Comment Letter (explaining that use of this 
72-hour reporting deadline would align the SEC's rules with other 
notification requirements that may apply to entities covered by the 
Proposed Rules, and identifying additional authorities that use the 
72-hour deadline, such as the CIRCIA, Pub. L. 117-103, 136 Stat. 49 
(2022); Executive Order 14028, ``Improving the Nation's 
Cybersecurity,'' 86 FR 26,633 (May 12, 2021), directing the Federal 
government to incorporate a 72-hour reporting period into the 
Federal Acquisition Regulation (``FAR''); the Defense Federal 
Acquisition Regulation Supplement (``DFARS''), 48 CFR 204.7302(b) 
and 252.204-7012(c); the New York State Department of Financial 
Services' (``NYDFS'') Cybersecurity Requirements for Financial 
Service Companies, 23 NYCRR section 500.17(a); the European Union's 
General Data Protection Regulation (``GDPR''), Regulation (EU) 2016/
679; and Article 23 of the EU's new Network and Information Security 
Directive (``NIS 2 Directive''), Directive (EU) 2022/2555).
    \246\ Id.
---------------------------------------------------------------------------

    In contrast, some commenters recommended modifying the proposal to 
remove any specified duration for a reporting deadline.\247\ Several

[[Page 47710]]

commenters suggested that rather than an inflexible time deadline, the 
Commission should require that notification be provided without 
unreasonable delay after a reasonable investigation has been performed 
by the service provider.\248\ Another commenter stated that rather than 
mandating any form of a deadline, the time period should be left to 
covered institutions and service providers to negotiate, accounting for 
the nature of services and customer data.\249\
---------------------------------------------------------------------------

    \247\ See, e.g., Schulte Comment Letter; SIFMA Comment Letter 2.
    \248\ See, e.g., SIFMA Comment Letter 2 (stating this 
modification would harmonize with the Proposed Interagency Guidance 
on Third-Party Relationships: Risk Management, 86 FR 38182, 38184 
(proposed July 19, 2021)); ACLI Comment Letter (stating this 
modification would harmonize service provider and covered entity 
requirements); and Federated Comment Letter.
    \249\ See Schulte Comment Letter. This commenter stated that by 
mandating a 48-hour limit, service providers would be ``left with 
the impractical challenge of allocating resources to making 
disclosures to counterparties (i) when resources could be better 
allocated to identifying and containing the scope of the data 
breach, and (ii) before the service provider has a complete picture 
of the impact of a data breach.'' See id.
---------------------------------------------------------------------------

    As to the triggering event requiring service providers to notify 
covered institutions of a relevant breach, one commenter urged the 
Commission to shift from the service provider ``becoming aware'' of a 
breach that entailed unauthorized access to customer information, to 
the service provider ``determining'' that such a breach had 
occurred.\250\ This commenter asserted that the process of ``becoming 
aware'' will involve time and resources to investigate and that 
changing to a ``determining'' standard may minimize pressure on the 
service provider to report prior to performing sufficient 
investigation, while helping harmonize regulatory approaches across the 
financial sector, as it would align with similar requirements adopted 
by Federal banking agencies related to notice provided by bank service 
providers.\251\ Another commenter stated the Commission should, in 
addition to shifting to a 72-hour reporting deadline, amend the trigger 
initiating this reporting deadline to the moment the service provider 
``has a reasonable basis to conclude that a notifiable incident has 
occurred or is occurring.'' \252\
---------------------------------------------------------------------------

    \250\ See Google Comment Letter.
    \251\ See Google Comment Letter (referencing Computer-Security 
Incident Notification Requirements for Banking Organizations and 
Their Bank Service Providers, available at: fdic.gov/news/board-matters/2021/2021-11-17-notational-fr.pdf?source=govdelivery&utm_medium=email&utm_source=govdelivery).
    \252\ See Microsoft Comment Letter.
---------------------------------------------------------------------------

    Other commenters suggested narrowing the scope of incidents that 
would trigger required notice by service providers to a covered 
institution.\253\ One commenter asserted that incident response program 
requirements should only address and be triggered by incidents that 
involve unauthorized access to or use of a subset of customer 
information (e.g., sensitive customer information).\254\ Another 
commenter stated that the proposal would result in notices to a covered 
institution if there has been unauthorized access to the service 
provider's customer information system, regardless of whether the 
covered institution's customers were in any way affected by the 
breach.\255\ Instead, the commenter stated that the Commission should 
limit the scope of incidents requiring notification to a covered 
institution to only those resulting in unauthorized access to that 
covered institution's ``customer information'' maintained by the 
service provider.\256\
---------------------------------------------------------------------------

    \253\ See Schulte Comment Letter; SIFMA Comment Letter 2.
    \254\ See Schulte Comment Letter.
    \255\ See SIFMA Comment Letter 2.
    \256\ See id.
---------------------------------------------------------------------------

    After consideration, the Commission is extending the deadline for 
providing notification from 48 to 72 hours. Although we appreciate that 
the 48-hour standard in the proposed amendments may not be an uncommon 
arrangement between covered institutions and their service providers in 
the market today, extending this deadline by 24 hours will provide 
service providers with additional time to conduct more effective 
investigations of a breach at the service provider, resulting in more 
relevant and accurate notifications to the covered institution. 
Further, the 72-hour standard brings this notification deadline in 
alignment with other existing regulatory standards, which should reduce 
costs to service providers and covered institutions without sacrificing 
the investor protection benefits of the rule.\257\
---------------------------------------------------------------------------

    \257\ As discussed above, a 72-hour reporting deadline aligns 
with, among others, requirements in CIRCIA that include a 72-hour 
deadline for entities to report cyber incidents to CISA, Executive 
Order 14028 on ``Improving the Nation's Cybersecurity,'' which 
directs the Federal government to incorporate a 72-hour reporting 
period into the FAR, the DFARS, NYDFS's cybersecurity regulations, 
which include a 72-hour reporting deadline to NYDFS after any 
determination that a cybersecurity incident has occurred at the 
covered entity, its affiliates, or a third-party service provider, 
the European Union's GDPR, as well as the European Union's NIS 2 
Directive. See discussion of Microsoft Comment Letter and cited 
regulatory frameworks supra footnote 245.
---------------------------------------------------------------------------

    The Commission disagrees that there should be no specified 
notification deadline and that covered institutions and service 
providers should be able to negotiate the appropriate timing for such 
notification. As discussed above, upon receipt of the breach 
notification from the service provider, a covered institution must 
initiate its incident response program adopted pursuant to paragraph 
(a)(3) of the final amendments.\258\ As covered institutions cannot 
reasonably be expected to initiate their incident response programs for 
incidents occurring at a service provider that the covered institution 
is not yet aware have occurred, providing the indefinite timeline 
commenters suggest could significantly hinder the effectiveness of 
covered institutions' incident response programs.\259\ For example, 
delays in the service provider's notification to the covered 
institution of a breach could result in further delays in the 
initiation of the incident containment and control procedures the 
covered institution has adopted pursuant to its incident response 
program obligations, consequently diminishing their effectiveness. 
Further, any excess delay in the service provider's notification to the 
covered institution and resulting delay in the covered institution's 
initiation of its incident response program, could significantly hinder 
the goal of the final amendments of providing customers with timely 
notification of data breaches so that they may take remedial action. In 
light of this, reasonably designed policies and procedures generally 
should also account for instances where the covered institution 
determines that a service provider has failed to provide notice to the 
covered institution within 72 hours as required. In such circumstances, 
in addition to initiating its incident response program upon receipt of 
the notice as required, a covered institution generally should 
reevaluate its policies and procedures governing its relationship with 
the service provider and make adjustments as necessary to ensure the 
service provider will take the required appropriate measures going 
forward.
---------------------------------------------------------------------------

    \258\ See supra footnote 237 and accompanying discussion.
    \259\ While a covered institution's receipt of such notice from 
a service provider establishes such awareness, as discussed above, 
where a covered institution has otherwise independently detected an 
incident of the unauthorized access to or use of customer 
information at the service provider, it must implement its incident 
response program under paragraph (a)(3) of the final amendments 
regardless of any notice provided by the service provider. See supra 
footnote 237 and accompanying discussion. See also final rule 
248.30(a)(3).
---------------------------------------------------------------------------

    Further, the Commission is adopting as proposed the ``becoming 
aware of'' standard for triggering a service provider's breach 
notifications to a covered institution. This standard is

[[Page 47711]]

intended to enable the covered institution to implement its incident 
response program expeditiously. While the Commission believes it is 
appropriate, as discussed above, to extend the timeframe for service 
provider notifications from 48 to 72 hours, adopting either a ``having 
a reasonable basis to conclude'' standard or a ``determining'' standard 
could frustrate the investor protection goals of these final 
amendments. Specifically, adopting either of these alternative 
standards could result in undue delays in a service provider's 
notification to the covered institution beyond the point at which the 
service provider is already aware that a relevant breach has occurred. 
Such a delay would frustrate the goal of both enabling covered 
institutions to initiate their incident response program expeditiously, 
as well as the goal of providing timely notification to affected 
individuals. For similar reasons, given that the ``determining'' 
standard used by Federal banking regulators involves a different 
context--notice to the banking organization of downgraded or degraded 
services--adopting it here solely to harmonize regulatory approaches 
would be inappropriate.\260\ Accordingly, the final amendments maintain 
the proposed ``becoming aware of'' standard for triggering a service 
provider's notification.
---------------------------------------------------------------------------

    \260\ Specifically, the Federal banking agency regulations 
require notification from the bank service provider to ``each 
affected banking organization customer as soon as possible when the 
bank service provider determines that it has experienced a computer-
security incident that has materially disrupted or degraded, or is 
reasonably likely to materially disrupt or degrade, covered services 
provided to the banking organization for four or more hours.'' See 
12 CFR 304.24(a).
---------------------------------------------------------------------------

    The Commission also is not limiting the scope of incidents to be 
reported to covered institutions to only those involving ``sensitive 
customer information'' or alternatively to breaches that result in 
unauthorized access to ``customer information'' maintained by the 
service provider rather than those that result in unauthorized access 
to a service provider's ``customer information system.'' Under the 
final amendments, a covered institution's incident response program 
must be reasonably designed to ``detect, respond to, and recover from 
unauthorized access to or use of customer information,'' and must 
include provisions to assess such incidents to ``identify the customer 
information systems and types of customer information that may have 
been accessed or used without authorization'' and take appropriate 
steps to ``contain and control the incident to prevent further 
unauthorized access to or use of customer information.'' \261\ As 
discussed above, in doing so, we are requiring that covered 
institutions' incident response programs address any incident involving 
customer information--not merely those involving sensitive customer 
information--and also account for the identification of affected 
customer information systems in addition to the types of customer 
information that may have been accessed or used without 
authorization.\262\ For the same reasons, we are not limiting the scope 
of reportable incidents to only those breaches in security at the 
service provider that result in unauthorized access to sensitive 
customer information, or alternatively to only those breaches that 
result in unauthorized access to ``customer information'' maintained by 
the service provider.
---------------------------------------------------------------------------

    \261\ See final rule 248.30(a)(3)(i) and (ii). See also 
discussion of the Assessment and Containment and Control portions of 
covered institutions' incident response program requirements supra 
sections II.A.1 and II.A.2.
    \262\ See discussion of incident response program Assessment and 
Containment and Control requirements, and the reasons for not 
restricting such requirements to only ``sensitive customer 
information'' supra Sections II.A.1 and II.A.2. See also discussion 
of incident response program Containment and Control requirements 
and the reasons for requiring identification of both the customer 
information systems as well as types of customer information that 
may have been accessed or used without authorization supra Section 
II.A.2.
---------------------------------------------------------------------------

c. Delegation of Notice and Covered Institutions' Customer Notification 
Obligations
    The Commission is adopting as proposed language that permits 
covered institutions, as part of their incident response programs, to 
enter into a written agreement with their service providers to notify 
affected individuals on the covered institution's behalf.\263\ However, 
the Commission is also adopting a new paragraph that states that, 
notwithstanding any covered institution's use of a service provider, 
the covered institution's obligation to ensure that affected 
individuals are notified in accordance with this rule rests with the 
covered institution.\264\
---------------------------------------------------------------------------

    \263\ See final rule 248.30(a)(5)(ii) (stating ``As part of its 
incident response program, a covered institution may enter into a 
written agreement with its service provider to notify affected 
individuals on its behalf in accordance with paragraph (a)(4) of 
this section.''); see also proposed rule 248.30(b)(5)(ii).
    \264\ See final rule 248.30(a)(5)(iii).
---------------------------------------------------------------------------

    One commenter stated that it is appropriate to permit a covered 
institution to enter into a written agreement with its service provider 
to notify affected individuals on the covered institution's behalf, so 
long as the notification is actually ultimately provided to customers 
in a manner that satisfies the covered institution's notice 
obligations.\265\ The Commission agrees that there may be situations 
where a covered institution's service provider is better situated than 
the covered institution to provide a customer a breach notification. 
Thus, the Commission is adopting paragraph (a)(5)(ii) as proposed.\266\
---------------------------------------------------------------------------

    \265\ See Schulte Comment Letter (stating that if the service 
provider was the victim of a cyber-attack that included unauthorized 
access to the covered institution's sensitive customer information, 
the service provider would be better situated to notify the affected 
customers).
    \266\ As discussed below infra footnote 391 and in the 
accompanying discussion, in accordance with the recordkeeping 
provisions adopted in these final amendments, covered institutions, 
other than funding portals, are required to preserve a copy of any 
notice transmitted by the service provider to any customer on the 
covered institution's behalf following the covered institution's 
determination made regarding whether notification is required 
pursuant to 17 CFR 248.30(a)(4). See also discussion of funding 
portal recordkeeping requirements infra footnote 385.
---------------------------------------------------------------------------

    At the same time, the Commission is adopting a new paragraph 
(a)(5)(iii) to specify that even where a covered institution uses a 
service provider, the obligation to ensure that affected individuals 
are notified in accordance with the rule rests with the covered 
institution.\267\ While the proposing release included similar 
language,\268\ the final rule explicitly provides that the covered 
institution will be obligated to satisfy the customer notification 
requirements of paragraph (a)(4) in the event of a relevant breach 
occurring at the service provider. The Commission

[[Page 47712]]

agrees that in providing flexibility to covered institutions by 
permitting them to enter into a written agreement with their service 
providers to notify affected individuals on the covered institution's 
behalf, such notification to customers should be provided in a manner 
that satisfies the covered institution's notice obligations. 
Accordingly, where a covered institution has entered into a written 
agreement with its service provider to provide notice on the covered 
institution's behalf, the covered institution must ensure that the 
service provider has satisfied the customer notification 
obligations.\269\ To accomplish this, the covered institution's 
policies and procedures should consider including steps for conducting 
reasonable due diligence to confirm that the service provider has 
provided notice to affected customers. In addition to maintaining a 
copy of any notice transmitted to affected individuals by the service 
provider on the covered institution's behalf as required by the covered 
institution's (other than funding portals) recordkeeping obligations 
under the final amendments,\270\ effective due diligence might also 
include obtaining confirmation of delivery of such notification in the 
form of attestations or certifications made by the service provider. 
Covered institutions could also consider confirming with a sample of 
affected customers that they received such service provider 
notifications.
---------------------------------------------------------------------------

    \267\ See final rule 248.30(a)(5)(iii) (specifically stating 
``Notwithstanding a covered institution's use of a service provider 
in accordance with paragraphs (a)(5)(i) and (ii), the obligation to 
ensure that affected individuals are notified in accordance with 
paragraph (a)(4) of this section rests with the covered 
institution'').
    \268\ In the proposal, the Commission stated that in such a 
circumstance where the covered institution has delegated performance 
of its notice obligation to a service provider through written 
agreement, the covered institution would remain responsible for any 
failure to provide a notice as required by the proposed rule. See 
Proposing Release at II.A.3. The Commission also stated in the 
proposal that covered institutions may delegate other functions to 
service providers, such as reasonable investigation to determine 
whether sensitive customer information has not been and is not 
reasonably likely to be, used in a manner that would result in 
substantial harm or inconvenience, but covered institutions would 
remain responsible for these functions even if they are delegated to 
service providers. See id. at footnote 93; see also discussion of 
paragraph (a)(4) customer notification obligations supra section 
II.A.3. Under new paragraph (a)(5)(iii), covered institutions may 
still delegate such functions to service providers as stated in the 
proposal, but the rule text expressly states that the ultimate 
obligation to ensure affected individuals are notified in accordance 
with paragraph (a)(4) will remain with the covered institution.
    \269\ See final rule 248.30(a)(5)(iii); see also final rule 
248.30(a)(4) (enumerating the scope of the covered institution's 
customer notification obligations).
    \270\ See, e.g. final rule 17 CFR 240.17a-4(e)(14)(iii). See 
also discussion on a covered institution's recordkeeping obligations 
as to notices delivered to customers by its service providers infra 
footnote 391 and accompanying discussion. Funding portals generally 
should maintain all copies of such notices in connection with their 
own requirements to demonstrate compliance with Regulation S-P. See 
discussion of existing funding portal recordkeeping obligations 
infra footnote 385.
---------------------------------------------------------------------------

    In addition, where the covered institution has entered into a 
written agreement with its service provider to provide notice on the 
covered institution's behalf pursuant to paragraph (a)(5)(ii), and the 
covered institution determines that the service provider has not 
provided such notifications in a manner that satisfies the conditions 
of paragraph (a)(4), the covered institution must still ensure that 
notification is provided to the customer, and the covered institution's 
policies and procedures generally should be designed to address these 
instances. To accomplish this, the covered institution generally should 
conduct timely due diligence to identify any lack of notification by 
the service provider to the customer and remedy the matter in advance 
of the deadline set out in paragraph (a)(4).
d. Service Provider Definition
    The Commission is adopting the definition of ``service provider'' 
to mean ``any person or entity that receives, maintains, processes, or 
otherwise is permitted access to customer information through its 
provision of services directly to a covered institution.'' \271\ This 
definition thereby includes affiliates of covered institutions if they 
are permitted access to this information through their provision of 
services. The scope of this definition is intended to help protect 
against the risk of harm that may arise from service providers' access 
to a covered institution's customer information and customer 
information systems.\272\
---------------------------------------------------------------------------

    \271\ See final rule 248.30(d)(10); see also proposed rule 
248.30(e)(10).
    \272\ For example, in 2015, Division of Examinations staff 
released observations following the examinations of some 
institutions' cybersecurity policies and procedures relating to 
vendors and other business partners, which revealed mixed results 
with respect to whether the firms had incorporated requirements 
related to cybersecurity risk into their contracts with vendors and 
business partners. See EXAMS, Cybersecurity Examination Sweep 
Summary, National Exam Program Risk Alert, Volume IV, Issue 4 (Feb. 
3, 2015), at 4, available at https://www.sec.gov/about/offices/ocie/cybersecurity-examination-sweep-summary.pdf.
---------------------------------------------------------------------------

    A number of commenters addressed the scope of the proposed 
definition. Several commenters suggested narrowing the scope of the 
service provider definition by revising it to exclude affiliates or 
other GLBA regulated entities.\273\ Similarly, three commenters 
asserted that the Commission should revise the definition to exclude 
affiliates and other entities under common control with the covered 
institution, as those affiliates are typically subject to the same 
cybersecurity and privacy programs, including service provider 
management, which are frequently structured and operate on a group-wide 
basis.\274\ One of these commenters also stated the Commission should 
also exclude entities subject to the GLBA that have direct contractual 
relationships with the client.\275\ This commenter separately asserted 
that the service provider definition should be narrowed to only cover 
those persons or entities that are a third party and receive, maintain, 
process, or otherwise are permitted access to sensitive customer 
information, so that covered institutions can prioritize ``higher-risk 
service providers'' and not expend resources unnecessarily on an overly 
broad set of service providers.\276\ Finally, one commenter requested 
that the Commission ``clarify the scope of the service provider 
definition, including whether service providers would include financial 
counterparties such as brokers, clearing and settlement firms, and 
custodial banks.'' \277\
---------------------------------------------------------------------------

    \273\ See, e.g., CAI Comment Letter; IAA Comment Letter 1; SIFMA 
Comment Letter 2; and Schulte Comment Letter.
    \274\ See CAI Comment Letter; IAA Comment Letter 1, SIFMA 
Comment Letter 2.
    \275\ See IAA Comment Letter 1.
    \276\ See id.
    \277\ See SIFMA Comment Letter 2.
---------------------------------------------------------------------------

    As stated above, we are modifying the definition of service 
provider from the proposal to remove reference to third parties in 
response to commenters to incorporate into rule text the Commission's 
intended scope of the ``service provider' definition, as discussed in 
the Proposing Release.\278\ It would not be appropriate to narrow the 
definition to exclude affiliates or non-affiliates that are also 
subject to the GLBA, as commenters have suggested. While a covered 
institution's affiliates may collectively operate under the same 
cybersecurity and privacy programs, such uniformity in approach does 
not diminish the risk of harm to the institution's customers in the 
event of a cyber incident involving unauthorized access to or use of 
customer information at the affiliate.\279\ This risk is similarly not 
diminished where a cyber incident involving unauthorized access to or 
use of customer information occurs at a covered institution's 
unaffiliated service provider that is subject to the GLBA, even where 
the service provider has a direct contractual relationship with the 
client. In such instances, maintaining such an entity's inclusion 
within the service provider definition will help ensure that the 
covered institution is made aware of cyber incidents that occur at the 
service provider to aid in both the covered institution's oversight of 
its service providers, as well as satisfaction of its customer 
notification and broader customer information safeguarding obligations 
under the final

[[Page 47713]]

amendments. It is thus important for the service provider definition to 
remain sufficiently broad to address these risks by setting out clear 
obligations for all parties possessing legitimate access to customer 
information regarding both the safeguarding of that information, and, 
where necessary, ensuring notification to the affected customers in the 
event of a breach involving unauthorized access to or use of customer 
information. However, while we are not narrowing the scope of the 
``service provider'' definition to exclude either affiliates of the 
covered institution or unaffiliated service providers that are 
independently subject to the GLBA, pursuant to paragraph (a)(5)(ii) of 
these final amendments the covered institution and a service provider 
may enter into a written agreement for the service provider to notify 
affected individuals on its behalf in in the event of a breach at the 
service provider, as discussed above.\280\
---------------------------------------------------------------------------

    \278\ See Proposing Release at Section II.A.3, stating ``This 
definition would include affiliates of covered institutions if they 
are permitted access to this information through their provision of 
services.''
    \279\ While we are not narrowing the service provider definition 
to exclude affiliates of the covered institution, in most instances 
it generally should be appropriate for the covered institution to 
rely upon the adherence of any affiliated service provider to 
enterprise-wide cybersecurity and privacy programs that cover both 
the covered institution and its affiliates, so long as such programs 
satisfy the requirements of the final rules and the covered 
institution does not know, or have reason to know, that the 
affiliate is not adhering to such enterprise-wide programs.
    \280\ See discussion on Delegation of Notice and Covered 
Institutions' Customer Notification Obligations supra Section 
II.A.4.c. See also 17 CFR 248.30(a)(5)(ii). The permissibility of 
such written agreements between covered institutions and their 
service providers, including both their affiliates and those 
unaffiliated service providers that are also subject to the GLBA, 
may also help reduce costs related to customer notifications at the 
covered institution, and help reduce the risk of over-notification 
of affected individuals in instances where both the covered 
institution and its affiliated service provider are independently 
subject to customer notification obligations for the same breach in 
security.
---------------------------------------------------------------------------

    Further, it would not be appropriate to narrow the service provider 
definition to only address those persons or entities that operate as 
``higher-risk service providers'' that receive, maintain, process, or 
are otherwise permitted access to sensitive customer information, as 
one commenter suggested. As discussed above, the scope of information 
covered by the assessment and containment and control requirements of 
the final amendments is designed to help ensure all information covered 
by the requirements in the GLBA is appropriately safeguarded, and that 
sufficient information is assessed to fulfill the more narrowly 
tailored obligation to notify affected individuals.\281\ Specifically, 
consistent with the GLBA, the final amendments are tailored to require 
that a covered institution's written policies and procedures must be 
reasonably designed to protect against unauthorized access to or use of 
customer information that could result in substantial harm or 
inconvenience to any customer, not merely all sensitive customer 
information.\282\ Narrowing the service provider definition in a manner 
that would fail to cover the full scope of information that the GLBA 
requires to be covered in a covered institution's safeguarding policies 
and procedures, as would result from commenters' suggestion, would be 
inappropriate.\283\ Further, we are also concerned that limiting the 
service provider definition to only address those persons or entities 
that receive, maintain, process, or are otherwise permitted access to 
sensitive customer information, as commenters suggest, would result in 
insufficient notification to covered institutions in the event of a 
breach at a service provider. The purpose of this service provider 
notification is to enable the covered institution to begin carrying out 
its response program, which requires an assessment of the nature and 
scope of any incident involving unauthorized access to or use of 
customer information, not merely those involving sensitive customer 
information.\284\ For these reasons, the Commission is adopting the 
service provider definition as modified.
---------------------------------------------------------------------------

    \281\ See discussion on Incident Response Program Including 
Customer Notification supra Section II.A.
    \282\ See 17 CFR 248.30(a)(2)(iii). See also 15 U.S.C. 
6801(b)(3) (mandating that the Commission shall establish 
appropriate standards for the financial institutions subject to its 
jurisdiction relating to administrative, technical, and physical 
safeguards ``to protect against unauthorized access to or use of 
such records or information which could result in substantial harm 
or inconvenience to any customer.'').
    \283\ As discussed below, the definition of ``customer 
information'' we are adopting in these final amendments is intended 
to ensure that the standard for covered institutions' safeguards 
rule policies and procedures is consistent with the objectives of 
the GLBA, which focuses on protecting ``nonpublic personal 
information'' of those who are ``customers'' of financial 
institutions. See discussion on the Definition of Customer 
Information infra Section II.B.1. See also 17 CFR 248.30(d)(5) 
(defining ``customer information''). In contrast, the definition of 
``sensitive customer information'' that we are adopting is more 
narrowly tailored to only cover any component of customer 
information alone or in conjunction with any other information, the 
compromise of which could create a reasonably likely risk of 
substantial harm or inconvenience to an individual identified with 
the information. See 17 CFR 248.30(d)(9)(i). As discussed above, 
this definition is more narrowly tailored, and has been specifically 
calibrated to include types of information that, if exposed, could 
put affected individuals at a higher risk of suffering substantial 
harm or inconvenience through, for example, fraud or identity theft 
enabled by the unauthorized access to or use of the information. See 
discussion on the Definition of ``Sensitive Customer Information'' 
supra Section II.A.3.b. The narrower tailoring than is used in the 
``customer notification'' definition is intended to protect 
customers by ensuring that they can take the necessary steps to 
minimize their exposure to these risks, while also being mindful of 
concerns of how a broader definition could increase the potential 
for over-notification of customers to address such risks. See id.
    \284\ See final rule 248.30(b)(i). See also discussion on the 
assessment required by paragraph (a)(3) as to a covered 
institution's incident response program supra section II.A.1 above.
---------------------------------------------------------------------------

    The Commission also acknowledges the request to clarify the scope 
of what is included within the service provider definition, including 
``whether service providers would include financial counterparties such 
as brokers, clearing and settlement firms, and custodial banks.'' In 
alignment with the service provider definition we are adopting, covered 
institutions should make this determination based on the facts and 
circumstances about the substance of the relationship with the covered 
institution, rather than the form of the entity in question. Where 
financial counterparties receive, maintain, or otherwise are permitted 
access to customer information through the provision of services 
directly to the covered institution, they meet the service provider 
definition as adopted.

B. Scope of Safeguards Rule and Disposal Rule

1. Scope of Information Protected
    We are adopting amendments to rule 248.30 that define the scope of 
information covered by the safeguards and disposal rules. These 
amendments will broaden and more closely align the scope of both rules 
by applying them to the information of not only a covered institution's 
own customers, but also the customers of other financial institutions 
that has been provided to the covered institution.\285\ These 
amendments further specify that the rules also apply to customer 
information handled or maintained on behalf of the covered 
institution.\286\ We are adopting these changes substantively as 
proposed, with changes to the structure of the rule in response to 
comments as discussed in more detail below.
---------------------------------------------------------------------------

    \285\ Final rule 248.30(a), (b), and (d)(5)(i). Regulation S-P 
defines ``financial institution'' generally to mean any institution 
the business of which is engaging in activities that are financial 
in nature or incidental to such financial activities as described in 
section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 
1843(k)). 17 CFR 248.3(n).
    \286\ Final rule 248.30(d)(5)(i).
---------------------------------------------------------------------------

    Specifically, the amendments:
     Adopt a new definition of ``customer information'' 
defining the scope of information covered by both the safeguards and 
disposal rules. These amendments provide greater specificity regarding 
what constitutes customer information that must be protected under the 
safeguards rule. They also expand the scope of the disposal rule, which 
currently applies only to consumer information (defined as ``consumer 
report information'' in the

[[Page 47714]]

current rule) so that it applies to both customer and consumer 
information.
     Provide that customer information protected under both the 
safeguards and disposal rules includes both customer information in the 
possession of a covered institution as well as customer information 
handled or maintained on its behalf.
     Provide that both customer and consumer information 
include information that pertains to individuals with whom the covered 
institution has a customer relationship, as well as to the customers of 
other financial institutions where such information has been provided 
to the covered institution. We are adopting this expansion as proposed 
but, as discussed below, have reorganized the rule provisions 
effectuating the change in response to comments.
Definition of Customer Information
    Currently, Regulation S-P's protections under the safeguards rule 
and disposal rule apply to different, and at times overlapping, sets of 
information.\287\ Specifically, as required under the GLBA, the 
safeguards rule currently requires broker-dealers, investment 
companies, and registered investment advisers (but not transfer agents) 
to maintain written policies and procedures to protect ``customer 
records and information,'' \288\ which is not defined in the GLBA or in 
Regulation S-P. The disposal rule requires every covered institution 
properly to dispose of ``consumer report information,'' a different 
term, which Regulation S-P defines consistently with the FACT Act 
provisions.\289\
---------------------------------------------------------------------------

    \287\ See Disposal of Consumer Report Information, Investment 
Company Act Release No. 26685 (Dec. 2, 2004) [69 FR 71322 (Dec. 8, 
2004)], at n.13 (``Disposal Rule Adopting Release'').
    \288\ See 17 CFR 248.30; 15 U.S.C. 6801(b)(1).
    \289\ See 17 CFR 248.30(b)(2). Section 628(a)(1) of the FCRA 
directed the Commission to adopt rules requiring the proper disposal 
of ``consumer information, or any compilation of consumer 
information, derived from consumer reports for a business purpose.'' 
15 U.S.C. 1681w(a)(1). Regulation S-P currently uses the term 
``consumer report information,'' defined to mean a record in any 
form about an individual ``that is a consumer report or is derived 
from a consumer report.'' 17 CFR 248.30(b)(1)(ii). ``Consumer 
report'' had the same meaning as in section 603(d) of the Fair 
Credit Reporting Act (15 U.S.C. 1681(d)). 17 CFR 248.30(b)(1)(i). We 
are amending the term ``consumer report information'' currently in 
Regulation S-P to ``consumer information'' (without changing the 
definition) to conform to the term used by other Federal financial 
regulators in their guidance and rules. See, e.g., 16 CFR 682.1(b) 
(FTC); 17 CFR 162.2(g) (CFTC); OCC Information Security Guidance at 
I.C.2.b; FRB Information Security Guidance'') at I.C.2.b; FDIC 
Information Security Guidance at I.C.2.b.
---------------------------------------------------------------------------

    To align more closely the information protected by both rules, as 
proposed, we are amending rule 248.30 by replacing the term ``customer 
records and information'' in the safeguards rule with a newly defined 
term ``customer information'' and by adding customer information to the 
coverage of the disposal rule. For covered institutions other than 
transfer agents, the term ``customer information'' will mean, as 
proposed, ``any record containing nonpublic personal information as 
defined in section 248.3(t) about a customer of a financial 
institution, whether in paper, electronic, or other form.'' \290\
---------------------------------------------------------------------------

    \290\ As discussed below, the customer information definition 
also specifies that the definition covers information in the 
possession of a covered institution or that is handled or maintained 
by the covered institution or on its behalf, regardless of whether 
such information pertains to individuals with whom the covered 
institution has a customer relationship or the customers of other 
financial institutions where such information has been provided to 
the covered institution. This is being adopted substantively as 
proposed, but reflects structural modifications to the rule text to 
address the concerns of a commenter who asked for increased clarity. 
See infra section II.B.2 for a discussion of the term customer 
information with respect to transfer agents.
---------------------------------------------------------------------------

    Commenters did not object to the proposed definition of ``customer 
information.'' As discussed in the Proposing Release, the customer 
information definition in the coverage of the safeguards rule is 
intended to be consistent with the objectives of the GLBA, which 
focuses on protecting ``nonpublic personal information'' of those who 
are ``customers'' of financial institutions.\291\ The customer 
information definition is also based on the definition of ``customer 
information'' in the safeguards rule adopted by the FTC.\292\
---------------------------------------------------------------------------

    \291\ See 15 U.S.C. 6801(a).
    \292\ See 16 CFR 314.2(d) (The FTC safeguards rule defining 
``customer information'' to mean ``any record containing nonpublic 
personal information, as defined in 16 CFR 313.3(n) about a customer 
of a financial institution, whether in paper, electronic, or other 
form, that is handled or maintained by or on behalf of you or your 
affiliates''). The final amendments do not require covered 
institutions to be responsible for their affiliates' policies and 
procedures for safeguarding customer information because covered 
institutions affiliates generally are financial institutions subject 
to the safeguards rules of other Federal financial regulators.
---------------------------------------------------------------------------

    Additionally, adding customer information to the coverage of the 
disposal rule is also consistent with the objectives of the GLBA. Under 
the GLBA, an institution has a ``continuing obligation'' to protect the 
security and confidentiality of customers' nonpublic personal 
information.\293\ The final amendments specify that this obligation 
continues through disposal of customer information. The final 
amendments also are consistent with the objectives of the FACT Act, 
which focuses on protecting ``consumer information,'' a category of 
information that will remain within the scope of the disposal 
rule.\294\ Adding customer information to the disposal provisions will 
simplify compliance with the FACT Act by eliminating a covered 
institution's need to determine whether its customer information is 
also consumer information subject to the disposal rule. Covered 
institutions should also be less likely to fail to dispose of consumer 
information properly by misidentifying it as customer information only. 
In addition, including customer information in the coverage of the 
disposal rule would conform the rule more closely to the Banking 
Agencies' Safeguards Guidance.\295\ Commenters did not address the 
expansion of the disposal rule to cover customer information.
---------------------------------------------------------------------------

    \293\ See 15 U.S.C. 6801(a).
    \294\ See 15 U.S.C. 1681w(a)(1); proposed rule 248.30(c)(1). 
``Consumer information'' is not included within the scope of the 
safeguards rule, except to the extent it overlaps with any 
``customer information,'' because the safeguards rule is adopted 
pursuant to the GLBA and therefore is limited to information about 
``customers.''
    \295\ See, e.g., OCC Information Security Guidance (OCC 
guidelines providing that national banks and Federal savings 
associations' must develop, implement, and maintain appropriate 
measures to properly dispose of customer information and consumer 
information.''); FRB Information Security Guidance (similar Federal 
Reserve Board provisions for State member banks). See also 15 U.S.C. 
6804(a) (directing the agencies authorized to prescribe regulations 
under title V of the GLBA to assure to the extent possible that 
their regulations are consistent and comparable); 15 U.S.C. 
1681w(2)(B) (directing the agencies with enforcement authority set 
forth in 15 U.S.C. 1681s to consult and coordinate so that, to the 
extent possible, their regulations are consistent and comparable).
---------------------------------------------------------------------------

    One commenter sought clarification regarding the proposal's 
coverage of customer information handled or maintained on behalf of a 
covered institution. This commenter stated that proposed paragraph (a) 
of rule 248.30, which set out the scope of information collectively 
covered under the safeguards and disposal rules, could be interpreted 
to limit the application of the rules to customer information in the 
possession of the covered institution, while proposed paragraph (e)(5) 
defined customer information to include information that is handled or 
maintained on behalf of the covered institution. The proposal included 
both customer information in the possession of a covered institution as 
well as customer information handled or maintained on its behalf in 
both the safeguards and disposal rules. This is because rule 248.30 
provided the rules applied to ``customer information'' and, as the 
commenter observed, the proposal defined customer information to 
include ``any record containing

[[Page 47715]]

nonpublic personal information as defined in Sec.  248.3(t) about a 
customer of a financial institution, whether in paper, electronic or 
other form, that is handled or maintained by the covered institution or 
on its behalf.'' Applying these rules to information handled or 
maintained on behalf of a covered institution is necessary so that the 
incident response program applies to information about a covered 
institution's customers that is handled or maintained by a service 
provider on the covered institution's behalf and to require that such 
information is disposed of properly.
    In response to this comment, we have removed the dedicated scope 
paragraph (a) from the proposed rule and moved all the requirements for 
customer information and consumer information into the definitions of 
those terms, now in renumbered paragraphs (d)(5)(1) and (d)(1) 
respectively. Accordingly, and substantively as proposed, the 
definition of consumer information covers information that a covered 
institution maintains or otherwise possesses for a business purpose, 
and the customer information definition covers information in the 
possession of a covered institution or that is handled or maintained by 
the covered institution or on its behalf.\296\ These structural changes 
do not change the scope of the proposed rule, but rather consolidate in 
each definition the scope of covered information as opposed to 
referring to information possessed by a covered institution in one 
paragraph of the rule and referring to information handled on its 
behalf in another.
---------------------------------------------------------------------------

    \296\ We also eliminated language in paragraph (b)(1) that now 
appears in the final amendments' definitions of customer information 
and consumer information.
---------------------------------------------------------------------------

Safeguards Rule and Disposal Rule Coverage of Customer Information
    We also are adopting the requirement, substantively as proposed, 
that both the safeguards rule and the disposal rule apply to the 
information specified in those definitions regardless of whether such 
information pertains to (a) individuals with whom the covered 
institution has a customer relationship or (b) the customers of other 
financial institutions where such information has been provided to the 
covered institution.\297\ As discussed above, however, we are 
structurally reflecting this requirement in the definitions of customer 
information and consumer information, rather than in proposed paragraph 
(a).
---------------------------------------------------------------------------

    \297\ The safeguards rule is applicable to ``consumer 
information'' only to the extent it overlaps with ``customer 
information.'' See supra footnote 291. Regulation S-P defines 
``financial institution'' generally to mean any institution the 
business of which is engaging in activities that are financial in 
nature or incidental to such financial activities as described in 
section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 
1843(k)). Rule 248.3(n).
---------------------------------------------------------------------------

    Comments were mixed on expanding the safeguards and disposal rules 
to cover nonpublic personal information received by covered 
institutions from third party financial institutions. Some commenters 
supported the expansion.\298\ Two of these commenters stated that 
sensitive nonpublic information should be protected regardless of how 
it came into a covered institution's possession.\299\ Other commenters 
opposed the proposed expansion, suggesting that the rules should be 
limited to the customer information of the covered institution's own 
customers and stating that the safeguards rule in its current form is 
appropriately calibrated.\300\ One of these commenters stated that 
requiring notification of customers of other financial institutions 
under the proposed expansion would be confusing to customers and 
impractical for covered institutions.\301\
---------------------------------------------------------------------------

    \298\ See EPIC Comment Letter; ICI Comment Letter; Better 
Markets Comment Letter.
    \299\ See ICI Comment Letter; Better Markets Comment Letter.
    \300\ See SIFMA Comment Letter 2; CAI Comment Letter.
    \301\ See SIFMA Comment Letter 2; see also supra footnote 110 
and accompanying text.
---------------------------------------------------------------------------

    After considering comments, the final amendments provide that the 
safeguards rule and disposal rule apply to both nonpublic personal 
information that a covered institution collects about its own customers 
and to nonpublic personal information it receives from another 
financial institution about that institution's customers. Currently, in 
contrast, Regulation S-P defines ``customer'' as ``a consumer who has a 
customer relationship with you.'' The safeguards rule, therefore, only 
protects the ``records and information'' of individuals who are 
customers of the particular institution and not others, such as 
individuals who are customers of another financial institution. The 
disposal rule, on the other hand, requires proper disposal of certain 
records about individuals without regard to whether the individuals are 
customers of the particular institution. The final amendments better 
align the scope of the safeguards and disposal rules by requiring that 
a covered institution protect the information of individuals even if 
those individuals are not customers of that particular institution but 
customers of another financial institution.
    The amendments also are designed to help ensure that the nonpublic 
personal information of covered institution customers is better 
protected from unauthorized disclosure on an ongoing basis, regardless 
of what entity is maintaining or handling that information.\302\ For 
example, information that a registered investment adviser has received 
from the custodian of a former client's assets would be covered under 
both the safeguard and disposal rules if the former client remains a 
customer of either the custodian or of another financial institution, 
even though the individual no longer has a customer relationship with 
the investment adviser.\303\ Applying the safeguards rule and the 
disposal rule to customer information that a covered institution 
receives from other financial institutions will help ensure customer 
information safeguards are not lost because a third party financial 
institution shares that information with a covered institution.
---------------------------------------------------------------------------

    \302\ See Proposing Release at the text accompanying nn.156-158.
    \303\ See final rule 248.30(d)(5)(i) (customer information is 
covered by the rule if it pertains to ``the customers of other 
financial institutions where such information has been provided to 
the covered institution'').
---------------------------------------------------------------------------

2. Extending the Scope of the Safeguards Rule and the Disposal Rule To 
Cover All Transfer Agents
    As discussed in more detail below, the final amendments, which are 
the same as proposed except for the modifications to the structure of 
the rules discussed above,\304\ extend both the safeguards rule and the 
disposal rule to apply to any transfer agent registered with the 
Commission or another appropriate regulatory agency.\305\ We are 
extending these provisions to transfer agents because, as discussed in 
the Proposing Release, transfer agents maintain sensitive, detailed 
information related to securityholders.\306\ Like other market 
participants, systems maintained by transfer agents are subject to 
threats and hazards to the security or integrity of those systems. 
Likewise, the individuals whose information is maintained by those 
transfer agents' systems are subject to similar risks of substantial 
harm and inconvenience as individuals whose customer information is 
maintained by other covered institutions. Yet, prior to the amendments, 
the safeguards rule did

[[Page 47716]]

not apply to any transfer agents, and the disposal rule applied only to 
those transfer agents registered with the Commission. To address these 
risks, and help ensure that individuals whose customer information is 
held by a transfer agent are protected and receive appropriate notice 
of a breach in the same manner as individuals whose customer 
information is held by any other covered institution, the final 
amendments apply both the safeguards rule and the disposal rule to all 
transfer agents, even if the transfer agent is registered with another 
appropriate regulatory agency. The final amendments do this by 
including ``transfer agents registered with the Commission or another 
appropriate regulatory agency'' in the definition of a ``covered 
institution,'' in the same manner as we proposed.\307\
---------------------------------------------------------------------------

    \304\ See supra section II.B.1 (discussing the changes to the 
structure of final rule 248.30(d)).
    \305\ The term ``transfer agent'' is defined by rule 
248.30(d)(12) to have the same meaning as in section 3(a)(25) of the 
Exchange Act (15 U.S.C. 78c(a)(25)).
    \306\ See Proposing Release at section II.C.3.
    \307\ Final rule 248.30(d)(3).
---------------------------------------------------------------------------

    As proposed, the final amendments also account for the fact that 
transfer agents' clients generally are the issuers whose securities are 
held by investors, not the individual investors themselves, by defining 
``customer'' with respect to a transfer agent registered with the 
Commission or another appropriate regulatory agency as any natural 
person who is a securityholder of an issuer for which the transfer 
agent acts or has acted as a transfer agent. Some commenters supported 
extending these rules to all transfer agents. These commenters stated 
that doing so would: (i) be consistent with current market practice; 
(ii) benefit investors; and (iii) create a single, equal standard for 
all transfer agents.\308\ Other commenters opposed extension of the 
safeguards rule and disposal rule to all transfer agents. In general, 
these commenters stated that doing so would: (i) exceed the scope of 
the Commission's authority; (ii) fail to recognize that a transfer 
agent's customer is an issuer of securities; (iii) potentially conflict 
with State law; (iv) confuse securityholders; and (v) impose 
unnecessary costs on transfer agents.\309\ As discussed below, the 
Commission agrees with the commenters who supported extending the 
safeguards rule and disposal rule to all transfer agents and is 
adopting the amendments as proposed.
---------------------------------------------------------------------------

    \308\ See Better Markets Comment Letter, ICI Comment Letter 1, 
EPIC Comment Letter.
    \309\ See SIFMA Comment Letter 2, Comment Letter from the 
Securities Transfer Association (May 10, 2023) (``STA Comment Letter 
1''), STA Comment Letter 2, Computershare Comment Letter.
---------------------------------------------------------------------------

Extending to All Transfer Agents, Including Transfer Agents Subject to 
Existing Federal and State Requirements, and Scope of the Commission's 
Authority
    We received some comments in support of our proposed extension of 
scope to include transfer agents. One commenter stated that extending 
the protections of the safeguards rule and the disposal rule to all 
transfer agents would benefit the public and protect investors, due to 
the sensitive information they possess, and would equalize the 
standards that are applicable to transfer agents.\310\ This commenter 
stated that due to their role, transfer agents have information related 
to securityholders that may include names, addresses, phone numbers, 
email addresses, employers, employment history, bank account 
information, credit card information, transaction histories, and 
securities holdings.\311\ This commenter further stated that the 
systems transfer agents maintain are subject to the same risks of a 
breach as other covered institutions, and therefore the individuals 
whose customer information transfer agents maintain are subject to the 
same risks as customers of other covered institutions.\312\ Finally, 
the commenter stated that extending the safeguards rule and disposal 
rule to all transfer agents will promote regulatory parity and fair 
competition among firms, regardless of their registration status.\313\
---------------------------------------------------------------------------

    \310\ See Better Markets Comment Letter.
    \311\ See id.
    \312\ See id.
    \313\ See id.
---------------------------------------------------------------------------

    Similarly, one commenter supported including transfer agents and 
requiring breach notifications,\314\ and another commenter stated that 
establishing incident response and minimum data breach reporting 
requirements for transfer agents would be a significant step toward a 
stronger and more comprehensive national data breach regime.\315\
---------------------------------------------------------------------------

    \314\ See ICI Comment Letter 1.
    \315\ See EPIC Comment Letter.
---------------------------------------------------------------------------

    Other comments, however, objected to scoping transfer agents into 
the Safeguards Rule. For example, one commenter suggested that applying 
the rules to all transfer agents could subject transfer agents 
registered with an appropriate regulatory agency that is not the 
Commission to conflicting data security requirements from those 
regulators, resulting in regulatory confusion.\316\ One commenter 
stated that extending the rules to all transfer agents would exceed the 
scope of the Commission's authority.\317\ Similarly, two commenters 
stated that the Commission should exempt certain transfer agents from 
the safeguards rule, such as transfer agents subject to existing State 
and Federal banking laws addressing privacy and safeguarding customer 
information, or those that do not engage in paying agent services.\318\ 
One of these commenters stated that transfer agents ``do not have the 
type or scope of personal information which could lead to further 
complications for securityholders'' because transfer agents are not 
subject to know-your-customer obligations, do not have extensive 
background information concerning securityholders, and generally do not 
have possession of shareholder assets or have information which could 
be used to take or transfer assets of shareholders.\319\ One of these 
commenters also stated that it is already subject to banking laws and 
inter-agency guidelines that address privacy, breach notification, and 
disposal of personal information, such as the Banking Agencies' 
Incident Response Guidance.\320\
---------------------------------------------------------------------------

    \316\ See SIFMA Comment Letter 2.
    \317\ See SIFMA Comment Letter 2.
    \318\ See STA Comment Letter 2 and Computershare Comment Letter. 
We use the term ``paying agent services'' to refer to 
administrative, recordkeeping, and processing services related to 
the distribution of cash and stock dividends, bond principal and 
interest, mutual fund redemptions, and other payments to 
securityholders.
    \319\ See STA Comment Letter 2.
    \320\ See Computershare Comment Letter.
---------------------------------------------------------------------------

    The Commission does not agree that extending the rules to all 
transfer agents would result in regulatory confusion. As discussed 
above, the GLBA and FACT Act oblige us to adopt regulations, to the 
extent possible, that are consistent and comparable with those adopted 
by the Banking Agencies, the CFPB, and the FTC.\321\ The Commission has 
been mindful of the need to set standards for safeguarding customer 
records and information that are consistent and comparable with the 
corresponding standards set by these agencies, and to this end, we have 
modified the final amendments from the proposal to promote greater 
consistency with other applicable Federal safeguard standards where 
such changes do not affect the investor protection purposes of this 
rulemaking, as discussed in more detail above.\322\ Thus, although 
there are some differences, the final amendments are largely aligned 
with the Banking

[[Page 47717]]

Agencies' Incident Response Guidance and Safeguards Guidance to which 
some transfer agents supervised by one of the Banking Agencies are 
already subject.\323\ We recognize, however, that transfer agents 
registered with the Banking Agencies are already subject to the Banking 
Agencies' Incident Response Guidance and Safeguards Guidance and 
therefore may need to review their existing procedures under the 
Banking Agencies' Guidance for compliance with the final amendments. To 
the extent there are differences between their existing procedures and 
the final amendments, given the Commission's efforts to promote 
consistency between the final amendments and other Federal safeguards 
standards, it will be possible for transfer agents to update their 
existing policies, procedures, and practices to ensure consistency with 
both the Banking Agencies' Guidance and the final amendments.\324\ 
Finally, even if the final amendments impose additional requirements on 
some transfer agents already subject to the Banking Agencies' Guidance, 
it is appropriate to establish a minimum nationwide standard for the 
notification of securityholders who are affected by a transfer agent 
data breach that is tailored to the Commission's mission and the 
specific requirements.\325\ For these reasons, the Commission does not 
agree that it should exempt from the safeguards rule transfer agents 
that are subject to existing Federal banking laws addressing privacy 
and safeguarding customer information.
---------------------------------------------------------------------------

    \321\ See supra section I.
    \322\ For example, the final amendments require covered 
institutions to ensure that their service providers provide 
notification as soon as possible, but no later than 72 hours after 
becoming aware that an applicable breach has occurred, which is 
informed by the 72-hour deadline that is required under CIRCIA. See 
supra section II.A.4.b.
    \323\ See infra sections IV.C.2.b and IV.D.2.b.
    \324\ See supra section I.
    \325\ See supra section I.
---------------------------------------------------------------------------

    Moreover, the Commission is not exempting from the safeguards rule 
transfer agents that do not engage in paying agent services. The 
population of transfer agents that maintain sensitive, detailed and 
individualized information related to securityholders is not limited to 
those transfer agents that engage in paying agent services. Providing 
the exemption suggested by this commenter would deprive securityholders 
whose sensitive customer information is maintained by a non-paying 
agent transfer agent of the important protections afforded under the 
final amendments.
    The Commission does not agree that extending the rules to all 
transfer agents would exceed the scope of the Commission's authority. 
As discussed in the proposal, when the Commission initially proposed 
and adopted the disposal rule, it did so to implement the congressional 
directive in section 216 of the FACT Act to adopt regulations to 
require any person who maintains or possesses a consumer report or 
consumer information derived from a consumer report for a business 
purpose to properly dispose of the information.\326\ The Commission 
determined at that time that, through the FACT Act, Congress intended 
to instruct the Commission to adopt a disposal rule to apply to 
transfer agents registered with the Commission.\327\ The Commission 
also stated at that time that the GLBA did not include transfer agents 
within the list of covered entities for which the Commission was 
required to adopt privacy rules.\328\ The Commission extended the 
disposal rule only to those transfer agents registered with the 
Commission to carry out its directive under the FACT Act, while 
deferring to the FTC to utilize its ``residual jurisdiction'' under the 
same congressional mandate, to enact both a disposal rule and broader 
privacy rules that might apply to transfer agents registered with 
another appropriate regulatory agency.\329\
---------------------------------------------------------------------------

    \326\ See Proposing Release at section II.C.3; see also 15 
U.S.C. 1681w.
    \327\ See Disposal of Consumer Report Information, Exchange Act 
Release No. 50361 (Sept. 14, 2004), 69 FR 56307 at n.23 (Sept. 20, 
2004).
    \328\ See id. at n.27.
    \329\ See id.
---------------------------------------------------------------------------

    The Commission, however, has broad authority under Section 17A of 
the Exchange Act that is independent of either the FACT Act or the 
GLBA, to prescribe rules and regulations for transfer agents as 
necessary or appropriate in the public interest, for the protection of 
investors, for the safeguarding of securities and funds, or otherwise 
in furtherance of the purposes of Title I of the Exchange Act.\330\ 
Specifically, whether transfer agents initially register with the 
Commission or another appropriate regulatory agency,\331\ section 
17A(d)(1) of the Exchange Act authorizes the Commission to prescribe 
such rules and regulations as may be necessary or appropriate in the 
public interest, for the protection of investors, or otherwise in 
furtherance of the purposes of the Exchange Act with respect to any 
transfer agents registered with either the Commission or another 
appropriate regulatory agency. Once a transfer agent is registered with 
any appropriate regulatory agency, the Commission ``is empowered with 
broad rulemaking authority over all aspects of a transfer agent's 
activities as a transfer agent.'' \332\ Pursuant to its statutory 
authority, the Commission has adopted rules that address various 
aspects of transfer agents' activities, including annual disclosures, 
transaction processing, responses to written inquiries, recordkeeping, 
safeguarding of funds and securities, lost securityholder searches, 
among others.\333\ These and the Commission's other transfer agent 
rules \334\ currently apply to and are enforceable against all 
registered transfer agents, including those that initially registered 
with an appropriate regulatory agency other than the Commission.\335\
---------------------------------------------------------------------------

    \330\ See 15 U.S.C. 78q-1.
    \331\ See Exchange Act Section 17A(d)(1), 15 U.S.C. 78q-1(d)(1) 
(providing that ``no registered clearing agency or registered 
transfer agent shall . . . engage in any activity as . . . transfer 
agent in contravention of such rules and regulations'' as the 
Commission may prescribe); Exchange Act Section 17A(d)(3)(b), 15 
U.S.C. 78q-1(d)(3)(b) (providing that ``Nothing in the preceding 
subparagraph or elsewhere in this title shall be construed to impair 
or limit . . . the Commission's authority to make rules under any 
provision of this title or to enforce compliance pursuant to any 
provision of this title by any . . . transfer agent . . . with the 
provisions of this title and the rules and regulations 
thereunder.'').
    \332\ See Senate Report on Securities Act Amendments of 1975, S. 
Rep. No. 94-75.
    \333\ See, e.g., SEC Form TA-2, 17 CFR 249b.102 (Form for 
Reporting Activities of Transfer Agents Registered Pursuant to 
Section 17A of the Securities Exchange Act of 1934) (annual 
disclosures); Exchange Act Rule 17Ad-2, 17 CFR 240.17Ad-2 
(transaction processing); Exchange Act Rule 17Ad-5, 17 CFR 240.17Ad-
5 (written inquiries); Exchange Act Rule 17Ad-6, 17 CFR 240.17Ad-6 
(recordkeeping); Exchange Act Rule 17Ad-7, 17 CFR 240.17Ad-7 (record 
retention); Exchange Act Rule 17Ad-12, 17 CFR 240.17Ad-12 
(safeguarding); Exchange Act Rule 17Ad-17, 17 CFR 240.17Ad-17 (lost 
securityholder searches).
    \334\ See, e.g., Exchange Act Rules 17Ad-1 through 17Ad-20, 17 
CFR 240.17Ad-1 through 240.17Ad-20.
    \335\ For example, the Commission has found bank-registered 
transfer agents in violation of various Commission rules. See In the 
Matter of Citibank, N.A., Exchange Act Release No. 31612 (Dec. 7, 
1992) (settled matter) (Exchange Act Rules 17Ad-12 and 17f-1); In 
the Matter of the Chase Manhattan Bank, Exchange Act Release No. 
44835 (Sept. 24, 2001) (settled matter) (Exchange Act Rules 17Ac2-2, 
17Ad-10, and 17Ad-11); In the Matter of Wilmington Trust Company, 
Exchange Act Release No. 49904 (Jun. 23, 2004) (settled matter) 
(Exchange Act Rules 17Ac2-2, 17Ad-10, 17Ad-11, and 17Ad-13); In the 
Matter of the Bank of New York, Exchange Act Release No. 53709 (Apr. 
24, 2006) (settled matter) (Exchange Act Rule 17Ad-17).
---------------------------------------------------------------------------

    The FTC has not adopted disposal and privacy rules to govern 
transfer agents registered with an appropriate regulatory agency that 
is not the Commission. The Commission is exercising its authority under 
section 17A(d)(1) of the Exchange Act to extend the safeguards rule to 
apply to any transfer agent registered with either the Commission or 
another appropriate regulatory agency and to extend the disposal rule 
to apply to transfer agents registered with another appropriate 
regulatory agency. The Commission does so to address the risks of 
market disruptions and investor harm posed by

[[Page 47718]]

cybersecurity and other operational risks faced by transfer agents. 
Extending the safeguards rule and disposal rule to address those risks 
is in the public interest, and necessary for the protection of 
investors and for the safeguarding of funds and securities.
    As explained in the proposal, transfer agents are subject to many 
of the same risks of data system breach or failure that other market 
participants face.\336\ For example, transfer agents are vulnerable to 
a variety of software, hardware, and information security risks that 
could threaten the ownership interests of securityholders or disrupt 
trading within the securities markets.\337\ A software, hardware, or 
information security breach or failure at a transfer agent could result 
in the corruption or loss of securityholder information, erroneous 
securities transfers, or the release of confidential securityholder 
information to unauthorized individuals. A concerted cyber attack or 
other breach could have the same consequences, or result in the theft 
of securities and other crimes. A transfer agent's failure to account 
for such risks and take appropriate steps to mitigate them can directly 
lead to the loss of funds or securities, including through theft or 
misappropriation, due to the information about securityholders that 
transfer agents maintain.\338\
---------------------------------------------------------------------------

    \336\ See Proposing Release at section II.C.3.
    \337\ See generally SEC Cybersecurity Roundtable transcript 
(Mar. 26, 2014), available at https://www.sec.gov/spotlight/cybersecurity-roundtable/cybersecurity-roundtable-transcript.txt.
    \338\ See Proposing Release at section II.C.3.
---------------------------------------------------------------------------

    At the same time, the scope and volume of funds and securities that 
are processed or held by transfer agents have increased dramatically 
since Regulation S-P was first adopted.\339\ The risk of loss of such 
funds and securities presents significant risks to issuers, 
securityholders, other industry participants, and the U.S. financial 
system as a whole. For example, transfer agents that provide paying 
agent services on behalf of issuers play a significant role within that 
system. According to Form TA-2 filings in 2023, transfer agents 
distributed approximately $3.68 trillion in securityholder dividends 
and bond principal and interest payments. Critically, because Form TA-2 
does not include information relating to the value of purchase, 
redemption, and exchange orders by mutual fund transfer agents, the 
$3.68 trillion amount stated above does not include these amounts. If 
the value of such transactions by mutual fund transfer agents was 
captured by Form TA-2 it is possible that the $3.68 trillion number 
would be significantly higher.\340\
---------------------------------------------------------------------------

    \339\ See id.
    \340\ As stated in the proposal, Commission staff has observed 
through supervisory activities that aggregate gross purchase and 
redemption activity for some of the larger mutual fund transfer 
agents has ranged anywhere from $3.5 trillion to nearly $10 trillion 
just for a single entity in a single year. See Proposing Release at 
section II.C.3.
---------------------------------------------------------------------------

    Moreover, contrary to some commenters' statements, transfer agents 
do maintain personal information about individual securityholders that 
could be used to take or transfer assets of securityholders or 
otherwise lead to further complications for securityholders. As stated 
in the proposal, transfer agents may obtain, share, and maintain 
personal information on behalf of securityholders who hold securities 
in registered form (i.e., in their own name rather than indirectly 
through a broker).\341\ For example, any registered transfer agent that 
maintains a master securityholder file on behalf of an issuer must post 
to that file debits and credits containing minimum and appropriate 
certificate detail representing every security transferred, purchased, 
redeemed, or issued.\342\ Pursuant to Exchange Act Rule 17Ad-9, 
certificate detail must include, among other things, the name and 
address of the registered securityholder, the number of shares or 
principal dollar amount of the equity or debt security, and any other 
identifying information about the securityholder or the 
securityholder's securities that the transfer agent reasonably deems 
essential to its recordkeeping system for the efficient and effective 
research of record differences.\343\ This can include date of birth, 
social security or tax payer identification number, phone numbers, 
email addresses, information about relatives, and other sensitive 
personal information.\344\ Transfer agents also maintain additional 
personal information about securityholders in connection with ancillary 
account, administrative, and other services transfer agents provide to 
securityholders on behalf of issuers, such as plan administration, 
proxy services, corporate action processing, and disbursement of 
dividend and interest payments.\345\ This is the same type of customer 
information collected and maintained by other covered institutions and 
warrants the same level of protection. For example, the Commission is 
aware of instances in which threat actors have utilized securityholder 
information obtained from a transfer agent to steal securities and 
funds from those securityholders.\346\
---------------------------------------------------------------------------

    \341\ See Proposing Release at section I, section II.C.3.
    \342\ See 17 CFR 240.17Ad-10.
    \343\ See 17 CFR 240.17Ad-9(a).
    \344\ See In the Matter of Columbia Management Investment 
Services Corp., Exchange Release No. 80016 (Feb. 10, 2017) (settled 
matter) (finding that the transfer agent's Records Management 
Manager ``viewed sensitive personal account information such as 
addresses, dates of birth, and identification numbers'' to 
misappropriate foreign deceased shareholders' funds and securities).
    \345\ See Proposing Release at section II.C.3 (discussing 
generally the services provided by transfer agents); Advanced Notice 
of Proposed Rulemaking, Concept Release, Transfer Agent Regulations, 
Exchange Act Release No. 76743 (Dec. 22, 2015), 80 FR 81948 (Dec. 
31, 2015) (describing the recordkeeping, shareholder communications, 
securities issuance, and tax reporting services provided by transfer 
agents).
    \346\ See In the Matter of Columbia Management Investment 
Services Corp., Exchange Act Release No. 80016 (Feb. 10, 2017) 
(settled matter) (finding that the transfer agent's Records 
Management Manager ``viewed sensitive personal account information 
such as addresses, dates of birth, and identification numbers'' to 
misappropriate foreign deceased shareholders' funds and securities).
---------------------------------------------------------------------------

    For these reasons, the Commission is extending the safeguards rule 
and disposal rule to cover all registered transfer agents because it is 
in the public interest and will help protect investors and safeguard 
their securities and funds. Extending the safeguards rule to cover any 
registered transfer agent addresses the risks to the security and 
integrity of customer information associated with the systems those 
transfer agents maintain. This in turn helps prevent securityholders' 
customer information from being compromised, which, as discussed above, 
could threaten the ownership interest of securityholders or disrupt 
trading within the securities markets. Extending the final amendments 
to all registered transfer agents also helps establish minimum 
nationwide standards for the notification of securityholders who are 
affected by a transfer agent data breach that leads to the unauthorized 
access or use of their information so that affected securityholders 
could take additional mitigating actions to protect their customer 
information, ownership interest in securities, and trading activity. 
Finally, as discussed above, extending the disposal rule to cover those 
transfer agents registered with another appropriate regulatory agency 
helps ensure all registered transfer agents are subject to the same 
minimum nationwide standard, tailored to the Commission's mission and 
requirements, and will protect investors and safeguard their securities 
and funds by reducing the risk of fraud or related crimes, including 
identity theft, which can lead to the loss of securities and funds.

[[Page 47719]]

Definition of a Transfer Agent's Customer
    As stated above, the final amendments include a definition of 
customer that is specific to transfer agents, which is being adopted as 
proposed, except for a clarification noted below. For a transfer agent, 
customer means any natural person who is a securityholder of an issuer 
for which the transfer agent acts or has acted as a transfer 
agent.\347\ The Commission is clarifying that this definition applies 
for purposes of section 248, meaning that it does not apply to any 
other rules, including those specific to transfer agents codified at 17 
CFR 240.17Ad. Unless specified, securityholders of issuers are not 
customers of transfer agents for purposes of other rules. The 
Commission is adopting this definition because, as discussed above, 
although transfer agents' customers generally are issuers of 
securities, transfer agents collect and maintain non-public personal 
information about the individual registered owners who hold those 
issuers' securities in connection with various services and activities 
they engage in on behalf of issuers.
---------------------------------------------------------------------------

    \347\ See final rule 248.30(d)(4)(ii).
---------------------------------------------------------------------------

    Some commenters supported this definition and approach of treating 
securityholders of an issuer as a transfer agent's customer, while 
other commenters did not. One commenter stated that this approach would 
close a ``regulatory gap''--despite possessing and maintaining 
sensitive information about securityholders, no transfer agents are 
currently subject to the safeguards rule, and only transfer agents 
registered with the Commission are subject to the disposal rule.\348\ 
Similarly, one commenter supported protecting customer information by 
subjecting that information to Regulation S-P, regardless of how it 
comes into the covered institution's possession.\349\ On the other 
hand, one commenter opposed this proposed definition, stating that the 
need for a specific defined term for transfer agents indicated that the 
amendments were not well suited for transfer agents.\350\ Three 
commenters stated that securityholders of issuers are not customers of 
the transfer agent, rather the issuer is the customer of the transfer 
agent.\351\
---------------------------------------------------------------------------

    \348\ See Better Markets Comment Letter.
    \349\ See ICI Comment Letter 1.
    \350\ See STA Comment Letter 2.
    \351\ See STA Comment Letter 2, Computershare Comment Letter, 
and SIFMA Comment Letter 2.
---------------------------------------------------------------------------

    The Commission agrees that customer information held by a covered 
institution must be protected, regardless of how that customer 
information comes into the covered institution's possession. As 
discussed in the proposal and above, transfer agents obtain, share, and 
maintain personal information on behalf of securityholders who hold 
securities in registered form (i.e., in their own name rather than 
indirectly through a broker).\352\ They also collect detailed personal 
information in connection with various services provided directly to 
individual securityholders, such as facilitating legal and other 
transfers of securities, replacing lost or stolen securities 
certificates, facilitating corporate communications with investors, 
providing cost-basis calculations for tax purposes, and other 
services.\353\ The fact that a transfer agent may not have a direct 
contractual relationship with an individual securityholder does not 
eliminate the need for transfer agents to protect the sensitive 
personal information about individual securityholders that is collected 
and maintained by the transfer agent.
---------------------------------------------------------------------------

    \352\ See Proposing Release at section I; section II.C.3; see 
also supra the text accompanying footnote 285.
    \353\ See Proposing Release at section II.C.3 (discussing 
generally the services provided by transfer agents); Advanced Notice 
of Proposed Rulemaking, Concept Release, Transfer Agent Regulations, 
Exchange Act Release No. 76743 (Dec. 22, 2015), 80 FR 81948 (Dec. 
31, 2015) (describing the recordkeeping, shareholder communications, 
securities issuance, and tax reporting services provided by transfer 
agents).
---------------------------------------------------------------------------

    Contrary to some commenters' statements, adopting a transfer agent-
specific definition of customer does not indicate that the safeguards 
rule and disposal rule are not well-suited for transfer agents. Rather, 
it helps ensure that the rule is appropriately tailored to address 
transfer agents and the specific type of customer information they 
collect and maintain. Tailoring specific rule provisions to specific 
types of entities to address their unique functions, structures, and 
businesses does not render the rule inappropriate to the entity for 
which the provisions are being tailored, nor is it an approach that is 
unique to transfer agents or to Regulation S-P. For example, since the 
adoption of Exchange Act Rule 17Ad-12, transfer agents have been 
required to safeguard any funds and securities, including 
securityholder funds and securities, in the transfer agent's possession 
or control.\354\ This is the case although securityholders may not be 
direct customers of transfer agents. As another example, final rule 
248.30(d)(5)(i) defines customer information, for any covered 
institution other than a transfer agent as any record containing 
nonpublic personal information as defined in final rule 248.3(t) about 
a customer of a financial institution, whether in paper, electronic or 
other form, in the possession of a covered institution or that is 
handled or maintained by the covered institution or on its behalf, 
regardless of whether such information pertains to (a) individuals with 
whom the covered institution has a customer relationship, or (b) the 
customers of other financial institutions where such information has 
been provided to the covered institution.\355\ The fact that the 
securityholder whose funds and securities the transfer agent is in 
possession of is not a direct customer of the transfer agent does not 
eliminate the need for the transfer agent to safeguard those funds and 
securities. The same is true for customer information in the possession 
of a transfer agent or that is handled or maintained by the transfer 
agent or on its behalf.
---------------------------------------------------------------------------

    \354\ See 17 CFR 240.17Ad-12.
    \355\ See final rule 248.30(d)(5)(i).
---------------------------------------------------------------------------

    Finally, two commenters stated that the Commission should propose a 
rule specific to transfer agents as part of the existing rules that 
apply specifically to transfer agents.\356\ In these commenters' views, 
such a rule would impose obligations similar to the final amendments 
but would apply only to transfer agents. One of these commenters 
further explained that it would support general safeguarding of 
securityholder information requirements, similar to those set forth in 
the safeguard rule, if the Commission enacted them as part of the 
regulations specific to transfer agents codified at 17 CFR 
240.17Ad.\357\
---------------------------------------------------------------------------

    \356\ See STA Comment Letter 2 and Computershare Comment Letter.
    \357\ See Computershare Comment Letter.
---------------------------------------------------------------------------

    The Commission is not taking the approach suggested by the 
commenters. The final amendments will accomplish a similar result to a 
transfer agent-specific rule, while helping to ensure consistent 
requirements among covered institutions. Further, the commenters did 
not explain how such a rule would differ from the final amendments, 
other than being in a different set of Commission regulations, or how 
such a rule would be a material improvement over the approach being 
adopted as proposed. The Commission does not agree that adopting 
something different from the final amendments is necessary to achieve 
the ``Commission's privacy and cybersecurity goals in a manner specific 
to the business and role of transfer agents.'' \358\ Rather, doing so 
would undermine the Commission's

[[Page 47720]]

goal of establishing a consistent minimum nationwide standard. Further, 
where necessary, the Commission has already tailored the final 
amendments in a manner specific to transfer agents. As noted above, the 
final amendments include a definition of customer that it is specific 
to transfer agents. Finally, to the extent one of commenters' goals is 
ensuring that all transfer agent rules are codified in the same place, 
specifically 17 CFR 240.17Ad, commenters' suggestion would not further 
that goal. Transfer agents registered with the Commission are already 
subject to the disposal rule, which is not part of the existing rule 
set codified at 17 CFR 240.17Ad, and a new safeguards or disposal rule 
within that section would necessarily cite to Regulation S-P for 
defined terms and other references.
---------------------------------------------------------------------------

    \358\ STA Comment Letter 2.
---------------------------------------------------------------------------

Application of Laws, Requirements, and Contractual Provisions
    Some commenters raised concerns about potential conflicts with, or 
duplication, of State law requirements. One commenter stated that 
securityholders of issuers are not customers of the transfer agent and 
imposing obligations on them creates conflicting and duplicative 
requirements to those already in place through State laws to safeguard 
securityholders' personal information.\359\ Another commenter stated 
that under State law, transfer agents do not notify securityholders of 
a breach but issuers do.\360\ Specifically, this commenter stated that 
all fifty States have laws that require transfer agents to notify their 
issuer clients of unauthorized access to personal information of 
securityholders, and issuers may then be required to notify 
securityholders depending on whether the standards of the State law 
have been met. This commenter also stated that its existing policies, 
procedures, and contractual obligations are designed to track these 
State law requirements and that certain provisions in transfer agents' 
contracts with issuer clients could prohibit transfer agents from 
notifying securityholders of data breaches in the manner required by 
the amendments.\361\ Both commenters stated that the Commission should 
consider preempting State laws to minimize the potential for multiple 
and competing obligations, and if not, prepare and produce a cost-
benefit analysis to identify the specific ways in which the amendments 
would be an improvement over existing law.\362\ This commenter further 
explained that the issuer client would notify securityholders depending 
on whether the standards of the State law have been met.\363\
---------------------------------------------------------------------------

    \359\ See STA Comment Letter 2.
    \360\ See Computershare Comment Letter.
    \361\ See Computershare Comment Letter.
    \362\ See STA Comment Letter 2 and Computershare Comment Letter. 
See also infra section IV.D.2.b.
    \363\ See id.
---------------------------------------------------------------------------

    While we acknowledge the commenters' concerns, the final amendments 
permit transfer agents and issuers to develop arrangements to address 
them. Nothing in the final amendments will prohibit or limit transfer 
agents' ability to enter into or modify their contracts with issuer 
clients in a manner that allows the transfer agent to comply with 
applicable legal requirements. Indeed, some transfer agents already 
send customer notices on behalf of their issuer clients. As one 
commenter stated in requesting that the Commission permit covered 
institutions to have their service providers send breach notices to 
affected individuals on their behalf, it is a common practice today for 
investment companies to have their transfer agents assume 
responsibility for sending affected customers breach notices.\364\ The 
Commission acknowledges that, to the extent a transfer agent has 
contractual provisions with issuer clients that prevent securityholders 
from receiving notice of a breach directly from the transfer agent, the 
transfer agent may determine to amend those contractual provisions to 
comply with the final amendments. Further, as discussed above, in a 
modification from the proposal, the final amendments provide that a 
covered institution that is required to notify affected individuals may 
satisfy that obligation by ensuring that the notice is provided by 
another party (as opposed to providing the notice itself). Accordingly, 
if a transfer agent experiences an incident affecting securityholders 
of another covered institution, it would have the option of 
coordinating with the covered institution as to which institution will 
actually send the notice.\365\
---------------------------------------------------------------------------

    \364\ See ICI Comment Letter 1.
    \365\ See supra section II.A.3.a.
---------------------------------------------------------------------------

    As explained in the proposal, the Commission understands that State 
laws generally require persons or entities that own or license 
computerized data that includes private information to notify residents 
of the State when a data breach results in the compromise of their 
private information.\366\ In addition, State laws generally require 
persons and entities that do not own or license such computerized data, 
but that maintain such computerized data for other entities, to notify 
the affected entity in the event of a data breach (so as to allow that 
entity to notify affected individuals). However, the specific 
requirements regarding the timing of the notice, content of the notice, 
types of data covered, and other aspects may vary.\367\ Indeed, one 
commenter highlighted the variation and uncertainty among different 
State law requirements.\368\ Thus, while transfer agents may already be 
complying with one or more State notification laws, variations in these 
State laws could result in residents of one State receiving notice 
while residents of another do not receive notice, or receive it later, 
or receive different information for the same data breach incident. The 
final amendments address this concern by imposing a Federal minimum 
standard for customer notification, which will help ensure timely, 
consistent notice to affected securityholders regardless of their State 
of residence.
---------------------------------------------------------------------------

    \366\ See Proposing Release at section III.C.2.
    \367\ See supra section I.
    \368\ See Computershare Comment Letter.
---------------------------------------------------------------------------

Impact of Notices From Transfer Agents
    One commenter stated that the proposal would equalize standards 
governing transfer agents, and in doing so, promote investor 
protection.\369\ On the other hand, several commenters stated that the 
proposed rule regarding transfer agents would confuse securityholders. 
One commenter suggested that requiring a transfer agent to identify and 
contact customers of another institution may cause those customers to 
be confused and concerned.\370\ Two commenters similarly stated that 
the notification requirement is likely to confuse securityholders 
because it would result in securityholders receiving notice from both 
the transfer agent and the issuer with respect to the same breach.\371\ 
One commenter further stated that a transfer agent should only be 
required to notify an issuer of an incident.\372\
---------------------------------------------------------------------------

    \369\ See Better Markets Comment Letter.
    \370\ See SIFMA Comment Letter 2.
    \371\ See STA Comment Letter 2 and Computershare Comment Letter.
    \372\ See SIFMA Comment Letter 2.
---------------------------------------------------------------------------

    We acknowledge that due to existing State law provisions, 
individuals affected by a breach at a transfer agent may receive notice 
from the issuer and the transfer agent with respect to the same breach. 
Moreover, transfer agents subject to the Banking Agencies' Incident 
Response Guidance may send notices under those provisions as well, and 
it is possible that an issuer may also send notices to securityholders, 
pursuant to State law or other

[[Page 47721]]

requirements. We acknowledge that these existing provisions, coupled 
with the requirements of the final amendments, may result in multiple 
notices being sent for the same incident. That said, as explained 
above, we have modified the final amendments to minimize the likelihood 
of multiple notices being sent by covered institutions for the same 
incident.\373\
---------------------------------------------------------------------------

    \373\ See supra section II.A.3.a.
---------------------------------------------------------------------------

    Regardless, we do not agree that individuals who receive a notice 
from both a transfer agent and the issuer with respect to the same 
breach or who are contacted by a transfer agent on behalf of another 
institution will be confused. Any potential confusion could be 
ameliorated through a clear description of the specific incident that 
would allow an individual to determine whether it is covered by a 
notice from any covered institution.\374\ Rather than create confusion, 
as some commenters assert, the final amendments will establish a 
Federal minimum standard for covered institutions, thereby reducing any 
extant or potential confusion. As discussed in the proposal, there are 
variations in existing State laws regarding a firm's duty to 
investigate a data breach, the specific events that trigger when notice 
of a breach is required, the timing of any such notices, and other 
details of a notice. The Federal minimum standard established by the 
final amendments will eliminate this confusion by ensuring that all 
affected securityholders receive an appropriate notice, regardless of 
the securityholder's State of residence, thereby enhancing investor 
protection overall. This benefit justifies the remote risk of potential 
confusion suggested by some commenters.
---------------------------------------------------------------------------

    \374\ It is possible that customers may not be aware of their 
relationship with a transfer agent or otherwise may not recognize 
the transfer agent and therefore could read the notification as a 
phishing attempt or another nefarious scheme. See infra section 
IV.D.2.b.
---------------------------------------------------------------------------

3. Maintaining the Current Regulatory Framework for Notice-Registered 
Broker-Dealers
    The final amendments will, as proposed, contain a number of 
amendments to Regulation S-P that result in the continuation of the 
same regulatory treatment for notice-registered broker-dealers as they 
were subject to under the existing safeguards rule and disposal 
rule.\375\ Specifically, notice-registered broker-dealers are 
explicitly excluded from the scope of the disposal rule,\376\ but 
subject to the safeguards rule. However, under substituted compliance 
provisions, notice-registered broker-dealers are deemed to comply with 
the safeguards rule (and all other aspects of Regulation S-P, other 
than the disposal rule) if they are subject to, and comply with, the 
financial privacy rules of the CFTC,\377\ including similar obligations 
to safeguard customer information.\378\ The Commission initially 
adopted substituted compliance provisions with regard to the safeguards 
rule in acknowledgment that notice-registered broker-dealers are 
subject to primary oversight by the CFTC, and to mirror similar 
substituted compliance provisions afforded by the CFTC to broker-
dealers registered with the Commission.\379\ When the Commission later 
adopted the disposal rule, it excluded notice-registered broker-dealers 
from the rule's scope, stating its belief that Congress did not intend 
for the Commission's FACT Act rules to apply to entities subject to 
primary oversight by the CFTC.\380\ For these reasons, the Commission 
tailored the proposal to ensure there would be no change in the 
treatment of notice-registered broker-dealers under the safeguards rule 
and the disposal rule.\381\
---------------------------------------------------------------------------

    \375\ Notice-registered broker-dealers are futures commission 
merchants and introducing brokers registered with the CFTC that are 
permitted to register as broker-dealers by filing a notice with the 
Commission for the limited purpose of effecting transactions in 
security futures products. See Registration of Broker-Dealers 
Pursuant to section 15(b)(11) of the Securities Exchange Act of 
1934, Exchange Act Release No. 44730 (Aug. 21, 2001) [66 FR 45138 
(Aug. 27, 2001)] (``Notice-Registered Broker-Dealer Release'').
    \376\ See 17 CFR 248.30(b)(2)(i).
    \377\ See 17 CFR 248.2(c) and 248.30(b). Under the substituted 
compliance provision in rule 248.2(c), notice-registered broker-
dealers operating in compliance with the financial privacy rules of 
the CFTC are deemed to be in compliance with Regulation S-P, except 
with respect to Regulation S-P's disposal rule (currently rule 
248.30(b)).
    \378\ See 17 CFR 160.30.
    \379\ See Notice-Registered Broker-Dealer Release; see also 
CFTC, Privacy of Customer Information [66 FR 21236 (Apr. 27, 2001)].
    \380\ See Proposing Release at n.203.
    \381\ This approach will provide notice-registered broker-
dealers with the benefit of consistent regulatory treatment under 
Regulation S-P, without imposing any additional costs, while also 
maintaining the same investor protections that the customers of 
notice-registered broker-dealers currently receive. To the extent 
notice-registered broker-dealers opt to comply with Regulation S-P 
and the proposed safeguards rule rather than avail themselves of 
substituted compliance by complying with the CFTC's financial 
privacy rules, the benefits and costs of complying with the proposed 
rule would be the same as those for other broker-dealers. Notice-
registered broker-dealers should not face additional costs under the 
final rule related to the disposal rule, as they would remain 
excluded from its scope. See Proposing Release.
---------------------------------------------------------------------------

    No comments were received regarding the treatment of notice-
registered broker-dealers under the safeguards rule and the disposal 
rule. For the reasons outlined in the Proposing Release, the Commission 
is adopting the amendments as proposed.\382\ Specifically, as proposed, 
the definition of a ``covered institution'' includes ``any broker or 
dealer,'' without excluding notice-registered broker-dealers, thus 
ensuring that Regulation S-P's substituted compliance provisions still 
apply to notice-registered broker-dealers with respect to the 
safeguards rule.\383\ In addition, the final amendments include the 
``covered institution'' defined term within the disposal rule, while 
retaining the disposal rule's existing exclusion for notice-registered 
broker-dealers.\384\
---------------------------------------------------------------------------

    \382\ See Proposing Release at Section II.C.4.
    \383\ See proposed rule 248.30(e)(3); see also 17 CFR 248.2(c).
    \384\ See proposed rule 248.30(c)(1). As we are not adopting the 
paragraph in proposed rule 248.30(a), we are similarly not adopting 
the proposed technical amendment to 17 CFR 248.2(c), which, as to 
the disposal rule, provides an exception from the substituted 
compliance regime afforded to notice-registered broker-dealers for 
Regulation S-P. See proposed rule 248.2(c); see also discussion on 
Scope of Information Protected supra Section II.B.1. This proposed 
technical amendment was intended to reflect the proposed shift in 
the disposal rule's citation from paragraph (b) of rule 248.30 to 
paragraph (c) of rule 248.30, to ensure continuity in the treatment 
of notice-registered broker-dealers under Regulation S-P. As the 
final amendments will not result in such a shift to the disposal 
rule's citation, this proposed technical amendment has been rendered 
unnecessary.
---------------------------------------------------------------------------

C. Recordkeeping

    We are adopting amendments to require covered institutions to make 
and maintain written records documenting compliance with the 
requirements of the safeguards rule and of the disposal rule as 
outlined in the table below (collectively, ``recordkeeping 
requirements'').\385\ We are adopting these amendments substantially as 
proposed, but, in response to a comment, with modifications designed to 
provide additional specificity to the scope of certain of the 
recordkeeping requirements as discussed below. The table below reflects 
the time periods that covered institutions will be

[[Page 47722]]

required to preserve these records, which are as proposed. These times 
vary by covered institution but are consistent with existing 
recordkeeping rules for these entities to the extent they have pre-
existing recordkeeping obligations.
---------------------------------------------------------------------------

    \385\ As discussed previously, pursuant to Regulation 
Crowdfunding, funding portals must comply with the requirements of 
Regulation S-P as they apply to brokers. Funding portals are not, 
however, subject to the recordkeeping obligations for brokers found 
under Rule 17a-4. See 17 CFR 240.17a-4; see also supra footnote 5 
and accompanying text. Instead, funding portals are already 
obligated, pursuant to Rule 404 of Regulation Crowdfunding, to make 
and preserve all records required to demonstrate their compliance 
with, among other things, Regulation S-P for five years, the first 
two years in an easily accessible place. See 17 CFR 227.404(a)(5). 
While the final amendments do not modify funding portals' 
recordkeeping requirements to include the same enumerated list of 
obligations as those applied to brokers under the amendments to Rule 
17a-4, funding portals generally should look to make and preserve 
the same scope of records in connection with demonstrating their 
compliance with this portion of Regulation S-P.

                                       Table 1--Recordkeeping Requirements
----------------------------------------------------------------------------------------------------------------
           Covered institution                        Rule                          Retention period
----------------------------------------------------------------------------------------------------------------
Registered Investment Companies.........  17 CFR 270.31a-1(b)........  Policies and Procedures. A copy of
                                          17 CFR 270.31a-2(a)........   policies and procedures in effect, or
                                                                        that at any time in the past six years
                                                                        were in effect, in an easily accessible
                                                                        place.
                                                                       Other records. Six years, the first two
                                                                        in an easily accessible place.
Unregistered Investment Companies \1\...  17 CFR 248.30(c)...........  Policies and Procedures. A copy of
                                                                        policies and procedures in effect, or
                                                                        that at any time in the past six years
                                                                        were in effect, in an easily accessible
                                                                        place.
                                                                       Other records. Six years, the first two
                                                                        in an easily accessible place.
Registered Investment Advisers..........  17 CFR 275.204-2(a)........  All records for five years, the first two
                                                                        in an easily accessible place.\2\
Broker-Dealers..........................  17 CFR 240.17a-4(e)........  All records for three years, in an easily
                                                                        accessible place.
Transfer Agents.........................  17 CFR 240.17ad-7(k).......  All records for three years, in an easily
                                                                        accessible place.
----------------------------------------------------------------------------------------------------------------
Note:
\1\ Regulation S-P applies to investment companies as the term is defined in section 3 of the Investment Company
  Act (15 U.S.C. 80a-3), whether or not the investment company is registered with the Commission. See 17 CFR
  248.3(r). Thus, a business development company, which is an investment company but is not required to register
  as such with the Commission, is subject to Regulation S-P. Similarly, employees' securities companies--
  including those that are not required to register under the Investment Company Act--are investment companies
  and are, therefore, subject to Regulation S-P. By contrast, issuers that are excluded from the definition of
  investment company--such as private funds that are able to rely on section 3(c)(1) or 3(c)(7) of the
  Investment Company Act--are not subject to Regulation S-P.
\2\ All books and records required to be made under the provision of 17 CFR 275.204-2(a) must be maintained and
  preserved in an easily accessible place for a period of not less than five years. 17 CFR 275.204-2(e).

    These recordkeeping requirements should aid covered institutions in 
periodically reassessing the effectiveness of their safeguarding and 
disposal programs by helping to ensure that those institutions have the 
records needed to perform that assessment. Additionally, maintenance of 
these records for sufficiently long periods of time and in accessible 
locations will help the Commission and its staff to monitor compliance 
with the requirements of the amended rules. We received one comment 
broadly in support of these recordkeeping requirements.\386\
---------------------------------------------------------------------------

    \386\ ICI Comment Letter.
---------------------------------------------------------------------------

    The text of the proposed recordkeeping rules were worded 
differently for different covered institutions. For example, the 
proposed recordkeeping rule text for broker-dealers and transfer agents 
detailed the specific records to be kept whereas the proposed rule for 
advisers stated that advisers would be required to make and keep true, 
accurate and current a copy of the written records documenting 
compliance with the requirements of the safeguards and disposal 
rules.\387\ The Commission sought comment on whether the detailed 
requirements proposed for broker-dealers and transfer agents should be 
included in the recordkeeping rules for other covered entities. While 
no commenter specifically responded to this request, one commenter did 
suggest that a clarification of the adviser recordkeeping rule could 
assist in understanding their obligations under the rule.\388\ We are 
modifying the text of the proposed recordkeeping rules for registered 
investment advisers and registered and unregistered investment 
companies to provide in the final amendments the same detailed 
description as found in the rule text for broker-dealers and transfer 
agents. This should provide specificity as to what records are required 
to be kept under all of the recordkeeping rules.\389\ In addition, and 
in a change from the proposal, we are modifying the final rules to 
require a covered institution to retain any written documentation from 
the Attorney General related to a delay in notice.\390\ This should 
help ensure that a covered institution can justify a valid delay in 
sending notifications to affected individuals and aid the Commission's 
examination and oversight program.
---------------------------------------------------------------------------

    \387\ See proposed 17 CFR 240.17a-4, 17 CFR 240.17ad-7, and 17 
CFR 275.204-2.
    \388\ IAA Comment Letter.
    \389\ See Proposing Release at section II.D.
    \390\ See e.g., final 17 CFR 240.17a-4(e)(14)(iii) and final 
rule 248.30(c)(iii).
---------------------------------------------------------------------------

    The records that will be required under these amendments are:

     Written policies and procedures required to be adopted 
and implemented pursuant to final rule 248.30(a)(1), which requires 
policies and procedures to address administrative, technical, and 
physical safeguards for the protection of customer information;
     Written documentation of any detected unauthorized 
access to or use of customer information, as well as any response 
to, and recovery from such unauthorized access to or use of customer 
information required by final rule 248.30(a)(3);
     Written documentation of any investigation and 
determination made regarding whether notification to affected 
individuals is required pursuant to final rule 248.30(a)(4), 
including the basis for any determination made, any written 
documentation from the Attorney General related to a delay in 
notice, as well as a copy of any notice transmitted following such 
determination; \391\
---------------------------------------------------------------------------

    \391\ Covered institutions are required to preserve a copy of 
any notice transmitted following the determination required under 
the final amendments, including those notices provided by the 
service provider to the covered institution's customers on behalf of 
the covered institution. See e.g., final 17 CFR 270.31a-
1(b)(13)(iii) (requiring registered investment companies to keep a 
copy of ``any notice transmitted following such determination'') 
(emphasis added); see also supra Section II.A.4.c.
---------------------------------------------------------------------------

     Written policies and procedures required to be adopted 
and implemented pursuant to final rule 248.30(a)(5)(i), which 
requires policies and procedures to oversee, monitor, and conduct 
due diligence on service providers, including to ensure that the 
covered institution is notified when a breach in security has 
occurred at the service provider;
     Written documentation of any contract or agreement 
between a covered institution and a service provider entered into 
pursuant to final rule 248.30(a)(5); and
     Written policies and procedures required to be adopted 
and implemented pursuant to final rule 248.30(b)(2), which requires 
policies and procedures to address the proper disposal of consumer 
information and customer information.

    The records that will be required include records of policies and 
procedures under the safeguards rule that address administrative, 
technical, and physical safeguards for the protection of customer 
information.\392\ The requirements will also include

[[Page 47723]]

records documenting, among other things: (i) a covered institution's 
assessments of the nature and scope of any incidents involving 
unauthorized access to or use of customer information; (ii) steps taken 
to contain and control such incidents; and (iii) a covered 
institution's notifications to affected individuals consistent with the 
requirements of the final amendments as discussed above, or, where 
applicable, any determination that notification is not required after a 
reasonable investigation of the incident.\393\ Records required to be 
made and maintained will also include records of those written policies 
and procedures associated with the service provider notification 
requirements of the final amendments as well as related records of 
written contracts and agreements between the covered institution and 
the service provider.\394\
---------------------------------------------------------------------------

    \392\ See, e.g., final 17 CFR 240.17a-4(e)(14)(i) and final 17 
CFR 270.31a-1(b)(13)(i); see also final rule 248.30(a)(1).
    \393\ See, e.g., final 17 CFR 17a-4(e)(14)(ii) and (iii) and 
final 17 CFR 270.31a-1(b)(13)(ii) and (iii); see also final rule 
248.30(a)(3)(i) through (iii).
    \394\ See, e.g., final 17 CFR 17a-4(e)(14)(iv) and (v) and final 
17 CFR 270.31a-1(b)(13)(iv) and (v); see also final rule 
248.30(a)(5)(i) through (ii).
---------------------------------------------------------------------------

    The disposal rule, as amended, will require that every covered 
institution adopt and implement written policies and procedures that 
address the proper disposal of consumer information and customer 
information.\395\ The only record required under the final amendments 
for purposes of the disposal rule is these written policies and 
procedures.\396\
---------------------------------------------------------------------------

    \395\ See final rule 248.30(b)(2). While the disposal rule does 
not currently require covered institutions to adopt and implement 
written policies and procedures, those adopted pursuant to the 
current safeguards rule should already cover disposal. See Disposal 
Rule Adopting Release at text accompanying n.20 (``proper disposal 
policies and procedures are encompassed within, and should be a part 
of, the overall policies and procedures required under the safeguard 
rule.''). Therefore, rule 248.30(b)(2) is intended primarily to seek 
sufficient documentation of policies and practices addressing the 
specific provisions of the disposal rule.
    \396\ See, e.g., final 17 CFR 17a-4(e)(14)(vi) and final 17 CFR 
270.31a-1(b)(13)(vi); see also final rule 248.30(b)(2).
---------------------------------------------------------------------------

D. Exception From Requirement To Deliver Annual Privacy Notice

    Currently, Regulation S-P generally requires broker-dealers, 
investment companies, and registered investment advisers to provide 
customers with annual notices informing them about the institutions' 
privacy practices (``annual privacy notice'').\397\ The Commission is 
adopting as proposed amendments to conform Regulation S-P to the 
requirements of the Fixing America's Surface Transportation Act (``FAST 
Act''),\398\ which provides an exception to the annual privacy notice 
required by Regulation S-P, provided certain requirements are met. As 
proposed, we are amending Regulation S-P to include an exception to the 
annual privacy notice requirement if the institution (1) only provides 
non-public personal information to non-affiliated third parties when an 
exception to third-party opt-out applies and (2) the institution has 
not changed its policies and practices with regard to disclosing non-
public personal information from its most recent disclosure sent to 
customers.\399\ The amendments also, as proposed, provide the timing 
for when an institution must resume providing annual privacy notices in 
the event that the institution changes its policies and practices such 
that the exception no longer applies. We received one comment 
supporting the proposed exception and timing requirements.\400\
---------------------------------------------------------------------------

    \397\ 17 CFR 248.4; 248.5. ``Annually'' for these purposes is 
defined as at least once in any period of 12 consecutive months 
during which that relationship exists. Institutions are permitted to 
define the 12-consecutive-month period, but must apply it to the 
customer on a consistent basis. 17 CFR 248.5(a)(1). The institution 
does not need to provide an annual notice in addition to an initial 
notice in the same 12-month period.
    \398\ Public Law 114-94, Sec. 75001, 129 Stat. 1312 (2015) 
(adding section 503(f) to the GLBA, codified at 15 U.S.C. 6803(f)).
    \399\ See final 17 CFR 248.5(e)(1).
    \400\ ICI Comment Letter.
---------------------------------------------------------------------------

    We are adopting as proposed amendments to the annual notice 
provision requirement of Regulation S-P to include the exception to the 
annual notice delivery added by the statutory exception Congress 
enacted in the FAST Act. The statutory exception states that a 
financial institution that meets the requirements for the annual 
privacy notice exception will not be required to provide annual privacy 
notices ``until such time'' as that financial institution fails to 
comply with the conditions to the exception, but does not specify a 
date by which the annual privacy notice delivery must resume.\401\ The 
amended timing requirements are designed to be consistent with the 
existing timing requirements for privacy notice delivery in Regulation 
S-P. Specifically, if the change in policies and practices will also 
result in the institution being required to send a revised privacy 
notice under the current requirements, the revised notice will be 
treated as an initial notice for the purpose of the timing requirement 
and the institution will be required to resume notices at the same time 
it otherwise provides annual privacy notices.\402\ If a revised notice 
is not required, the institution will be required to resume providing 
annual privacy notices within 100 days of the change. The amendments 
allow institutions to preserve their existing approach to selecting a 
delivery date for annual privacy notices, thereby avoiding the 
potential burdens of determining delivery dates based on a new approach 
and any 100-day period will accommodate the institution delivering the 
privacy notice alongside any quarterly reporting to customers. The 
amendments also are intended to be consistent with existing privacy 
notice delivery requirements of the CFTC, CFPB, and FTC.\403\
---------------------------------------------------------------------------

    \401\ See supra footnote 398.
    \402\ See 17 CFR 248.8.
    \403\ See 17 CFR 160.5(D) (CFTC); 12 CFR 1016.5(e)(2) (CFPB); 16 
CFR 313.5(e)(2) (FTC). See also CFTC, Privacy of Consumer Financial 
Information--Amendment to Conform Regulations to the Fixing 
America's Surface Transportation Act, 83 FR 63450 (Dec. 10, 2018), 
at n.17; CFPB, Amendment to the Annual Privacy Notice Requirement 
Under the Gramm-Leach-Bliley Act (Regulation P) 83 FR 40945 (Aug. 
17, 2018); FTC, Privacy of Consumer Financial Information Rule Under 
the Gramm-Leach-Bliley Act, 84 FR 13150 (Apr. 4, 2019).
---------------------------------------------------------------------------

E. Existing Staff No-Action Letters and Other Staff Statements

    As stated in the Proposing Release, certain staff letters and other 
staff statements addressing Regulation S-P and other matters covered by 
the final amendments may be withdrawn or rescinded in connection with 
this adoption. Upon the compliance date of these rules, staff letters 
and other staff statements, or portions thereof, will be withdrawn or 
rescinded to the extent that they are moot, superseded, or otherwise 
inconsistent with the rules. This may include the letters and 
statements below. To the extent any staff statement is inconsistent or 
conflicts with the requirements of the rules, even if not specifically 
identified below, that statement is superseded.

                     Table 2--Letters and Statements
------------------------------------------------------------------------
        Name of letter or statement                  Date issued
------------------------------------------------------------------------
Staff Responses to Questions about          Jan. 23, 2003.
 Regulation S-P.
Certain Disclosures of Information to the   Mar. 11, 2011; Dec. 11,
 CFP Board.                                  2014.
Investment Adviser and Broker-Dealer        Apr. 16, 2019.
 Compliance Issues Related to Regulation S-
 P--Privacy Notices and Safeguard Policies.
------------------------------------------------------------------------

F. Compliance Period

    The Commission is providing an 18-month compliance period after the 
date of publication in the Federal Register for larger entities, and a 
24-month compliance period after the date of publication in the Federal 
Register for

[[Page 47724]]

smaller entities. Table 3 below outlines which entities will be 
considered ``larger entities'' for these purposes. Smaller entities 
will be those covered institutions that do not meet these standards. 
The Commission generally has approved similar tiered compliance dates 
with respect to smaller versus larger entities in the past and, in our 
experience, these thresholds are a reasonable means of distinguishing 
larger and smaller entities for purposes of tiered compliance dates for 
rules affecting these entities.\404\
---------------------------------------------------------------------------

    \404\ See, e.g., Investment Company Names, Investment Company 
Act Release No. 35000 (Sept. 20, 2023) [88 FR 70436 (Oct. 27, 
2023)]; Investment Company Reporting Modernization, Investment 
Company Act Release No. 32314 (Oct. 13, 2016) [81 FR 81870 (Nov. 18, 
2016)]; Investment Company Liquidity Risk Management Programs, 
Investment Company Act Release No. 32315 (Oct. 13, 2016) [81 FR 
82142 (Nov. 18, 2016)]; Inline XBRL Filing of Tagged Data, 
Securities Act Release No. 10514 (June 28, 2018) [83 FR 40846 (Sept. 
17, 2018)]; and Private Fund Advisers; Documentation of Registered 
Investment Adviser Compliance Reviews, Investment Advisers Act 
Release No. 6383 (Aug. 23, 2023) [88 FR 63206 (Sept. 14, 2023)].

                 Table 3--Designation of Larger Entities
------------------------------------------------------------------------
                                          Qualification to be considered
                 Entity                        a ``larger entity''
------------------------------------------------------------------------
Investment companies together with       Net assets of $1 billion or
 other investment companies in the same   more as of the end of the most
 group of related investment companies    recent fiscal year.
 \1\.
Registered investment advisers \2\.....  $1.5 billion or more in assets
                                          under management.
Broker-dealers \3\.....................  All broker-dealers that are not
                                          small entities under the
                                          Securities Exchange Act for
                                          purposes of the Regulatory
                                          Flexibility Act.
Transfer agents \4\....................  All transfer agents that are
                                          not small entities under the
                                          Securities Exchange Act for
                                          purposes of the Regulatory
                                          Flexibility Act.
------------------------------------------------------------------------
Note:
\1\ ``Group of related investment companies'' is as defined in 17 CFR
  270.0-10. We estimate that, as of September 2023, 77% of registered
  investment companies would be considered to be larger entities. This
  estimate is based on data reported in response to Items B.5, C.19, and
  F.11 on Form N-CEN.
\2\ We estimate that, as of September 2023, 23% of registered investment
  advisers would be considered to be larger registered investment
  advisers. This estimate is based on data reported in response to Items
  2.A and 5.F.2.(c) on Form ADV.
\3\ A broker or dealer is a small entity if it: (i) had total capital of
  less than $500,000 on the date in its prior fiscal year as of which
  its audited financial statements were prepared or, if not required to
  file audited financial statements, on the last business day of its
  prior fiscal year; and (ii) is not affiliated with any person that is
  not a small entity. This threshold was chosen to include all broker-
  dealers who do not fall within the definition of a small entity under
  the Regulatory Flexibility Act (5 U.S.C. 553). Based upon FOCUS
  filings for the third quarter of 2023, we estimate approximately 77%
  of broker-dealers, not including funding portals, would be considered
  larger entities. Based upon staff analysis and review of public
  filings, we estimate approximately 3% of funding portals would be
  considered larger entities.
\4\ A transfer agent is a small entity if it: (i) received less than 500
  items for transfer and less than 500 items for processing during the
  preceding six months; (ii) transferred items only of issuers that are
  small entities; (iii) maintained master shareholder files that in the
  aggregate contained less than 1,000 shareholder accounts or was the
  named transfer agent for less than 1,000 shareholder accounts at all
  times during the preceding fiscal year; and (iv) is not affiliated
  with any person that is not a small entity. 17 CFR 240.0-10. This
  threshold was chosen to include all transfer agents who do not fall
  within the definition of a small entity under the Regulatory
  Flexibility Act. Based on the number of transfer agents that reported
  a value of fewer than 1,000 for items 4(a) and 5(a) on Form TA-2 filed
  with the Commission as of September 30, 2023, we estimate
  approximately 132 transfer agents may be considered small entities, of
  315 total registered transfer agents. See infra section VI.

    We proposed a 12-month transition period from the effective date 
for all covered institutions, regardless of asset size, and we 
solicited comment on whether the compliance period should be shorter or 
longer, and whether it should be the same for all covered institutions. 
Commenters that addressed this aspect of the proposal urged the 
Commission to provide additional time, generally suggesting a two-year 
or three-year period to provide time for covered institutions to 
prepare to comply with the rule's requirements.\405\ Commenters 
suggested that the proposed compliance period underestimates the time 
it would take to implement any final rule.\406\ In particular, 
commenters expressed that advisers will need to holistically reassess 
their current service provider infrastructure and may need time to find 
new service providers or renegotiate terms of service provider 
agreements in order to comply with the rule's requirements.\407\ 
Separately, two commenters urged the Commission to consider a tiered 
compliance period that staggers the compliance date based on firm size, 
with larger firms having to comply with the rule's requirements prior 
to smaller firms.\408\ These commenters asserted that a longer 
compliance period for smaller broker-dealers and investment advisers 
would allow these firms to benefit from the implementation of larger 
industry participants.
---------------------------------------------------------------------------

    \405\ See, e.g., SIFMA Comment Letter 2; Computershare Comment 
Letter; ICI Comment Letter 1; Federated Comment Letter; Google 
Comment Letter.
    \406\ See, e.g., IAA Comment Letter 1; FII Comment Letter; SIFMA 
Comment Letter 2; ICI Comment Letter 1; see also IAA Comment Letter 
2 (stating that ``advisers would need to holistically reassess their 
current service provider infrastructure and undergo the time-
consuming and expensive process of negotiating terms with each 
Service Provider, re-evaluate their current policies, procedures, 
and practices in light of any new requirements, prepare for new and/
or different client notification obligations, and create and 
implement modified written incident response program policies and 
procedures and recordkeeping requirements'').
    \407\ See, e.g., Google Comment Letter; Federated Comment 
Letter; SIFMA Comment Letter 2; AWS Comment Letter; FII Comment 
Letter.
    \408\ IAA Comment Letter 1; FSI Comment Letter.
---------------------------------------------------------------------------

    We have taken commenter concerns into account in determining the 
compliance schedule,\409\ and we are adopting a compliance period of 
18-months following the date of publication of the final amendments in 
the Federal Register for larger entities, and 24-months following the 
date of publication in the Federal Register for smaller entities.\410\ 
The compliance period we are adopting is designed to

[[Page 47725]]

strike the appropriate balance between allowing covered institutions 
adequate time to establish or adjust their data notification compliance 
practices and allowing customers and investors to benefit from the 
amended Regulation S-P framework. Taking concerns of smaller entities 
into account, smaller entities will benefit from having an additional 
six months to come into compliance with the final amendments, based on 
feedback from commenters and to the extent that smaller entities may 
face additional or different challenges in coming into compliance with 
the final amendments than larger entities. Although we are providing 
for a longer compliance period than proposed, we are not providing more 
than 18 or 24 months, as suggested by some commenters, because we have 
made modifications from the proposal that should alleviate commenters' 
concerns related to time needed to establish and implement processes to 
comply with the final amendments. In a modification from the proposal, 
the final amendments will no longer require covered institutions to 
have a written contract with its service providers mandating that 
service providers take appropriate measures to protect against 
unauthorized access to or use of customer information, but will instead 
require covered institutions to establish written policies and 
procedures reasonably designed to oversee, monitor, and conduct due 
diligence on service providers.\411\ Accordingly, the compliance dates 
will provide an appropriate amount of time for covered institutions to 
comply with the final amendments.
---------------------------------------------------------------------------

    \409\ ICI Comment Letter 1; Schulte Comment Letter; IAA Comment 
Letter 2 (asserting that the Commission's new rules could 
potentially require investment advisers to establish and implement 
new regulatory requirements during compressed and overlapping 
compliance periods while attempting to comply with existing ongoing 
regulatory obligations). For further discussion of other recent 
Commission rules that may have overlapping compliance periods for 
some covered entities, as well as the potential associated costs 
associated with implementing multiple rules at once, see infra 
section IV.
    \410\ With respect to the compliance period, commenters 
requested the Commission consider interactions between the proposed 
rule and other recent Commission rules. In determining compliance 
dates, the Commission considers the benefits of the rules as well as 
the costs of delayed compliance dates and potential overlapping 
compliance dates. For the reasons discussed throughout the release, 
to the extent that there are costs from overlapping compliance 
dates, the benefits of the rule justify such costs. See infra 
section IV for a discussion of the interactions of the final 
amendments with certain other Commission rules.
    \411\ See supra section II.A.4.
---------------------------------------------------------------------------

III. Other Matters

    Pursuant to the Congressional Review Act,\412\ the Office of 
Information and Regulatory Affairs has designated the final amendments 
as a ``major rule'' as defined by 5 U.S.C. 804(2). If any of the 
provisions of these rules, or the application thereof to any person or 
circumstance, is held to be invalid, such invalidity shall not affect 
other provisions or application of such provisions to other persons or 
circumstances that can be given effect without the invalid provision or 
application.
---------------------------------------------------------------------------

    \412\ 5 U.S.C. 801 et seq.
---------------------------------------------------------------------------

IV. Economic Analysis

A. Introduction

    The Commission is mindful of the economic effects, including the 
benefits and costs, of the adopted amendments. Section 3(f) of the 
Exchange Act, section 2(c) of the Investment Company Act, and section 
202(c) of the Investment Advisers Act provide that when engaging in 
rulemaking that requires us to consider or determine whether an action 
is necessary or appropriate in or consistent with the public interest, 
to also consider, in addition to the protection of investors, whether 
the action will promote efficiency, competition, and capital formation. 
Section 23(a)(2) of the Exchange Act also requires us to consider the 
effect that the rules will have on competition and prohibits us from 
adopting any rule that would impose a burden on competition not 
necessary or appropriate in furtherance of the Exchange Act. The 
analysis below addresses the likely economic effects of the final 
amendments, including the anticipated and estimated benefits and costs 
of the amendments and their likely effects on efficiency, competition, 
and capital formation. The Commission also discusses the potential 
economic effects of certain alternatives to the approaches taken in 
this adoption.
    The final amendments require every broker-dealer,\413\ every 
funding portal,\414\ every investment company, every registered 
investment adviser, and every transfer agent to notify affected 
customers of certain data breaches.\415\ To that end, the final 
amendments require these covered institutions to develop, implement, 
and maintain written policies and procedures that include an incident 
response program that is reasonably designed to detect, respond to, and 
recover from unauthorized access to or use of customer 
information,\416\ and that includes a customer notification component 
for cases where sensitive customer information has been, or is 
reasonably likely to have been, accessed or used without 
authorization.\417\ The final amendments also define the scope of 
information covered by the safeguards rule and by the disposal 
rule,\418\ and extend the covered population to all transfer agents 
registered with the Commission or with another appropriate regulatory 
agency.\419\ Finally, the final amendments impose various related 
recordkeeping requirements,\420\ and include in the regulation an 
existing statutory exception to annual privacy notice 
requirements.\421\
---------------------------------------------------------------------------

    \413\ Notice-registered broker-dealers subject to and complying 
with the financial privacy rules of the CFTC will be deemed to be in 
compliance with the final provision through the substituted 
compliance provisions of Regulation S-P. See supra section II.B.3. 
As discussed above, unless otherwise stated, references elsewhere in 
this release to ``brokers'' or ``broker-dealers'' include funding 
portals. See supra footnote 5. For the purposes of this economic 
analysis, however, ``broker'' and ``broker-dealer'' do not include 
funding portals because the economic effects of the final amendments 
on funding portals differ in some respects from the effects on 
broker-dealers.
    \414\ Pursuant to Regulation Crowdfunding, funding portals 
``must comply with the requirements of [Regulation S-P] as they 
apply to brokers.'' See 17 CFR 227.403(b); see also supra footnote 5 
and accompanying text.
    \415\ Notification is required in the event that sensitive 
customer information was, or is reasonably likely to have been, 
accessed or used without authorization. See final rule 
248.30(a)(4)(i).
    \416\ As discussed above, ``customer information'' includes not 
only information of customers of the aforementioned entities, but 
also information of customers of other financial institutions in the 
possession of covered institutions. See supra section II.B.1 and 
final rule 248.30(d)(5)(i). In addition, with respect to transfer 
agents, ``customers'' refers to ``any natural person who is a 
securityholder of an issuer for which the transfer agent acts or has 
acted as a transfer agent.'' See final rule 248.30(d)(4)(ii).
    \417\ See final rule 248.30(a)(4); see also supra section II.A. 
Notice will not be required, however, if a covered institution has 
determined, after a reasonable investigation of the facts and 
circumstances of an incident of unauthorized access to or use of 
sensitive customer information, that sensitive customer information 
has not been, and is not reasonably likely to be, used in a manner 
that would result in substantial harm or inconvenience.
    \418\ Under the final amendments, the safeguards rule applies to 
``customer information'' and the disposal rule applies to ``consumer 
information'' and ``customer information.'' See final rule 
248.30(a)(1), 248.30(b), 248.30(d)(1), and 248.30(d)(5).
    \419\ See final rule 248.30(d)(3).
    \420\ See, e.g., final rule 17 CFR 275.204-2(a). See also supra 
section II.C and footnote 385.
    \421\ See final rule 248.5(e).
---------------------------------------------------------------------------

    The final amendments will affect covered institutions as well as 
customers who will receive the required notices. The final amendments 
will also have indirect effects on service providers that receive, 
maintain, process, or otherwise are permitted access to customer 
information on behalf of covered institutions: under the final 
amendments, unauthorized access to or use of sensitive customer 
information via service providers will fall under the customer 
notification requirement. The final amendments require that a covered 
institution's incident response program include the establishment, 
maintenance, and enforcement of written policies and procedures 
reasonably designed to require oversight, including through due 
diligence and monitoring, of service providers.\422\ These policies and 
procedures must be reasonably designed to ensure that service providers 
take appropriate measures to protect against unauthorized access to or 
use of customer information and provide notification to the covered 
institution of a breach of security resulting in

[[Page 47726]]

unauthorized access to a customer information system maintained by the 
service provider.\423\
---------------------------------------------------------------------------

    \422\ See final rule 248.30(a)(5).
    \423\ See id.
---------------------------------------------------------------------------

    The main economic effects of the final amendments will result from 
the notification and incident response program requirements applicable 
to all covered institutions.\424\ For reasons discussed later in this 
section, the extension of Regulation S-P to transfer agents will have 
more limited economic effects.\425\ Finally, we anticipate the 
recordkeeping requirements and the incorporation of the existing 
statutory exception to annual privacy notice requirements to have 
minimal economic effects, as discussed further below.\426\
---------------------------------------------------------------------------

    \424\ See infra sections IV.D.1.a and IV.D.1.b.
    \425\ See infra section IV.D.2.b.
    \426\ See infra sections IV.D.3 and IV.D.4.
---------------------------------------------------------------------------

    The main economic benefits of the final notification and incident 
response program requirements, as well as the extension of Regulation 
S-P to include all transfer agents, will result from enhanced 
protection of customer information. Customers will directly benefit 
from the opportunity to take appropriate mitigating actions to protect 
their accounts and information in the event of unauthorized access to 
or use of their sensitive information. Direct benefits will result from 
covered institutions allocating additional resources towards policies 
and procedures, information safeguards, and cybersecurity to comply 
with the final requirements. There may lastly be indirect benefits from 
covered institutions undertaking these actions to the extent they seek 
to avoid reputational harm resulting from the mandated notifications. 
These additional resources will contribute to reducing the exposure of 
covered institutions, and of the broader financial system, to incidents 
resulting in unauthorized access to or use of customer 
information.\427\ The main economic costs from these new requirements 
will be compliance costs related to the development and implementation 
of the required policies and procedures, reputational costs borne by 
firms that would not otherwise have notified customers of a data 
breach, and indirect costs from increased expenditures on additional 
safeguards for covered institutions who will choose to make such 
investments to avoid such reputational costs.\428\
---------------------------------------------------------------------------

    \427\ While the scope of the safeguards rule and of the final 
amendments is not limited to cybersecurity, in the contemporary 
context, their main economic effects are realized through their 
effects on cybersecurity. See infra footnote 507.
    \428\ Throughout this economic analysis, ``compliance costs'' 
refers to the direct costs that must be borne in order to avoid 
violating the Commission's rules. This includes costs related to the 
development of policies and procedures required by the regulation, 
costs related to delivery of the required notices, and the direct 
costs of any other required action. As used here, ``compliance 
costs'' excludes costs that are not required, but may nonetheless 
arise as a consequence of the Commission's rules (e.g., reputational 
costs resulting from disclosure of data breach, or increased 
cybersecurity spending aimed at avoiding such reputational costs).
---------------------------------------------------------------------------

    We anticipate that the economic benefits and costs of the final 
notification requirements will--in the aggregate--be limited because 
all States already require some form of customer notification of 
certain data breaches,\429\ and because many entities are likely to 
already have response programs in place.\430\ Many customers already 
receive some level of data breach notification under other laws. This 
means that the benefits and costs, both direct and indirect, will only 
accrue from actions taken by covered institutions that are not already 
required by existing rules or caused by existing competitive forces. 
The final amendments will, however, afford many individuals greater 
protections by, for example, defining ``sensitive customer 
information'' more broadly than the current definitions used by certain 
States; \431\ providing for a 30-day notification outside timeframe 
that is shorter than the timing currently mandated by many States, 
including States providing for no deadline or those allowing for 
various delays; \432\ and providing for a more robust notification 
trigger than in many States.\433\ The final amendments also limit the 
time a service provider can take to notify a covered institution of a 
breach to 72 hours, which is a shorter period of time than mandated by 
many States, allowing covered institutions to notify their customers 
faster if such notification is required under the final 
amendments.\434\ Further, in certain States, State customer 
notification laws do not apply to entities subject to or in compliance 
with the GLBA, and the final amendments will help ensure that customers 
residing in these States receive notice of a breach if it occurs.\435\ 
The final amendments will help ensure that all customers, regardless of 
where they reside, receive a minimum of information regarding a given 
breach affecting their information and are therefore equally able to 
take appropriate mitigating actions.
---------------------------------------------------------------------------

    \429\ See infra section IV.C.2.a.
    \430\ See infra sections IV.C.1 and IV.C.2.
    \431\ See infra section IV.D.1.b(3).
    \432\ See infra section IV.D.1.b(2).
    \433\ See infra section IV.D.1.b(4).
    \434\ Upon receipt of such a notification from a service 
provider, a covered institution must initiate its incident response 
program. This may or may not result in the covered institution 
having to notify customers. See final rule 248.30(a)(5)(i); infra 
section IV.D.1.c.
    \435\ See infra section IV.D.1.b(1).
---------------------------------------------------------------------------

    For these reasons, the final requirements will improve customers' 
knowledge of when their sensitive information has been compromised. 
Specifically, we expect that the adopted Federal minimum standard for 
notifying customers of certain types of data breaches, along with the 
preparation of written policies and procedures for incident response, 
will result in more customers being notified of these data breaches as 
well as faster notifications for some customers, and that both of these 
effects will improve customers' ability to act to protect their 
personal information. Moreover, such improved notification will--in 
many cases--become public and impose additional reputational costs on 
covered institutions that fail to safeguard customers' sensitive 
information. We expect that these potential additional reputational 
costs will increase the disciplining effect on covered institutions, 
incentivizing them to improve customer information safeguards and 
reduce their exposure to data breaches, thereby improving the 
resilience of the financial system more broadly.\436\ This will reduce 
economic inefficiency in that it will better align customers' and 
covered institutions' incentives to safeguard customer information, but 
will also result in new indirect costs for covered institutions who 
choose to undertake these improvements in order to avoid those 
potential reputational costs. In addition, by revealing when breaches 
occur, the final amendments will help provide customers with 
information on the effectiveness of covered institutions' customer 
information safeguards, further helping customers make better-informed 
decisions when choosing a covered institution.\437\
---------------------------------------------------------------------------

    \436\ As discussed below, the final amendments could result in 
unnecessary notification, which could lead to customer 
desensitization. See infra section IV.D.1. Unnecessary notification 
could decrease covered institutions' incentives to invest in 
customer information safeguards in order to avoid reputational costs 
if unnecessary notification, for example, desensitizes customers to 
notices. In that scenario, those reputational costs are themselves 
reduced as a result of unnecessary notification. See infra section 
IV.D.1.b(4) for a discussion of the effects of unnecessary 
notification.
    \437\ See infra section IV.B.
---------------------------------------------------------------------------

    To the extent that a covered institution does not have policies and 
procedures to safeguard customer information and respond to 
unauthorized access to or use of customer information, it will bear the 
costs to develop and implement the

[[Page 47727]]

required policies and procedures for the incident response 
program.\438\ Moreover, transfer agents--who were not subject to any of 
the customer information safeguard provisions of Regulation S-P prior 
to this adoption--will face additional compliance costs related to the 
development of policies and procedures that address administrative, 
technical, and physical safeguards for the protection of customer 
information.\439\
---------------------------------------------------------------------------

    \438\ See infra section IV.D.1 for a discussion of these costs.
    \439\ That is, they will face the compliance costs of the 
provisions of Regulation S-P not applicable to registered transfer 
agents before this adoption. See 17 CFR 248.30(a). In addition, 
transfer agents registered with a regulatory agency other than the 
Commission will face additional compliance costs to develop, 
implement, and maintain written policies and procedures that address 
the proper disposal of customer information, as these transfer 
agents were not subject to the disposal rule before this adoption. 
See 17 CFR 248.30(b); see also infra section IV.D.2.b for a 
discussion of these costs.
---------------------------------------------------------------------------

    As adopting policies and procedures involves fixed costs, doing so 
is very likely to impose a proportionately larger compliance cost on 
smaller covered institutions as compared to larger covered 
institutions.\440\ This may reduce smaller covered institutions' 
ability to compete with their larger peers, for whom the fixed costs 
are spread over more customers.\441\ However, given the considerable 
competitive challenges arising from economies of scale and scope 
already faced by smaller firms, we do not anticipate that the costs 
associated with this adoption will significantly alter these 
challenges. Similarly, although the final amendments may lead to 
improvements to capital formation, existing State rules are similar in 
many respects to the amendments, and so we do not expect the amendments 
to have a significant impact on capital formation vis-[agrave]-vis the 
baseline.\442\
---------------------------------------------------------------------------

    \440\ If both large and small covered institutions were to 
undertake the same compliance activities, the fixed costs associated 
with these activities would impose a proportionately larger 
compliance cost on smaller covered institutions. See infra footnote 
722. As discussed below, smaller covered institutions may have to 
undertake additional activities compared to larger covered 
institutions, which would result in additional burdens. See, e.g., 
infra section IV.D.1.a.
    \441\ See infra sections IV.D.1 and IV.E.
    \442\ We acknowledge, however, that the final amendments could 
have incremental effects on capital formation, and we discuss these 
effects below. See infra section IV.E.
---------------------------------------------------------------------------

    Many of the benefits and costs discussed below are difficult to 
quantify. Doing so would involve estimating the losses likely to be 
incurred by a customer in the absence of mitigation measures, the 
efficacy of mitigation measures implemented with a given delay, and the 
expected delay before notification can be provided under the final 
amendments. In general, data needed to arrive at such estimates are not 
available to the Commission. Thus, while we have attempted to quantify 
economic effects where possible, much of the discussion of economic 
effects is qualitative in nature.

B. Broad Economic Considerations

    In a market with complete information, customers are able to 
perfectly observe the quality of the goods and services being provided 
and the processes and service provider relationships by which they are 
being provided. Fully informed customers can then decide what level of 
quality of good or service to consume, based on their own personal 
preferences. In this context, one element of a financial service's 
quality is the customer information safeguards of the firm providing 
the service, which capture the likelihood of a customer's information 
being exposed in the event of a breach, as well as the firm's response 
to such a breach if it were to occur.\443\ Under this assumption, a 
customer is then able to choose a financial firm that offers a service 
of a quality that meets his or her preferences.\444\
---------------------------------------------------------------------------

    \443\ The response includes elements such as detection, 
assessment, recovery, and the communication of the breach to the 
firm's customers.
    \444\ For example, a customer may be particularly averse to risk 
and consequently choose a financial firm with a higher level of 
information safeguards, even if this firm's service is being 
provided for a higher price.
---------------------------------------------------------------------------

    In the context of covered institutions--firms whose services 
frequently involve custody of highly sensitive customer information--
the assumption of complete information is unrealistic. Customers have 
little visibility into the internal processes of a firm and those of 
its service providers, so it is impractical for them to directly 
observe the level of customer information safeguards that a firm is 
employing.\445\ In addition, customers generally do not know how a firm 
would respond to a breach, including whether and to what extent a firm 
would inform its customers about such breach.\446\ In fact, firms often 
lack incentives to voluntarily disclose when information breaches occur 
(and likely have substantial incentives to avoid such disclosures). 
Hence, customer information could be compromised without the customers 
being informed or with the customers being only partially 
informed.\447\ As a result, prospective customers have limited ability 
to choose a covered institution that is offering the service that most 
closely meets their needs. In addition, current customers may be paying 
for a service that is of lower quality than they expect.\448\ In both 
cases, customers have limited ability to avoid covered institutions 
that fail to protect customer information to the level expected by 
these customers.\449\ Hence, this information asymmetry prevents market 
forces from penalizing covered institutions that fail to protect 
customer information, and therefore prevents market forces from 
yielding economically efficient outcomes. This market failure serves as 
the economic rationale for this regulatory intervention.
---------------------------------------------------------------------------

    \445\ As discussed below, customers already receive some 
information on covered institutions' customer information safeguards 
and disclosure of nonpublic personal information to third parties. 
See infra section IV.C.2.c.
    \446\ Even if a firm has been the subject of a breach in the 
past, it may have changed its procedures since the last breach. In 
this case, even knowing the firm's response to a previous breach 
would not be fully informative to customers.
    \447\ Here, customers are ``partially informed'' if the 
information they receive about the breach is not sufficient to allow 
them to take appropriate mitigating actions.
    \448\ It could also be the case that the true quality of the 
service is higher than what customers expect. In this case, the 
customers would not be harmed, but the firm would not be fully 
realizing the benefits from its investment in customer information 
safeguards.
    \449\ The release of information about data breaches can lead to 
loss of customers, reputational harm, litigation, or regulatory 
scrutiny. See, e.g., U.S. Fed. Trade Comm'n, Press Release, Equifax 
to Pay $575 Million as Part of Settlement with FTC, CFPB, and States 
Related to 2017 Data Breach (July 22, 2019), available at https://www.ftc.gov/news-events/news/press-releases/2019/07/equifax-pay-575-million-part-settlement-ftc-cfpb-states-related-2017-data-breach. 
See also James Mackay, 5 Damaging Consequences of Data Breach: 
Protect Your Assets (Dec. 15, 2023), available at https://www.metacompliance.com/blog/data-breaches/5-damaging-consequences-of-a-data-breach (stating that research has shown that up to a third 
of customers in retail, finance and healthcare would stop doing 
business with organizations that have been breached and that 85% 
would tell others about their experience) and 2019 Consumer Survey: 
Trust and Accountability in the Era of Data Misuse, Ping Identity, 
available at https://www.pingidentity.com/en/resources/content-library/misc/3464-2019-consumer-survey-trust-accountability.html 
(last visited Apr. 9, 2024) (describing a survey of more than 4,000 
individuals across the U.S., U.K., Australia, France, and Germany 
which found that 81% of people would stop engaging with a brand 
online following a data breach; this includes 25% who would stop 
interacting with the brand in any capacity).
---------------------------------------------------------------------------

    The information asymmetry can lead to three inefficiencies. First, 
the information asymmetry about specific information breaches that have 
occurred prevents individual customers whose information has been 
compromised from taking timely actions (e.g., increased monitoring of 
account activity or placing blocks on credit reports) necessary to 
mitigate the potential

[[Page 47728]]

consequences of such breaches. Second, the information asymmetry about 
covered institutions' efforts at avoiding and limiting the consequences 
of such breaches can lead to customers choosing financial firms with 
levels of safeguards different from what they expect, which can result 
in customers choosing firms that they would not have otherwise chosen 
if provided with better information. Third, this asymmetry can also 
reduce covered institutions' incentives to sufficiently safeguard 
customer information. As a result, they could devote too little effort 
(i.e., ``underspend'') toward safeguarding this information, thereby 
increasing the probability of the information being compromised in the 
first place.\450\ This scenario is often characterized as a moral 
hazard problem. When an agent's actions cannot be observed or directly 
contracted for by the principal, it is difficult to induce the agent to 
supply the proper amounts of productive inputs.\451\ In other words, 
information asymmetry prevents covered institutions (the agents) that 
spend more effort on safeguarding customer information from having 
customers (the principals) recognize their extra efforts and therefore 
prevents the covered institutions from realizing some of the benefits 
associated with this additional effort.\452\ This reduces the 
incentives for covered institutions to exert effort towards 
safeguarding information.\453\
---------------------------------------------------------------------------

    \450\ For example, in a recent survey of financial firms, 58% of 
the respondents self-reported ``underspending'' on cybersecurity. 
See McKinsey & Co. and Institute of International Finance, IIF/
McKinsey Cyber Resilience Survey (Mar. 2020), available at https://www.iif.com/portals/0/Files/content/cyber_resilience_survey_3.20.2020_print.pdf (``IIF/McKinsey 
Report''). A total of 27 companies participated in the survey, with 
23 having a global footprint. Approximately half of respondents were 
European or U.S. Globally Systemically Important Banks (G-SIBs).
    \451\ See, e.g., Bengt Holmstrom, Moral Hazard and 
Observability, 10 Bell J. Econ. 74-91 (1979) (``It has long been 
recognized that a problem of moral hazard may arise when individuals 
engage in risk sharing under conditions such that their privately 
taken actions affect the probability distribution of the outcome [. 
. .]. The source of this moral hazard or incentive problem is an 
asymmetry of information among individuals that results because 
individual actions cannot be observed and hence contracted upon.''); 
Bengt Holmstrom, Moral Hazard in Teams, 13 Bell J. Econ. 324-340 
(1982) (``Moral hazard refers to the problem of inducing agents to 
supply proper amounts of productive inputs when their actions cannot 
be observed and contracted for directly.''). In other contexts, 
moral hazard refers to a party taking on excessive risk when knowing 
another party will be responsible for negative outcomes. This 
alternative definition may be viewed as a special case within the 
broader economic definition associated with the difficulty of 
contracting for privately taken actions. See, e.g., Adam Carpenter, 
Moral Hazard Definition, U.S. News (Aug. 11, 2022; updated Dec. 8, 
2023), available at https://money.usnews.com/investing/term/moral-hazard.
    \452\ Such benefits include attracting customers who are willing 
to pay more for enhanced security, thereby allowing these covered 
institutions to charge a higher price for their services.
    \453\ This is not to say that firms do not have any incentives 
to invest in customer information safeguards. As discussed below, 
firms themselves are hurt by incidents resulting in unauthorized 
access to or use of customer information and therefore have 
incentives to invest in safeguards even when these incidents remain 
unknown to their customers. See infra section IV.C.1.
---------------------------------------------------------------------------

    We expect the final amendments may mitigate the inefficiencies 
described above in several ways. First, by helping facilitate timely 
and informative notices to customers when their information is 
compromised, the amendments may mitigate information asymmetries around 
the compromise of information and improve customers' ability to take 
appropriate remedial actions. Second, by revealing when such events 
occur, the amendments may help customers draw inferences about a 
covered institution's efforts toward protecting customer information, 
which might help inform their choice of covered institution and reduce 
the probability of customers inadvertently choosing a firm that is less 
likely to meet their preferences or needs.\454\ This, in turn, might 
provide firms with greater incentives to exert effort toward protecting 
customer information,\455\ thereby mitigating the moral hazard problem. 
And, by imposing a regulatory requirement to develop, implement, and 
maintain policies and procedures, the final amendments might further 
enhance firms' cybersecurity preparations and will restrict firms' 
ability to limit efforts in these areas.
---------------------------------------------------------------------------

    \454\ In the case of transfer agents and funding portals, such 
effects would usually be mediated through security-issuing firms' 
choice of transfer agent or funding portal and therefore be less 
direct. Nonetheless we expect that, all else being equal, firms 
would prefer to avoid employing the services of transfer agents or 
funding portals that have been unable to prevent investors' 
information from being compromised.
    \455\ See, e.g., Richard J. Sullivan & Jesse Leigh Maniff, Data 
Breach Notification Laws, 101 Econ. Rev. 65 (2016) (``Sullivan & 
Maniff'').
---------------------------------------------------------------------------

    The effectiveness of the final amendments at mitigating these 
problems will depend on several factors. First, the effectiveness of 
the amendments will depend on the degree to which breach notification 
provides customers with sufficient actionable information in a 
sufficient timeframe to help them mitigate the effects of the 
compromise of sensitive customer information. Second, it will depend on 
customers' ability to draw inferences on a covered institution's 
protection of customer information based on the notifications they 
receive, or the absence thereof.\456\ Third, it will also depend on the 
degree to which the prospect of issuing such notices--and the prospect 
of the reputational harm, litigation, and regulatory scrutiny that 
could ensue--helps alleviate underspending on safeguarding customer 
information.\457\ These factors themselves depend on the extent to 
which covered institutions already have in place processes and 
practices that satisfy the final requirements and therefore on the 
extent to which the amendments will induce improvements to existing 
practices relative to the baseline.\458\
---------------------------------------------------------------------------

    \456\ Because breaches can happen even at firms with very high 
customer information safeguards, and because firms with very low 
levels of safeguards might never be victim of a breach, customers' 
ability to draw inferences could be limited.
    \457\ Although empirical evidence on the effectiveness of 
notification breach laws (that is, on how such laws help individuals 
mitigate the effects of a breach and how they prevent such breaches 
from occurring by influencing firms' levels of safeguards) is quite 
limited, extant studies suggest that such laws protect consumers 
from harm. See Sasha Romanosky et al., Do Data Breach Disclosure 
Laws Reduce Identity Theft?, 30 J. Pol'y Analysis & Mgmt 256 (2011); 
see also Sullivan & Maniff, supra footnote 455.
    \458\ This economic analysis presents evidence suggesting that 
the inefficiencies described above do exist in this context, and 
therefore suggesting that covered institutions' existing processes 
and practices can be improved. See infra footnote 464 and 
accompanying text for evidence that some notices do not currently 
contain sufficient information for customers to take appropriate 
mitigating actions and infra section IV.D.1.b(2) for evidence that 
such notices are sometimes sent with such delay as to make it 
difficult for customers to take ``timely'' mitigating actions; see 
also supra footnote 449 for evidence that customers would modify the 
firms with which they do business if they learned that this firm was 
the victim of a breach, suggesting that such customers do draw 
inferences on firms' customer information safeguards when learning 
that breaches occur and modify their behavior as a result; see also 
infra section IV.C.1 for evidence that some firms are currently 
underspending on cybersecurity.
---------------------------------------------------------------------------

    Some commenters supported generally the economic rationale in the 
Proposing Release.\459\ Some of these commenters expressed that the 
asymmetric information market failure was present in this context.\460\ 
Some

[[Page 47729]]

commenters stated that this market failure could lead to 
inefficiencies.\461\ One commenter stated that firms ``either seek to 
skirt notification requirements altogether or provide vague or 
confusing notifications,'' preventing affected individuals from taking 
timely actions, and that firms' self-interest could lead them to fail 
to notify customers affected by a breach.\462\ Another commenter stated 
its view that firms have a natural tendency to want to avoid making 
disclosures that could incur liability or lead to a loss of 
customers.\463\ Another commenter stated that beginning in the fourth 
quarter of 2021, less information started being included in data breach 
notices and that in 2022, only 34 percent of notices included 
information about the breaches and their victims.\464\ This commenter 
further added that this lack of actionable information in breach 
notices prevented individuals from effectively judging the risks they 
faced and from taking the appropriate actions to protect 
themselves.\465\ One commenter supported the economic rationale of the 
Proposing Release, stating that stronger notification requirements 
could effectively incentivize covered institutions to improve their 
data security practices in order to avoid the reputational harm 
associated with distributing breach notices.\466\
---------------------------------------------------------------------------

    \459\ See, e.g., Nasdaq Comment Letter; FSI Comment Letter.
    \460\ See, e.g., Better Markets Comment Letter (``But companies 
will not always disclose data breaches to affected individuals 
voluntarily. They may be concerned about the damage to their 
reputation and their bottom line from disclosing a breach.''); EPIC 
Comment Letter (``A company has better visibility than its consumers 
do into the threats to the privacy and security of consumer data 
entrusted to that company's custody; and the company's interests are 
not directly aligned with those of its consumers.''); Nasdaq Comment 
Letter (``Requiring various financial institutions and market 
entities to address these cybersecurity risks through policies and 
procedures, incident response programs, third-party management, 
notifications and/or public disclosures can promote transparency and 
consistency. Investors, issuers and other market participants 
benefit from healthy capital markets that promote trust and 
transparency.'').
    \461\ See, e.g., EPIC Comment Letter; Better Markets Comment 
Letter.
    \462\ See EPIC Comment Letter.
    \463\ See NASAA Comment Letter.
    \464\ See Better Markets Comment Letter, citing Identity Theft 
Resource Center, Data Breach Annual Report (Jan 2023), available at 
https://www.idtheftcenter.org/wp-content/uploads/2023/01/ITRC_2022-Data-Breach-Report_Final-1.pdf (``IRTC Data Breach Annual Report'').
    \465\ See Better Markets Comment Letter.
    \466\ See EPIC Comment Letter. This commenter also cited Federal 
Communications Commission (FCC), Data Breach Reporting Requirements, 
Proposed Rule, FCC 22-102, 88 FR 3953 (Jan. 23, 2023) (stating that 
the FCC ``anticipate[s] that requiring notification for accidental 
breaches will encourage telecommunications carriers to adopt 
stronger data security practices and will help us identify and 
confront systemic network vulnerabilities'').
---------------------------------------------------------------------------

    Other commenters disagreed with the economic rationale in the 
Proposing Release and stated that covered institutions' level of 
customer information safeguards and/or breach notification practices 
were already adequate, and that existing regulation made the amendments 
unnecessary.\467\ We disagree with these commenters that the amendments 
are unnecessary, even if some covered institutions may already have 
policies and procedures in place that satisfy the final amendments' 
requirements. We have discussed, here and in the Proposing Release, the 
information asymmetries that prevent customers from knowing whether or 
how they will be notified of a data breach and from choosing firms 
based on the level of their customer information safeguards.\468\ 
Furthermore, in addition to describing existing requirements and 
guidance available to (and potentially adopted by) covered institutions 
addressing customer information safeguards and customer notification, 
we have described (here and in the Proposing Release) a variety of 
practices and State law requirements that could lead to different 
notification outcomes depending on where the customer resides.\469\ In 
particular, we have described a variety of delays and inconsistencies 
in notification under existing requirements.\470\ Hence, the Proposing 
Release described in detail the existing regulatory framework and 
analyzed the benefits and costs of the proposed amendments relative to 
this framework. In addition, as discussed above, some commenters 
provided additional evidence of deficiencies in existing 
practices.\471\ Moreover, in response to commenters, we have 
supplemented the analysis of the amendments' benefits and costs, 
describing in greater detail the changes made by the final amendments 
over the baseline.\472\ We summarize these changes below. We have also 
supplemented the analysis of the expected benefits and costs of 
expanding the scope of the safeguards and disposal rules to include 
transfer agents.\473\
---------------------------------------------------------------------------

    \467\ See ASA Comment Letter (stating that the proposal was not 
``supported by evidence that brokers are fundamentally failing in 
their obligations to safeguard investor information and notify 
government authorities--within applicable Federal and State law--
when a significant breach of sensitive information has occurred'' 
and that the Proposing Release did not ``provide any discussion 
about how current broker-dealer cybersecurity and customer 
notification policies are deficient or in need of a regulatory 
fix''); ACLI Comment Letter (``The ACLI's members already comply 
with much of the Proposal's content through State regulations, such 
as those that require companies to maintain written cybersecurity 
policies and procedures, respond to cyber incidents, notify 
authorities and consumers of certain cyber incidents, and dispose of 
consumer data. However, we are concerned with the Proposal's 
shortened notification timeframes and expanded scope.''); CAI 
Comment Letter (stating that ``[n]otice currently is given to 
individuals whose information is reasonably believed to have 
potentially been affected after the findings of the investigation 
are determined,'' that it ``believes this current practice is an 
appropriate and common-sense approach to notification,'' and that 
``[t]he new notice requirement proposed under Proposed Rule 30(b) 
would simply add another layer on top of these existing requirements 
and would likely go entirely unnoticed by consumers''); 
Computershare Comment Letter (``Computershare believes Proposed Reg 
S-P is an unnecessary regulation for transfer agents, as they are 
already subject, either directly or indirectly, to State, Federal or 
provincial laws designed to protect personal information of 
securityholders and requiring breach notification.''); STA Comment 
Letter 2 (stating that the proposed amendments would not 
``meaningfully increase the safeguarding of shareholder 
information'' and instead ``cause ambiguity among competing 
laws.'').
    \468\ See Proposing Release at section III.B.
    \469\ See Proposing Release at section III.C; see also infra 
section IV.C.2.
    \470\ See Proposing Release at section III.C.2.a; see also infra 
section IV.C.2.a.
    \471\ See supra footnote 460 and accompanying text.
    \472\ See infra section IV.D.
    \473\ See infra section IV.D.2.b.
---------------------------------------------------------------------------

    In particular, the variety of practices and State law requirements 
that could lead to different notification outcomes under existing 
requirements provides a further rationale for the rule and motivated 
specific differences in the final amendments relative to State laws. We 
discuss the effects of these differences in detail below,\474\ but for 
example, the required timing of notification in the final amendments is 
stricter than under many State laws. The analysis in section 
IV.D.1.b(2) provides evidence that currently, many customers receive 
notification long after the event. The amendments are designed to help 
ensure that customers receive notification in a timely manner. In 
addition, the notification obligation covers a set of customer 
information that is broader than in many State laws, thereby covering 
more data breaches. Moreover, the final amendments require certain 
information to be included in the notice sent to customers. This 
requirement will help ensure that customers receive relevant 
information, allowing them to take appropriate mitigating actions in 
case of a breach. Hence, while the final amendments contain some 
requirements that are similar to those in some existing State laws, the 
final requirements are stricter than many State laws and may therefore 
lead to customers receiving additional, timelier, and more relevant 
notices than under existing regulations.\475\ In addition, variations 
in State law requirements highlight the need for a consistent Federal 
minimum standard for covered institutions. Such a standard will protect 
all customers regardless of their State of residence and reduce the 
potential confusion that could result from customers in one State 
receiving

[[Page 47730]]

notice of an incident while customers in another State do not.
---------------------------------------------------------------------------

    \474\ See infra section IV.D.1.
    \475\ It is possible that, because of the overlap with State 
laws, some covered institutions already have policies and procedures 
in place satisfying the final amendments' requirements. For these 
institutions and their customers, both the benefits and the costs of 
the amendments will be limited.
---------------------------------------------------------------------------

    Other commenters stated that the analysis in the Proposing Release 
underestimated the costs of the amendments.\476\ Some commenters also 
stated that the proposed amendments in general would be very costly to 
implement for smaller covered institutions.\477\ As discussed more 
fully below, we expect some of the changes made to the final amendments 
to result in lower costs relative to the proposal.\478\ For example, 
the changes made to the service provider provisions of the amendments 
(requiring that covered institutions oversee service providers instead 
of requiring written contracts between covered institutions and their 
service providers, and requiring that the covered institution's 
policies and procedures be reasonably designed to ensure service 
providers take appropriate measures to notify covered institutions of 
an applicable breach in security within 72 hours instead of 48 hours) 
may reduce some costs relative to the proposal and facilitate their 
implementation, especially for smaller covered institutions.\479\ In 
addition, in a change from proposal, we are adopting longer compliance 
periods for all covered institutions, and an even longer compliance 
period for smaller covered institutions,\480\ who are less likely to 
already have policies and procedures broadly consistent with the final 
amendments.
---------------------------------------------------------------------------

    \476\ See, e.g., IAA Comment Letter 1 (``We urge the Commission 
to undertake a more expansive, accurate, and quantifiable assessment 
of the specific and cumulative costs, burdens, and economic effects 
that would be placed on advisers by the proposed requirements, as 
well as of the potential unintended consequences for their 
clients.'').
    \477\ See, e.g., ASA Comment Letter; IAA Comment Letter 1.
    \478\ See, e.g., infra sections IV.D.1.c and IV.E.
    \479\ See supra section II.A.4; infra section IV.D.1.c.
    \480\ See supra section II.F.
---------------------------------------------------------------------------

C. Baseline

    The baseline against which the costs, the benefits, and the effects 
on efficiency, competition, and capital formation of the final 
amendments are measured consists of current requirements for customer 
notification and information safeguards, current practice as it relates 
to customer notification and information safeguards, and the current 
market structure and regulatory framework. The economic analysis 
appropriately considers existing regulatory requirements, including 
recently adopted Commission rules as well as State, Federal, and 
foreign laws and regulations, as part of the economic baseline against 
which the costs and benefits of the final amendments are measured.\481\
---------------------------------------------------------------------------

    \481\ See, e.g., Nasdaq v. SEC, 34 F.4th 1105, 1111-15 (D.C. 
Cir. 2022). This approach also follows SEC staff guidance on 
economic analysis for rulemaking. See SEC Staff, Current Guidance on 
Economic Analysis in SEC Rulemaking (Mar. 16, 2012), available at 
https://www.sec.gov/divisions/riskfin/rsfi_guidance_econ_analy_secrulemaking.pdf (``The economic 
consequences of proposed rules (potential costs and benefits 
including effects on efficiency, competition, and capital formation) 
should be measured against a baseline, which is the best assessment 
of how the world would look in the absence of the proposed 
action.''); Id. at 7 (``The baseline includes both the economic 
attributes of the relevant market and the existing regulatory 
structure.''). The best assessment of how the world would look in 
the absence of the proposed or final action typically does not 
include recently proposed actions, because that would improperly 
assume the adoption of those proposed actions.
---------------------------------------------------------------------------

    Several commenters requested that the Commission consider 
interactions between the economic effects of the proposal and other 
recent Commission proposals.\482\ The Commission adopted several of the 
rules mentioned by commenters, namely the Electronic Recordkeeping 
Adopting Release,\483\ the Form N-PX Adopting Release,\484\ the 
Settlement Cycle Adopting Release,\485\ the May 2023 SEC Form PF 
Adopting Release,\486\ the Public Company Cybersecurity Rules,\487\ the 
Money Market Fund Adopting Release,\488\ the Investment Company Names 
Adopting

[[Page 47731]]

Release,\489\ the Beneficial Ownership Adopting Release,\490\ the 
Private Fund Advisers Adopting Release,\491\ the Securitizations 
Conflicts Adopting Release,\492\ and the February 2024 Form PF Adopting 
Release.\493\ These adopted rules are part of the baseline against 
which this economic analysis considers the benefits and costs of the 
final amendments. In response to commenters, this economic analysis 
also considers potential economic effects arising from the extent to 
which there is any overlap between the compliance period for the final 
amendments and the compliance periods for these other adopted 
rules.\494\
---------------------------------------------------------------------------

    \482\ See, e.g., IAA Comment Letter 2; IAA Comment Letter 1; CAI 
Comment Letter; Comment Letter of the Securities Industry and 
Financial Markets Association, et al. (Mar. 31, 2023) (``SIFMA 
Comment Letter 1''). See also Comment Letter of the Investment 
Company Institute (Aug. 17, 2023) (``ICI Comment Letter 2'') 
(stating the Commission should analyze the interconnections in 
related rules).
    \483\ Electronic Recordkeeping Requirements for Broker-Dealers, 
Security-Based Swap Dealers, and Major Security-Based Swap 
Participants, Release No. 34-96034 (Oct. 12, 2022) [87 FR 66412 
(Nov. 3. 2022)] (``Electronic Recordkeeping Adopting Release''). One 
commenter stated that the Proposing Release could create concurrent 
obligations with Rule 17a-4 and Rule 18a-6. See AWS Comment Letter. 
Rule 17a-4 and Rule 18a-6 were amended in the Electronic 
Recordkeeping Adopting Release. Those amendments modified 
requirements regarding the maintenance and presentation of 
electronic records, the use of third-party recordkeeping services, 
and prompt production of records. The compliance dates were May 3, 
2023, and Nov. 3, 2023. See Electronic Recordkeeping Adopting 
Release, section II.I.
    \484\ Enhanced Reporting of Proxy Votes by Registered Management 
Investment Companies; Reporting of Executive Compensation Votes by 
Institutional Investment Managers, Release Nos. 33-11131, 34-96206, 
IC-34745 (Nov. 2, 2022) [87 FR 78770 (Dec. 22, 2022)] (``Form N-PX 
Adopting Release''). The Form N-PX amendments enhanced the 
information funds report publicly about their proxy votes, and apply 
to most registered management investment companies. The effective 
date is July 1, 2024. Form N-PX Adopting Release, section II.K.
    \485\ Shortening the Securities Transaction Settlement Cycle, 
Release No. 34-96930 (Feb. 15, 2023) [88 FR 13872 (Mar. 6, 2023)] 
(``Settlement Cycle Adopting Release''). This rule shortens the 
standard settlement cycle for most broker-dealer transactions from 
two business days after the trade date to one business day after the 
trade date. To facilitate orderly transition to a shorter settlement 
cycle, the rule requires same-day confirmations, allocations, and 
affirmations for processing transactions subject to the rule, and 
requires registered investment advisers to make and keep records of 
each confirmation received, and of any allocation and each 
affirmation sent or received, with a date and time stamp for each 
indicating when it was sent or received. With certain exceptions, 
the rule has a compliance date of May 28, 2024. Settlement Cycle 
Adopting Release, sections VII, VII.B.3.
    \486\ Form PF; Event Reporting for Large Hedge Fund Advisers and 
Private Equity Fund Advisers; Requirements for Large Private Equity 
Fund Adviser Reporting, Investment Company Act Release No. 6297 (May 
3, 2023) [88 FR 38146 (June 12, 2023)] (``May 2023 SEC Form PF 
Adopting Release''). The Form PF amendments adopted in May 2023 
require large hedge fund advisers and all private equity fund 
advisers to file reports upon the occurrence of certain reporting 
events. The compliance dates are Dec. 11, 2023, for the event 
reports in Form PF sections 5 and 6, and June 11, 2024, for the 
remainder of the Form PF amendments in the May 2023 SEC Form PF 
Adopting Release. See May 2023 SEC Form PF Adopting Release, section 
II.E.
    \487\ Public Company Cybersecurity Rules, supra footnote 14. The 
amendments require current disclosure about material cybersecurity 
incidents, and periodic disclosures about a registrant's processes 
to assess, identify, and manage material cybersecurity risks, 
management's role in assessing and managing material cybersecurity 
risks, and the board of directors' oversight of cybersecurity risks. 
With respect to Item 106 of Regulation S-K and item 16K of Form 20-
F, all registrants must provide disclosures beginning with annual 
reports for fiscal years ending on or after Dec. 15, 2023. With 
respect to incident disclosure requirements in Item 1.05 of Form 8-K 
and in Form 6-K, all registrants other than SRCs were required to 
begin complying on Dec. 18, 2023; SRCs must begin complying with 
Item 1.05 of Form 8-K on June 15, 2024. With respect to structured 
data requirements, all registrants must tag disclosures beginning 
one year after the initial compliance date: specifically, beginning 
with annual reports for fiscal years ending on or after Dec. 15, 
2024, in the case of Item 106 of Regulation S-K and item 16K of Form 
20-F, and beginning Dec. 18, 2024, in the case of Item 1.05 of Form 
8-K and Form 6-K. Cybersecurity Disclosure Adopting Release, section 
II.I.
    \488\ Money Market Fund Reforms; Form PF Reporting Requirements 
for Large Liquidity Fund Advisers; Technical Amendments to Form N-
CSR and Form N-1, Release No. 33-11211 (July 12, 2023) [88 FR 51404 
(Aug. 3, 2023)] (``Money Market Fund Adopting Release''). The 
amendments are designed to improve the resilience and transparency 
of money market funds by increasing minimum liquidity requirements 
to provide a more substantial buffer in the event of rapid 
redemptions; removing provisions that permitted a money market fund 
to temporarily suspend redemptions, and removing the regulatory tie 
between the imposition of liquidity fees and a fund's liquidity 
level; requiring certain money market funds to implement a liquidity 
fee framework that will better allocate the costs of providing 
liquidity to redeeming investors; and enhancing certain reporting 
requirements. The Money Market Fund Adopting Release has compliance 
dates of Oct. 2, 2024, for implementing mandatory liquidity fees and 
of Apr. 2, 2024, for discretionary liquidity fees; a compliance date 
of Apr. 2, 2024, for minimum liquidity requirements and weighted 
average maturity calculations; a compliance date of June 11, 2024, 
for certain form amendments and website reporting requirements; and 
an effective date of Oct. 2, 2023, for other provisions. Money 
Market Fund Adopting Release, section II.H.
    \489\ Investment Company Names, Release No. 33-11238 (Sept. 20, 
2023) [88 FR 70436 (Oct. 11, 2023)], as amended by Investment 
Company Names; Correction, Release No. 33-11238A (Oct. 24, 2023) [88 
FR 73755 (Oct. 27, 2023)] (``Investment Company Names Adopting 
Release''). The amendments broaden the scope of the requirement for 
certain funds to adopt a policy to invest at least 80 percent of the 
value of their assets in accordance with the investment focus that 
the fund's name suggests; require enhanced prospectus disclosure for 
terminology used in fund names; impose related notice, 
recordkeeping, and reporting requirements. The compliance date for 
the final amendments is Dec. 11, 2025, for larger entities and June 
11, 2026, for smaller entities. See Investment Company Names 
Adopting Release, sections II.H, IV.D.3.
    \490\ Modernization of Beneficial Ownership Reporting, Release 
No. 33-11253 (Oct. 10, 2023) [88 FR 76896 (Nov. 7, 2023)] 
(``Beneficial Ownership Adopting Release''). Among other things, the 
amendments generally shorten the filing deadlines for initial and 
amended beneficial ownership reports filed on Schedules 13D and 13G, 
and require that Schedule 13D and 13G filings be made using a 
structured, machine-readable data language. The amendments are 
effective Feb. 5, 2024. The new filing deadline for Schedule 13G 
will not be required before Sept. 30, 2024, and the rule's 
structured data requirements have a one-year implementation period 
ending Dec. 18, 2024. Beneficial Ownership Adopting Release, section 
II.G.
    \491\ Private Fund Advisers; Documentation of Registered 
Investment Adviser Compliance Reviews, Release No. IA-6383 (Aug. 23, 
2023) [88 FR 63206 (Sept. 14, 2023)] (``Private Fund Advisers 
Adopting Release''). The Commission adopted five new rules and two 
rule amendments as part of the reforms. The compliance date for the 
quarterly statement rule and the audit rule is Mar. 14, 2025, for 
registered private fund advisers. For the adviser-led secondaries 
rule, the preferential treatment rule, and the restricted activities 
rule, the Commission adopted staggered compliance dates that provide 
for the following compliance periods: for advisers with $1.5 billion 
or more in private funds assets under management, a 12-month 
compliance period (ending on Sept. 14, 2024) and for advisers with 
less than $1.5 billion in private funds assets under management, an 
18-month compliance period (ending on Mar. 14, 2025). The amended 
Advisers Act compliance provision for registered investment advisers 
had a Nov. 13, 2023, compliance date. See Private Fund Advisers 
Adopting Release, sections IV, VI.C.1.
    \492\ Prohibition Against Conflicts of Interest in Certain 
Securitizations, Release No. 33-11254 (Nov. 27, 2023) [88 FR 85396 
(Dec. 7, 2023)] (``Securitizations Conflicts Adopting Release''). 
The new rule prohibits an underwriter, placement agent, initial 
purchaser, or sponsor of an asset-backed security (including a 
synthetic asset-backed security), or certain affiliates or 
subsidiaries of any such entity, from engaging in any transaction 
that would involve or result in certain material conflicts of 
interest. The compliance date for securitization participants to 
comply with the prohibition is Jun. 9, 2025. Securitizations 
Conflicts Adopting Release, section II.I.
    \493\ Form PF: Reporting Requirements for All Filers and Large 
Hedge Fund Advisers, Release No. IA-6546 (Feb. 8, 2024) [89 FR 17984 
(Mar. 12, 2024)] (``February 2024 Form PF Adopting Release''). The 
Form PF amendments are designed to enhance the Financial Stability 
Oversight Council's ability to monitor systemic risk as well as 
bolster the SEC's regulatory oversight of private fund advisers and 
investor protection efforts. The compliance date for the rule is 
Mar. 12, 2025. February 2024 Form PF Adopting Release, section II.F.
    \494\ See infra sections IV.D and IV.E. In addition, commenters 
indicated there could be overlapping compliance costs between the 
final amendments and proposals that have not been adopted. See, 
e.g., IAA Comment Letter 2, Exhibit A; IAA Comment Letter 1; CAI 
Comment Letter; FSI Comment Letter. Proposed rules that commenters 
mentioned included Cybersecurity Risk Management for Investment 
Advisers, Registered Investment Companies, and Business Development 
Companies, Release No. 33-11028 (Feb. 9, 2022), 87 FR 13524 (Mar. 9, 
2022); Enhanced Disclosures by Certain Investment Advisers and 
Investment Companies About Environmental, Social, and Governance 
Investment Practices, Release No. 33-11117 (Oct. 7, 2022) [87 FR 
63016] (Oct. 18, 2022)]; Open-End Fund Liquidity Risk Management 
Programs and Swing Pricing; Form N-PORT Reporting, Release No. 33-
11130 (Nov. 2, 2022), [87 FR 77172 (Dec. 16, 2022)]; Safeguarding 
Advisory Client Assets, Release No. IA-6240 (Feb. 15, 2023), [88 FR 
14672 (Mar. 9, 2023)]; and Cybersecurity Risk Management Rule for 
Broker-Dealers, Clearing Agencies, Major Security-Based Swap 
Participants, the Municipal Securities Rulemaking Board, National 
Securities Associations, National Securities Exchanges, Security-
Based Swap Data Repositories, Security-Based Swap Dealers, and 
Transfer Agents, Release No. 34-97142 (Mar. 15, 2023) [88 FR 20212 
(Apr. 5, 2023)]. To the extent those proposals are adopted, the 
baseline in those subsequent rulemakings will reflect the existing 
regulatory requirements at that time.
---------------------------------------------------------------------------

    The parties directly affected by the final amendments, the 
``covered institutions,'' \495\ include every broker-dealer (3,476 
entities),\496\ every funding portal (92 entities),\497\ every 
investment company (13,766 distinct legal entities),\498\ every 
investment adviser (15,565 entities) registered with the 
Commission,\499\ and every transfer agent (315 entities) registered 
with the Commission or another appropriate regulatory agency.\500\ In 
addition, the final amendments will affect current and prospective 
customers of covered institutions as well as certain service providers 
to covered institutions.\501\ The final amendments will impact hundreds 
of millions of customers. For example, as discussed in more detail in 
subsequent sections, carrying broker-dealers report a total of 233 
million customer accounts,\502\ registered investment advisers report a 
total of more than 51 million individual clients,\503\ and transfer 
agents report around 250 million individual accounts.\504\
---------------------------------------------------------------------------

    \495\ See infra section IV.C.3.
    \496\ Of these, 303 are dually registered as investment 
advisers. See infra section IV.C.3.a. These numbers exclude notice-
registered broker-dealers, who will be deemed in compliance with the 
final provision through the substituted compliance provisions of 
Regulation S-P. See supra section II.B.3. For this release, the 
number of broker-dealers dually registered as investment advisers 
was estimated based on FOCUS filings for broker-dealers during the 
third quarter of 2023, Form BD filings as of Sept. 2023, and Form 
ADV filings for investment advisers as of Oct. 5, 2023. The 
Proposing Release cited a figure of 502 as of Dec. 2021. The correct 
number of broker-dealers dually registered as investment advisers as 
of Dec. 2021 in the Proposing Release should be 328. This change 
would not have affected the Commission's assessment of economic 
effects at Proposal as these assessments were focused primarily on 
effects at the level of individual covered institutions and their 
customers.
    \497\ See infra section IV.C.3.b.
    \498\ See infra section IV.C.3.d, in particular Table 4, for 
statistics on the different types of investment companies. Many of 
these distinct legal entities represent different series of a common 
registrant. Moreover, many of the registrants are themselves part of 
a larger family of companies (although BDCs and ESCs are not grouped 
in families, see Form N-2 and Form 40-APP). See infra footnote 660. 
We estimate there are 313 such families. See infra section IV.C.3.d. 
For this release, the number of families was estimated by counting 
unique family names in Form N-CEN filings as of Sept. 30, 2023. The 
Proposing Release cited a figure of 1,093 using 2021 N-CEN filings. 
The correct number of distinct fund families using 2021 N-CEN 
filings in the Proposing Release should be 327. This change would 
not have affected the Commission's assessment of economic effects at 
Proposal as these assessments were focused primarily on effects at 
the level of individual covered institutions and their customers.
    \499\ See infra section IV.C.3.c.
    \500\ See infra section IV.C.3.e.
    \501\ See infra section IV.C.3.f.
    \502\ See infra section IV.C.3.a.
    \503\ See infra section IV.C.3.c.
    \504\ See infra section IV.C.3.e.
---------------------------------------------------------------------------

1. Safeguarding Customer Information: Risks and Practices
    Over the last two decades, the widespread adoption of digitization 
and the migration toward internet-based products and services has 
radically changed the manner in which firms interact with customers. 
This trend has also applied to the financial services industry.\505\ 
Alongside this progress, the industry has observed increased exposure 
to cyberattacks that threaten not only the financial firms themselves, 
but also their customers. Hence, the trend toward digitization has 
increasingly turned the problem of safeguarding customer records and 
information into one of cybersecurity.\506\

[[Page 47732]]

Cyber threat intelligence surveys find the financial sector to be a 
highly attacked industry,\507\ making the problem of cybersecurity 
particularly acute for financial firms. The customer records and 
information in their possession can be quite sensitive (e.g., personal 
identifying information, bank account numbers, financial transactions) 
and their compromise could lead to substantial harm.\508\
---------------------------------------------------------------------------

    \505\ See Michael Grebe et al., Digital Maturity Is Paying Off, 
BCG (June 7, 2018), available at https://www.bcg.com/publications/2018/digital-maturity-is-paying-off.
    \506\ This is not to say that this is exclusively a problem of 
cybersecurity. Generally, however, the risks associated with purely 
physical forms of compromise are of a smaller magnitude, as large-
scale compromise using physical means is cumbersome. The largest 
publicly known incidents of compromised information have appeared to 
involve electronic access to digital records, as opposed to physical 
access to records or computer hardware. For a partial list of recent 
data breaches and their causes. See, e.g., Michael Hill and Dan 
Swinhoe, The 15 Biggest Data Breaches of the 21st Century, CSO (Nov. 
8, 2022), available at https://www.csoonline.com/article/2130877/the-biggest-data-breaches-of-the-21st-century.html (last visited 
Apr. 9, 2024); Drew Todd, Top 10 Data Breaches of All Time, 
SecureWorld (Sept. 14, 2022), available at https://www.secureworld.io/industry-news/top-10-data-breaches-of-all-time 
(last visited Apr. 9, 2024).
    \507\ See, e.g., IBM, X-Force Threat Intelligence Index 2022 
(Feb. 2022), available at https://www.ibm.com/downloads/cas/ADLMYLAZ.
    \508\ See, e.g., David W. Opderbeck, Cybersecurity and Data 
Breach Harms: Theory and Reality, 82 Md. L. Rev. 1001 (2023) (``A 
criminal actor can use stolen PII in true identity theft to open new 
lines of credit in the victim's name, including new credit cards, 
personal loans, business loans, or mortgages. Criminal actors also 
employ true identity theft to file for tax refunds, welfare, 
insurance, or pension benefits in the victim's name.'').
---------------------------------------------------------------------------

    Certain recent changes in the industry, including changes discussed 
by commenters, have continued the trend toward digitization and the 
importance of cybersecurity. For example, the shift to remote work has 
brought new cybersecurity challenges. One commenter stated that 91 
percent of data security professionals saw negative risk implications 
from remote and hybrid work.\509\ The same commenter cited a report 
finding that in 2022, the cost of a data breach was on average nearly 
$1 million higher when remote work was a factor in the breach and more 
than $1 million higher in organizations with a share of employees 
working remotely between 80 percent and 100 percent compared with 
organizations where less than 20 percent of employees worked 
remotely.\510\ Remote work arrangements have significantly expanded 
following the onset of the COVID-19 pandemic in the United States in 
2020,\511\ and a recent study found the financial services industry to 
be the fifth most flexible industry in terms of work location 
flexibility.\512\
---------------------------------------------------------------------------

    \509\ See Better Markets Comment Letter, citing Hugo Guzman, 
Remote Work Leading to Big Data-Loss Problems, Law.com (Mar. 7, 
2023).
    \510\ See Better Markets Comment Letter citing IBM, Cost of a 
Data Breach Report 2022 (July 2022) (``2022 IBM Cost of Data Breach 
Report''), available at https://www.ibm.com/downloads/cas/3R8N1DZJ. 
The 2023 version of the same report does not address remote work 
specifically.
    \511\ Census Press Release, U.S. Census Bureau Releases New 2021 
American Community Survey 1-year Estimates for All Geographic Areas 
With Populations of 65,000 or More (Sept. 15, 2022), available at 
https://www.census.gov/newsroom/press-releases/2022/people-working-
from-home.html#:~:text=SEPT.,by%20the%20U.S.%20Census%20Bureau.
    \512\ See The Flex Index, Q3 2023 Flex Report, available at 
https://www.flex.scoopforwork.com/reports/flex-report-2023-q3 (last 
visited Apr. 9, 2024).
---------------------------------------------------------------------------

    The financial sector is one of the biggest spenders on 
cybersecurity measures: a recent survey found that financial firms 
spent an average of approximately 13.6 percent of their technology 
budget on cybersecurity in 2023, compared to an overall average across 
industries of 11.6 percent.\513\ While spending on cybersecurity 
measures in the financial services industry is considerable, it may 
nonetheless be inadequate--even in the estimation of financial firms 
themselves. According to one recent survey, 58 percent of financial 
firms self-reported ``underspending'' on cybersecurity measures.\514\ 
In addition, some covered institutions increasingly use third-party 
vendors to provide a wide range of functions, which may implicate a 
review of those service providers' cybersecurity controls.\515\
---------------------------------------------------------------------------

    \513\ See James Rundle, Cybersecurity Budgets Grow, But at a 
Slower Pace, Wall St J. (Sept. 29, 2023), available at https://www.wsj.com/articles/cybersecurity-budgets-grow-but-at-a-slower-pace-89ce3d3c. One commenter agreed that total cybersecurity costs 
are significant. See Better Markets Comment Letter (``While the 
magnitude of dollar losses is difficult to estimate, it is clear 
that companies must expend significant resources to prevent 
breaches, detect breaches that do occur, contain the damage from 
breaches, prevent future breaches, and in some cases make customers 
whole.'').
    \514\ See IIF/McKinsey Report, supra footnote 450.
    \515\ See, e.g., FINRA, Regulatory Notice 21-29: Vendor 
Management and Outsourcing (Aug. 13, 2021), available at https://www.finra.org/sites/default/files/2021-08/Regulatory-Notice-21-29.pdf (encouraging firms that ``use--or are contemplating using--
Vendors to review [. . .] obligations and assess whether their 
supervisory procedures and controls for outsourced activities or 
functions are sufficient to maintain compliance with applicable 
rules''). See also infra section IV.C.3.f for a discussion of 
different types of covered institutions' reliance on service 
providers.
---------------------------------------------------------------------------

    Before adopting these amendments, the Commission did not require 
covered institutions to notify customers (or the Commission) in the 
event of a data breach, and so statistics relating to data breaches 
that occurred at covered institutions were not readily available. 
However, data compiled from notifications required under various State 
laws indicate that in 2022 the number of data breaches reported in the 
U.S. was 1,802--a 3 percent decrease over 2021, but a 63 percent 
increase over 2020.\516\ Of these, 268 (15 percent) were reported by 
firms in the financial services industry.\517\ However, the report 
estimating these statistics states that the 1,802 breaches reported are 
a minimum estimate and states that in the U.S., the number of breach 
notices issued per business day in 2022 (7 notices) was much lower than 
in the European Union (356 notices) in 2021 (the last year for which 
data is available).\518\ One commenter cited a report stating that 
nearly half of U.S. consumers had been affected by data breaches where 
a firm holding their personal data was hacked, compared to a global 
average of 33 percent of consumers.\519\
---------------------------------------------------------------------------

    \516\ See IRTC Data Breach Annual Report.
    \517\ See id.
    \518\ See id. See also Better Markets Comment Letter. The report 
suggests that this disparity may be related to the fact that in the 
European Union, enforcement officials, together with the 
organization affected by a breach, make the determination that the 
breach puts individuals or businesses at risk and therefore requires 
notification. See also infra section IV.D.1.b(4).
    \519\ See EPIC Comment Letter, citing Thales, 2022 Thales 
Consumer Digital Trust Index (Sept. 2022).
    \520\ See IBM, Cost of a Data Breach Report 2023 (July 2023) 
(``2023 IBM Cost of Data Breach Report''), available at https://www.ibm.com/reports/data-breach?utm_content=SRCWW&p1=Search&p4=43700077723822555&p5=p&&msclkid=45aa555fae8d1f62fb9c3066eddb719a&gclid=45aa555fae8d1f62fb9c3066eddb719a&gclsrc=3p.ds.
---------------------------------------------------------------------------

    The average total cost of a data breach for a U.S. firm in 2023 was 
estimated to be $9.48 million by one report.\520\ While the report does 
not provide estimates for U.S. financial services firms specifically, 
it estimated that world-wide, the cost of a data breach for financial 
services firms averaged $5.90 million, and that average costs for U.S. 
firms were approximately twice the world-wide average.\521\ Hence, we 
can estimate that for U.S. financial firms, the cost of a data breach 
was about $12 million. The bulk of these costs is attributed to 
detection and escalation (36 percent), lost business (29 percent), and 
post-breach response (27 percent); customer notification is estimated 
to account for only a small fraction (8 percent) of these costs.\522\ 
For the U.S.

[[Page 47733]]

financial industry as a whole, this implies an estimate of aggregate 
notification costs under the baseline of between $200 million and $250 
million.\523\ Because these estimates are based on data breach 
incidence rates for all firms, and because financial firms are part of 
one of the most attacked industries,\524\ the actual aggregate 
notification costs are likely higher than this estimated range.
---------------------------------------------------------------------------

    \521\ The 2023 IBM Cost of Data Breach Report estimates that the 
global average cost of a data breach is $4.45 million. One 
commenter, citing the 2022 IBM Cost of Data Breach Report, stated 
that the average cost of a data breach in 2022 was $4.35 million, 
which is a global average. See Better Markets Comment Letter. In the 
Proposing Release, we also cited the 2022 IBM Cost of Data Breach 
Report and stated that the cost of a data breach was $9.44 million, 
which applies to U.S. firms specifically.
    \522\ See 2023 IBM Cost of Data Breach Report.
    \523\ The $200 million figure is based on 8% (the customer 
notification portion) of an average cost of $9.48 million multiplied 
by 268 data breaches. The $250 million figure is based on the same 
calculation but using $12 million instead of $9.48 million. See 
supra footnotes 516 and 520 and accompanying text.
    \524\ See supra footnotes 507-512 and accompanying text.
---------------------------------------------------------------------------

    Some commenters supported the Proposing Release's assessment that 
data breaches are an important risk currently faced by covered 
institutions and their customers.\525\ One commenter cited an article 
describing a data breach at a financial institution that had cost that 
institution more than $150 million.\526\ Commenters also mentioned 
additional types of risks. One commenter stated that in addition to the 
financial costs imposed on firms by data breaches, individuals whose 
sensitive information is compromised also suffer harms, both financial 
and psychological, as many become victims of identity theft.\527\ 
Another commenter stated that the consequences of these breaches were 
staggering and that the Commission's proposals to establish minimum 
standards for incident response and breach notification could help with 
mitigation.\528\ The same commenter cited a report by the Government 
Accountability Office indicating that past victims of identity theft, 
which can be a consequence of data breaches, have ``lost job 
opportunities, been refused loans, or even been arrested for crimes 
they did not commit as a result of identity theft.'' \529\
---------------------------------------------------------------------------

    \525\ See, e.g., Better Markets Comment Letter; Nasdaq Comment 
Letter.
    \526\ See Better Markets Comment Letter, citing Emily Flitter & 
Karen Weise, Capital One Data Breach Compromises Data of Over 100 
Million, N.Y. Times (July 29, 2019), available at https://www.nytimes.com/2019/07/29/business/capital-one-data-breach-hacked.html.
    \527\ See Better Markets Comment Letter. Citing the IRTC Data 
Breach Annual Report, the same commenter also stated that globally, 
organizational data compromises impacted over 392 million individual 
victims in 2022.
    \528\ See EPIC Comment Letter.
    \529\ See EPIC Comment Letter citing U.S. Government 
Accountability Office, GAO-14-34, Agency Responses to Breaches of 
Personally Identifiable Information Need to be More Consistent (Dec. 
2013), available at https://www.gao.gov/assets/660/659572.pdf.
---------------------------------------------------------------------------

2. Regulations and Guidelines
    Two features of the existing regulatory framework are most relevant 
to the amendments: existing regulations that require covered 
institutions to notify customers in the event that their information is 
compromised; and existing regulations and guidelines that affect 
covered institutions' practices for safeguarding customers' 
information. While the relevance of the former is obvious, the latter 
is potentially more significant: regulations aimed at improving firms' 
practices for safeguarding customer information reduce the need for 
data breach notifications in the first place. In this section, we 
summarize these two aspects of the regulatory framework as well as 
existing annual notice delivery requirements.
a. State Law Customer Notification Requirements
(1) Scope of Requirements
    All 50 States and the District of Columbia impose some form of data 
breach notification requirement under State law. These laws vary in 
detail from State to State but have certain common features. State laws 
trigger data breach notification obligations when some type of 
``personal information'' of a State's resident is either accessed or 
acquired in an unauthorized manner, subject to various common 
exceptions. For the vast majority of States (46), a notification 
obligation is triggered only when there is unauthorized acquisition, 
while a handful of States (5) require notification whenever there is 
unauthorized access.\530\
---------------------------------------------------------------------------

    \530\ See, e.g., notification requirements in California (Cal. 
Civ. Code section 1798.82(a)) and Texas (Tex. Bus. & Com. Code 
section 521.053) triggered by the unauthorized acquisition of 
certain information, as compared to notification requirements in 
Florida (Fla. Stat. section 501.171) and New York (N.Y. Gen. Bus. 
Law section 899-AA) triggered by unauthorized access to personal 
information. ``States'' in this discussion includes the 50 U.S. 
States and the District of Columbia, for a total of 51. All State 
law citations are to the Sept. 2023 versions of State codes.
---------------------------------------------------------------------------

    Generally, States can be said to adopt either a basic or an 
enhanced definition of personal information. A typical example of a 
basic definition specifies personal information as the customer name 
linked to one or more pieces of nonpublic information such as Social 
Security number, driver's license number (or other State identification 
number), or financial account number together with any required 
credentials to permit access to said account.\531\ A typical enhanced 
definition includes additional types of nonpublic information that 
trigger the notification requirement; examples include: passport 
number, military identification number, or other unique identification 
number issued on a government document commonly used to verify the 
identity of a specific individual; unique biometric data generated from 
measurements or technical analysis of human body characteristics, such 
as a fingerprint, retina, or iris image, used to authenticate a 
specific individual.\532\ Enhanced definitions also trigger 
notification requirements when a username or email address in 
combination with a password or security question and answer that would 
permit access to an online account is compromised.\533\ Most States 
(37) adopt some form of enhanced definition, while a minority (14) 
adopt a basic definition.
---------------------------------------------------------------------------

    \531\ See, e.g., Kan. Stat. section 50-7a01(g) or Minn. Stat. 
section 325E.61(e).
    \532\ See, e.g., Md. Comm. Code section 14-3501 (defining 
``personal information'' to include credit card numbers, health 
information, health insurance information, and biometric data such 
as retina or fingerprint).
    \533\ See, e.g., Ariz. Code section 18-551 (defining ``personal 
information'' to include an individual's username or email address, 
in combination with a password or security question and answer, that 
allows access to an online account).
---------------------------------------------------------------------------

    One commenter stated that all States provided an exception to the 
notification requirement if the data compromised were encrypted.\534\ 
We found that States may include an explicit encryption or redaction 
exception in their definition of personal information,\535\ in their 
definition of breach,\536\ or in the determination that notification of 
affected individuals is necessary.\537\ Multiple States include at 
least two of these exceptions. States

[[Page 47734]]

vary, however, in the whether and how they define encryption or 
redaction.\538\
---------------------------------------------------------------------------

    \534\ See SIFMA Comment Letter 2 (``Note that all U.S. State 
data breach notification laws provide an encryption safe harbor.''); 
see also Liisa M. Thomas, Thomas on Data Breach: A Practical guide 
to Handling Data Breach Notifications Worldwide (Feb. 2023), at 
section 2:45 (``Thomas 2023'').
    \535\ See, e.g., Kan. Stat. section 50-7a01(g) (defining 
``personal information'' to include a consumer's first name or first 
initial and last name linked to any one or more of the specified 
data elements that relate to the consumer, when the data elements 
are neither encrypted nor redacted); Wyo. Stat. section 40-12-501 
(defining ``personal identifying information'' to exclude redacted 
data elements).
    \536\ See, e.g., Ariz. Code section 18-551 (defining ``breach'' 
to include unauthorized acquisition of and unauthorized access that 
materially compromises the security or confidentiality of 
unencrypted and unredacted computerized personal information).
    \537\ See, e.g., Minn. Stat. section 325E.61(a) (requiring 
notification of a breach to any resident whose unencrypted personal 
information was, or is reasonably believed to have been, acquired by 
an unauthorized person).
    \538\ We considered a safe harbor from the notification 
requirements for encrypted information. See infra section IV.F.3.
---------------------------------------------------------------------------

    Most States (43) provide an exception to the notification 
requirement if, following a breach of security, the entity investigates 
and determines that there is no reasonable likelihood that the 
individual whose personal information was breached has experienced or 
will experience certain harms (``no-harm exception'').\539\ Twenty of 
these States do not have a presumption of notification and instead 
require notification only if, for example, an investigation reveals a 
risk of harm or misuse.\540\ Although the types of harms vary by State, 
they most commonly include: ``harm'' generally (13), identity theft or 
other fraud (10), or misuse of personal information (8). Figure 1 plots 
the frequency of the various types of harms referenced in States' no-
harm exceptions.
---------------------------------------------------------------------------

    \539\ See, e.g., Fla. Stat. section 501.171(4)(c) and N.Y. Gen. 
Bus. Law section 899-AA(2)(a). Eight States, including California 
and Texas, do not have a no-harm exception and require notification 
even in the cases where there is no risk of harm.
    \540\ See, e.g., N.C. Stat. section 75-61(14) and Utah Code 13-
44-202(1).
[GRAPHIC] [TIFF OMITTED] TR03JN24.000

(2) Timing, Content, and Method of Notification
    In general, State laws provide a general principle for timing of 
notification (e.g., delivery shall be made ``without unreasonable 
delay,'' or ``in the most expedient time possible and without 
unreasonable delay'').\541\ Some States augment the general principle 
with a specific deadline (e.g., notice must be made ``in the most 
expedient time possible and without unreasonable delay, but not later 
than 30 days after the date of determination that the breach occurred'' 
unless certain exceptions apply).\542\ All States allow for a delay if 
it is requested by a law enforcement agency.\543\ Additionally, some 
States allow for a delay if necessary to determine the nature and scope 
of the breach or to restore the reasonable integrity of the information 
system.\544\ Figure 2 plots the frequency of different notification 
deadlines in

[[Page 47735]]

State laws. For States with specific deadlines, the figure 
distinguishes between States that allow an exception to determine the 
nature and scope of the breach or to restore the reasonable integrity 
of the information system, and those that do not.
---------------------------------------------------------------------------

    \541\ See, e.g., Cal. Civ. Code section 1798.82(a) (disclosure 
to be made ``in the most expedient time possible and without 
unreasonable delay'' but allowing for needs of law enforcement and 
measures to determine the scope of the breach and restore the 
system).
    \542\ See, e.g., Colo. Rev. Stat. section 6-1-716(2)(a) (notice 
to be made ``in the most expedient time possible and without 
unreasonable delay, but not later than thirty days after the date of 
determination that a security breach occurred, consistent with the 
legitimate needs of law enforcement and consistent with any measures 
necessary to determine the scope of the breach and to restore the 
reasonable integrity of the computerized data system''); Fla. Stat. 
section 501.171(4)(a) (notice to be made ``as expeditiously as 
practicable and without unreasonable delay . . . but no later than 
30 days after the determination of a breach'' unless delayed at the 
request of law enforcement or waived pursuant to the State's no-harm 
exception).
    \543\ See, e.g., Ala. Stat. section 8-38-5(c) (``If a federal or 
State law enforcement agency determines that notice to individuals 
required under this section would interfere with a criminal 
investigation or national security, the notice shall be delayed upon 
the receipt of written request of the law enforcement agency for a 
period that the law enforcement agency determines is necessary.''); 
Ark. Code section 4-110-105(c) (``The notification required by this 
section may be delayed if a law enforcement agency determines that 
the notification will impede a criminal investigation.''); Conn. 
Stat. section 36a-701b.(d) (``Any notification required by this 
section shall be delayed for a reasonable period of time if a law 
enforcement agency determines that the notification will impede a 
criminal investigation and such law enforcement agency has made a 
request that the notification be delayed.''); Md. Comm. Code section 
14-3504(d)(1) (notice may be delayed if ``a law enforcement agency 
determines that the notification will impede a criminal 
investigation or jeopardize homeland or national security''); N.C. 
Stat. section 75-65(c) (``The notice required by this section shall 
be delayed if a law enforcement agency informs the business that 
notification may impede a criminal investigation or jeopardize 
national or homeland security, provided that such request is made in 
writing or the business documents such request contemporaneously in 
writing, including the name of the law enforcement officer making 
the request and the officer's law enforcement agency engaged in the 
investigation.'').
    \544\ See, e.g., Tex. Bus. & Com. Code section 521.053 (notice 
to be made ``without unreasonable delay and in each case not later 
than the 60th day after the date on which the person determines that 
the breach occurred, except as provided by Subsection (d) or as 
necessary to determine the scope of the breach and restore the 
reasonable integrity of the data system'').
[GRAPHIC] [TIFF OMITTED] TR03JN24.001

    One commenter stated that, where State laws have a 30-day notice 
requirement, the 30-day periods generally do not begin to run until a 
determination has been made that the incident affected residents of 
that State that will require notice, and that the Commission's proposed 
30-day requirement would be triggered much sooner in the process.\545\ 
The same commenter also stated that notices are currently sent to 
individuals whose information is reasonably believed to have 
potentially been affected after the findings of an investigation are 
determined.\546\ To help analyze and respond to these comments, and 
also to provide additional context for our analysis of the possible 
effects of the final amendments,\547\ we conducted supplemental 
analysis of the frequency of different triggers for the specific 
deadline requirement in the 20 States that specify such a deadline. The 
results of this analysis are in Figure 3 and demonstrate variation in 
triggering events. For example, State laws specify that the 
notification of customers be made ``not later than sixty days from the 
discovery of the breach,'' \548\ or ``no later than 30 days after the 
determination of a breach or reason to believe a breach occurred.'' 
\549\ Many of these triggers use words such as ``determination'' or 
``confirmation,'' which, consistent with the commenter's observation, 
suggests investigation that might cause the specific deadline to be 
triggered later than the Commission's proposed or adopted notification 
trigger, although ``discovery of breach''--used in five States--could 
potentially be earlier.\550\
---------------------------------------------------------------------------

    \545\ See CAI Comment Letter (``While the Commission correctly 
notes in the S-P Proposing Release that some existing State laws 
also include a 30-day notice requirement, those requirements 
generally do not begin to run until a determination has been made 
that the incident affected residents of that State that will require 
notice.''). In the final amendments, as in the proposal, the 
beginning of the 30-day outside timeframe is a covered institution 
``becoming aware'' that unauthorized access to or use of customer 
information has occurred or is reasonably likely to have occurred. 
See proposed rule 248.30(b)(4)(iii); final rule 248.30(a)(4)(iii).
    \546\ See CAI Comment Letter.
    \547\ See infra section IV.D.1.b(2).
    \548\ See La. Rev. Stat. section 51:3074.
    \549\ See Fla. Stat. section 501.171(4)(a).
    \550\ See infra section IV.D.1.b(2).
---------------------------------------------------------------------------

BILLING CODE 8011-01-P

[[Page 47736]]

[GRAPHIC] [TIFF OMITTED] TR03JN24.002

BILLING CODE 8011-01-C
    One commenter stated that most State data breach notification laws 
did not specify a number of days to report a breach, and that of the 
States that did have a specific timeframe, many had an exception 
allowing for compliance with the GLBA in lieu of adherence to their 
timeframes.\551\ To help analyze and respond to this comment, and also 
to provide additional context for our analysis of the possible effects 
of the final amendments, we conducted supplemental analysis of the 
overlap between States that have a specific deadline and States that 
include a GLBA exception.\552\ We found that of the 20 States that have 
a specific deadline, 10 do not include a GLBA exception.\553\
---------------------------------------------------------------------------

    \551\ See SIFMA Comment Letter 2.
    \552\ See infra section IV.D.1.b(1).
    \553\ We discuss this exception and the States where it applies 
in section IV.D.1.b(1).
---------------------------------------------------------------------------

    Additionally, one commenter stated the establishment of a Federal 
minimum standard for data breach notification would satisfy State 
notice laws that provide exemptions for firms subject to such a 
requirement.\554\ To help analyze and respond to this comment, and also 
to provide additional context for our analysis of the possible effects 
of the final amendments,\555\ we conducted supplemental analysis of 
this question. We have found that some States excuse entities from 
individual notification under State law if the entities comply with the 
notification requirements of a Federal regulator or, in some cases, 
another State. Some States allow these substitute notifications to 
replace their own state-specific requirements on notice content and 
timing,\556\ while others only allow it if the provisions are at least 
as protective as State law.\557\
---------------------------------------------------------------------------

    \554\ See IAA Comment Letter 1.
    \555\ See infra section IV.D.1.b.
    \556\ See, e.g., Fla. Stat. section 501.171(4)(g) (``Notice 
provided pursuant to rules, regulations, procedures, or guidelines 
established by the covered entity's primary or functional federal 
regulator is deemed to be in compliance with the notice requirement 
in this subsection . . . .''); Va. Code. Ann. section 18.2-186.6(H) 
(``An entity that complies with the notification requirements . . . 
established by the entity's primary or functional state or federal 
regulator shall be in compliance with this section.''). According to 
Thomas 2023, approximately 15 States allow compliance with a primary 
regulator to replace their own State's required notification in some 
circumstances; see also ICI Comment Letter 1 (``Today, approximately 
13 states provide an exemption or exclusion from the state's breach 
notice requirements if the entity experiencing the breach has a duty 
under federal law to provide notice of the breach.''). See also 
infra section IV.D.1.b(1) on GLBA safe harbor provisions, which are 
similar but distinct.
    \557\ See, e.g., Colo. Rev. Stat. 6-1-716(3)(b) (``In the case 
of a conflict . . . the law or regulation with the shortest 
timeframe for notice to the individual controls.''); Iowa Code 
section 715C.2(7)(b) (exempting in the case of compliance ``with a 
state or federal law that provides greater protection to personal 
information and at least as thorough disclosure requirements for 
breach of security or personal information than that provided by 
this section'').
---------------------------------------------------------------------------

    Some commenters stated that different State laws currently have 
different requirements as to what content must be included in a notice 
to customers.\558\ One of these commenters further stated that, as a 
result, covered institutions may, when they experience a data breach 
incident today, send different notification letters to residents of 
different States for the same incident.\559\ To help analyze and

[[Page 47737]]

respond to these comments, and to provide additional context for our 
analysis of the possible effects of the final amendments,\560\ we 
conducted supplemental analysis of the frequency at which different 
items are currently required by State laws to be included in notices to 
customers. This analysis, shown in Figure 4, supports commenters' 
observation that different States have different requirements. While 
half of the States do not have such requirements, many States (25) 
provide minimum content to be included in the notices sent to 
individuals whose information has been affected by a breach. The most 
common required items include the type of information affected, contact 
information for consumer reporting agencies, and the date of the 
breach. Figure 4 plots the frequency of different items required by 
State laws to be included in the notices.
---------------------------------------------------------------------------

    \558\ See, e.g., IAA Comment Letter 1.
    \559\ See ICI Comment Letter 1 (``In discussing breach notices 
with our members, we understand it is not uncommon for their current 
breach response programs to include separate notification letters 
depending upon the state the individual resides in.''). One benefit 
of the final amendments will be to help ensure that all customers 
receive a minimum level of information regarding a given breach. See 
infra section IV.D.1.b(5).
    \560\ See infra section IV.D.1.b(5).
    [GRAPHIC] [TIFF OMITTED] TR03JN24.003
    
    States also differ in their requirements regarding the method that 
must be used to notify affected individuals.\561\ While all States 
allow for a written notification, most States impose conditions if the 
notice is sent electronically. For example, 37 States provide that a 
notice can be sent electronically only if the notice is consistent with 
the Electronic Signatures in Global and National Commerce Act.\562\ 
Fifteen States have as a condition that a primary method of 
communication between the entity and the affected residents be by 
electronic means.\563\ Five States impose no condition for electronic 
notices,\564\ and 2 States only require that the notifying institution 
have the email address of the affected individuals.\565\ In addition, 
26 States allow for the notice to be made over the phone.\566\ Of these 
26 States, 7 provide that a condition for a telephonic notice is that 
contact is made directly with the affected individuals.\567\
---------------------------------------------------------------------------

    \561\ We conducted this supplemental analysis to help analyze 
and respond to comments, and also to provide additional context for 
our analysis of the possible effects of the final amendments. See 
infra section IV.D.1.b(5).
    \562\ 15 U.S.C. 7001, et seq. See, e.g., Cal. Civ. Code section 
1798.82(j); Conn. Stat. section 36a-701b.(e); Ga. Code section 10-1-
911(4); Tex. Bus. & Com. Code section 521.053(e).
    \563\ See. e.g., Colo. Rev. Stat. section 6-1-716(1)(F); Del. 
Code Tit. 6 section 12B-101(5); Tenn. Code Ann. section 47-18-
2107(e).
    \564\ See, e.g., Ala. Code section 8-38-5(d); Fla. Stat. section 
501.171(4)(d); Va. Code. Ann. section 18.2-186.6(A).
    \565\ See Ariz. Code section 18-552(F); Ind. Code 24-4.9-3-4.
    \566\ See. e.g., Conn. Stat. section 36a-701b.(e); N.Y. Gen. 
Bus. Law section 899-AA(5); 73 Pa. Stat. section 2302.
    \567\ See, e.g., Ariz. Code section 18-552(F); Mo. Stat. 
407.1500 section 2(6); 9 Vt. Stat. Ann. section 2435(b)(6)(A).
---------------------------------------------------------------------------

    All States allow, under some conditions, for substitute 
notification instead of the required methods of notification discussed 
above. The most common conditions include a specified large number of 
individuals to notify and/or a minimum dollar cost to notify the 
affected individuals. These conditions vary widely across States.\568\ 
In most States, a substitute notice consists of all of the following 
elements: email notification to the affected individuals, a notice on 
the institution's website, and notification to major statewide 
media.\569\ However, other States have fewer requirements.\570\
---------------------------------------------------------------------------

    \568\ For example, some States allow for a substitute notice if 
the number of affected individuals is above 1,000 or 5,000 or if the 
cost of providing notice is above $5,000 or $10,000, while many 
States have a threshold of 500,000 affected individuals or a cost 
threshold of $250,000. See, e.g., Maine Rev. Stat. Tit. 10 section 
1347(4); Miss. Code section 75-24-29(6); N.H. Rev. Stat. section 
359-C:20(III); Cal. Civ. Code section 1798.82(j); Fla. Stat. section 
501.171(4)(f); N.Y. Gen. Bus. Law section 899-AA(5).
    \569\ See, e.g., DC Code section 28-3851(2); La. Rev. Stat. 
section 51:3074(G); N.J. Stat. section 56:8-163(d).; Va. Code. Ann. 
section 18.2-186.6(A).
    \570\ See, e.g., Ala. Code section 8-38-5(e) (``Substitute 
notice shall include both of the following: 1. A conspicuous notice 
on the internet website of the covered entity, if the covered entity 
maintains a website, for a period of 30 days. 2. Notice in print and 
in broadcast media, including major media in urban and rural areas 
where the affected individuals reside.''); Fla. Stat. section 
501.171(4)(f) (``Such substitute notice shall include the following: 
1. A conspicuous notice on the internet website of the covered 
entity if the covered entity maintains a website; and 2. Notice in 
print and to broadcast media, including major media in urban and 
rural areas where the affected individuals reside.''); Tex. Bus. & 
Com. Code section 521.053(f) (requiring that under certain 
conditions, ``the notice may be given by: (1) electronic mail, if 
the person has electronic mail addresses for the affected persons; 
(2) conspicuous posting of the notice on the person's website; or 
(3) notice published in or broadcast on major statewide media'').

---------------------------------------------------------------------------

[[Page 47738]]

(3) Notification by Service Providers
    Some data breach incidents involve service providers. Covered 
institutions may use service providers to perform certain business 
activities and functions, such as trading and order management, 
information technology functions, and cloud computing services. As a 
result of this outsourcing, service providers may receive, maintain, or 
process customer information, or be permitted to access it, and 
therefore a security incident at the service provider could expose 
information at or belonging to the covered institution. In general, 
State laws require persons and entities that maintain computerized data 
for other entities, but do not own or license that data, to notify the 
data-owning entity in the event of a data breach (so as to allow that 
entity to notify affected individuals).\571\ However, several State 
laws provide that a covered institution may contract with the service 
provider such that the service provider directly notifies affected 
individuals of a data breach.\572\ In addition, some States impose the 
responsibility of notifying affected individuals on entities that 
maintain or possess the data even if they do not own or license 
it.\573\
---------------------------------------------------------------------------

    \571\ See, e.g., Cal. Civ. Code section 1798.82(b); DC Code 
section 28-3852(b); N.Y. Gen. Bus. Law section 899-AA(3); Tex. Bus. 
& Com. Code section 521.053(c).
    \572\ See, e.g., Fla. Stat. section 501.171(6)(b); Ala. Code 
section 8-38-8. We do not have information on the frequency of such 
arrangements.
    \573\ See, e.g., Ky. Rev. Stat. 365.732(2) (``Any information 
holder shall disclose any breach of the security of the system, 
following discovery or notification of the breach in the security of 
the data, to any resident of Kentucky whose unencrypted personal 
information was, or is reasonably believed to have been, acquired by 
an unauthorized person.''); Maine Rev. Stat. Tit. 10 section 
1348(1)(B). (``If any other person who maintains computerized data 
that includes personal information becomes aware of a breach of the 
security of the system, the person shall conduct in good faith a 
reasonable and prompt investigation to determine the likelihood that 
personal information has been or will be misused and shall give 
notice of a breach of the security of the system following discovery 
or notification of the security breach to a resident of this State 
if misuse of the personal information has occurred or if it is 
reasonably possible that misuse will occur.''). See also Thomas 
2023, at section 2:21.
---------------------------------------------------------------------------

    Some commenters opposed the proposed provision that would have 
required service providers to notify covered institutions of a breach 
of sensitive customer information within 48 hours.\574\ A commenter 
further stated that our analysis of the effects of this requirement was 
incomplete.\575\ We conducted supplemental analysis of the notification 
timeframe required by State laws for entities that do not own or 
license the compromised data to help analyze and respond to these 
comments, and to provide additional context for our analysis of the 
possible effects of the final amendments.\576\
---------------------------------------------------------------------------

    \574\ See, e.g., ACLI Comment Letter.
    \575\ See Microsoft Comment Letter (``The cost-benefit analyses 
of the Proposed Rules do not identify why a 48-hour or shorter 
reporting period is optimal.''). See also supra section II.A.4 for a 
discussion of the length of notification period.
    \576\ See infra section IV.D.1.c.
---------------------------------------------------------------------------

    In general, State laws provide a window for notification of the 
entity that owns or licenses the data by the entity that maintains the 
data.\577\ Ten States provide a specific deadline of either 24 hours 
(one State),\578\ 10 days (four States),\579\ 45 days (four 
States),\580\ or 60 days (one State).\581\ Thirty-eight States provide 
instead a general principle such as ``as soon as practicable'' or 
``without unreasonable delay.'' \582\ In particular, 24 States require 
the notification to take place immediately after the discovery of the 
breach or the determination that a breach has occurred.\583\ Figure 5 
plots the frequency of these different provisions across State laws. 
This variation across State laws in timelines for (1) notification of 
the entity that owns or licenses the data by the entity that maintains 
the data and (2) notification of the affected individuals by the entity 
that owns or licenses the data can result in widely different lengths 
of time between the discovery of a breach and the time the affected 
individuals are notified. In addition, variations in these State laws 
could result in residents of one State receiving notice while residents 
of another receive no notice for the same data breach incident.\584\
---------------------------------------------------------------------------

    \577\ A small number of States do not require such a 
notification. For example, Rhode Island does not distinguish between 
entities that own or license the data and those entities that do 
not, requiring all entities to notify customers directly (R.I. Gen. 
Laws section 11-49.3-4(a)(1) (``Any municipal agency, State agency, 
or person that stores, owns, collects, processes, maintains, 
acquires, uses, or licenses data that includes personal information 
shall provide notification as set forth in this section of any 
disclosure of personal information, or any breach of the security of 
the system, that poses a significant risk of identity theft to any 
resident of Rhode Island whose personal information was, or is 
reasonably believed to have been, acquired by an unauthorized person 
or entity.''). Similarly, South Dakota does not have a provision for 
persons or businesses that do not own or license computerized 
personal data (SDCL sections 22-40-19 through 22-40-26).
    \578\ See Ga. Code section 10-1-912(b) (``Any person or business 
that maintains computerized data on behalf of an information broker 
or data collector that includes personal information of individuals 
that the person or business does not own shall notify the 
information broker or data collector of any breach of the security 
of the system within 24 hours following discovery, if the personal 
information was, or is reasonably believed to have been, acquired by 
an unauthorized person.'').
    \579\ See, e.g., Md. Comm. Code section 14-3504(c) (``Except as 
provided in subsection (d) of this section, the notification 
required under paragraph (1) of this subsection shall be given as 
soon as reasonably practicable, but not later than 10 days after the 
business discovers or is notified of the breach of the security of a 
system.'').
    \580\ See, e.g., Tenn. Code Ann. section 47-18-2107(c) (``Any 
information holder that maintains computerized data that includes 
personal information that the information holder does not own shall 
notify the owner or licensee of the information of any breach of 
system security if the personal information was, or is reasonably 
believed to have been, acquired by an unauthorized person. The 
disclosure must be made no later than forty-five (45) days from the 
discovery or notification of the breach of system security, unless a 
longer period of time is required due to the legitimate needs of law 
enforcement, as provided in subsection (d).'').
    \581\ See La. Rev. Stat. section 51:3074(E) (``The notification 
required pursuant to Subsections C and D of this Section shall be 
made in the most expedient time possible and without unreasonable 
delay but not later than sixty days from the discovery of the 
breach, consistent with the legitimate needs of law enforcement, as 
provided in Subsection F of this Section, or any measures necessary 
to determine the scope of the breach, prevent further disclosures, 
and restore the reasonable integrity of the data system.'').
    \582\ See, e.g., Miss. Code section 75-24-29(4) (``Any person 
who conducts business in this State that maintains computerized data 
which includes personal information that the person does not own or 
license shall notify the owner or licensee of the information of any 
breach of the security of the data as soon as practicable following 
its discovery, if the personal information was, or is reasonably 
believed to have been, acquired by an unauthorized person for 
fraudulent purposes.''); Va. Code. Ann. section 18.2-186.6(D) (``An 
individual or entity that maintains computerized data that includes 
personal information that the individual or entity does not own or 
license shall notify the owner or licensee of the information of any 
breach of the security of the system without unreasonable delay 
following discovery of the breach of the security of the system'').
    \583\ See, e.g., Ark. Code section 4-110-105(b), N.C. Stat. 
section 75-65(b), and Utah Code 13-44-202(3). For many of these 
States, this immediate notification can be delayed if the delay is 
requested by a law enforcement agency.
    \584\ See supra footnote 578 on South Dakota. In addition, in 
some States, notification from the service provider to the 
information owner is required only in the case of fraud or misuse. 
See, e.g., Miss. Code section 75-24-29(4) (requiring notification if 
the information was or is reasonably believed to have been acquired 
by an unauthorized person for fraudulent purposes); Colo. Rev. Stat. 
section 6-1-716(2)(b) (requiring notification if misuse of personal 
information about a Colorado resident occurred or is likely to 
occur).

---------------------------------------------------------------------------

[[Page 47739]]

[GRAPHIC] [TIFF OMITTED] TR03JN24.004

    Some of the service providers that will be affected by the final 
amendments are covered institutions themselves.\585\ Also, some 
entities that are covered institutions but not service providers under 
the final amendments could, under State law, be entities that maintain 
but do not own or license that data, meaning they may have an 
obligation under State law to notify the data owner.\586\ In 
particular, commenters stated that transfer agents were generally 
considered service providers of the securities issuers under State 
laws.\587\ State laws typically require transfer agents to notify the 
securities issuers in case of security breach, which in turn must 
notify the affected customers. One commenter stated that transfer 
agents were, in addition, often required by contract to notify their 
securities issuer clients in case of data breach.\588\ Another 
commenter stated that it was not uncommon for covered institutions to 
require, by contract or agreement, that their service providers, 
including transfer agents, notify them in case of security breach.\589\ 
Hence, we expect that all or almost all covered institutions and their 
service providers are already complying with one or more notification 
requirements, pursuant to either State law or contract.\590\
---------------------------------------------------------------------------

    \585\ See supra section II.A.3.a.
    \586\ This could be the case, for example, of transfer agents 
providing services only to publicly traded companies that are not 
covered institutions.
    \587\ See, e.g., Computershare Comment Letter (``It is also 
contrary to privacy laws that deem the issuer to be the `controller' 
or `business' with respect to securityholders and their data and 
deem the transfer agent based on its role to be the `processor' or 
`service provider.' '').
    \588\ See STA Comment Letter 2.
    \589\ See ICI Comment Letter 1.
    \590\ Even if a State does not have specific requirements for 
entities that do not own or license computerized personal or 
protected information (such as South Dakota, see supra footnote 
578), it is unlikely, by the nature of the transfer agent business, 
that a transfer agent would have access to customer information of 
individuals residing in this State only.
---------------------------------------------------------------------------

b. Customer Information Safeguards
    Regulation S-P, prior to the adoption of the amendments, required 
all covered institutions to adopt written policies and procedures 
reasonably designed to: ``(i) insure [sic] the security and 
confidentiality of customer records and information; (ii) protect 
against any anticipated threats or hazards to the security or integrity 
of customer records and information; and (iii) protect against 
unauthorized access to or use of customer records and information that 
could result in substantial harm or inconvenience to any customer.'' 
\591\ In addition, Regulation S-P established limitations on how 
covered institutions may disclose nonpublic personal information about 
a consumer to nonaffiliated third parties.\592\ It also established 
limitations on the further disclosure of nonpublic personal information 
received by a covered institution from a nonaffiliated financial 
institution, as well as limitations on the further disclosure of 
nonpublic personal information disclosed from a covered institution to 
a nonaffiliated third party.\593\ Before this adoption, Regulation S-P 
did not include specific provisions for how covered institutions were 
to satisfy their obligations to safeguard customer records and 
information when utilizing service providers.
---------------------------------------------------------------------------

    \591\ 17 CFR 248.30. See also Compliance Programs of Investment 
Companies and Investment Advisers, Investment Advisers Act Release 
No. 2204 (Dec. 17, 2003) [68 FR 74714 (Dec. 24, 2003)], at n.22 
(``Compliance Program Release'') (stating expectation that policies 
and procedures would address safeguards for the privacy protection 
of client records and information and noting the applicability of 
Regulation S-P); see also supra section II.B.2 explaining that prior 
to these final amendments, the safeguards rule did not apply to any 
transfer agents, and the disposal rule applied only to transfer 
agents registered with the Commission.
    \592\ See 17 CFR 248.10.
    \593\ See 17 CFR 248.11.
---------------------------------------------------------------------------

    Covered institutions that hold transactional accounts for consumers 
may also be subject to Regulation S-ID.\594\ Such entities must develop 
and implement a written identity theft program that includes policies 
and procedures to identify relevant types of identity theft red flags, 
detect the occurrence of those red flags, and respond appropriately to 
the detected red flags.\595\
---------------------------------------------------------------------------

    \594\ Regulation S-ID applies to ``financial institutions'' or 
``creditors'' that offer or maintain ``covered accounts.'' Entities 
that are likely to qualify as financial institutions or creditors 
and maintain covered accounts include most registered brokers, 
dealers, funding portals, investment companies, and some registered 
investment advisers. See 17 CFR 248.201; see also Identity Theft Red 
Flag Rules, Investment Advisers Act Release No. 3582 (Apr. 10, 2013) 
[78 FR 23637 (Apr. 19, 2013)] (``Identity Theft Release''); see also 
17 CFR 227.403(b).
    \595\ In a 2017 Risk Alert, the SEC Office of Compliance 
Inspections and Examinations (now called the Division of 
Examinations) noted that, based on observations from examinations of 
75 registrants, nearly all examined broker-dealers and most of the 
examined advisers had specific cybersecurity and Regulation S-ID 
policies and procedures. See EXAMS Risk Report, Observations from 
Cybersecurity Examinations (Aug. 7, 2017), available at https://www.sec.gov/files/observations-from-cybersecurity-examinations.pdf; 
see also Identity Theft Release. In addition, affected entities must 
also periodically update their identity theft programs. See 17 CFR 
248.201. Other rules also require updates to policies and procedures 
at regular intervals: see, e.g., Rule 38a-1 under the Investment 
Company Act; FINRA Rule 3120 (Supervisory Control System); and FINRA 
Rule 3130 (Annual Certification of Compliance and Supervisory 
Processes).

---------------------------------------------------------------------------

[[Page 47740]]

    In addition, broker-dealers that operate alternative trading 
systems exceeding specified volume thresholds are SCI entities subject 
to Regulation SCI and required, among other things, to have certain 
policies and procedures reasonably designed to ensure that their market 
systems have adequate levels of capacity, integrity, resiliency, 
availability, and security and take appropriate corrective action when 
``SCI events'' occur.\596\ SCI entities are required to disseminate 
information to their members or participants about certain types of SCI 
events.\597\ Upon the SCI entity having a reasonable basis to conclude 
that a certain type of SCI event (such as a ``systems intrusion'' that 
is not de minimis) has occurred, it is generally required to promptly 
disseminate information about the SCI event to those members and 
participants that the SCI entity has reasonably estimated may have been 
affected. If such ``SCI event'' is ``major,'' the information 
disseminated must be to all of the entity's members or 
participants.\598\ When required, the notification must include a 
summary description of the systems intrusion, including a description 
of the corrective action taken by the SCI entity and when the systems 
intrusion has been or is expected to be resolved, unless the SCI entity 
determines that dissemination of such information would likely 
compromise the security of the SCI entity's SCI systems or indirect SCI 
systems, or an investigation of the systems intrusion, and documents 
the reasons for such determination.\599\ Therefore, information about 
an ``SCI event'' caused by a cybersecurity incident may be required to 
be disseminated to some or all an SCI entity's members or participants 
pursuant to Regulation SCI.
---------------------------------------------------------------------------

    \596\ Regulation SCI is codified at 17 CFR 242.1000 through 
1007.
    \597\ 17 CFR 242.1002(c).
    \598\ 17 CFR 242.1002(c)(3).
    \599\ 17 CFR 242.1002(c).
---------------------------------------------------------------------------

    The safeguards rule of Regulation S-P did not, before this 
adoption, apply to transfer agents. In addition, the disposal rule did 
not apply to transfer agents registered with a regulatory agency other 
than the Commission.\600\ Thus, for these institutions, the final 
amendments create new requirements to adopt written policies and 
procedures that address administrative, technical, and physical 
safeguards for the protection of customer information and to take 
reasonable measures to protect against unauthorized access to or use of 
consumer information and customer information in connection with its 
disposal.\601\ Some transfer agents registered with a regulatory agency 
other than the Commission may already be subject to some of the Federal 
regulation described below. In addition, many States impose 
requirements regarding the safeguarding and the disposal of customer 
information.\602\ Hence, many transfer agents are likely to already 
have policies and procedures in the areas covered by these new 
requirements.
---------------------------------------------------------------------------

    \600\ See supra section II.B.2.
    \601\ See final rule 240.30(a)(1) and (b).
    \602\ Twenty States have customer information safeguard 
requirements, and 30 States have customer information disposal 
requirements. See, e.g., Cal. Civ. Code section 1798.81.5 (``A 
business that owns, licenses, or maintains personal information 
about a California resident shall implement and maintain reasonable 
security procedures and practices appropriate to the nature of the 
information, to protect the personal information from unauthorized 
access, destruction, use, modification, or disclosure.''); Del. Code 
Tit. 6 section 12B-100 (``Any person who conducts business in this 
State and owns, licenses, or maintains personal information shall 
implement and maintain reasonable procedures and practices to 
prevent the unauthorized acquisition, use, modification, disclosure, 
or destruction of personal information collected or maintained in 
the regular course of business.''); Fla. Stat. section 501.171(2) 
(``Each covered entity, governmental entity, or third-party agent 
shall take reasonable measures to protect and secure data in 
electronic form containing personal information.''). See also, e.g., 
Cal. Civ. Code section 1798.81 (``A business shall take all 
reasonable steps to dispose, or arrange for the disposal, of 
customer records within its custody or control containing personal 
information when the records are no longer to be retained by the 
business by (a) shredding, (b) erasing, or (c) otherwise modifying 
the personal information in those records to make it unreadable or 
undecipherable through any means.''); La. Rev. Stat. section 
51:3074(B) (``Any person that conducts business in the state or that 
owns or licenses computerized data that includes personal 
information, or any agency that owns or licenses computerized data 
that includes personal information shall take all reasonable steps 
to destroy or arrange for the destruction of the records within its 
custody or control containing personal information that is no longer 
to be retained by the person or business by shredding, erasing, or 
otherwise modifying the personal information in the records to make 
it unreadable or undecipherable through any means.''); N.J. Stat. 
section 56:8-162 (``A business or public entity shall destroy, or 
arrange for the destruction of, a customer's records within its 
custody or control containing personal information, which is no 
longer to be retained by the business or public entity, by 
shredding, erasing, or otherwise modifying the personal information 
in those records to make it unreadable, undecipherable or 
nonreconstructable through generally available means.'').
---------------------------------------------------------------------------

    Some covered institutions may also be subject to other regulators' 
rules and guidelines implicating customer information safeguards. 
Transfer agents supervised by one of the Banking Agencies may be 
subject to the Banking Agencies' Incident Response Guidance and to the 
Banking Agencies' Safeguards Guidance, for example.\603\ The Banking 
Agencies' Incident Response Guidance requires covered financial 
institutions to develop a response program covering assessment, 
notification to relevant regulators and law enforcement, incident 
containment, and customer notice.\604\ These guidelines require 
customer notification if a financial institution determines that misuse 
of sensitive customer information ``has occurred or is reasonably 
possible.'' \605\ They also require notices to occur ``as soon as 
possible,'' but permit delays if ``an appropriate law enforcement 
agency determines that notification will interfere with a criminal 
investigation and provides the institution with a written request for 
the delay.'' \606\ Under the guidelines, ``sensitive customer 
information'' means ``a customer's name, address, or telephone number, 
in conjunction with the customer's Social Security number, driver's 
license number, account number, credit or debit card number, or a 
personal identification number or password that would permit access to 
the customer's account.'' \607\ In addition, ``any combination of 
components of customer information that would allow someone to log onto 
or access the customer's account, such as user name and password or 
password and account number'' is also considered sensitive customer 
information under the guidelines.\608\ The Banking Agencies' Safeguards 
Guidance directs every financial institution covered by the

[[Page 47741]]

guidelines to require its service providers by contract to implement 
appropriate measures designed to protect against unauthorized access to 
or use of customer information that could result in substantial harm or 
inconvenience to any customer.\609\ In addition, the Banking Agencies' 
Incident Response Guidance directs that an institution's contract with 
its service provider should require the service provider to take 
appropriate actions to address incidents of unauthorized access to the 
financial institution's customer information, including notification to 
the institution as soon as possible of any such incident, to enable the 
institution to expeditiously implement its response program.\610\
---------------------------------------------------------------------------

    \603\ See Banking Agencies' Incident Response Guidance and 
Banking Agencies' Safeguards Guidance; see also Computershare 
Comment Letter (``Many registered transfer agents like Computershare 
US and Computershare Canada entities are banks or trust companies, 
and therefore already subject to state, federal, or provincial 
banking laws, rules, regulations and inter-agency guidelines.'' The 
commenter also refers to ``Title V, Subtitle A, of the Gramm-Leach-
Bliley Act, 15 U.S.C. 6801-6809; 12 CFR 30, Appendix B to Part 30--
Interagency Guidelines Establishing Information Security Standards; 
and New York State Department of Financial Services Cybersecurity 
Regulation, 23 NYCRR Part 500.'').
    \604\ See Banking Agencies' Incident Response Guidance at 
Supplement A, section II.A.
    \605\ See id., at Supplement A, section III.A.
    \606\ See id., at Supplement A, section III.A.
    \607\ See id., at Supplement A, section III.A.1.
    \608\ See id., at Supplement A, section III.A.1.
    \609\ See id., at Supplement A, section I.C.
    \610\ See id., at Supplement A, section II.
---------------------------------------------------------------------------

    The Banking Agencies' Safeguards Guidance requires certain 
financial institutions to implement a comprehensive written information 
security program that includes administrative, technical, and physical 
safeguards appropriate to the size and complexity of the entity and the 
nature and scope of its activities.\611\ This guidance requires that 
the information security program be designed to (1) ensure the security 
and confidentiality of customer information; (2) protect against any 
anticipated threats or hazards to the security or integrity of such 
information; (3) protect against unauthorized access to or use of such 
information that could result in substantial harm or inconvenience to 
any customer; and (4) ensure the proper disposal of customer 
information and consumer information.\612\
---------------------------------------------------------------------------

    \611\ See Banking Agencies' Safeguards Guidance, at section 
II.A.
    \612\ See id., at section II.B.
---------------------------------------------------------------------------

    Private funds may be subject to the FTC's recently amended FTC 
Safeguards Rule, which contains data security requirements to protect 
customer financial information.\613\ The FTC Safeguards Rule generally 
requires financial institutions to develop, implement, and maintain a 
comprehensive information security program,\614\ defined as the 
administrative, technical, and physical safeguards the financial 
institution uses to access, collect, distribute, process, protect, 
store, use, transmit, dispose of, or otherwise handle customer 
information.\615\ The rule also requires that the comprehensive 
information security program contain various elements, including an 
incident response plan.\616\ In addition, it requires financial 
institutions to take reasonable steps to select and retain service 
providers capable of maintaining appropriate safeguards for customer 
information and to require those service providers by contract to 
implement and maintain such safeguards.\617\ Since the date of our 
proposal, the FTC Safeguards Rule has been updated to require financial 
institutions to notify the FTC as soon as possible, and no later than 
30 days after discovery, of a security breach involving the unencrypted 
information of at least 500 consumers.\618\ Although the FTC Safeguards 
Rule does not contain a customer notification requirement, the FTC 
indicated that it ``intends to enter notification event reports into a 
publicly available database'' unless a law enforcement official 
requests delay.\619\
---------------------------------------------------------------------------

    \613\ The FTC Safeguards Rule applies to financial institutions 
of certain types ``that are not otherwise subject to the enforcement 
authority of another regulator under section 505 of the Gramm-Leach-
Bliley Act, 15 U.S.C. 6805.'' See 16 CFR 314.1(b). Private funds 
that are able to rely on section 3(c)(1) or 3(c)(7) of the 
Investment Company Act are not subject to Regulation S-P but they 
may be subject to the FTC Safeguards Rule. See supra footnote 2. 
Investment advisers registered with the Commission, including those 
that are advisers to private funds, are covered institutions for the 
purposes of the final amendments.
    \614\ See 16 CFR 314.3(a).
    \615\ See 16 CFR 314.2(i).
    \616\ See 16 CFR 314.4(h).
    \617\ See 16 CFR 314.4(f). The FTC Safeguards Rule does not 
contain a requirement that financial institutions require their 
service providers to notify them in case of a breach resulting in 
customer information being compromised.
    \618\ The amendments are effective May 13, 2024. See Standards 
for Safeguarding Customer Information, 88 FR 77499 (Nov. 13, 2023); 
see also FTC Press Release, FTC Amends Safeguards Rule to Require 
Non-Banking Financial Institutions to Report Data Security Breaches 
(Oct. 27, 2023), available at https://www.ftc.gov/news-events/news/press-releases/2023/10/ftc-amends-safeguards-rule-require-non-banking-financial-institutions-report-data-security-breaches.
    \619\ 88 FR at 77506. See also 16 CFR 315.4(j)(vi) (effective 
May 13, 2024), describing the conditions for a delay in notifying 
the public of the breach, if requested by law enforcement.
---------------------------------------------------------------------------

    In addition, many entities covered by this rule may be subject to 
other, more general information protection requirements.\620\ In 
particular, companies operating in foreign jurisdictions may need to 
comply with information protection requirements in their foreign 
markets. For example, the GDPR requires entities that process the 
personal data of EU citizens or residents to, among other things, do so 
in a manner that ensures appropriate security, integrity, and 
confidentiality.\621\ Other recent regulations in foreign jurisdictions 
may subject covered institutions to further rules intended to address 
cybersecurity risk management by financial institutions and some of 
their service providers.\622\ Hence, we expect that some of the 
entities covered by the final amendments, or their service providers, 
already have customer information safeguards in place because of other 
information protection regimes.
---------------------------------------------------------------------------

    \620\ See supra Section I (discussing other requirements); 
footnotes 245, 257 (examples of other regimes); see also Microsoft 
Comment Letter.
    \621\ GDPR, supra footnote 245, at Art. 5(1)(f); see also What 
is GDPR, the EU's New Data Protection Law?, available at https://gdpr.eu/what-is-gdpr/ (last visited Apr. 8, 2024). The GDPR places 
data protection obligations on organizations that process the 
personal data of EU citizens and residents. Among these are 
provisions requiring notification in the case of a breach: Art. 
34(1), for example, requires a personal data breach to be 
``communicated to the data subject without undue delay'' when the 
breach is likely to result in a high risk to the rights and freedoms 
of natural persons, unless certain exceptions (including an 
encryption exception) apply.
    \622\ See, e.g., Regulation (EU) 2022/2554 of the European 
Parliament and of the Council of 14 December 2022 on Digital 
Operational Resilience for the Financial Sector and Amending 
Regulations, Official J. of the Euro. Union (2022), available at 
https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022R2554 (``DORA'').
---------------------------------------------------------------------------

    A variety of guidance is available to institutions seeking to 
address information security risk, particularly through the development 
of policies and procedures. These include NIST and CISA voluntary 
standards, both of which include assessment, containment, and 
notification elements similar to those included in these 
amendments.\623\ We do not have extensive data spanning all types of 
covered institutions on their use of these or similar guidelines or on 
their development of written policies and procedures to address 
incident response, and no commenter suggested such data. However, past 
Commission examination sweeps of broker-dealers and investment advisers 
suggest that such practices are widespread.\624\ Thus, we expect that 
institutions seeking to develop written policies and procedures likely 
would have encountered these and similar standards and may have 
included the critical elements of

[[Page 47742]]

assessment and containment, as well as notification.
---------------------------------------------------------------------------

    \623\ See NIST Special Publication 800-61, Revision 2 (Aug. 
2012) (``NIST Computer Security Incident Handling Guide''), 
available at https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final and CISA, Cybersecurity Incident & Vulnerability 
Response Playbooks (Nov. 2021) (``CISA Incident Response 
Playbook''), available at https://www.cisa.gov/sites/default/files/publications/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf.
    \624\ See OCIE, SEC, Cybersecurity Examination Sweep Summary 
(Feb. 3, 2015), available at https://www.sec.gov/about/offices/ocie/cybersecurity-examination-sweep-summary.pdf (Written policies and 
procedures, for both the examined broker-dealers (82%) and the 
examined advisers (51%), discuss mitigating the effects of a 
cybersecurity incident and/or outline the plan to recover from such 
an incident. Similarly, most of the examined broker-dealers (88%) 
and many of the examined advisers (53%) reference published 
cybersecurity risk management standards.).
---------------------------------------------------------------------------

c. Annual Notice Delivery Requirement
    Under the baseline,\625\ a broker-dealer, funding portal, 
investment company, or registered investment adviser must generally 
provide an initial privacy notice to its customers not later than when 
the institution establishes the customer relationship and annually 
after that for as long as the customer relationship continues.\626\ If 
an institution chooses to share nonpublic personal information with a 
nonaffiliated third party other than as disclosed in an initial privacy 
notice, the institution must generally send a revised privacy notice to 
its customers.\627\
---------------------------------------------------------------------------

    \625\ For the purposes of the economic analysis, the baseline 
does not include the exception to the annual notice delivery 
requirement provided by the FAST Act. This statutory exception was 
self-effectuating and became effective on Dec. 4, 2015. See FAST 
Act, Public Law 114-94, section 75001, adding section 503(f) to the 
GLBA, codified at 15 U.S.C. 6803(f).
    \626\ 17 CFR 248.4 and 248.5.
    \627\ 17 CFR 248.8. Regulation S-P provides certain exceptions 
to the requirement for a revised privacy notice, including if the 
institution is sharing as permitted under rules 248.13, 248.14, and 
248.15 or with a new nonaffiliated third party that was adequately 
disclosed in the prior privacy notice.
---------------------------------------------------------------------------

    The types of information required to be included in the initial, 
annual, and revised privacy notices are identical. Each privacy notice 
must describe the categories of information the institution shares and 
the categories of affiliates and non-affiliates with which it shares 
nonpublic personal information.\628\ The privacy notices also must 
describe the type of information the institution collects, how it 
protects the confidentiality and security of nonpublic personal 
information, a description of any opt out right, and certain 
disclosures the institution makes under the FCRA.\629\
---------------------------------------------------------------------------

    \628\ See 17 CFR 248.6(a)(2) through (5) and (9).
    \629\ See 17 CFR 248.6(a)(1) (information collection); 
248.6(a)(8) (protecting nonpublic personal information), 248.6(a)(6) 
(opt out rights); 248.6(a)(7) (disclosures the institution makes 
under section 603(d)(2)(A)(iii) of the FCRA (15 U.S.C. 
1681a(d)(2)(A)(iii)), notices regarding the ability to opt out of 
disclosures of information among affiliates).
---------------------------------------------------------------------------

3. Market Structure
    The final amendments will affect five categories of covered 
institutions: broker-dealers other than notice-registered broker-
dealers, funding portals, registered investment advisers, investment 
companies, and transfer agents registered with the Commission or 
another appropriate regulatory agency. These institutions compete in 
several distinct markets and offer a wide range of services, including 
effecting customers' securities transactions, providing liquidity, 
pooling investments, transferring ownership in securities, advising on 
financial matters, managing portfolios, and consulting to pension 
funds. Many of the larger covered institutions belong to more than one 
category (e.g., a dually registered broker-dealer/investment adviser), 
and thus operate in multiple markets. In the rest of this section, we 
first outline the market for each class of covered institution and then 
consider service providers.
a. Broker-Dealers
    Broker-dealers include both brokers (persons engaged in the 
business of effecting transactions in securities for the account of 
others),\630\ as well as dealers (persons engaged in the business of 
buying and selling securities for their own accounts).\631\ Most 
brokers and dealers maintain customer relationships, and are thus 
likely to come into the possession of sensitive customer 
information.\632\ In the market for broker-dealer services, a 
relatively small set of large- and medium-sized broker-dealers dominate 
while thousands of smaller broker-dealers compete in niche or regional 
segments of the market.\633\ Broker-dealers provide a variety of 
services related to the securities business, including (1) managing 
orders for customers and routing them to various trading venues; (2) 
providing advice to customers that is in connection with and reasonably 
related to their primary business of effecting securities transactions; 
(3) holding customers' funds and securities; (4) handling clearance and 
settlement of trades; (5) intermediating between customers and 
carrying/clearing brokers; (6) dealing in corporate debt and equities, 
government bonds, and municipal bonds, among other securities; (7) 
privately placing securities; and (8) effecting transactions in mutual 
funds that involve transferring funds directly to the issuer. Some 
broker-dealers may specialize in just one narrowly defined service, 
while others may provide a wide variety of services.
---------------------------------------------------------------------------

    \630\ See 15 U.S.C. 78c(a)(4).
    \631\ See 15 U.S.C. 78c(a)(5).
    \632\ Such information would include the customers' names, tax 
numbers, telephone numbers, broker, brokerage account numbers, etc.
    \633\ See Regulation Best Interest: The Broker-Dealer Standard 
of Conduct, Release No. 34-86031 (June 5, 2019) [84 FR 33318 (July 
12, 2019)], at 33406.
---------------------------------------------------------------------------

    Based on an analysis of FOCUS filings and Form BD filings, there 
were 3,476 registered broker-dealers during the third quarter of 
2023.\634\ Of these, 303 were dually registered as investment 
advisers.\635\ There were over 233 million customer accounts reported 
by carrying brokers.\636\ However, the majority of broker-dealers are 
not ``carrying broker-dealers'' and therefore do not report the numbers 
of customer accounts.\637\ Therefore, we expect that this figure of 233 
million understates the total number of customer accounts because many 
of the accounts at carrying broker-dealers have corresponding accounts 
with non-carrying brokers. Both carrying and non-carrying broker-
dealers potentially possess sensitive customer information for the 
accounts that they maintain.\638\ Because non-carrying broker-dealers 
do not report on the numbers of customer accounts, it is not possible 
to ascertain with any degree of confidence the distribution of customer 
accounts across the broader broker-dealer population.
---------------------------------------------------------------------------

    \634\ The numbers in this section exclude notice-registered 
broker-dealers. See supra section II.B.3.
    \635\ See supra footnote 496.
    \636\ FOCUS filings and Form X-17A-5 Schedule I, Item I8080. For 
this release, the number of customer accounts reported by carrying 
brokers was estimated based on FOCUS filings during the third 
quarter of 2023 and Form X-17A-5 Schedule I, Item I8080 for 2022. 
The Proposing Release cited a figure of 72 million as of July 1, 
2022. The correct number of customer accounts reported by carrying 
brokers as of July 1, 2022, in the Proposing Release should be 220 
million. This change would not have affected the Commission's 
assessment of economic effects at Proposal as these assessments were 
focused primarily on effects at the level of individual covered 
institutions and their customers.
    \637\ See General Instructions to Form CUSTODY (as of Sept. 30, 
2022).
    \638\ This information includes name, address, age, and tax 
identification or Social Security number. See FINRA Rule 4512.
---------------------------------------------------------------------------

b. Funding Portals
    Funding portals act as intermediaries in facilitating securities-
based crowdfunding transactions that are subject to Regulation 
Crowdfunding.\639\ Securities-based crowdfunding involves using the 
internet to raise capital through small individual contributions from a 
large number of people. The crowdfunding transaction must be conducted 
through an intermediary registered with the Commission, but a statutory 
exemption allows that intermediary to forgo registration as a broker-
dealer. Therefore some, but not all, crowdfunding intermediaries are 
registered broker-dealers while others are funding portals.
---------------------------------------------------------------------------

    \639\ See 17 CFR part 227.
---------------------------------------------------------------------------

    Funding portals are registered with the Commission and are members 
of FINRA.\640\ They must provide investors

[[Page 47743]]

with educational materials, take measures to reduce the risk of fraud, 
make information available about the issuer and the offering, and 
provide communication channels to permit discussions about offerings on 
the funding portal's platform, among other related services.\641\ In 
facilitating crowdfunding transactions, funding portals may come into 
possession of investors' sensitive customer information, as investors 
are required to open an account with the funding portal before the 
funding portal may accept an investment commitment from them.\642\ 
Funding portals may have possession of sensitive customer information 
but, unlike broker-dealers, funding portals are statutorily prohibited 
from holding, managing, possessing, or handling investor funds or 
securities.\643\ These funding portals are required to direct investors 
to transmit money or other consideration for the securities directly to 
a qualified third party that has agreed in writing to hold the funds 
for the benefit of investors and the issuer and to promptly transmit or 
return the funds to the person entitled to the funds.\644\
---------------------------------------------------------------------------

    \640\ See Regulation Crowdfunding, Release No. 33-9974, (Oct. 
30, 2015) [80 FR 71388 (Nov. 16, 2015)] (``Regulation Crowdfunding 
Adopting Release''). An entity raising funds through securities-
based crowdfunding typically seeks small individual contributions 
from a large number of people. Individuals interested in the 
crowdfunding campaign--members of the ``crowd''--may share 
information about the project, cause, idea or business with each 
other and use the information to decide whether to fund the campaign 
based on the collective ``wisdom of the crowd.'' The JOBS Act 
established a regulatory structure for startups and small businesses 
to raise capital through securities offerings using the internet 
through crowdfunding. See id. at section I.A. Securities Act section 
4(a)(6) provides an exemption from registration for certain 
crowdfunding transactions. 15 U.S.C. 77d(a)(6). A company issuing 
securities in reliance on rules established by the Regulation 
Crowdfunding Adopting Release (17 CFR part 227, ``Regulation 
Crowdfunding'') is permitted to raise a maximum of $5 million in a 
twelve-month period and is required to conduct the transaction 
exclusively through an intermediary registered with the Commission, 
either a broker-dealer or a funding portal. See 17 CFR 227.100(a).
    \641\ See Regulation Crowdfunding Adopting Release at section 
II.
    \642\ See 17 CFR 227.302(a)(1). Regulation Crowdfunding Rule 302 
does not prescribe specific information that a funding portal must 
collect as part of opening an account.
    \643\ See 15 U.S.C. 78c(a)(80)(D).
    \644\ See 17 CFR 227.303(e)(2), which defines a ``qualified 
third party'' as (i) a registered broker or dealer that carries 
customer or broker or dealer accounts and holds funds or securities 
for those persons or (ii) a bank or credit union (where such credit 
union is insured by National Credit Union Administration) that has 
agreed in writing either to hold the funds in escrow for the persons 
who have the beneficial interests therein and to transmit or return 
such funds directly to the persons entitled thereto when so directed 
by the funding portal as described in paragraph (e)(3) of the rule, 
or to maintain a bank or credit union account (or accounts) for the 
exclusive benefit of investors and the issuer.
---------------------------------------------------------------------------

    As of December 31, 2023, there were 92 registered funding portals 
that were members of FINRA (excluding funding portals that had 
withdrawn their registration and FINRA membership).\645\ The 
crowdfunding intermediary market is highly concentrated.\646\ For 
example, based on staff analysis from May 16, 2016 (inception of 
Regulation Crowdfunding) through December 31, 2023, five intermediaries 
accounted for 70 percent of all initiated offerings, including one 
funding portal accounting for 29 percent of all initiated 
offerings.\647\
---------------------------------------------------------------------------

    \645\ See FINRA, ``Funding Portals We Regulate,'' at https://www.finra.org/about/funding-portals-we-regulate.
    \646\ The crowdfunding intermediary market includes all funding 
portals and some registered broker-dealers who may also serve as 
intermediaries of Regulation Crowdfunding transactions. See 17 CFR 
227.300(a).
    \647\ Based on staff analysis of EDGAR filings under Regulation 
Crowdfunding as of December 31, 2023. This includes all initiated 
offerings facilitated by either funding portals or registered 
broker-dealers.
---------------------------------------------------------------------------

c. Investment Advisers
    Registered investment advisers provide a variety of services to 
their clients, including financial planning advice, portfolio 
management, pension consulting, selecting other advisers, publication 
of periodicals and newsletters, security rating and pricing, market 
timing, and conducting educational seminars.\648\ Although advisers 
engaged in any of these activities are likely to possess sensitive 
customer information, the degree of sensitivity will vary widely across 
advisers. Some advisers may only hold the customer's address, payment 
details, and the customer's overall financial condition, while others 
may hold account numbers, tax identification numbers, access 
credentials to brokerage accounts, and other highly sensitive 
information.
---------------------------------------------------------------------------

    \648\ See Form ADV.
---------------------------------------------------------------------------

    Based on Form ADV filings received up to October 5, 2023, there are 
15,565 investment advisers registered with the Commission with a total 
of more than 51 million individual clients and $114 trillion in assets 
under management.\649\ Practically all (97 percent) of these advisers 
reported providing portfolio management services to their clients.\650\ 
Over half (57 percent) reported having custody of clients' cash or 
securities either directly or through a related person,\651\ with 
client funds in custody totaling $43 trillion.\652\
---------------------------------------------------------------------------

    \649\ Form ADV, Items 5D(a-b) (as of Oct. 5, 2023). Broadly, 
regulatory assets under management capture the current value of 
assets in securities portfolios for which the adviser provides 
continuous and regular supervisory or management services. See Form 
ADV, Part 1A Instruction 5.b.
    \650\ Form ADV, Items 5G(2-5) (as of Oct. 5, 2023).
    \651\ Here, ``custody'' means ``holding, directly or indirectly, 
client funds or securities, or having any authority to obtain 
possession of them.'' An adviser also has ``custody'' if ``a related 
person holds, directly or indirectly, client funds or securities, or 
has any authority to obtain possession of them, in connection with 
advisory services [the adviser] provide[s] to clients.'' See 17 CFR 
275.206(4)-2(d)(2).
    \652\ Form ADV, Items 9A and 9B (as of Oct. 5, 2023).

---------------------------------------------------------------------------

[[Page 47744]]

[GRAPHIC] [TIFF OMITTED] TR03JN24.005

    Figure 6 plots the cumulative distribution of the number of 
individual clients handled by investment advisers registered with the 
Commission. The distribution is highly skewed: 13 advisers each 
reported having more than one million clients while 95 percent of 
advisers reported having fewer than 2,000 clients. Many such advisers 
are quite small, with half reporting fewer than 62 clients.\653\
---------------------------------------------------------------------------

    \653\ Form ADV, Items 5D(a) and (b) (as of Oct. 5, 2023).
---------------------------------------------------------------------------

    Similarly, most investment advisers registered with the Commission 
are limited geographically. These advisers must generally make a 
``notice filing'' with a State in which they have a place of business 
or six or more clients.\654\ Figure 7 plots the frequency distribution 
of the number of such filings. Based on notice filings, 57 percent of 
investment advisers registered with the Commission operated in fewer 
than four States, and 37 percent operated in only one State.\655\
---------------------------------------------------------------------------

    \654\ See General Instructions to Form ADV (as of Oct. 5, 2023).
    \655\ Form ADV, Item 2.C (as of Oct. 5, 2023). This includes 
1,887 advisers who do not make any notice filings.

---------------------------------------------------------------------------

[[Page 47745]]

[GRAPHIC] [TIFF OMITTED] TR03JN24.006

d. Investment Companies
    Investment companies are companies that issue securities and are 
primarily engaged in the business of investing in securities. 
Investment companies invest money they receive from investors on a 
collective basis, and each investor shares in the profits and losses in 
proportion to that investor's interest in the investment company. 
Investment companies subject to the final amendments include registered 
open-end and closed-end funds, business development companies 
(``BDCs''), Unit Investment Trusts (``UITs''), employee securities' 
companies (``ESCs''), and management company separate accounts 
(``MCSAs''). Because they are not operating companies, investment 
companies do not have ``customers'' as such, and thus are unlikely to 
possess significant amounts of nonpublic ``customer'' information in 
the conventional sense. They may, however, have access to nonpublic 
information about their investors.\656\
---------------------------------------------------------------------------

    \656\ The definition of ``customer information'' in the final 
amendments includes information about investment companies' 
investors. See final rule Sec. Sec.  248.30(d)(5)(i) and 248.3(t).
---------------------------------------------------------------------------

    Table 4 summarizes the investment company universe that will be 
subject to the final amendments. In total, as of September 30, 2023, 
there were 13,766 investment companies, including 12,183 open-end 
management investment companies, 682 closed-end managed investment 
companies, 702 UITs,\657\ 141 BDCs,\658\ approximately 43 ESCs, and 15 
MCSAs. Many of the investment companies that will be subject to the 
final amendments are part of a ``family'' of investment companies.\659\ 
Such families often share infrastructure for operations (e.g., 
accounting, auditing, custody, legal), and potentially marketing and 
distribution. We expect that many of the compliance costs and other 
economic costs discussed in the following sections will likely be borne 
at the family level.\660\ We estimate that there were up to 1,131 
distinct operational entities (families and unaffiliated investment 
companies) in the investment company universe.\661\
---------------------------------------------------------------------------

    \657\ For this release, the number of UITs includes N-4, N-6, N-
8B-2, and S-6 filers as of Sept. 30, 2023. The Proposing Release 
cited a figure of 662 UITs using 2021 N-CEN filings. The correct 
number of UITs using 2021 N-CEN filings in the Proposing Release 
should be 703. This change would not have affected the Commission's 
assessment of economic effects at Proposal as these assessments were 
focused primarily on effects at the level of individual covered 
institutions and their customers.
    \658\ For this release, the number of BDCs was estimated using 
London Stock Exchange Group (``LSEG'') BDC Collateral data as of 
Sept. 2023.
    \659\ As used here, ``family'' refers to a set of funds 
reporting the same family investment company name (Form N-CEN Item 
B.5) or filing under the same registrant name (Form N-CEN Item 
B.1.A).
    \660\ For example, each investment company in a family is likely 
to share common policies and procedures.
    \661\ For this release, the number of unaffiliated entities was 
estimated using N-CEN filings as of Sept. 30, 2023. The Proposing 
Release cited a figure of 476 using 2021 N-CEN filings. The correct 
number of the unaffiliated entities using 2021 N-CEN filings in the 
Proposing Release should be 609. This change would not have affected 
the Commission's assessment of economic effects at Proposal as these 
assessments were focused primarily on effects at the level of 
individual covered institutions and their customers.
---------------------------------------------------------------------------

BILLING CODE 8011-01-P

[[Page 47746]]

[GRAPHIC] [TIFF OMITTED] TR03JN24.007

BILLING CODE 8011-01-C
e. Transfer Agents
    Transfer agents maintain records of security ownership and are 
responsible for processing changes of ownership (``transfers''), 
communicating information from the firm to its security-holders (e.g., 
sending annual reports), replacing lost stock certificates, etc. 
However, in practice, most securities registered in the U.S. are held 
in ``street name,'' where the ultimate ownership information is not 
maintained by the transfer agent but rather in a hierarchal ledger. In 
this structure, securities owned by individuals are not registered in 
the name of the individual with the transfer agent. Rather, the 
individual's broker maintains the records of the individual's ownership 
claim on securities. Brokers, in turn, have claims on securities held 
by a single nominee owner who maintains records of the claims of the 
various brokers.\662\ In such cases, the transfer agent is not aware of 
the ultimate owner of the securities and therefore does not hold 
sensitive information belonging to those owners, as only the broker 
holds this information.
---------------------------------------------------------------------------

    \662\ In the U.S., this owner is generally Cede & Co., a 
partnership organized by the Depository Trust & Clearing 
Corporation.
---------------------------------------------------------------------------

    Despite the prevalence of securities held in street name, a large 
number of individuals nonetheless hold securities directly through a 
transfer agent. Securities held directly may be held either in the form 
of a physical stock certificate or in book-entry form through the 
Direct Registration System (``DRS''). In either case, the transfer 
agent would need to maintain sensitive information about the 
individuals who own the securities. For example, to handle a request 
for replacement certificate, the transfer agent would need to confirm 
the identity of the individual making such a request and to maintain a 
record of such confirmation. Similarly, to effect DRS transfers, a 
transfer agent would need to provide a customer's identification 
information in the message to the DRS.
    In 2023, there were 251 transfer agents registered with the 
Commission, with an additional 64 registered with the Banking 
Agencies.\663\ As discussed above,\664\ differences in the baseline 
regulation of these transfer agents affect their current notification 
obligations.\665\ Among the 315 transfer agents, 132 are considered 
small entities.\666\ By registration, 100 of these small transfer

[[Page 47747]]

agents are registered with the Commission and 32 are registered with 
the Banking Agencies.\667\
---------------------------------------------------------------------------

    \663\ Form TA-1 (as of Sept. 30, 2023).
    \664\ See supra footnotes 601 and 604 and accompanying text.
    \665\ See infra sections IV.D.2.b and IV.E (discussing benefits 
and costs, and competitive effects, relative to the baseline).
    \666\ See infra section VI.C. Estimate based on the number of 
transfer agents that reported a value of fewer than 1,000 for items 
4(a) and 5(a) on Form TA-2 collected by the Commission as of Sept. 
30, 2023.
    \667\ Id.
---------------------------------------------------------------------------

    On average, each transfer agent reported around 1 million 
individual accounts, with the largest reporting 61 million.\668\ Figure 
8 plots the cumulative distribution of the number of individual 
accounts reported by registered transfer agents. Approximately one 
third of registered transfer agents reported no individual 
accounts,\669\ and 58 percent reported fewer than ten thousand 
individual accounts.\670\
---------------------------------------------------------------------------

    \668\ Form TA-2 Items 5(a) (as of Sept. 30, 2023). This analysis 
is limited to the 265 transfer agents that filed form TA-2. For the 
205 transfer agents registered with the Commission that filed form 
TA-2, the average number of individual accounts is 1.2 million; for 
the 60 transfer agents registered with the Banking Agencies that 
filed form TA-2, the average number of individual accounts is 69 
thousand.
    \669\ Some registered transfer agents outsource many functions--
including tracking the ownership of securities in individual 
accounts--to other transfer agents (``service companies''). See Form 
TA-1 Item 6 (as of June 20, 2022).
    \670\ Form TA-2, Items 5(a) (as of Sept. 30, 2023).
    [GRAPHIC] [TIFF OMITTED] TR03JN24.008
    
f. Service Providers
    The final amendments require that a covered institution's incident 
response program include the establishment, maintenance, and 
enforcement of written policies and procedures reasonably designed to 
require oversight, including through due diligence and monitoring, of 
service providers. These policies and procedures must be reasonably 
designed to ensure service providers take appropriate measures to 
protect against unauthorized access to or use of customer information 
and to notify covered institutions of an applicable breach in 
security.\671\ These requirements on a covered institution will affect 
a service provider that ``receives, maintains, processes, or otherwise 
is permitted access to customer information through its provision of 
services directly to [the] covered institution.'' \672\
---------------------------------------------------------------------------

    \671\ See final rule 248.30(a)(5).
    \672\ Final rule 248.30(d)(10).
---------------------------------------------------------------------------

    Covered institutions' relationships with a wide range of service 
providers will be affected. Specialized service providers with 
offerings geared toward outsourcing of covered institutions' core 
functions will generally fall under the requirements. Those offering 
customer relationship management, customer billing, portfolio 
management, customer portals (e.g., customer trading platforms), 
customer acquisition, tax document preparation, proxy voting, and 
regulatory compliance (e.g., AML/KYC) will likely fall under the 
requirements. Some of these specialized service providers will be 
themselves covered institutions.\673\ In addition, various less-
specialized service providers might potentially fall under the 
requirements. Service providers offering Software-as-a-Service (SaaS) 
solutions for email, file storage, and similar general-purpose services 
might potentially be in a position to receive, maintain, or process 
customer information. Similarly, providers of Infrastructure-as-a-
Service (IaaS), Platform-as-a-Service (PaaS), as well as those offering 
more ``traditional'' consulting services (e.g., IT contractors) will in 
many cases be ``otherwise [ ] permitted access to customer 
information'' and might fall under the provisions.
---------------------------------------------------------------------------

    \673\ For example, many investment companies rely on third-party 
investment advisers and transfer agents.
---------------------------------------------------------------------------

    In the Proposing Release, we stated that the financial services 
industry is increasingly relying on service providers through various 
forms of outsourcing.\674\ We also stated that we were unable to 
quantify or characterize in much detail the structure of the relevant 
service provider markets due to data limitations.\675\ One commenter 
stated that this resulted in an analysis that fails to meaningfully 
address the associated costs.\676\ While this commenter did not 
identify any additional data sources, in response we have conducted a 
further review of industry literature.\677\ While we

[[Page 47748]]

continue to find certain data limitations, we also have identified 
certain additional informative data points on covered institutions' 
reliance on service providers.\678\ A recent notice issued by FINRA 
states that FINRA's members, which include broker-dealers, ``are 
increasingly using third-party vendors to perform a wide range of core 
business and regulatory oversight functions,'' a trend that has 
accelerated with the COVID-19 pandemic.\679\ One report describes the 
results of a 2022 survey of 248 advisers and independent broker-
dealers.\680\ The survey found that 32 percent of the registered 
investment advisers and 50 percent of the independent broker-dealers 
that responded to the survey reported outsourcing investment management 
functions, and that while these proportions had not changed 
significantly in the past decade, half of the respondents who do 
outsource some of these functions reported an increase in their use of 
service providers. In addition, a different recent report finds that 33 
percent of asset managers surveyed outsource their entire back-office 
function and 20 percent outsource their entire middle-office 
function.\681\ By the nature of their business models, most of the 
operations of investment companies are carried out by service 
providers.\682\ Finally, many transfer agents outsource many 
functions.\683\ Hence, all types of covered institutions affected by 
the final amendments commonly retain service providers to some extent.
---------------------------------------------------------------------------

    \674\ See Proposing Release at section III.C.3.e; see also Bank 
for International Settlements, Outsourcing in Financial Services 
(Feb. 15, 2005), available at https://www.bis.org/publ/joint12.htm.
    \675\ See Proposing Release at section III.C.3.e.
    \676\ See IAA Comment Letter 1.
    \677\ In addition, in response to this commenter, we have added 
further details on the current regulatory framework, in particular 
with respect to the obligations of covered institutions regarding 
their service providers and the notification obligations of service 
providers. See supra section IV.C.2. Also, we have supplemented the 
analysis of the benefits and costs of the final amendments' service 
provider requirements. See infra section IV.D.1.c. The supplemental 
review described here is designed to help us analyze and respond to 
commenters, and also to provide additional context for this 
analysis.
    \678\ Potential service providers include a wide range of firms 
fulfilling a variety of functions. The internal organization of 
covered institutions, including their reliance on service providers, 
is not generally publicly observable. Although certain regulatory 
filings shed a limited light on the use of third-party service 
providers (e.g., transfer agents' reliance on third parties for 
certain functions and investment advisers' reliance on third parties 
for recordkeeping), we are unaware of any data sources that provide 
detail on the reliance of covered institutions on service providers.
    \679\ See FINRA, Regulatory Notice 21-29, supra footnote 515.
    \680\ See FlexShares, The Race to Scalability 2022 (July 2022).
    \681\ See Cerulli Associates, Asset Managers Turn to Outsourcing 
Providers for Operating Model Sustainability (Nov. 22, 2022), 
available at https://www.cerulli.com/press-releases/asset-managers-turn-to-outsourcing-providers-for-operating-model-sustainability 
(``Cerulli Report'').
    \682\ See Investment Company Institute, How US-Registered 
Investment Companies Operate and the Core Principles Underlying 
Their Regulation (May 2022), available at https://www.ici.org/system/files/2023-06/us-reg-funds-principles.pdf.
    \683\ See supra footnote 670. See also Interagency Guidance on 
Third-Party Relationships: Risk Management, 88 FR 37920, 37937 (June 
9, 2023), which may cover some transfer agents registered with a 
regulatory agency other than the Commission.
---------------------------------------------------------------------------

D. Benefits and Costs of the Final Rule Amendments

    The final amendments can be divided into four main components. 
First, they create a requirement for covered institutions to adopt 
policies and procedures for the protection of customer information. The 
policies and procedures must include an incident response program to 
address unauthorized access to or use of customer information, 
including by providing notification to individuals affected by an 
incident during which their sensitive customer information was, or is 
reasonably likely to have been, accessed or used without authorization. 
The response program must also include the establishment, maintenance, 
and enforcement of written policies and procedures reasonably designed 
to require oversight of service providers, including to ensure service 
providers take appropriate measures to protect against unauthorized 
access to or use of customer information. Second, the amendments define 
the information covered by the safeguards rule and the disposal 
rule,\684\ and extend the application of the safeguards rule to 
transfer agents. Third, the amendments require covered institutions 
(other than funding portals) to maintain and retain records documenting 
compliance with the amended rules.\685\ Fourth, they incorporate into 
regulation an existing statutory exemption for annual privacy notices. 
Below we discuss the benefits and the costs of each component in turn.
---------------------------------------------------------------------------

    \684\ See final rule 248.30(a)(1), 248.30(b), 248.30(d)(1), and 
248.30(d)(5).
    \685\ As discussed above, funding portals are not subject to the 
recordkeeping obligations found under Rule 17a-4. Funding portals 
are instead obligated, pursuant to Rule 404 of Regulation 
Crowdfunding, to make and preserve all records required to 
demonstrate their compliance with Regulation S-P for five years, the 
first two years in an easily accessible place. See supra footnote 
385; see also 17 CFR 227.404(a)(5).
---------------------------------------------------------------------------

    Some commenters criticized, generally, the discussion of benefits 
and costs in the Proposing Release. One commenter stated that the 
Commission should ``undertake a more expansive, accurate, and 
quantifiable assessment of the specific and cumulative costs, burdens, 
and economic effects that would be placed on investment advisers by the 
proposed requirements, as well as of the potential unintended 
consequences for their clients.'' \686\ Another commenter stated a need 
for more in-depth analysis of how the proposed amendments might impact 
transfer agents, their customers (issuers of securities), and 
securityholders.\687\ Other commenters did not directly disagree with 
the analysis in the Proposing Release, but stated that the proposed 
amendments would place a high overall burden on covered institutions, 
including smaller institutions.\688\
---------------------------------------------------------------------------

    \686\ See IAA Comment Letter 1.
    \687\ See STA Comment Letter 2.
    \688\ See, e.g., SIFMA Comment Letter 2; ASA Comment Letter.
---------------------------------------------------------------------------

    In response to these commenters, we have supplemented the analysis 
of the benefits and the costs of the final amendments regarding the 
timing requirement for notification of customers affected by a breach, 
including by providing more details on how the requirements differ from 
the baseline; \689\ different elements required to be included in a 
notice to affected individuals; \690\ different requirements relating 
to service providers; \691\ and the extension of the rule's scope to 
include all transfer agents.\692\ As discussed below, we have also made 
changes to the final amendments that will reduce compliance costs for 
all covered institutions, including those that are smaller in 
size.\693\
---------------------------------------------------------------------------

    \689\ See infra section IV.D.1.b(2); see also supra section 
IV.C.2.a(2).
    \690\ See infra section IV.D.1.b(5); see also supra section 
IV.C.2.a(2).
    \691\ See infra section IV.D.1.c; see also supra sections 
IV.C.2.a(3) and IV.C.3.f.
    \692\ See infra section IV.D.1.b; see also supra section 
IV.C.2.a(3).
    \693\ See infra footnote 1058 and accompanying text.
---------------------------------------------------------------------------

    Several commenters stated that the Commission should consider the 
cumulative costs of implementing the proposed amendments and other 
recent Commission rules and proposed rules.\694\ Specifically, one 
commenter stated that ``there can be no doubt that the costs of 
compliance--direct and indirect--rise with each regulation and directly 
impact the ability of [covered institutions] to invest in other aspects 
of their businesses'' and that the Commission should ``consider the 
cumulative effects that'' the final amendments and other adopted rules 
will have on covered institutions' ``operational limitations and, more 
importantly, resource constraints, in determining the compliance 
dates.'' \695\ That commenter and others mentioned proposals which 
culminated in several adopted rules.\696\
---------------------------------------------------------------------------

    \694\ See supra footnote 482.
    \695\ See IAA Comment letter 2.
    \696\ See supra footnotes 483-493.
---------------------------------------------------------------------------

    Consistent with its long-standing practice, the Commission's 
economic analysis in each adopting release

[[Page 47749]]

considers the incremental benefits and costs for the specific rule--
that is, the benefits and costs stemming from that rule compared to the 
baseline. The Commission acknowledges the possibility that complying 
with more than one rule may entail costs that could exceed the costs if 
the rules were to be complied with separately. Four of the rules 
identified by commenters have compliance dates that occur before the 
effective date of the final amendments,\697\ such that there is no 
overlap in compliance periods. The compliance periods for the other 
rules overlap in part, but the compliance dates adopted by the 
Commission in recent rules are generally spread out over an 
approximately three-year period from 2023 to 2026,\698\ which could 
limit the number of implementation activities occurring simultaneously. 
Where overlap in compliance periods exists, the Commission acknowledges 
that there may be additional costs on those covered institutions 
subject to one or more other rules as well as implications of those 
costs, such as impacts on entities' ability to invest in other aspects 
of their businesses.\699\
---------------------------------------------------------------------------

    \697\ The compliance dates for the Electronic Recordkeeping 
Adopting Release occurred in 2023, and the compliance date for the 
Settlement Cycle Adopting Release is May 28, 2024. The compliance 
dates for the May 2023 SEC Form PF Adopting Release and the Form N-
PX Adopting Release are June 11, 2024, and July 1, 2024, 
respectively.
    \698\ See supra section IV.C. In addition, we adopted longer 
compliance periods for all covered institutions relative to the 
proposal, and an even longer compliance period for smaller covered 
institutions. See supra section II.F.
    \699\ See, e.g., IAA Comment letter 2 (describing the types of 
implementation activities, such as updating internal controls, and 
training).
---------------------------------------------------------------------------

    Covered institutions subject to the final amendments in this 
rulemaking may be subject to one or more of the other adopted rules 
commenters named depending on whether those institutions' activities 
fall within the scope of the other rules. Specifically, the rules and 
amendments in the February 2024 Form PF Adopting Release, and those 
rules and amendments in the Private Fund Advisers Adopting Release for 
which the compliance dates have not already passed, apply to advisers 
to private funds: as private fund advisers are a subset of the covered 
institutions affected by the amendments, only a subset of covered 
institutions face compliance costs associated with these recent rules 
and amendments.\700\ The Public Company Cybersecurity Rules apply only 
to public companies, not all covered institutions.\701\ The amendments 
adopted in the Money Market Fund Adopting Release place a compliance 
burden on money market funds and certain liquidity fund advisers 
registered with the Commission, which are also a subset of covered 
institutions.\702\ The Investment Company Names Adopting Release 
amended requirements for those registered investment companies and BDCs 
with names with terms suggesting that the fund has particular 
characteristics, which are a subset of the funds affected by the final 
amendments.\703\ The Beneficial Ownership Adopting Release amended 
disclosure requirements that apply only to persons who beneficially own 
more than five percent of a covered class of equity securities.\704\ 
The rule adopted in the Securitization Conflicts Adopting Release 
affects only certain entities (and their affiliates and subsidiaries) 
that participate in securitization transactions.\705\ We acknowledge 
that covered institutions subject to multiple rules may still 
experience increased costs associated with implementing multiple rules 
at once as well as implications of those costs, such as impacts on 
those institutions' ability to invest in other aspects of their 
businesses.
---------------------------------------------------------------------------

    \700\ See Private Fund Advisers Adopting Release, at section 
VI.C.1; February 2024 Form PF Adopting Release, at section IV.B.2.
    \701\ See Public Company Cybersecurity Rules, at section IV.B.2. 
One commenter also suggested the Commission should consider the 
relationship between reporting obligations in the proposed 
amendments and the Public Company Cybersecurity Rules. See ASA 
Comment Letter. We modified the final amendments, relative to the 
proposal, to align with the Public Company Cybersecurity Rules with 
regard to disclosure delays for national security or public safety 
reasons. See supra section II.A.(d)(2).
    \702\ See Money Market Fund Adopting Release, at section IV.B.
    \703\ See Investment Company Names Adopting Release, at section 
IV.C.
    \704\ See Beneficial Ownership Adopting Release, at section 
IV.B.3.
    \705\ See Securitization Conflicts Adopting Release, at section 
IV.B.2.
---------------------------------------------------------------------------

1. Written Policies and Procedures
    In this section, we discuss the effects of written policies and 
procedures requirements in the final amendments, focusing on those 
relating to the incident response program required under the final 
amendments. Specifically, while the final amendments require covered 
institutions to develop, implement, and maintain written policies and 
procedures that address administrative, technical, and physical 
safeguards for the protection of customer information,\706\ general 
written policies and procedures to protect customer information are 
already part of the baseline.\707\ The primary new requirements pertain 
to written policies and procedures that must include an incident 
response program to address unauthorized access to or use of customer 
information.
---------------------------------------------------------------------------

    \706\ See final rule 248.30(a)(1).
    \707\ Prior to this adoption, Regulation S-P already required 
covered institutions to adopt policies and procedures reasonably 
designed to protect customer information. See supra section 
IV.C.2.b. Transfer agents were not previously covered by the 
safeguards rule and were not, before this adoption, required by the 
Commission to have such written policies and procedures in place. We 
analyze the benefits and costs that are specific to transfer agents 
in section IV.D.2.b.
---------------------------------------------------------------------------

    We expect that requiring written policies and procedures for the 
response program will improve the effectiveness of response programs in 
multiple ways, which will benefit covered institutions and their 
customers. Written policies and procedures are a practical prerequisite 
for organizations to implement standard operating procedures and have 
been recognized as effective at improving outcomes in critical 
environments.\708\ We expect that this will also be the case for 
response programs for data breach incidents. Written policies and 
procedures can help ensure that the covered institution's personnel 
know what corrective actions to take and when in the event of a data 
breach. Written policies and procedures can also help ensure that the 
incident is handled in an optimal manner. Moreover, establishing 
incident response procedures ex ante can facilitate discussion among 
the covered institution's staff and expose flaws in the incident 
response procedures before they are used in a real response. This may 
also lead to covered institutions improving their customer information 
safeguards, which could reduce the likelihood of unauthorized access to 
or use of customer information in the first place.\709\
---------------------------------------------------------------------------

    \708\ Other Commission regulations, such as the Investment 
Company Act and Investment Advisers Act compliance rules, require 
policies and procedures. 17 CFR 270.38a-1(a)(1), 275.206(4)-7(a). 
The utility of written policies and procedures is recognized outside 
the financial sector as well; for example, standardized written 
procedures have been increasingly embraced in the field of medicine. 
See, e.g., Robert L. Helmreich, Error Management as Organizational 
Strategy, In Proceedings of the IATA Human Factors Seminar, Vol. 1., 
Citeseer (1998); see also Joseph Alex, Chaparro Keebler, Elizabeth 
Lazzara & Anastasia Diamond, Checklists: A Review of Their Origins, 
Benefits, and Current Uses as a Cognitive Aid in Medicine, 
Ergonomics in Design, 2019 Q. Hum. Fac. App. 27 (2019). We are not 
aware of any studies that assess the efficacy of written policies 
and procedures specifically in the context of financial regulation, 
and no commenter provided such sources.
    \709\ See infra section IV.D.1.b(3) for examples of how covered 
institutions could enhance their customer information safeguards.

---------------------------------------------------------------------------

[[Page 47750]]

    We do not anticipate that the final requirement for written 
policies and procedures will result in substantial new benefits from 
its application to large covered institutions, those with a national 
presence, or those already subject to comparable Federal regulations. 
As stated above,\710\ all States and the District of Columbia generally 
require businesses to notify their customers when certain customer 
information is compromised. States do not typically require the 
adoption of written policies and procedures for the handling of such 
incidents.\711\ However, despite the lack of explicit statutory 
requirements, covered institutions--especially those with a national 
presence--may have developed and implemented written policies and 
procedures for a response program that incorporates various standard 
elements, including for assessment, containment, and notification.\712\ 
Given the numerous and distinct State data breach laws, it would be 
difficult for larger covered institutions operating in multiple States 
to comply effectively with existing State laws without having some 
written policies and procedures in place. As such covered institutions 
are generally larger, they are more likely to have compliance staff 
dedicated to designing and implementing regulatory policies and 
procedures, which could include policies and procedures regarding 
incident response. Moreover, to the extent that covered institutions 
that have already developed written policies and procedures for 
incident response have based such policies and procedures on common 
cyber incident response frameworks (e.g., NIST Computer Security 
Incident Handling Guide, CISA Cybersecurity Incident Response 
Playbook),\713\ generally accepted industry best practices, or other 
applicable regulatory guidelines,\714\ these large covered 
institutions' written policies and procedures are likely to include the 
elements of assessment, containment, and notification, and to be 
substantially consistent with the requirements of the final amendments. 
Thus, we do not anticipate that the final requirement for written 
policies and procedures will result in substantial new benefits from 
its application to these institutions.
---------------------------------------------------------------------------

    \710\ See supra section IV.C.2.
    \711\ Some States do, however, require businesses to have 
procedures to protect personal information. See, e.g., Cal. Civil 
Code section 1798.81.5 and N.Y. Gen. Bus. Law. section 899-BB.
    \712\ Various industry guidebooks, frameworks, and government 
recommendations share many common elements, including the ones 
included in the final amendments. See, e.g., NIST Computer Security 
Incident Handling Guide and CISA Incident Response Playbook.
    \713\ See supra footnote 625.
    \714\ For example, the Banking Agencies' Incident Response 
Guidance states that covered institutions that are subsidiaries of 
U.S. bank holdings companies should develop response programs that 
include assessment, containment, and notification elements. See 
supra discussion of Banking Agencies' Incident Response Guidance in 
text accompanying footnote 605.
---------------------------------------------------------------------------

    For the same reasons, this requirement is unlikely to impose 
significant new costs for these institutions. As discussed below, we 
estimate that certain costs associated with developing and implementing 
policies and procedures to comply with the final amendments will be, on 
average, $15,445 per year per covered institution.\715\ Here, we expect 
the main costs associated with the final requirement to be the costs of 
reviewing, and possibly updating, existing policies and procedures to 
ensure that they satisfy the new requirements. Hence, we expect these 
reviews and updates will result in these covered institutions incurring 
direct compliance costs generally smaller than the costs of developing 
and implementing new policies and procedures. If covered institutions 
respond to this requirement by improving their customer information 
safeguards beyond what is required by the final amendments, they will 
incur additional costs.\716\ We expect that the costs incurred by these 
covered institutions as a result of this requirement will ultimately be 
passed on to customers of these institutions.\717\
---------------------------------------------------------------------------

    \715\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $5,425 per year per covered 
institution. See infra section V. We expect that for some 
institutions, the actual costs might be lower than these estimates. 
For example, there may be some portability between funds belonging 
to the same family of investment companies, which could mitigate 
costs per investment company. See supra section IV.C.3.d. We 
estimate that these costs will be higher for transfer agents because 
transfer agents were not, before this adoption, covered by the 
safeguards rule. In addition, transfer agents registered with a 
regulatory agency other than the Commission were not, before this 
adoption, covered by the disposal rule. See infra footnote 1003 and 
accompanying text.
    \716\ Because covered institutions could decide to enhance their 
customer information safeguards in many different ways, we are 
unable to quantify expected costs resulting from such enhancements. 
See infra section IV.D.1.b(3) for examples of how covered 
institutions could enhance their customer information safeguards as 
a result of the final amendments.
    \717\ Costs incurred by larger covered institutions as a result 
of the final amendments will generally be passed on to their 
customers in the form of higher fees. However, smaller covered 
institutions--which are likely to face higher costs relative to 
their size--may not be able to do so. See infra section IV.E.
---------------------------------------------------------------------------

    We expect that the final written policies and procedures 
requirements will have more substantial benefits and costs for smaller 
covered institutions without a national presence, such as small 
registered investment advisers and broker-dealers who cater to a 
clientele based on geography, as compared to larger covered 
institutions. Before this adoption, some of these covered institutions 
may have had lower incentives to develop and implement written policies 
and procedures for a response program and may therefore have been less 
likely to have such policies and procedures in place for several 
reasons. First, the incentives to develop and implement policies and 
procedures for a response program may vary for covered institutions of 
different sizes. Some smaller covered institutions may already 
prioritize response programs, for example because the firm views 
reputational costs of a cybersecurity breach or other type of 
unauthorized access to or use of customer information as posing the 
potential for serious harm to the firm. However, for other smaller 
covered institutions, the firm and its managers may view response 
programs as lower priority because, for example, the potential 
reputational cost of an unauthorized access to or use of customer 
information may be relatively smaller than it would be for a larger 
firm. This would be the case to the extent that the firm and its 
managers perceive that the firm has a lower franchise value (the 
present value of the future profits that a firm is expected to earn as 
a going concern) and lower brand equity (the value of potential 
customers' perceptions of the firm). Thus, the costs of potential 
reputational harm may be perceived to be lower than at larger firms. 
Moreover, the cost of developing and implementing written policies and 
procedures for a response program is proportionately large compared to 
larger covered institutions since it involves fixed costs.
    Second, some covered institutions could potentially have, before 
this adoption, complied effectively with the relevant State data breach 
notification laws without adopting written policies and procedures to 
deal with customer notification: they may only have needed to 
consider--on an ad hoc basis--the notification requirements of the 
small number of States in which their customers reside.\718\ Hence, for 
such covered institutions, the cost of developing policies and 
procedures will be relatively larger, but the benefits for

[[Page 47751]]

the customers of these institutions will also be larger.
---------------------------------------------------------------------------

    \718\ As discussed above, many registered investment advisers 
have clients in only a few States. See supra section IV.C.3.c.
---------------------------------------------------------------------------

    We expect that for such covered institutions, the final amendments 
will likely impose additional compliance costs related to written 
policies and procedures for safeguarding customer information.\719\ 
Certain costs associated with developing and implementing policies and 
procedures to comply with the final amendments are estimated to be 
$15,445 generally per year per covered institution, but may vary 
depending on the size of the institution and the current state of their 
existing policies and procedures.\720\ Furthermore, as for larger 
covered institutions, if these covered institutions respond to this 
requirement by improving their customer information safeguards beyond 
what is required by the final amendments, they will incur additional 
costs. While these smaller covered institutions might potentially pass 
some of the costs resulting from the final amendments on to customers 
in the form of higher fees, their ability to do so may be limited due 
to the presence of larger competitors with more customers across which 
to spread costs.\721\ In addition, covered institutions that improve 
their customer notification procedures in response to the final 
amendments might suffer reputational costs resulting from the 
additional notifications.\722\
---------------------------------------------------------------------------

    \719\ The existing policies and procedures were already required 
under Regulation S-P before this adoption; see 17 CFR 248.30. The 
final amendments may also generate additional costs to covered 
institutions who decide to improve their customer information 
safeguards to avoid the potential reputational harm associated with 
the customer notification requirements. However, one commenter 
stated that the FTC has often noted that reasonable security 
measures are a relatively low cost. See EPIC Comment Letter. Such 
improvements in customer information safeguards would also provide 
potential benefits to customers in addition to reducing the risk of 
reputational harm for the covered institutions.
    \720\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $5,425 per year per covered 
institution. See infra section V. We expect that for some 
institutions, the actual costs might be lower than these estimates. 
For example, there may be some portability between funds belonging 
to the same family, which could mitigate costs. See supra section 
IV.C.3.d.
    \721\ See supra section IV.C.3. Developing and implementing 
written policies and procedures for a response program involves 
fixed costs. Larger institutions can spread these costs over a 
larger number of customers, resulting in a smaller increase in the 
price that each customer pays. Smaller institutions must spread 
these costs over a smaller number of customers, resulting in a 
larger price increase per customer. This could result in smaller 
institutions losing more customers as a result of the increase in 
price. Hence, smaller institutions could decide to absorb more of 
the costs compared to large institutions in order to avoid losing 
customers.
    \722\ See supra section IV.B; see also infra section IV.D.1.b.
---------------------------------------------------------------------------

    Some commenters stated that many covered institutions already had 
policies and procedures in place.\723\ These commenters also stated 
that these policies and procedures would need to be reviewed and 
updated to comply with the amendments, but to different extents. On the 
one hand, one commenter stated that its members already complied with 
much of the proposal's content through State regulations, such as the 
requirements that companies maintain written cybersecurity policies and 
procedures, respond to cyber incidents, notify authorities and 
consumers of certain cyber incidents, and dispose of consumer 
data.\724\ A second commenter stated that the customer notification 
requirements would need to be incorporated into existing policies and 
procedures.\725\ These commenters' perspectives are consistent with our 
view that the final rules will impose a fairly limited burden for 
covered institutions bringing existing policies and procedures into 
compliance with the new requirements. On the other hand, a different 
commenter stated that written incident response program policies and 
procedures and recordkeeping requirements would need to be created and 
implemented,\726\ indicating higher potential burden. Hence, we 
continue to expect that the policies and procedures requirements will 
potentially have different effects on different covered 
institutions.\727\ In a change from the proposal and after considering 
commenters' concerns, we are now adopting a longer compliance period 
for all covered institutions relative to the proposal, and an even 
longer compliance period of 24 months for smaller covered institutions, 
which are less likely to already have policies and procedures broadly 
consistent with the final amendments.\728\
---------------------------------------------------------------------------

    \723\ See, e.g., IAA Comment Letter 1; SIFMA Comment Letter 2.
    \724\ See ACLI Comment Letter.
    \725\ See SIFMA Comment Letter 2.
    \726\ See IAA Comment Letter 1.
    \727\ For example, some covered institutions, such as transfer 
agents, may not have existing notification procedures since they may 
not have been required, under State law, to notify customers in case 
of a breach. See supra section IV.C.2.a(3); infra section IV.D.2.b.
    \728\ The compliance period for larger institutions under the 
final amendments is 18 months from the date of publication in the 
Federal Register. The proposed compliance period for all covered 
institutions was 12 months from the effective date of the final 
amendments. See supra section II.F.
---------------------------------------------------------------------------

    Two commenters discussed how the proposed amendments would affect 
an entity that is dually registered as an investment adviser and 
broker-dealer. One commenter stated that it appreciated the approach of 
the proposal, which applies uniformly to the two types of covered 
institutions and would allow for streamlining of processes.\729\ 
Another commenter stated that bringing both sides of the entity into 
compliance with the proposed amendments would impose a significant 
burden and require a dual registrant to modify both sides of the 
entity' compliance frameworks.\730\ We do not expect a significant 
burden, because we expect that these institutions could generally 
implement a single set of procedures to comply with many of the 
provisions of the final amendments, which would limit these additional 
burdens.\731\ To the extent entities registered as more than one 
category of covered institution arrange their business such that there 
are separate policies and procedures for each category, those entities 
may encounter additional cost burden when complying with the final 
amendments. For example, an entity that creates two different incident 
response programs for its advisory and broker-dealer operations could 
bear as much as twice the cost burden as the same entity would bear 
when creating one incident response program,\732\ although there may be 
efficiencies to the extent that development of one program informs the 
other. The final amendments, however, do not prevent that entity from 
using the same incident response program across its categories of 
covered institutions.
---------------------------------------------------------------------------

    \729\ See FSI Comment Letter.
    \730\ See Cambridge Comment Letter.
    \731\ For example, we expect that these institutions will be 
able to implement a single set of procedures to satisfy the customer 
notification requirements.
    \732\ For example, annual average costs of $30,890 associated 
with preparation of written policies and procedures instead of 
annual average costs of $15,445. See, e.g., infra footnote 856 and 
accompanying text.
---------------------------------------------------------------------------

    In the remainder of this section, we first consider the benefits 
and costs associated with requiring covered institutions to have a 
response program generally. We then analyze the benefits and the costs 
of the notification requirements vis-[agrave]-vis the notification 
requirements already in force under the various existing State laws. We 
conclude this section with an analysis of the benefits and costs of the 
response program's service provider provisions.
a. Response Program
    The final amendments require covered institutions' written policies 
and procedures to include a response program ``reasonably designed to 
detect, respond to, and recover from unauthorized access to or use of

[[Page 47752]]

customer information, including customer notification procedures.'' 
\733\ The response program must address incident assessment, 
containment, as well as customer notification and oversight of service 
providers.\734\
---------------------------------------------------------------------------

    \733\ Final rule 248.30(a)(3).
    \734\ See final rule 248.30(a)(3).
---------------------------------------------------------------------------

    The question of how best to structure the response to an incident 
resulting in unauthorized access to or use of customer information has 
received considerable attention from firms, IT consultancies, 
government agencies, standards bodies, and industry groups, resulting 
in numerous reports with recommendations and summaries of best 
practices.\735\ While the emphasis of these reports varies, certain key 
components are common across many incident response programs. For 
example, NIST's Computer Security Incident Handling Guide identifies 
four main phases to cyber incident handling: (1) preparation; (2) 
detection and analysis; (3) containment, eradication, and recovery; and 
(4) post-incident activity.\736\ The assessment, containment, and 
notification prongs of the final policies and procedures requirements 
correspond to the latter three phases of the NIST recommendations. 
Similar analogues are found in other reports, recommendations, and 
other regulators' guidelines.\737\ Thus, the required procedures of the 
incident response program are substantially consistent with industry 
best practices and these other regulatory documents that seek to 
develop effective policies and procedures in this area.
---------------------------------------------------------------------------

    \735\ See supra section IV.C.1.
    \736\ See NIST Computer Security Incident Handling Guide.
    \737\ See supra text accompanying footnote 604.
---------------------------------------------------------------------------

    While some commenters suggested that some specific provisions of 
the amendments be better aligned with existing regulation,\738\ other 
commenters stated that the Commission's proposal would generally align 
the amendments with other regulatory frameworks such as the Banking 
Agencies' Incident Response Guidance.\739\ One of these commenters 
stated that consistency across regulatory requirements facilitates 
firms' operations, provides for efficiencies in their operations, and 
better serves customers.\740\ In the final amendments, we have revised 
some requirements from the proposal to better align them with existing 
regulatory framework. For example, one commenter stated that a 72-hour 
deadline would improve alignment with other existing requirements and 
that this would significantly reduce complexity and compliance burdens 
for covered institutions and their service providers.\741\ Consistent 
with other regulatory frameworks,\742\ the final amendments require 
that covered institutions ensure that their service providers take 
appropriate measures to provide notification to the covered institution 
as soon as possible, but no later than 72 hours after becoming aware 
that a breach in security has occurred.\743\
---------------------------------------------------------------------------

    \738\ See SIFMA Comment Letter 2; Computershare Comment Letter.
    \739\ See, e.g., ICI Comment Letter 1; Nasdaq Comment Letter.
    \740\ See ICI Comment Letter 1.
    \741\ See Microsoft Comment Letter; see also supra footnote 245 
and accompanying text.
    \742\ See supra footnote 257 and accompanying text.
    \743\ The proposed amendments instead had a requirement of 48 
hours. See Proposing Release at section II.A.3.
---------------------------------------------------------------------------

    Similar to the written policies and procedures requirement, we 
expect the benefits and the costs of the response program requirements 
to vary across covered institutions. In general, costs will be larger 
for entities that do not have any related incident response programs or 
related policies and procedures. For those entities, costs may include 
needing to familiarize themselves with the new requirements, initial 
set-up costs for new systems to monitor when customers need to be 
notified, new notification systems, and development and implementation 
of new policies and procedures associated with response programs. 
Therefore, on the one hand, the effects of the requirements are likely 
to be small for covered institutions with a national presence who are 
likely to already have such programs in place.\744\ For such 
institutions, we expect direct compliance costs to be largely limited 
to reviews and, if needed, updates of existing policies and 
procedures.\745\ On the other hand, we expect greater benefits and 
costs for smaller, more geographically limited covered institutions 
since they are less likely to have an existing incident response 
program. The benefits ensuing from these institutions incorporating 
incident response programs to their written policies and procedures can 
be expected to arise from improved efficacy in notifying affected 
customers and--more generally--from improvements in the manner in which 
such incidents are handled. The response program requirements might 
potentially provide substantial benefit in a specific incident, for 
example in the case of a data breach at an institution that does not 
currently have an incident response program and is unprepared to 
promptly respond in keeping with law and best practice. Such an 
institution will also bear the full costs associated with adopting and 
implementing procedures complying with the final amendments.\746\
---------------------------------------------------------------------------

    \744\ In addition, as discussed above, private funds may be 
subject to the FTC Safeguards Rule, which requires an incident 
response plan. See supra footnotes 614 and 617 and accompanying 
text. Hence, we expect that private funds advisers that are 
registered with the Commission may already have an incident response 
plan in place.
    \745\ We expect these reviews and updates will result in 
entities incurring costs generally smaller than the costs of 
adopting and implementing new procedures. See supra section IV.D.1.
    \746\ See supra footnote 721 and accompanying text for a 
discussion of certain quantified costs associated with developing 
and implementing policies and procedures. See also infra section V.
---------------------------------------------------------------------------

    In addition to helping ensure that customers are notified when 
their data are breached,\747\ having reasonably designed strategies for 
incident assessment and containment ex ante might reduce the frequency 
and scale of breaches through more effective intervention and improved 
managerial awareness, providing further indirect benefits. Any such 
improvements to covered institutions' processes will benefit their 
customers (e.g., by reducing harms to customers resulting from data 
breaches), as well as the covered institutions themselves (e.g., by 
reducing the expected costs of handling data breaches), representing 
further indirect benefits of the rule.
---------------------------------------------------------------------------

    \747\ The benefits and costs specific to the notification 
requirements are analyzed in detail in section IV.D.1.b below.
---------------------------------------------------------------------------

    We lack data on efficacy of incident assessment, incident 
containment, or customer notification that would allow us to quantify 
the economic benefits of the final requirements, and no commenter 
suggested such data. Similarly, we lack data, and no commenter 
suggested such data, that would allow us to quantify the indirect 
economic costs, such as reputational cost of any potential increase in 
the frequency of customer notification or the indirect costs of 
customer information protection improvements that may be undertaken to 
avoid such reputational costs. In the aggregate, however, considering 
the amendments in the context of the baseline, these benefits and costs 
are likely to be limited. As we have discussed above,\748\ all States 
have previously enacted data breach notification laws with 
substantially similar aims and, therefore, we think it likely that many 
institutions have response programs to support compliance with these 
laws. In addition, we anticipate that larger covered institutions with 
a national presence--which account for the bulk of

[[Page 47753]]

covered institutions' customers--have already developed written 
incident response programs consistent with the proposed requirements in 
most respects.\749\ Thus, the benefits and costs of requiring written 
incident response programs will be the most significant for smaller 
covered institutions without a national presence--institutions whose 
policies affect relatively few customers.
---------------------------------------------------------------------------

    \748\ See supra section IV.C.2.a.
    \749\ See supra footnote 713 and accompanying text.
---------------------------------------------------------------------------

    In support of the proposed response program requirement, some 
commenters stated that response programs had benefits beyond the 
notification of affected individuals. One commenter stated that 
effective cybersecurity practices and system safeguards, including 
incident response and notification, were critical for the financial 
markets and services industry and the regulators tasked with oversight 
of this sector.\750\ Another commenter stated that the costs associated 
with the incident response programs and more robust notification regime 
served an important forcing function for entities that might otherwise 
not adequately invest in safeguards on the front end.\751\ This 
commenter also cited a report stating that having an incident plan is 
one of the steps organizations can take to protect their data.\752\ In 
addition, in support of the Proposing Release, commenters cited sources 
offering additional context and evidence of the benefits of incident 
response programs. A report cited by a commenter states that businesses 
with an incident response team that tested their incident response plan 
saw an average of $2.66 million lower breach costs compared to 
organizations without an incident response team and that did not test 
their incident response plan.\753\ A more recent version of the same 
report states that businesses which both had an incident response team 
and tested their incident response plan took 54 fewer days to identify 
and contain a data breach, compared to businesses that did not have a 
response team nor test their incident response plan (252 days as 
compared to 306 days).\754\ This information generally supports our 
view that incident response programs will have benefits for both 
covered institutions and their customers. However, because the 
amendments' requirements differ from those analyzed in these reports, 
we are unable to use these estimates to precisely quantify the benefits 
of the amendments in terms of prevention of and response to data breach 
incidents involving customer information. Nevertheless, to the extent 
that different reasonably designed incident response programs yield 
benefits of similar magnitudes, the final amendments will have benefits 
of similar magnitude for the covered institutions that do not currently 
have an incident response program in place, with associated benefits 
for the customers of these institutions.
---------------------------------------------------------------------------

    \750\ See Google Comment Letter.
    \751\ See EPIC Comment Letter. Potential reputational costs, and 
the associated potential loss of customers, that could result from 
customer notification will incentivize covered institutions to spend 
more on information safeguards. However, additional costs associated 
with the required response program are unlikely to provide such 
incentives. Once informed, the customers will have the possibility 
to stop doing business with covered institutions they wish to avoid.
    \752\ See EPIC Comment Letter, citing Internet Society's Online 
Trust Alliance, 2018 Cyber Incident & Breach Trends Report (July 9, 
2019), available at https://www.internetsociety.org/wp-content/uploads/2019/07/OTA-Incident-Breach-Trends-Report_2019.pdf.
    \753\ See Better Markets Comment Letter. The commenter cited the 
2022 IBM Cost of Data Breach Report which finds that the cost of a 
data breach for organizations without an incident response team and 
that did not test their incident response plan was $5.92 million, 
while the costs for organizations with an incident response team 
that tested its incident response plan was $3.26 million. Equivalent 
numbers are not available in the 2023 version of the report.
    \754\ See 2023 IBM Cost of Data Breach Report.
---------------------------------------------------------------------------

b. Notification Requirements
    The final requirements provide for a Federal minimum standard for 
data breach notification, applicable to the sensitive customer 
information of all customers of covered institutions (including 
customers of other financial institutions whose information has been 
provided to a covered institution),\755\ regardless of their state of 
residence. The information value of a data breach notification standard 
is a function of its various provisions and how these provisions 
interact to provide customers with thorough, timely, and accurate 
information about how and when their information has been compromised. 
Customers receiving notices that are more thorough, timely, and 
accurate have a better chance of taking effective remedial actions, 
such as placing holds on credit reports, changing passwords, and 
monitoring account activity.\756\ These customers will also be better 
able to make informed decisions about whether to continue to do 
business with institutions that have been unable to prevent their 
information from being compromised. Similarly, non-customers who learn 
of a data breach, for example from individuals notified as a result of 
the final amendments, might use this information to evaluate their 
potential use of a covered institution.
---------------------------------------------------------------------------

    \755\ See final rule 248.30(d)(5)(i).
    \756\ Commenters agreed that a breach notification allows 
customers to take mitigating actions limiting the negative effects 
of a breach. See, e.g., EPIC Comment Letter. One commenter also 
stated that the value of any required disclosure depended largely on 
the extent to which it conveyed clear, comprehensible, and usable 
information. See Better Markets Comment Letter.
---------------------------------------------------------------------------

    As discussed above, all 50 States and the District of Columbia 
already have data breach notification laws that apply, in varying ways, 
to compromises of their residents' information.\757\ Thus, the benefits 
of the adopted Federal minimum standard for notification of customers 
(vis-[agrave]-vis the baseline) will vary depending on each customer's 
State of residence, with the greatest benefits accruing to customers 
that reside in States with the least informative customer notification 
requirements.\758\
---------------------------------------------------------------------------

    \757\ See supra section IV.C.2.a. In addition, some covered 
institutions may be required to share information with certain 
individuals about certain events under other Federal regulations 
such as Regulation SCI or the Banking Agencies' Incident Response 
Guidance. See supra section IV.C.2.b.
    \758\ In some cases, large benefits could also accrue to 
customers that reside in States with broader and more informative 
breach notification laws if they reside in States where such laws 
are not applicable to entities in compliance with the GLBA. See 
infra section IV.D.1.b(1).
---------------------------------------------------------------------------

    Unfortunately, with the data available, it is not practicable to 
decompose the marginal contributions of the various State law 
provisions to the overall ``strength'' of State data breach laws. 
Consequently, it is not possible for us to quantify on a state-by-state 
basis the benefits of the adopted Federal minimum standard to customers 
residing in the various States. In considering the benefits of the 
final notification requirement, we limit consideration to the 
``strength'' of individual provisions of the final amendments vis-
[agrave]-vis the corresponding provisions under State laws and consider 
the number of customers that might potentially benefit from each.
    Similarly--albeit to a somewhat lesser extent--the costs to covered 
institutions will also vary depending on the geographical distribution 
of each covered institution's customers. Generally, the costs 
associated with the final amendments will be greater for covered 
institutions whose customers reside in States with less informative 
customer notification laws than for those whose customers reside in 
States with broader and more informative notification laws. In 
particular, smaller covered institutions whose customers are 
concentrated in States where State data breach laws result in less 
informative customer notification are likely to face higher costs since 
they may have to issue additional notices to comply with the 
amendments. The costs

[[Page 47754]]

associated with notice issuance comprise both administrative costs and 
reputational costs. Certain costs arising from notice issuance are 
covered in the Paperwork Reduction Act analysis in section V and are 
estimated to be on average $5,178 per year per covered 
institution.\759\ We lack data, and no commenter suggested such data, 
that would allow us to quantify the reputational cost resulting from 
any potential increase in the frequency of customer notification or the 
indirect costs of customer information protection improvements that may 
be undertaken by covered institutions to avoid such reputational costs.
---------------------------------------------------------------------------

    \759\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $3,862 per year per covered 
institution. See infra section V.
---------------------------------------------------------------------------

    Although some commenters stated that a Federal notification 
requirement was not needed given existing State law requirements,\760\ 
other commenters supported this proposed provision.\761\ One commenter 
stated that a significant advantage would be that in several States, it 
would relieve covered institutions from having to issue state-specific 
breach notices under State law.\762\ Another commenter further stated 
that a Federal breach notification requirement ``would satisfy State 
notice laws that provide exemptions for firms subject to such a 
requirement, which will help to a degree to reduce the confusion and 
notification burdens arising from the patchwork of State data breach 
notification requirements.'' \763\ Another commenter stated that the 
benefits of a Federal minimum standard would outweigh the burden of the 
new notification requirements.\764\
---------------------------------------------------------------------------

    \760\ See, e.g., CAI Comment Letter (stating that the proposed 
amendments' requirements ``would simply add another layer on top of 
these existing requirements and would likely go entirely unnoticed 
by consumers, while complicating compliance efforts for covered 
institutions and raising additional compliance and legal risk''). We 
disagree with these commenters and discuss in detail in the 
subsections below the benefits of different provisions of the 
notification requirements over the baseline.
    \761\ See, e.g., ICI Comment Letter 1; IAA Comment Letter 1.
    \762\ See ICI Comment Letter 1.
    \763\ See IAA Comment Letter 1; see also supra footnote 557 and 
accompanying text. Another commenter stated that the proposed 
notification requirements would not replace State law requirements 
and that covered institutions would continue to have to comply 
beyond the Federal minimum standard for at least 20 States. See FSI 
Comment Letter.
    \764\ See FSI Comment Letter.
---------------------------------------------------------------------------

    In the rest of this section, we consider key provisions of the 
final notification requirements, their potential benefits to customers 
(vis-[agrave]-vis existing State notification laws), and their costs.
(1) GLBA Safe Harbors
    A number of State data breach laws provide exceptions to 
notification for entities subject to and in compliance with the GLBA. 
These ``GLBA Safe Harbors'' may result in customers not receiving any 
data breach notification from registered investment advisers, broker-
dealers, funding portals, investment companies, or transfer agents. The 
final amendments will help ensure customers receive notice of breach in 
cases where they may not currently because notice is not required under 
State law.
    Based on an analysis of State laws, we found that 19 States provide 
a GLBA Safe Harbor.\765\ Together, these States account for 24 percent 
of the U.S. population, or approximately 17 million potential customers 
who may benefit from this provision.\766\ While we do not have data on 
the exact geographical distribution of customers across all covered 
institutions, we are able to identify registered investment advisers 
whose customers reside exclusively in GLBA Safe Harbor States.\767\ We 
estimate that there are 679 such advisers, representing 4.4 percent of 
the registered adviser population, and that these advisers represent in 
total more than 97,000 clients.\768\ We expect that a similar 
percentage of broker-dealers would be found to be operating exclusively 
in GLBA Safe Harbor States.
---------------------------------------------------------------------------

    \765\ States with exceptions that specifically mention the GLBA 
include Arizona, Connecticut, the District of Columbia, Delaware, 
Iowa, Kentucky, Maryland, Minnesota, Missouri, Nevada, New Mexico, 
Oregon, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, 
Virginia, and Wisconsin. Additional States have exceptions for 
compliance with a primary Federal regulator, as discussed supra.
    \766\ Estimates of the numbers of potential customers are based 
on State population adjusted by the percentage of households 
reporting direct stock ownership (21%). See U.S. Census Bureau, 
Apportionment Report (2020), available at https://www2.census.gov/programs-surveys/decennial/2020/data/apportionment/apportionment-2020-table01.xlsx (last visited Apr. 12, 2024); see also Federal 
Reserve Board, Survey of Consumer Finances (2022), available at 
https://www.federalreserve.gov/econres/scfindex.htm (last visited 
Apr. 9, 2024).
    \767\ Based on Form ADV, Item 2.C as of Oct. 5, 2023; see also 
supra footnote 655.
    \768\ Based on Form ADV, Item 5.D as of Oct. 5, 2023; see also 
supra footnote 650.
---------------------------------------------------------------------------

    Changing the effect of the GLBA Safe Harbors is not likely to 
impose significant direct compliance costs on most covered 
institutions. For the reasons outlined above, many covered institutions 
have customers residing in States without a GLBA Safe Harbor and we 
therefore expect them to have existing procedures for notifying 
customers under State law. Additionally, some jurisdictions require 
notification policies or actual notification as condition of the safe 
harbor.\769\ However, covered institutions whose customer base is 
limited to GLBA Safe Harbor States may not have implemented any 
procedures to notify customers in the event of a data breach. These 
covered institutions may face higher costs than entities with some 
notification procedures already in place, but the customers of these 
institutions will benefit the most from the final amendments by 
receiving notice they may not have otherwise received.
---------------------------------------------------------------------------

    \769\ See, e.g., D.C. Code section 28-3852(g).
---------------------------------------------------------------------------

    One commenter agreed that some State laws provided exemptions from 
their notice requirements under the GLBA but disagreed that this 
implied benefits for the amendments, stating that the proposed 
amendments would not preempt State notification requirements and would 
instead add another variation on existing requirements to be accounted 
for by covered institutions, with limited real benefits to affected 
individuals.\770\ The final amendments will create new and to various 
extents different notification requirements for covered institutions 
with customers residing in States without GLBA exemptions. However, we 
disagree with this commenter's assertion that benefits to affected 
individuals will be limited. As discussed above, State laws vary in 
detail from State to State.\771\ We discuss below how the final 
amendments will impose a Federal minimum standard for customer 
notification and how we expect this standard to benefit customers.
---------------------------------------------------------------------------

    \770\ See CAI Comment Letter (``Although some state laws do 
provide exemptions from their state specific notice requirements 
where a notice is provided consistent with requirements under the 
Gramm-Leach Bliley Act (GLBA), most do not. This proposed new 
requirement would not serve to preempt those generally applicable 
state notice requirements, and would not establish a new singular 
standard. It would just be another variation on existing 
requirements to be accounted for, with limited real benefit to 
affected individuals.'').
    \771\ See supra section IV.C.2.a.
---------------------------------------------------------------------------

(2) Accelerated Timing of Customer Notification
    The final amendments require covered institutions to provide notice 
to customers in the event of some data breaches as soon as practicable, 
but not later than 30 days, after becoming aware that unauthorized 
access to or use of customer information has occurred or is reasonably 
likely to have occurred.\772\ As discussed in section IV.C.2.a, 
existing State laws vary in terms of notification timing. Most States 
(31) do not include a specific deadline for

[[Page 47755]]

notifying customers, but rather require that the notice be given in an 
expedient manner and/or that it be provided without unreasonable delay. 
These States account for 60 percent of the U.S. population, with 
approximately 42 million potential customers residing in these 
States.\773\ Four States have a 30-day deadline; we estimate that close 
to 8 million potential customers reside in these States. The remaining 
16 States provide for longer notification deadlines. For the estimated 
20 million potential customers residing in these 16 States, the final 
amendments' 30-day outside timeframe might tighten the notification 
timeframes.\774\ In addition, the 30-day outside timeframe is likely to 
tighten notification timeframes for the approximately 42 million 
potential customers residing in States with no specific deadline.
---------------------------------------------------------------------------

    \772\ See final rule 248.30(a)(4)(iii).
    \773\ See supra Figure 2; see also supra footnote 767.
    \774\ State deadlines are either 30, 45, or 60 days, but differ 
in terms of triggers of those deadlines; see supra Figure 3.
---------------------------------------------------------------------------

    Even though the timing language in State laws without specific 
deadlines generally suggests that notices must be prompt, we have 
evidence that the notices are frequently sent significantly later than 
30 days after the affected institution learns of the breach. The 
Proposing Release references data from California and Washington, which 
we explain in more detail below. California requires that such notice 
be given ``in the most expedient time possible and without unreasonable 
delay.'' \775\ Nevertheless, data from the California Office of the 
Attorney General, regarding notices sent to more than 500 California 
residents for any one incident, indicate that for the notices for which 
these data are available, the average time from discovery to 
notification was 144 days in 2022, and 91 percent of these notices were 
sent later than 30 days after the discovery of the breach.\776\ Hence, 
we expect that the aggregate effects of a 30-day notification outside 
timeframe might be significant for the 42 million potential customers 
residing in States with no specific deadline.\777\
---------------------------------------------------------------------------

    \775\ See Cal. Civil Code section 1798.82.
    \776\ This analysis was performed using data from the State of 
California Department of Justice, Office of the Attorney General, 
Search Data Security Breaches (2023), available at https://oag.ca.gov/privacy/databreach/list (last visited Apr. 8, 2024). 
California law requires that a sample copy of a breach notice sent 
to more than 500 California residents be provided to the California 
Attorney General. Four-hundred fifty-six such notices were reported 
in the year of 2022. Of those notices, 164 (36%) included both the 
date of the discovery of the breach and the date the notice was sent 
to affected individuals. For those 164 notices, the average number 
of days between discovery and notice was 144 and the median number 
of days was 107. One hundred fifty of these notices (91%) were sent 
more than 30 days after discovery. The minimum number of days was 0 
and the maximum was 538. The Proposing Release cited an average 
number of days between discovery and notice of 197 (for calendar 
year 2021). The correct number should be 97. This change would not 
have affected the Commission's assessment, in the Proposing Release, 
that there would be substantial economic benefits from a new 
notification deadline in an amended Regulation S-P, as both 
estimates are substantially larger than 30 days.
    \777\ The final amendments' 30-day notification timeframe starts 
when a covered institution becomes aware that unauthorized access to 
or use of customer information has occurred or is likely to have 
occurred. See final rule 248.30(a)(4)(iii). The analysis performed 
here relies instead on an entity's description of when it discovered 
or became aware of a breach, which could refer to a different point 
in time.
---------------------------------------------------------------------------

    In addition, because the final amendments will not provide for 
broad exceptions to the 30-day notification requirement,\778\ in many 
cases the amendments will tighten notification timeframes even for the 
8 million potential customers residing in States with a 30-day 
deadline. For example, in Washington, the State law requires that the 
notice be given ``without unreasonable delay, and no more than thirty 
calendar days after the breach was discovered.'' \779\ However, the law 
also allows for a delay ``at the request of law enforcement'' or ``due 
to any measures necessary to determine the scope of the breach and 
restore the reasonable integrity of the data system.'' \780\ Data from 
the Washington Attorney General's Office indicate that for the notices 
for which these data are available, the average time from discovery to 
notification was 137 days in 2022 and the median time was 93 days.\781\ 
Eighty-seven percent of these notices were sent later than 30 days 
after the discovery of the breach, presumably as a result of these 
exceptions.\782\ Hence, we expect that the timing requirements of the 
final amendments will result in many notices being sent earlier even in 
some States with a 30-day deadline.
---------------------------------------------------------------------------

    \778\ See supra footnote 544 and accompanying text.
    \779\ See RCW 19.255.010(8).
    \780\ See RCW 19.255.010(8).
    \781\ This analysis was performed using data from the Washington 
State Office of the Attorney General, Data Breach Notifications, 
available at https://www.atg.wa.gov/data-breach-notifications (last 
visited Apr. 8, 2024). Washington law requires that any business, 
individual, or public agency that is required to issue a security 
breach notification to more than 500 Washington residents as a 
result of a single security breach shall electronically submit a 
single sample copy of that security breach notification. One hundred 
and eighty-five such notices were reported in the year 2022. For 121 
(65%) of those notices, data is available for both the date of the 
discovery of the breach and the date the notice was sent to affected 
individuals. For those 121 notices, the average number of days 
between discovery and notice was 137 and the median number of days 
was 93. One hundred four notices (87%) were sent more than 30 days 
after discovery. The minimum number of days was 4 and the maximum 
was 651.
    \782\ These numbers should be interpreted with care, since what 
different firms describe as the time at which they ``discover'' a 
breach could vary. See also supra footnote 778.
---------------------------------------------------------------------------

    Tighter notification deadlines should increase customers' ability 
to take effective measures to counter threats resulting from their 
sensitive information being compromised. Such measures may include 
placing holds on credit reports or engaging in more active monitoring 
of account and credit report activity.
    In practice, however, when it takes a long time to discover a data 
breach, a relatively short delay between discovery and customer 
notification may have little impact on customers' ability to take 
effective countermeasures.\783\ Based on the data from the California 
Office of the Attorney General, the average number of days between the 
start of a breach and its discovery was 46 days in 2022, with a median 
of 7 days and a standard deviation of 126 days.\784\ In addition, data 
from the Washington Attorney General's Office show that in 2022, there 
were on average 94 days between the time a breach occurred and its 
discovery, with a median of 10 days and a standard deviation of 319 
days.\785\

[[Page 47756]]

This suggests that time to discovery is likely to prevent issuance of 
timely customer notices in many but not all cases. As plotted in Figure 
9, while some firms take many months--even years--to discover a data 
breach, others do so in a matter of days: 66 percent of firms were able 
to detect a breach within 2 weeks and 77 percent were able to do so 
within 30 days.\786\ Thus, while the adopted 30-day notification 
outside timeframe may not always substantially improve the timeliness 
of customer notices, in many cases it may improve timeliness.
---------------------------------------------------------------------------

    \783\ In other words, the utility of a notice is likely to 
exhibit decay. For example, if a breach is discovered immediately, 
the utility of receiving a notification within 1 day is considerably 
greater than the utility of receiving a notification in 30 days. 
However, if a breach is discovered only after 200 days, the 
difference in expected utility from receiving a notification on day 
201 versus day 231 is smaller: with each passing day some 
opportunities to prevent the compromised information from being 
exploited are lost (e.g., unauthorized wire transfer), with each 
passing day opportunities to discover the compromise grow (e.g., 
noticing an unauthorized transaction), and with each passing day the 
compromised information becomes less valuable (e.g., passwords, 
account numbers, addresses, etc., generally change over time).
    \784\ See supra footnote 777 describing the methodology. Many 
breaches, for example in the case of ransomware attacks or 
compromises of physical equipment, are discovered on the day that 
they happen or shortly thereafter.
    \785\ See supra footnote 782 describing the methodology. A few 
factors could influence the estimated length of time between a 
breach and its discovery by the notifying entity. First, the two 
States discussed here (California and Washington) require firms to 
report the date on which the breach started. In instances where 
firms do not know this information, they could report the discovery 
date instead. This would result in an underestimate of the time 
between when a breach occurs and its discovery. Second, as discussed 
above, different firms could interpret the meaning of discovery 
differently. See supra footnote 783. Third, the discovery date used 
for this estimate is the date on which the notifying entity 
discovers the breach. If the breach happened at a service provider, 
it is possible that the service provider discovered the breach 
earlier and notified its client later. Hence, the numbers reported 
here likely overestimate the amount of time the affected entity took 
to discover the breach when the breach affected an entity different 
from the notifying entity. For comparison, according to IBM, in 2023 
it took an average of 207 days to identify a data breach. See 2023 
IBM Cost of Data Breach Report.
    \786\ Based on data from the State of California Department of 
Justice, Office of the Attorney General. See supra footnote 777; 
footnote 785 and accompanying text. The equivalent numbers for 
Washington are 56% and 73%, based on data from the Washington State 
Office of the Attorney General. See supra footnote 782; footnote 786 
and accompanying text.
[GRAPHIC] [TIFF OMITTED] TR03JN24.009

    While we do not expect that the 30-day outside timeframe for 
customer notification will impose significant direct costs relative to 
a longer timeframe (or relative to having no fixed timeframe), the 
shorter outside timeframe might potentially lead to indirect costs 
arising from notification potentially interfering with incident 
containment efforts. Based on data from the Washington Attorney 
General's Office for the fiscal year of 2022, ``containment'' of data 
breaches generally occurs quickly--7.6 days on average.\787\ However, 
according to IBM's study for 2022, it takes an average of 70 days to 
``contain'' a data breach.\788\ The discrepancy suggests that there 
exists some ambiguity in the interpretation of ``containment,'' raising 
the possibility that the 30-day notification outside timeframe might 
require customer notification to occur before some aspects of incident 
containment have been completed and potentially interfering with 
efforts to do so.\789\
---------------------------------------------------------------------------

    \787\ In the data provided by the Washington Attorney General, 
``containment'' (data field DaysToContainBreach) is defined as ``the 
total number of days it takes a notifying entity to end the exposure 
of consumer data, after discovering the breach.'' See supra footnote 
782.
    \788\ In the IBM study, ``containment'' refers to ``the time it 
takes for an organization to resolve a situation once it has been 
detected and ultimately restore service.'' See 2022 IBM Cost of Data 
Breach Report. We use the 2022 average here (70 days) to align with 
the date of the Washington and California State data, but note that 
IBM reports for 2021 and 2023 reported averages of 75 and 73 days, 
respectively. See Proposing Release at n.466; 2023 IBM Cost of Data 
Breach Report. Some of the discrepancy may be due to variation in 
how entities report the date at which the breach started in the data 
for Washington; see supra footnote 786.
    \789\ For example, the notice may prompt the attacker to 
accelerate efforts to obtain or use sensitive information before the 
vulnerability can be completely contained.

---------------------------------------------------------------------------

[[Page 47757]]

    Some commenters opposed the proposed timeframe for customer 
notifications.\790\ One commenter stated that the proposed outside 
timeframe of 30 days after becoming aware of a breach was insufficient 
time to provide a meaningful notification to impacted individuals, 
particularly in complex cases.\791\ Another commenter stated that the 
proposed 30-day outside timeframe was ``unjustified and arbitrary'' and 
that it was ``likely to be insufficient for proper investigation and 
notification.'' \792\ Another commenter stated that the proposed timing 
requirement was overly rigid and did not account for the wide variety 
and complexity of cybersecurity incidents, and that 30 days after 
becoming aware of a possible incident was not enough time to accomplish 
the many steps required to be able to issue notifications to affected 
individuals.\793\ This commenter detailed these steps as ``needing to 
respond to and remediate the security incident directly, conduct a 
forensic investigation to determine what information may have been 
affected, analyze the affected data to determine what sensitive 
customer information is contained in affected data, extract or obtain 
the information needed to make notification to affected users, hire 
vendors and arrange identity protection services for affected 
individuals, and actually send the notifications.'' \794\ These 
commenters, as well as other commenters, suggested longer or less 
specific timeframes.\795\
---------------------------------------------------------------------------

    \790\ See, e.g., ACLI Comment Letter; IAA Comment Letter 1.
    \791\ See ACLI Comment Letter. See also Cambridge Comment 
Letter; IAA Comment Letter 1.
    \792\ See Federated Comment Letter.
    \793\ See CAI Comment Letter.
    \794\ See CAI Comment Letter.
    \795\ See, e.g., FSI Comment Letter (``We recommend that the 
notification requirement under Reg S-P be revised from `as soon as 
practicable, but not later than 30-days' to `as soon as practicable, 
but not later than 60-days' after a firm becomes aware that 
unauthorized access to or use of customer information has occurred 
or is reasonably likely to occur.''); Cambridge Comment Letter (``A 
period of, for example, 60 days would be more realistic, while 
achieving the Proposals' same goals.''); IAA Comment Letter 1 (``We 
recommend a 45-day rather than a 30-day notification requirement to 
provide a more reasonable amount of time for advisers to perform 
investigation and risk assessments, collect the information 
necessary to include in client notices, and provide notices in 
complex cases.'').
---------------------------------------------------------------------------

    A different commenter instead stated that the final required 
timeframe should not be longer than 30 days, citing an article stating 
that ``an analysis of the current State data breach notification laws 
shows that requiring notification within thirty days of a breach to 
affected consumers would be appropriate.'' \796\ This article further 
adds that a ``thirty-day time limit will give an organization ample 
time to conduct a full investigation'' and ``ensure that consumers are 
notified of a breach in a timely manner so they can take the proper 
steps to mitigate any losses and protect their personal information 
from further exposure to cybercriminals through credit freezes, credit 
monitoring, and the like.'' The same commenter suggested that the 
deadline be shortened to 14 days after becoming aware of an 
incident.\797\
---------------------------------------------------------------------------

    \796\ See Better Markets Comment Letter, citing Gregory S. 
Gaglione Jr., The Equifax Data Breach: An Opportunity to Improve 
Consumer Protection and Cybersecurity Efforts in America, 67 Buff. 
L. Rev. 1133 (2019).
    \797\ See Better Markets Comment Letter.
---------------------------------------------------------------------------

    After considering these comments, we are adopting the notification 
timeframe as proposed. Under the final amendments, covered institutions 
will be required to provide notice to affected customers as soon as 
practicable, but not later than 30 days, after becoming aware that 
unauthorized access to or use of customer information has occurred or 
is reasonably likely to have occurred. Commenters stated that this 
notification timeframe may result in customers receiving notices that 
are less accurate or receiving some notices that are unnecessary. The 
final amendments' notification timeframe may, in some cases, result in 
customers receiving less informative notices than they would have 
received under a longer notification timeframe, since covered 
institutions will have less time to understand the incident before 
sending the notice. This 30-day timeframe may also result in instances 
where a notification will be sent but, had the covered institution been 
able to fully investigate the breach in the prescribed timeframe, the 
covered institution would have been able to determine that notification 
was not required.\798\ If unnecessary notifications are sent, as 
commenters suggest could occur, these instances may result in customers 
taking unnecessary mitigating actions, and the costs of these actions 
will be a cost of the final amendments.\799\ These instances will also 
result in additional costs associated with customer notification, such 
as administrative costs related to preparing and distributing notices 
and potential reputational costs (including indirect costs of customer 
information protection improvements that may be undertaken to avoid 
such reputational costs) for covered institutions; we have accounted 
for these additional costs associated with notification in our 
estimates of some of the costs arising from notice issuance.\800\ 
However, the 30-day notification timeframe preserves the benefits of 
the proposed, relatively short notification timeframe and allows 
customers to take rapid and effective mitigating actions.\801\
---------------------------------------------------------------------------

    \798\ Longer investigations are likely to correlate with more 
complicated incidents and are less likely to result in a 
determination that notice is not required. We therefore do not 
expect that a longer notification outside timeframe would have led 
to significantly fewer required notices.
    \799\ See infra section IV.D.1.b(4) for a discussion of the 
effect of unnecessary notification.
    \800\ Certain costs arising from notice issuance are covered in 
the Paperwork Reduction Act analysis in section V and are estimated 
to be on average $5,178 per year per covered institution. This 
estimate is an annual average for the first three years. The 
corresponding ongoing annual costs beyond the first three years are 
estimated to be on average $3,862 per year per covered institution. 
See infra section V. We have increased these estimates from the 
proposal in response to commenters. See infra section V.
    \801\ We have further reviewed, in response to commenters, 
evidence that customers prefer an early notification. A survey of 
U.S. individuals found that notifying customers immediately was one 
of main steps the respondents would recommend to firms after a data 
breach, providing evidence that extending the timeframe is likely to 
therefore reduce the benefits of the notification requirement. See 
Lillian Ablon et al., Consumer Attitudes Toward Data Breach 
Notifications and Loss of Personal Information, RAND Corporation 
(2016), available at https://www.rand.org/pubs/research_reports/RR1187.html. Customers who receive notices faster are better able to 
take appropriate mitigating actions.
---------------------------------------------------------------------------

    In some circumstances, requiring customers to be notified within 30 
days may hinder law enforcement investigation of an incident by 
potentially making an attacker aware of the attack's detection.\802\ It 
could also make other threat actors aware of vulnerabilities in a 
covered institution's systems, which they could then try to exploit. 
The final amendments allow a covered institution to delay notification 
of customers if the Attorney General determines that the notice 
required poses a substantial risk to national security or public safety 
and notifies the Commission of such determination in writing.\803\ The 
main benefit of this delay is to decrease the likelihood of the 
potential situations described above where law enforcement is hindered. 
The delay might, in some cases, lead to a better protection of national 
security and public safety. Another benefit of the delay is that it 
might give covered institutions more time to assess the scope of the 
incident and gather the information to be included in the notice to 
customers in particularly complex cases. However, the delay provisions 
might also, in some cases, result in customers being notified later, 
which

[[Page 47758]]

would decrease the benefits of such notification, as described 
above.\804\ Where investigations do not rise to the level of meeting 
the prescribed conditions for delayed notification, customer 
notification could alert attackers that their intrusion has been 
detected and could potentially impact law enforcement's investigation.
---------------------------------------------------------------------------

    \802\ The attacker could then work to remove evidence on the 
covered institution's systems, thereby making the identity of the 
attacker harder to uncover by law enforcement.
    \803\ See final rule 248.30(a)(4)(iii).
    \804\ See supra text following footnote 783.
---------------------------------------------------------------------------

    Because we do not have data on the frequency with which an 
investigation will rise to the level of meeting the final amendments' 
conditions for delayed notification, and because we do not have data on 
the scope of the effect on national security or public safety of 
breaches being revealed to the attackers, nor did commenters identify 
such data, we are unable to precisely estimate the costs and benefits 
of this provision. However, we expect that such events will be 
relatively rare.\805\
---------------------------------------------------------------------------

    \805\ See SIFMA comment letter 2 (``The Commission should be 
aware that under present practice and experience, the number of 
cases where delay is requested or mandated by other government 
entities, or court orders, is quite limited--so the SEC need not 
assume or fear that notification delays would become routine or be 
otherwise abused.''). In addition, the State of California requires 
that, if a notice sent to individuals affected by a breach was 
delayed at the request of law enforcement agency, the notice mention 
such delay. See Cal. Civil Code section 1798.82. Of the 456 notices 
reported in 2022, only 4 indicated that they were delayed at the 
request of law enforcement. See supra footnote 777 for a description 
of these data. Because the final amendments' conditions for a 
notification delay are stricter than those under California law, we 
expect that the frequency at which covered institutions will delay 
notifications for national security and public safety reasons will 
be even lower.
---------------------------------------------------------------------------

(3) Broader Scope of Information Triggering Notification
    In the final amendments, ``sensitive customer information'' is 
defined more broadly than in most State laws, yielding a customer 
notification trigger that is broader in scope than the various State 
law notification triggers included under the baseline.\806\ The broader 
scope of information triggering the notice requirements will cover more 
data breaches impacting customers than the notice requirements under 
the baseline. This broader scope might benefit customers who will be 
made aware of more cases where their information has been compromised. 
At the same time, the broader scope might lead to false alarms--cases 
where the ``sensitive customer information'' divulged does not 
ultimately harm the customer. Such false alarms might be problematic if 
they reduce customers' responsiveness to data breach notices. In 
addition, the scope will also likely imply additional costs for covered 
institutions, which may need to adapt their processes for safeguarding 
information to encompass a broader range of customer information and 
may need to issue additional notices.\807\
---------------------------------------------------------------------------

    \806\ See final rule 248.30(d)(9) and supra section IV.C.2.a(1).
    \807\ Estimates of certain costs related to notice issuance are 
discussed in section V.
---------------------------------------------------------------------------

    In the final amendments, ``sensitive customer information'' is 
defined as ``any component of customer information alone or in 
conjunction with any other information, the compromise of which could 
create a reasonably likely risk of substantial harm or inconvenience to 
an individual identified with the information.'' \808\ The definition's 
basis in ``any component of customer information'' creates a broader 
scope than under State notification laws. In addition to identification 
numbers, PINs, and passwords, many other pieces of nonpublic 
information have the potential to satisfy this standard. For example, 
many financial institutions have processes for establishing identity 
that require the user to provide a number of pieces of information 
that--on their own--are not especially sensitive (e.g., mother's maiden 
name, name of a first pet, make and model of first car), but which--
together--could allow access to a customer's account. The compromise of 
some subset of such information will thus potentially require a covered 
institution to notify customers under the final amendments.
---------------------------------------------------------------------------

    \808\ Final rule 248.30(d)(9).
---------------------------------------------------------------------------

    The definitions of information triggering notice requirements under 
State laws are generally much more circumscribed and can be said to 
fall into one of two types: basic and enhanced. Basic definitions are 
used by 14 States, which account for 21 percent of the U.S. 
population.\809\ In these States, only the compromise of a customer's 
name together with one or more enumerated pieces of information 
triggers the notice requirement. Typically, the enumerated information 
is limited to Social Security number, a driver's license number, or a 
financial account number combined with an access code. For the 
estimated 15 million potential customers residing in these States,\810\ 
a covered institution's compromise of the customer's account login and 
password would not necessarily result in a notice, nor would a 
compromise of his credit card number and PIN.\811\ Such compromises 
could nonetheless lead to substantial harm or inconvenience. Thus, the 
final amendments will significantly enhance the notification 
requirements applicable to these customers.
---------------------------------------------------------------------------

    \809\ See supra section IV.C.2.a(1).
    \810\ See supra footnote 767.
    \811\ See supra text accompanying footnote 532.
---------------------------------------------------------------------------

    States adopting enhanced definitions for information triggering 
notice requirements extend the basic definition to include username/
password and username/security question combinations.\812\ These 
definitions may also include additional enumerated items whose 
compromise (when linked with the customer's name) can trigger the 
notice requirement (e.g., biometric data, tax identification number, 
and passport number).\813\ For the estimated 55 million potential 
customers residing in the States with enhanced definitions,\814\ the 
benefits from the final amendments will be somewhat more limited. 
However, even for these customers, the amendments will tighten the 
effective notification requirement. There are many pieces of 
information not covered by the enhanced definitions whose compromise 
might potentially lead to substantial harm or inconvenience. For 
example, under California law, the compromise of information such as a 
customer's email address in combination with a security question and 
answer would only trigger the notice requirement if that information 
would--in itself--permit access to an online account. Under many such 
State laws, the compromise of information such as a customer's name, 
combined with his or her transaction history, account balance, or other 
information not specifically enumerated would not necessarily trigger 
the notice requirement.
---------------------------------------------------------------------------

    \812\ See supra section IV.C.2.a(1).
    \813\ See id.
    \814\ See supra footnote 767.
---------------------------------------------------------------------------

    The broader scope of information triggering a notice requirement 
under the final amendments will benefit customers. As discussed above, 
many pieces of information not covered under State data breach laws 
could, when compromised, cause substantial harm or inconvenience. Under 
the amendments, data breaches involving such information might require 
customer notification in cases where State law does not, and thus 
potentially increase customers' ability to take actions to mitigate the 
effects of such breaches. At the same time, there is some risk that the 
broader minimum standard will lead to notifications resulting from data 
compromises that--while troubling--are ultimately less likely to cause 
substantial harm or inconvenience.\815\ A

[[Page 47759]]

large number of such unnecessary notices might undermine the 
effectiveness of the notice regime.\816\
---------------------------------------------------------------------------

    \815\ This may be the case even though the amendments include an 
exception from notification when the covered institution determines, 
after investigation, that the sensitive customer information has not 
been, and is not reasonably likely to be, used in a manner that 
would result in substantial harm or inconvenience. For example, the 
covered institution could decide to forgo investigations and always 
notify, or it could investigate but not reach a conclusion that 
satisfied the terms of the exception.
    \816\ See infra section IV.D.1.b(4) for a discussion of the 
effects of notification specifically.
---------------------------------------------------------------------------

    The broader minimum standard for notification is likely to result 
in higher costs for covered institutions. There will be increased 
administrative costs related to preparing and distributing notices for 
covered institutions who will send out additional notices as a result 
of the scope of information triggering a notice requirement under the 
final amendments. As discussed below, we estimate that certain costs 
associated with the preparation and distribution of notices will be, on 
average, $5,178 per year per covered institution.\817\
---------------------------------------------------------------------------

    \817\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $3,862 per year per covered 
institution. See infra section V.
---------------------------------------------------------------------------

    In addition, it is possible that covered institutions have 
developed processes and systems designed to provide enhanced 
information safeguards for the specific types of information enumerated 
in the various State laws. For example, it is likely that IT systems 
deployed by financial institutions only retain information such as 
passwords or answers to security questions in hashed form, reducing the 
potential for such information to be compromised. Similarly, it is 
likely that such systems limit access to information such as Social 
Security numbers to a limited set of employees. It may be costly for 
covered institutions to upgrade these systems to expand the scope of 
enhanced information safeguards.\818\ In some cases, it may be 
impractical to expand the scope of such systems. For example, while it 
may be feasible for covered institutions to strictly limit access to 
Social Security numbers, passwords, or answers to secret questions, it 
may not be feasible to apply such limits to account numbers, 
transaction histories, account balances, related accounts, or other 
potentially sensitive customer information. In these cases, the adopted 
minimum standard might not have a significant prophylactic effect and 
might lead to an increase in reputation and litigation costs for 
covered institutions resulting from more frequent breach notifications.
---------------------------------------------------------------------------

    \818\ We lack data, and no commenter suggested such data, that 
would allow us to quantify the indirect costs resulting from any 
potential upgrade to customer information safeguards that covered 
institutions could choose to implement as a result of the final 
amendments in order to avoid potential reputational costs associated 
with customer notification following a breach.
---------------------------------------------------------------------------

    Furthermore, because the definition of sensitive customer 
information is based on a determination that the compromise of this 
information could create a ``reasonably likely risk of substantial harm 
or inconvenience to an individual identified with the information,'' 
\819\ it could increase costs related to incident evaluation, outside 
legal services, and litigation risk. While we lack data, and no 
commenter suggested such data, that would allow us to quantify all of 
these costs, we discuss below certain costs associated with developing 
and implementing policies and procedures to comply with the final 
amendments, including costs for internal and external counsel.\820\ 
This subjectivity could reduce consistency in the propensity of covered 
institutions to provide notice to customers, reducing the utility of 
such notices in customers' inferences about covered institutions' 
safeguarding efforts.
---------------------------------------------------------------------------

    \819\ Final rule 248.30(d)(9). See supra section II.A.3.c; infra 
section IV.D.1.b(4).
    \820\ See infra section V.
---------------------------------------------------------------------------

    Some commenters opposed the proposed amendments' definition of 
sensitive customer information, suggesting either a better alignment 
with existing regulation,\821\ or that the final amendments specify a 
list of customer information included in the definition.\822\ Covered 
institutions will have to devote some resources determining what 
specific pieces of information are included in the scope of the final 
notification requirements. However, different types of covered 
institutions may keep different types of customer information, the 
information collected by covered institutions might change in the 
future, and the type of information that could create a reasonably 
likely risk of substantial harm or inconvenience to an individual might 
also change in the future. Thus, having a wide and general range of 
sensitive customer information trigger the amendments' notice 
requirement will provide benefits to the affected customers, who may 
not receive a notice under the baseline. In addition, as discussed 
above, existing regulations adopt widely different definitions of 
customer information triggering a breach notification, making alignment 
difficult.\823\
---------------------------------------------------------------------------

    \821\ See Computershare Comment Letter; ICI Comment Letter 1; 
SIFMA Comment Letter 2.
    \822\ See CAI Comment Letter; SIFMA Comment Letter 2.
    \823\ See supra section IV.C.2.a(1).
---------------------------------------------------------------------------

(4) Notification Trigger
    The final amendments include a requirement for a covered 
institution to provide notice to individuals whose sensitive customer 
information was, or is reasonably likely to have been, accessed or used 
without authorization, unless, after a reasonable investigation of the 
facts and circumstances of the incident of unauthorized access to or 
use of sensitive customer information, the covered institution has 
determined that sensitive customer information has not been, and is not 
reasonably likely to be, used in a manner that would result in 
substantial harm or inconvenience.\824\ As discussed above, the final 
amendments reflect a presumption of notification: a covered institution 
must provide a notice unless it determines notification is not required 
following a reasonable investigation.\825\ Moreover, if the covered 
institution is unable to determine which customers are affected by a 
data breach, a notice to all potentially affected customers is 
required.\826\ The resulting presumptions of notification are important 
because although it is usually possible to determine what information 
could have been compromised in a data breach, it is often not possible 
to determine what information was compromised or to estimate the 
potential for such information to be used in a way that is likely to 
cause harm.\827\ Because of this, it may not be feasible to establish 
the likelihood of sensitive customer information being used in a manner 
that would result in substantial harm or inconvenience or of sensitive 
customer information pertaining to a specific individual being accessed 
or used without authorization. Consequently, in the absence of the 
presumptions of notification, it may be possible for covered 
institutions to avoid notifying customers in cases where it is unclear 
what information was compromised or whether sensitive customer 
information was or is reasonably likely to be used in

[[Page 47760]]

a manner that would result in substantial harm or inconvenience.
---------------------------------------------------------------------------

    \824\ See final rule 248.30(a)(4)(i).
    \825\ See supra section II.A.3. A covered institution's 
determination that there is no risk of harm or inconvenience may 
also take into consideration whether the compromised data was 
encrypted. See supra section II.A.3.b. We expect that this could 
mitigate the risk of unnecessary notification. We considered a safe 
harbor from the definition of sensitive customer information for 
encrypted information. See infra section IV.F.3.
    \826\ See final rule 248.30(a)(4)(ii); see also supra section 
II.A.3.a.
    \827\ Many covered institutions, especially smaller investment 
advisers and broker-dealers, are unlikely to have elaborate software 
for logging and auditing data access. For such entities, it may be 
impossible to determine what specific information was exfiltrated 
during a data breach.
---------------------------------------------------------------------------

    Currently, 20 States' notification laws do not include a 
presumption of notification.\828\ We do not have data with which to 
estimate reliably the effect of these presumptions on the propensity of 
covered institutions to issue customer notifications, and no commenter 
suggested such data. However, we expect that for the estimated 20 
million potential customers residing in the 20 States without a 
presumption of notification,\829\ some notifications that will be 
required under the final amendments would not occur under the baseline. 
Thus, we anticipate that the final amendments will improve these 
customers' ability to take actions to mitigate the effects of data 
breaches. In addition, the final amendments' presumptions for 
notification rest on a concept of ``substantial harm or inconvenience'' 
that is likely to be wider than the equivalent concept of ``harm'' used 
in some State laws.\830\ Hence, we also expect that the presumptions of 
notification will have potential benefits even for the customers 
residing in some of the States with a presumption of notification.
---------------------------------------------------------------------------

    \828\ See supra section IV.C.2.a(1).
    \829\ See id.; see also supra footnote 767.
    \830\ See supra section II.A.3.c for a discussion of the concept 
of ``substantial harm or inconvenience.'' Some states use a narrower 
definition of harm, for example including only fraud or financial 
harm. See supra section IV.C.2.a(1); see also Fla. Stat. section 
501.171(4)(c) and Iowa Code section 715C.2(6) for examples of States 
with a presumption for notification but a narrower concept of harm.
---------------------------------------------------------------------------

    The increased sensitivity of the notification trigger resulting 
from the presumptions of notification will result in additional costs 
for covered institutions, who will bear higher reputational costs 
(including indirect costs of customer information protection 
improvements that may be undertaken to avoid such reputational costs) 
as well as some additional direct compliance costs (e.g., mailing 
notices, responding to customer questions, etc.) due to more breaches 
requiring customer notification. While we are unable to quantify all of 
these additional costs,\831\ we estimate that certain costs associated 
with the preparation and distribution of notices will be, on average, 
$5,178 per year per covered institution.\832\
---------------------------------------------------------------------------

    \831\ As stated above, we do not have data with which to 
estimate reliably the effect of these presumptions on the propensity 
of covered institutions to issue customer notifications, and no 
commenter suggested such data. In addition, as stated above, we lack 
data, and no commenter suggested such data, that would allow us to 
quantify the indirect economic costs, such as reputational cost of 
any potential increase in the frequency of customer notification. 
See supra section IV.D.1.a.
    \832\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $3,862 per year per covered 
institution. See infra section V.
---------------------------------------------------------------------------

    Some commenters disagreed with the proposed requirement that if a 
covered institution were unable to determine which customers were 
affected by a data breach, it would have had to notify all individuals 
whose sensitive customer information resided in the customer 
information system that was, or was reasonably likely to have been, 
accessed or used without authorization.\833\ One commenter stated that 
this would result in significant over-notification of individuals, and 
that this would unnecessarily disturb and frighten individuals who 
likely were not affected.\834\ The commenter also stated that the 
proposed requirements would significantly increase costs and litigation 
risk for covered institutions and possibly their service providers and 
other financial institutions whose information resides on the 
system.\835\ Another commenter stated that this proposed provision 
would create reputational risks for transfer agents and that it 
believed resources would be better spent investigating the incident and 
determining the impacted securityholders.\836\ Another commenter stated 
that this proposed requirement would be unnecessarily burdensome for 
covered institutions and that it could have negative consequences for 
clients, noting that there would be a risk that too much information 
could be overwhelming and lead to desensitization.\837\
---------------------------------------------------------------------------

    \833\ See, e.g., CAI Comment Letter; IAA Comment Letter 1.
    \834\ See CAI Comment Letter.
    \835\ See CAI Comment Letter.
    \836\ See Computershare Comment Letter.
    \837\ See IAA Comment Letter 1.
---------------------------------------------------------------------------

    Another commenter disagreed with the proposed requirement that a 
covered institution would have had to notify customers whose 
information was compromised unless the covered institution could 
determine that the event would not result in a risk of substantial harm 
or inconvenience for these individuals, suggesting instead that the 
standard be harmonized further with the Banking Agencies' Incident 
Response Guidance and with many State laws so as to require 
notification only if the covered institution affirmatively could find 
risk of harm.\838\ This commenter stated that the proposed presumption 
of notification could lead to excessive and unnecessary notifications 
to consumers where a low likelihood of harm were present, which could 
result in consumers spending time and effort needlessly monitoring 
accounts or taking actions such as instituting a credit freeze, and 
simultaneously desensitize consumers to a notification for an actual 
breach where significant harm could result.\839\
---------------------------------------------------------------------------

    \838\ See SIFMA Comment Letter 2.
    \839\ See SIFMA Comment Letter 2.
---------------------------------------------------------------------------

    After considering these comments, we have determined that the 
presumptions of notification should be included in the final 
amendments. On the one hand, we acknowledge, as commenters stated,\840\ 
that unnecessary notifications could occur and negatively affect 
covered institutions and their customers as a result of these 
presumptions. Unnecessary notifications will result in costs for 
covered institutions, including the costs associated with notification 
such as administrative costs related to preparing and distributing 
notices as well as reputational costs, litigation risk, or diversion of 
resources identified by commenters.\841\ More broadly, as stated by 
commenters,\842\ unnecessary notification could reduce customers' 
responsiveness to data breach notices, for example by decreasing 
customers' ability to discern which notices require action. Unnecessary 
notification could also desensitize customers to notices, thereby 
leading to a decrease in the reputational costs of notification. This 
could decrease covered institutions' incentives to invest in customer 
information safeguards in order to avoid such reputational costs.\843\ 
However, the risks of unnecessary notification reducing the benefits of 
the rule are mitigated by the fact that notification is not required in 
cases where the covered institution can determine, after a reasonable 
investigation, that there is no risk of substantial harm or 
inconvenience for the customers whose information has been compromised. 
In addition, in a change from the proposal, the final amendments 
explicitly provide that a covered institution need not provide notice 
to an individual whose sensitive customer information resides in the 
customer information system that was, or was reasonably likely to have 
been, accessed or used without authorization if the covered institution 
reasonably determines that this individual's sensitive customer

[[Page 47761]]

information was not accessed or used without authorization.\844\
---------------------------------------------------------------------------

    \840\ See supra footnotes 834-840 and accompanying text.
    \841\ Id.
    \842\ See IAA Comment Letter 1; SIFMA Comment Letter 2.
    \843\ Estimates of certain costs related to notice issuance are 
discussed above. See supra footnote 833 and accompanying text.
    \844\ See final rule 248.30(a)(4)(ii).
---------------------------------------------------------------------------

    On the other hand, adopting these presumptions of notification will 
allow potentially affected customers to take appropriate mitigating 
actions. In support of the proposed presumption of notification, 
another commenter stated that any risk that a presumption to notify 
individuals could lead to a volume of notices that would inure affected 
individuals to the notices and result in their not taking proactive 
action would be outweighed by the risk that individuals would not be 
notified at all and would not have the opportunity to decide for 
themselves whether to take action.\845\ To support this statement, this 
commenter referenced a study stating that requiring a determination of 
misuse to trigger disclosure permits additional discretion to the 
breached entity which, coupled with the existence of a disclosure 
disincentive,\846\ might bias an institution's investigation of a data 
leak and might lead to a conclusion that consumer notification was not 
required.\847\ We agree with this commenter. In addition, as discussed 
above, allowing covered institutions to conduct a full investigation 
before determining whether customers need to be notified could 
significantly reduce the benefits of such notification, and thus of the 
final amendments, by delaying the notice.\848\
---------------------------------------------------------------------------

    \845\ See Better Markets Comment Letter.
    \846\ See supra section IV.B.
    \847\ See Better Markets Comment Letter, citing Paul M. Schwartz 
and Edward J. Janger, Notification of Data Security Breaches, 105 
Mich. L. Rev. 913, 939 (2007). In addition, a report cited by the 
same commenter discusses the frequency of notification and how it 
relates to specific notification trigger. The report links higher 
frequency of notification to a requirement that a government 
official participate in the determination that a data breach creates 
risk for the affected parties, and therefore that notification is 
required. See IRTC Data Breach Annual Report; see also supra 
footnote 518 and accompanying text.
    \848\ See supra section II.A.3.a; see also supra section 
IV.D.1.b(2) for a discussion of the benefits of timely notification.
---------------------------------------------------------------------------

(5) Content and Method of Notice
    The proposed amendments included a list of information that would 
have had to be included in a customer notice.\849\ Many of these 
content requirements remain in the final amendments.\850\ While some 
commenters agreed generally with the proposed notice content 
requirements,\851\ other commenters disagreed with the proposed 
inclusion of some elements and stated that our analysis of these 
requirements in the Proposing Release was insufficient.\852\ In 
response to these commenters, we conducted supplemental analysis of the 
frequency at which different items are required in existing State laws, 
and are including a supplemental analysis of the costs and benefits of 
each of the required elements vis-[agrave]-vis this baseline.\853\
---------------------------------------------------------------------------

    \849\ See proposed rule 248.30(b)(4)(iv).
    \850\ See final rule 248.30(a)(4)(iv).
    \851\ See, e.g., Better Markets Comment Letter.
    \852\ See, e.g., CAI Comment Letter.
    \853\ See supra section IV.C.2.a(2).
---------------------------------------------------------------------------

    The main benefit of requiring specific content to be included in 
the notice is to help ensure that customers residing in different 
States receive similar information when their information is 
compromised in the same breach. Because State law requirements differ 
in terms of required content, covered institutions may send different 
notices to different individuals.\854\ The final amendments will help 
ensure that all customers receive a minimum of information regarding a 
given breach affecting their information and are therefore equally able 
to take appropriate mitigating actions.
---------------------------------------------------------------------------

    \854\ See ICI Comment Letter 1 (``In discussing breach notices 
with our members, we understand it is not uncommon for their current 
breach response programs to include separate notification letters 
depending upon the state the individual resides in.'').
---------------------------------------------------------------------------

    The final amendments provide that the notice must include a 
description of the incident, including the information that was 
breached and the approximate date at which it occurred, as well as 
contact information where customers can inquire about the incident. In 
addition, the notice must include information on recommended actions 
affected customers can take. We expect that these required items will 
help customers take appropriate mitigating action to protect themselves 
from further effect of the breach. Including these elements might 
require some covered institutions to modify their existing processes 
for notification, which will incur some costs.\855\ We expect that 
these costs will be passed on to customers.
---------------------------------------------------------------------------

    \855\ These costs are included in the policies and procedures 
costs discussed in section IV.D.1 above. As discussed below, we 
estimate that certain costs associated with developing and 
implementing policies and procedures to comply with the final 
amendments will be, on average, $15,445 per year per covered 
institution. This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $5,425 per year per covered 
institution. See infra section V.
---------------------------------------------------------------------------

    The first required item is a general description of the incident 
and the type of sensitive customer information that was or is 
reasonably believed to have been accessed or used without 
authorization.\856\ We received no comment on this specific 
requirement. Obtaining this information is crucial for customers as it 
will allow them to assess the level of risk and to take appropriate 
mitigating actions. This will also allow them to avoid spending time 
and resources on mitigating actions related to information that was not 
affected by the breach. We expect that most covered institutions who 
already have notification processes already include this information, 
since 22 States require that the notice describe the type of 
information affected by the breach and 13 States require a description 
of the incident to be included.\857\ As a result, we expect that the 
benefits will be the greatest for customers of institutions who do not 
operate nationally and operate only in States without such 
requirements. We estimate that there are approximately 51 million 
potential customers residing in the 38 States that do not require a 
description of the incident, and 35 million potential customers 
residing in the 29 States that do not require the type of customer 
information compromised to be included in the notice.\858\ We expect 
the costs to be the highest for the covered institutions operating only 
in those States.
---------------------------------------------------------------------------

    \856\ See final rule 248.30(a)(4)(iv)(A).
    \857\ See supra section IV.C.2.a(2).
    \858\ See supra footnote 767.
---------------------------------------------------------------------------

    The second item required by the final amendments is the date of the 
incident, the estimated date of the incident, or the date range within 
which the incident occurred, if the information is reasonably possible 
to determine at the time the notice is provided.\859\ One commenter 
disagreed with this proposed requirement, stating that it would imply 
that covered institutions subject to both Regulation S-P and the 
Banking Agencies' Incident Response Guidance would have to revise their 
long-standing breach notices to add the information.\860\ This 
commenter also stated that the Proposing Release did not detail a basis 
for this inclusion. Including the date of the breach, even if it is the 
approximate date, will provide useful information to the affected 
customers and help them make better decisions about the mitigating 
actions to take. In particular, customers could review their account 
statements back to the date where the breach happened.\861\ An 
additional benefit of this inclusion will be to provide information to 
customers about how effectively a

[[Page 47762]]

covered institution was able to detect and assess a breach. This will 
help reduce the information asymmetry about a covered institution's 
customer information safeguards and help customers be better informed 
when deciding which covered institutions to retain for their financial 
services needs.
---------------------------------------------------------------------------

    \859\ See final rule 248.30(a)(4)(iv)(B).
    \860\ See ICI Comment Letter 1.
    \861\ See supra footnote 210 and accompanying text.
---------------------------------------------------------------------------

    There are 13 States requiring the notice to include an approximate 
date (or date range) for the breach, and 38 States without such a 
requirement.\862\ These 38 States account for 70 percent of the U.S. 
population and 49 million estimated potential customers.\863\ For these 
customers, the final amendments might result in their receiving 
information they would not have otherwise received. Because 13 States 
already require that the notice include an approximate date, we expect 
that the costs will be minimal for the covered institutions that 
operate nationally. For the covered institutions that do not operate 
nationally, the final amendments might require them to adapt their 
procedures to include additional information in the notices to 
customers.
---------------------------------------------------------------------------

    \862\ See supra section IV.C.2.a(2).
    \863\ See supra footnote 767.
---------------------------------------------------------------------------

    The third item required by the final amendments is ``contact 
information sufficient to permit an affected individual to contact the 
covered institution to inquire about the incident, including the 
following: a telephone number (which should be a toll-free number if 
available), an email address or equivalent method or means, a postal 
address, and the name of a specific office to contact for further 
information and assistance.'' \864\ One commenter disagreed with this 
proposed requirement, stating that it was unclear what purpose or 
benefit this requirement would have for the affected individuals and 
adding that it would place significant burdens on the internal 
operations of the covered institution.\865\ Another commenter also 
disagreed with this proposed requirement, stating that covered 
institutions should have flexibility in determining the contact 
information to provide, based on how they normally interact with their 
customers, and suggesting that the final amendments only require one of 
the listed contact methods.\866\ The requirement to include multiple 
contact methods provides valuable options for affected customers, who 
may have differing preferences and aptitudes in their use of contact 
methods.\867\ We do not expect that this requirement will overly burden 
covered institutions, even for those institutions that will need to 
adapt their processes to the new requirements.\868\ In addition, 
nothing in this requirement prevents a covered institution from 
providing additional contact methods.
---------------------------------------------------------------------------

    \864\ Final rule 248.30(a)(4)(iv)(C).
    \865\ See CAI Comment Letter.
    \866\ See SIFMA Comment Letter 2.
    \867\ In addition, the final amendments will not preclude a 
covered institution from providing the contact information of a 
third-party service provider. See supra footnote 211.
    \868\ Ten States require the notice to include a phone number as 
contact information while two States require the notice to include a 
physical address. See supra section IV.C.2.a(2).
---------------------------------------------------------------------------

    The final amendments also require the notice to include a 
recommendation that the customer review account statements and 
immediately report suspicious activity to the covered institution (if 
the individual has an account with the covered institution); an 
explanation of what a fraud alert is and how an individual may place 
one; a recommendation that the individual periodically obtain credit 
reports; an explanation of how the individual may obtain a credit 
report free of charge; and information about the availability of online 
guidance from the FTC and usa.gov regarding steps an individual can 
take to protect against identity theft, a statement encouraging the 
individual to report any incidents of identity theft to the FTC, and 
the FTC's website address.\869\ One commenter supported these proposed 
requirements, stating that the proposed notice requirements avoided 
common problems with the content of many data breach notifications, 
such as confusing language, a lack of details, and insufficient 
attention to the practical steps customers should take in 
response.\870\ We expect that these additional elements will provide 
useful information to affected customers regarding potential mitigating 
actions to take and help ensure that these customers are able to react 
appropriately to the notice. We expect that while these requirements 
will impose costs on covered institutions whose notification process 
does not already include these elements,\871\ these costs will be 
limited and passed on to the customers.\872\ We received no comments 
opposing these requirements.
---------------------------------------------------------------------------

    \869\ See final rule 248.30(a)(4)(iv)(D) through (H).
    \870\ See Better Markets Comment Letter.
    \871\ Because some States require some of these elements to be 
included in the notification to affected individuals, we expect that 
many covered institutions already have procedures similar to those 
required by the final amendments. See supra section IV.C.2.a(2).
    \872\ As discussed above, these costs will represent only a 
fraction of the policies and procedures costs discussed in section 
IV.D.1 above. See supra footnote 856 and accompanying text.
---------------------------------------------------------------------------

    The proposed amendments included a provision that would have 
required the notice to include a description of what has been done by 
the covered institution to protect the sensitive customer information 
from further unauthorized access or use. One commenter disagreed with 
this proposed requirement, stating that it ``would be extremely useful 
to threat actors and not particularly useful to clients.'' \873\ After 
considering this comment, we have decided to exclude this provision 
from the final amendments.\874\ In addition to reducing the perceived 
risk of providing a roadmap for threat actors, we expect that this 
change will accelerate the process of preparing the notice, thereby 
reducing the associated costs.
---------------------------------------------------------------------------

    \873\ See IAA Comment Letter 1.
    \874\ See supra section II.A.3.e.
---------------------------------------------------------------------------

    The final amendments require that notice must be transmitted by a 
means designed to ensure that each affected individual can reasonably 
be expected to receive actual notice in writing.\875\ Some commenters 
discussed the alignment between the requirements of the final 
amendments and those of existing regulation affecting covered 
institutions. In particular, one commenter stated that a Federal 
notification requirement would complicate compliance efforts for 
covered institutions already complying with similar State laws.\876\ On 
the other hand, another commenter stated that the proposed amendments' 
alignment with existing requirements would allow covered institutions 
to leverage existing programs.\877\ We analyze here the expected 
benefits and costs of this provision of the final amendments vis-
[agrave]-vis the baseline.\878\
---------------------------------------------------------------------------

    \875\ See final rule 248.30(a)(4)(i). Under the final 
amendments, the notice can be sent electronically. See supra 
footnote 200 and accompanying text.
    \876\ See CAI Comment Letter.
    \877\ See FSI Comment Letter.
    \878\ See supra section IV.C.2.a(2).
---------------------------------------------------------------------------

    We expect that the main benefit of this provision will be to help 
ensure that customers whose sensitive personal information has been 
breached receive the required information. We expect that the costs of 
this provision will be limited for most covered institutions since most 
States require similar methods of notification.\879\ Hence, we expect 
that most covered institutions will not have to significantly modify 
their procedures and processes for notice issuance in order to satisfy 
this provision of the final amendments.
---------------------------------------------------------------------------

    \879\ See id.
---------------------------------------------------------------------------

    However, we do expect some benefits in some instances. First, 26 
States allow

[[Page 47763]]

a notice to be made over the telephone.\880\ While 7 of these States 
require direct contact with the affected individuals when the notice is 
given using this method, 19 do not have such requirements.\881\ We 
expect that for the 21 million potential customers residing in the 19 
States allowing for telephonic notices but without such 
requirements,\882\ receiving a written notice may result in clearer 
information and in a higher likelihood of taking appropriate mitigating 
actions.
---------------------------------------------------------------------------

    \880\ See id.
    \881\ See supra footnote 568 and accompanying text.
    \882\ See supra footnote 767.
---------------------------------------------------------------------------

    Second, many States allow for electronic notifications. While most 
of these States require that this be done only under certain conditions 
that are similar to the final amendments' conditions, some States have 
conditions that are significantly looser. The final amendments provide 
that the notice can be provided through electronic means to customers 
who have agreed to receive information electronically.\883\ In 
contrast, five States allow electronic notification without 
restriction, and two States require only that the institution has an 
email address for the affected individuals.\884\ We expect that for the 
11 million potential customers residing in these seven States \885\--
that allow electronic notification even to customers who have not 
explicitly agreed to receiving electronic notification--the final 
amendments will help ensure that they receive a notice in a format that 
they are expecting.\886\
---------------------------------------------------------------------------

    \883\ See supra footnote 200 and accompanying text.
    \884\ See supra footnotes 565 and 566 and accompanying text.
    \885\ See supra footnote 767.
    \886\ We acknowledge that the final amendments may result in 
some customers receiving a notice in a format that they do not 
prefer. For example, customers could agree to an electronic notice 
but still receive a notice by mail, which they may be less likely to 
see or respond to.
---------------------------------------------------------------------------

    Third, all States allow for a substitute notice under certain 
conditions.\887\ Substitute notification requirements vary across 
States but must generally include an email notification to affected 
individuals, a notice on the entity's website, and notification to 
major statewide media.\888\ The final amendments do not provide for 
such substitute notice and instead have the same notice requirements in 
all cases. We expect that the final amendments will strengthen the 
benefits of notification by helping ensure that affected individuals 
are made aware of the relevant information regarding a breach of their 
sensitive information. Examples of customers who would benefit include 
customers who: interact infrequently with the covered institution, 
thereby not visiting the institution's website regularly; who do not 
consume local or State news sources; or who may be wary or skeptical of 
receiving such information by email if they have not given their prior 
informed consent (for example, customers who are used to receiving 
communications from the covered institution by mail only or who 
interact with the covered institution very rarely). In other States, 
the requirements for substitute notice include fewer elements.\889\ We 
expect that for the customers residing in these States, the final 
amendments will help ensure that they are made aware of the breach and 
provided an appropriate notice.
---------------------------------------------------------------------------

    \887\ These conditions often include a certain minimum number of 
affected individuals to notify and a minimum dollar cost to notify 
these individuals. See supra footnote 569 and accompanying text.
    \888\ See supra section IV.C.2.a(2).
    \889\ See supra footnote 571 and accompanying text.
---------------------------------------------------------------------------

    The final amendments require written notification, which may be 
provided electronically if certain conditions are met, such as if the 
customer has agreed to receive information electronically.\890\ Not all 
State notification provisions include similar consent conditions for 
electronic communication.\891\ Therefore, the final amendments may 
result in additional compliance costs in the instances where, prior to 
the final amendments, the covered institutions would have sent email 
notices or used substitute notification, but will instead have to 
obtain customer consent for electronic notification or else send 
individual notices by mail because their methods of electronic delivery 
are not consistent with existing Commission guidance on electronic 
delivery, for example if they have not obtained customer consent to 
receive electronic communications.\892\ However, given the variety of 
State law conditions and requirements, we expect that most notices 
being sent already satisfy many of these provisions and we therefore 
expect that these provisions will result in limited additional 
costs.\893\
---------------------------------------------------------------------------

    \890\ See supra section II.A.3.e. and footnote 200.
    \891\ See supra footnote 885 and accompanying text.
    \892\ Id. Because some States have conditions for sending an 
electronic notice that are different from those under the final 
amendments, we expect that there might be some cases where a covered 
institution will be required to send a notice by mail when it could 
have sent an electronic notice under State law. See supra footnotes 
884 through 888 and accompanying text.
    \893\ An analysis of the notices sent to residents of California 
and Washington suggests that notices are frequently sent by postal 
mail. Both States allow for electronic notification if the notice is 
consistent with the Electronic Signatures in Global and National 
Commerce Act (15 U.S.C. 7001). Nevertheless, we have found that in 
California, at least 90% of the notices appear to be sent by mail. 
The equivalent number is 89% for Washington. We identified the 
notices sent by mail (as opposed to those sent by email or 
satisfying other substitute notice requirements) as those including 
a redacted or mock recipient address, an address for a return mail 
processing center, or an explicit mention such as ``Via First-Class 
Mail.'' It is possible that notices containing none of these 
elements are sent by mail, and therefore we expect that the true 
percentages are likely to be higher than those reported here. See 
supra footnotes 777 and 782 and accompanying text for details on the 
notice data used for this analysis.
---------------------------------------------------------------------------

c. Service Provider Provisions
    The final amendments require that a covered institution's incident 
response program include the establishment, maintenance, and 
enforcement of written policies and procedures reasonably designed to 
require oversight, including through due diligence and monitoring, of 
service providers. Specifically, these written policies and procedures 
must be reasonably designed to ensure the service providers take 
appropriate measures to protect against unauthorized access to or use 
of customer information and provide notification to the covered 
institution as soon as possible, but no later than 72 hours after 
becoming aware that a breach in security has occurred resulting in 
unauthorized access to a customer information system. Upon receipt of 
such notification, a covered institution must initiate its incident 
response program.\894\ In the final amendments, ``service provider'' is 
defined as ``any person or entity that receives, maintains, processes, 
or otherwise is permitted access to customer information through its 
provision of services directly to a covered institution.'' \895\ Thus, 
the requirements might affect arrangements with a broad range of 
entities, including potentially email providers, customer relationship 
management systems, cloud applications, and other technology vendors.
---------------------------------------------------------------------------

    \894\ See final rule 248.30(a)(5)(i).
    \895\ Final rule 248.30(d)(10).
---------------------------------------------------------------------------

    As modern business processes increasingly rely on service 
providers,\896\ ensuring consistency in regulatory requirements 
increasingly requires consideration of the functions performed by 
service providers and how these functions interact with the regulatory 
regime.\897\ Ignoring such aspects could incentivize covered 
institutions to attempt to outsource functions to service providers to 
avoid the requirements that would apply if the

[[Page 47764]]

functions were performed in-house. Thus, the service provider 
requirements will strengthen the benefits of the final amendments by 
helping ensure that they have similar effects regardless of how a 
covered institution chooses to implement its business processes (i.e., 
whether those processes are implemented in-house or outsourced).
---------------------------------------------------------------------------

    \896\ See supra section IV.C.3.f
    \897\ See supra section IV.C.2.a(3).
---------------------------------------------------------------------------

    Commenters supported the proposal's objective to safeguard customer 
information in the case where this information rests with service 
providers.\898\ One commenter stated that third-party service providers 
were specifically a favored attack vector, adding that the Commission's 
attention to this risk was well-directed.\899\ Another commenter stated 
that it did not disagree that service providers should protect 
sensitive customer information and be required to provide timely 
notification of a breach to the covered institution.\900\ Another 
commenter stated that service providers that have access to customer 
information should be contractually required to take appropriate risk-
based measures and diligence designed to protect against unauthorized 
access to or use of customer information, including notification of a 
covered institution in the event of certain types of breaches in 
security.\901\ Another commenter recognized and supported the 
importance of covered institutions having appropriate policies and 
procedures to manage the cybersecurity and privacy risks posed by 
service providers that process their customer information.\902\
---------------------------------------------------------------------------

    \898\ See, e.g., EPIC Comment Letter; SIFMA Comment Letter 2.
    \899\ See EPIC Comment Letter.
    \900\ See IAA Comment Letter 1.
    \901\ See SIFMA Comment Letter 2.
    \902\ See CAI Comment Letter.
---------------------------------------------------------------------------

    Some commenters criticized the analysis of the proposed service 
provider provisions.\903\ One commenter stated, referring to the 
proposed service provider written agreement obligation, that the 
Commission had failed to address the costs in any meaningful way and 
was thus dismissive of them.\904\ Another commenter stated that the 
Proposing Release included no discussion or estimate of the costs that 
renegotiating contracts with service providers or hiring new service 
providers would impose on brokers.\905\ In addition, some commenters 
disagreed with our analysis of specific parts of the requirements, 
stating that the analysis in the Proposing Release did not identify why 
a 48-hour reporting period was optimal,\906\ or stating that the 
breadth of the definition of service providers was disproportionate to 
the benefits and risks presented.\907\ In response to these commenters, 
we have modified this aspect of the amendments, as discussed in greater 
detail above.\908\ These modifications mitigate, but may not eliminate 
entirely, commenters' concerns regarding the costs associated with the 
service provider provisions of the proposed amendments. We also have 
supplemented the economic analysis of the service provider provisions 
in response to comments as follows. First, we have supplemented the 
analysis of the potential costs to covered institutions. This includes 
an analysis of the indirect effects of the final amendments on covered 
institutions' service providers, and how these effects may affect 
covered institutions and their customers,\909\ for example where costs 
to service providers are passed on to covered institutions, and 
ultimately to covered institutions' customers,\910\ or have negative 
competitive effects that impact covered institutions.\911\ Second, we 
are providing supplemental analysis specifically on the timeline 
requirement and the definition of service providers.\912\
---------------------------------------------------------------------------

    \903\ See, e.g., IAA Comment Letter 1; ASA Comment Letter.
    \904\ See IAA Comment Letter 1.
    \905\ See ASA Comment Letter. In the Proposing Release, we 
requested data that could help us quantify the costs and benefits 
that we were unable to quantify. We did not receive data or 
estimates from commenters that could help us quantify the costs of 
renegotiating contracts or hiring new service providers. See 
Proposing Release at section III.G, question 110.
    \906\ See Microsoft Comment Letter.
    \907\ See IAA Comment Letter 1 (``We believe the proposed 
definition of Service Provider is unrealistically and unnecessarily 
broad, reaching service providers where there are little or no 
marginal benefits to their inclusion and the costs (time, money, 
personnel, etc.) to advisers would be substantial.'').
    \908\ See supra section II.A.4.
    \909\ See infra footnotes 928-936 and accompanying text.
    \910\ See infra text accompanying footnote 933.
    \911\ See infra section IV.E.
    \912\ Additional context for this analysis is provided in 
section IV.C.3.f.
---------------------------------------------------------------------------

    The costs to covered institutions of implementing the final 
amendments will be influenced by the potential burdens on service 
providers that may result from the amendments. If implementing 
procedures that satisfy covered institutions' requirements were 
costless for them, service providers would be likely to agree to 
implement the requirements without much negotiation and the costs to 
covered institutions would be minimal. If, instead, such procedures 
were costly to implement for service providers, more negotiation would 
be required, which would be costlier for all parties involved. In 
addition, in this case, the service providers might increase the price 
of their services, further increasing the costs for covered 
institutions.\913\ We discuss further below the expected indirect 
effects of the final amendments on service providers and how these 
effects may affect covered institutions.\914\
---------------------------------------------------------------------------

    \913\ Because we are not aware of any data, and no commenter 
suggested any data, that could be used to estimate how much service 
providers will pass through increased costs to covered institutions, 
we are unable to quantify the magnitude of the potential increased 
costs for covered institutions.
    \914\ See infra text accompanying footnote 927.
---------------------------------------------------------------------------

    However, even if, as in the scenario described above, the cost per 
service provider turns out to be minimal for covered institutions, the 
total cost might still become significant for covered institutions that 
have a large number of service providers. Even in this case, covered 
institutions will need to devote time and resources to verify that they 
satisfy the final requirements with respect to each of their service 
providers. In addition, covered institutions will need to devote time 
and resources to oversee their service providers throughout their 
relationship with these service providers.\915\ We are unable to 
quantify these costs, as the range would be too wide to be informative 
and commenters did not provide any data that would yield an estimation 
of such a range. The range of costs for covered institutions is likely 
to be wide given the varied nature of the uses of service providers by 
financial institutions. For instance, the cost for covered institutions 
that do not rely on service providers is likely to be minimal. However, 
for those covered institutions that have more complex arrangements with 
service providers, the cost would be significantly higher. The cost 
depends on a large number of factors that vary across covered 
institutions.\916\ For example, the cost

[[Page 47765]]

would depend on the number of service providers used, the extent to 
which service providers are used for multiple functions, each service 
provider's access to relevant customer information, as well as the 
staffing needs of the covered institutions.
---------------------------------------------------------------------------

    \915\ See supra section II.A.4. For PRA purposes, we have 
identified certain types of staff who we anticipate would be 
involved in implementing the rules. See infra section V.B. It is 
possible that those staff members may also be involved in oversight 
of service providers.
    \916\ In a proposing release pertaining to service providers, 
the Commission anticipated a range of compliance costs associated 
with required oversight of service providers by registered 
investment advisers. For example, in the proposing release, the 
Commission estimated a range of $44,106.67-$132,320 in ongoing 
annual costs per adviser associated with the proposed due diligence 
requirements (and further costs associated with proposed monitoring 
requirements and other aspects of the proposed rule). We do not 
believe those ranges of cost estimates are determinative in the 
context of the final amendments here. In particular, the scope of 
the final amendments differs substantially from the scope of that 
proposal. Those cost estimates pertained to a service provider's 
performance of outsourced functions that meet two elements: (1) 
those necessary for the adviser to provide its investment advisory 
services in compliance with the Federal securities laws; and (2) 
those that, if not performed or performed negligently, would be 
reasonably likely to cause a material negative impact on the 
adviser's ability to provide investment advisory services. By 
contrast, the final amendments here pertain to the protection of 
customer information in the case of all outsourced functions to all 
service providers. See Outsourcing by Investment Advisers, Release 
No. 6176 (Oct. 26, 2022) [87 FR 68816, 68821 (Nov. 16, 2022)].
---------------------------------------------------------------------------

    The definition of service provider in the final amendments will 
affect the costs to covered institutions by determining the number of 
service providers for which covered institutions will have to perform 
these tasks. The final amendments adopt a definition of service 
provider to mean ``any person or entity that receives, maintains, 
processes, or otherwise is permitted access to customer information 
through its provision of services directly to a covered institution.'' 
\917\ Many commenters opposed the proposed definition of service 
provider.\918\ These commenters suggested narrower definitions which 
would exclude a covered institution's affiliates.\919\ In addition, one 
commenter stated that the proposed definition was unrealistically and 
unnecessarily broad, reaching service providers where there would be 
few or no marginal benefits to their inclusion and the costs (time, 
money, personnel, etc.) to covered institutions would be 
substantial.\920\ This commenter suggested that the definition of 
service provider be limited to persons or entities with permitted 
access to sensitive customer information only.\921\
---------------------------------------------------------------------------

    \917\ Final rule 248.30(d)(10).
    \918\ See, e.g., IAA Comment Letter 1; Schulte Comment Letter. 
The definition of service provider in the final amendments is 
identical to the definition that was in the proposal. See supra 
section II.A.4.
    \919\ See IAA Comment Letter 1 (stating that ``the IAA believes 
that it is neither appropriate nor necessary to treat affiliates 
that provide services to an affiliated firm through a shared 
services or similar model as Service Providers''); Schulte Comment 
Letter (``We believe that the proposed definition of `service 
provider' should exclude a Covered Institution's affiliates.''); 
SIFMA Comment Letter 2 (``The associations also recommend that the 
Commission exclude affiliates of covered institutions from the 
definition of service providers, as affiliates are part of the same 
enterprise information/cybersecurity oversight as the covered 
institutions.''); CAI Comment Letter (``The Committee requests that 
proposed Rule 30(e)(10) be revised to specifically exclude 
affiliates and other entities under common control with the covered 
institution.'').
    \920\ See IAA Comment Letter 1.
    \921\ See IAA Comment Letter 1. This commenter also requested, 
if the proposed written contract requirement were to be kept in the 
final amendments, that it apply only to those service providers that 
have physical or virtual access to a covered institution's customer 
information system.
---------------------------------------------------------------------------

    We acknowledge that fulfilling the requirements for each of their 
service providers will impose costs on the covered institutions. 
However, the potential benefits are also large given the increasing 
reliance of covered institutions on service providers.\922\ Individual 
customers have no control over a covered institution's decisions to 
perform activities in-house or to outsource them. As such, these 
customers have little control over who has access to their information. 
A broad definition of service providers will contribute to safeguard 
customers' information and will help ensure that customers are notified 
in the event their sensitive information is compromised, no matter 
where this information resides. Furthermore, the modifications in the 
final amendments to require covered institutions to establish, 
maintain, and enforce written policies and procedures reasonably 
designed to require oversight, including through due diligence and 
monitoring, of service providers, instead of requiring written 
contracts as was proposed,\923\ will alleviate the commenters' concerns 
over the potential inclusion of affiliates. Since affiliates are likely 
to have policies and procedures similar to those of covered 
institutions,\924\ we expect that both the benefits and the costs of 
implementing this provision of the requirements will be minimal.
---------------------------------------------------------------------------

    \922\ See supra section IV.C.3.f.
    \923\ See proposed rule 248.30(b)(5)(i).
    \924\ See IAA Comment Letter 1 (``Many advisers are structured 
in a manner that makes it administratively beneficial for them to 
obtain services from affiliates. These services often are provided 
by affiliates in a manner established by the organization's policies 
without the need for formal contracts because the affiliates are 
typically subject to company-wide policies and standards relating to 
safeguarding PII. Moreover, the information security policies of 
affiliates are typically subject to oversight by an organizational 
component that monitors compliance.'') and Schulte Comment Letter 
(``We note that affiliates are typically included within the scope 
of a Covered Institution's cybersecurity policies and procedures and 
would also be covered by an applicable incident response plan.'').
---------------------------------------------------------------------------

    The indirect effects of the final amendments on service providers 
might also affect the costs borne by covered institutions and, 
ultimately, their customers. In particular, these indirect effects may 
generate costs to service providers, which may be passed on (at least 
partly) to covered institutions and ultimately to covered institutions' 
customers,\925\ or may result in negative competitive effects on 
service provider industries that then impact the services offered to 
covered institutions and their customers.\926\ The potential indirect 
effects on service providers that will result from the final amendments 
can be divided into three parts.\927\ First, entities that meet the 
definition of service providers will likely take appropriate measures 
to protect against unauthorized access to or use of customer 
information to facilitate covered institutions' compliance with the 
final amendments. We expect that many service providers already take 
such measures.\928\ Hence, we expect that the number of service 
providers who will modify their business processes for this specific 
requirement is limited. Such modifications will benefit not only the 
customers whose information is being better protected and the covered 
institutions relying on the service providers, but also the service 
providers themselves, to the extent that the modifications decrease the 
likelihood of unauthorized access to their customer information systems 
which could affect their operations or reputation.
---------------------------------------------------------------------------

    \925\ See infra text accompanying footnote 933.
    \926\ See infra section IV.E.
    \927\ We are unable to quantify the indirect costs associated 
with these indirect effects that would be incurred by service 
providers as a result of the final amendments, as the cost range 
would be too wide to be informative. The uncertainty around these 
costs is due to a number of factors, including variation in 
complexity of service provider functions provided to covered 
institutions, the degree of market concentration across service 
provider markets (and hence the number of covered institutions a 
service provider may need to work with to comply with the rule), and 
variation in current service provider practices. The costs to any 
single service provider of meeting the burden for any single 
function for any single covered institution may therefore have 
substantial variance. For example, in certain cases a few service 
providers may perform the same function for many covered 
institutions and hence benefit from economies of scale. By contrast, 
service providers in less concentrated industries would potentially 
face higher costs.
    \928\ For example, many States impose some form of requirements 
regarding the safeguard and the disposal of customer information. 
See supra footnote 603. In addition, the FTC Safeguards Rule 
requires financial institutions to take reasonable steps to select 
and retain service providers capable of maintaining appropriate 
safeguards for customer information and to require those service 
providers by contract to implement and maintain such safeguards. See 
supra footnote 618 and accompanying text. Hence, we expect that the 
service providers of private funds subject to the FTC Safeguards 
Rule already have customer information safeguards in place. This 
could lower the costs of the service provider provisions of the 
final amendments for the private funds advisers that are registered 
with the Commission and that are therefore covered institutions. See 
supra footnote 614 and accompanying text. Furthermore, service 
providers that are subject to other regimes such as the GDPR or DORA 
may already have appropriate safeguards in place.

---------------------------------------------------------------------------

[[Page 47766]]

    Second, covered institutions' policies and procedures will need to 
be reasonably designed to ensure that service providers take 
appropriate measures to provide notification of unauthorized access to 
a customer information system to the covered institutions as soon as 
possible, but no later than 72 hours after becoming aware that the 
breach has occurred. This provision might also result in a number of 
service providers adapting their businesses processes. However, 
considering that 24 States require entities that maintain but do not 
own or license customer information data to notify the entity that owns 
or licenses such data ``immediately'' in case of a breach of security, 
we expect that many service providers already have processes in place 
to ensure that such notification is made.\929\ For the service 
providers who do not already have such processes in place, this 
approach will create benefits for the customers who will be informed in 
a timely manner in the event their sensitive information is 
compromised.
---------------------------------------------------------------------------

    \929\ In addition, other existing regulations have 72-hour 
reporting or notification deadlines. See supra footnote 257 and 
accompanying text; see also supra footnote 245.
---------------------------------------------------------------------------

    Third, because the final amendments require covered institutions to 
establish, maintain, and enforce written policies and procedures 
reasonably designed to require oversight, including through due 
diligence and monitoring, of service providers who have access to their 
customers' information, these service providers will face requests for 
information from covered institutions or otherwise participate in the 
covered institutions' oversight activities. This will impose costs on 
service providers, but it will also strengthen the benefits of the 
amendments by helping ensure that customer information is appropriately 
protected even when it is residing in service providers' systems.
    For service providers that provide specialized services aimed at 
covered institutions, the final amendments may create market pressure 
to enhance service offerings that facilitate covered institutions' 
compliance with the requirements.\930\ Such enhancement will entail 
costs for specialized service providers, including the actual cost of 
adapting business processes, as discussed above, to accommodate the 
requirements.\931\ That said, we do not expect that these costs will 
represent an undue burden as both the specialized service providers and 
the covered institutions are operating in a highly regulated industry 
and might be accustomed to adapting their business processes to meet 
regulatory requirements. Moreover, more specialized service providers 
may be likely to have particularly sensitive or valuable information 
about the customers of covered institutions, and therefore the investor 
protection benefits in those cases may be substantial. With respect to 
service providers providing services aimed at a broad range of 
institutions, such as those providing email or customer-relationship 
management services, covered institutions are likely to represent a 
small fraction of their customer base. These service providers may be 
unwilling to adapt their business processes to the regulatory 
requirements of a small subset of their customers if they do not 
already have such processes in place.
---------------------------------------------------------------------------

    \930\ A service provider involved in any business-critical 
function likely ``receives, maintains, processes, or otherwise is 
permitted access to customer information.'' See final rule 
248.30(d)(10).
    \931\ We have no data on the number of specialized service 
providers used by covered institutions and on the frequency with 
which these service providers already adapt their business processes 
to regulatory changes, and no commenter suggested such data.
---------------------------------------------------------------------------

    For the service providers that already have in place processes 
satisfying the covered institutions' requirements, we expect that the 
costs to both the service providers and the covered institutions will 
be minimal and will mostly result from covered institutions' oversight 
duties. If service providers modify their business processes to 
facilitate covered institutions' compliance with the final amendments' 
requirements, we anticipate they likely will pass costs on to covered 
institutions, and ultimately covered institutions may pass these costs 
on to customers.\932\ We also expect that there might be a fraction of 
service providers who will be unwilling to take the steps necessary to 
facilitate covered institutions' compliance with the final amendments. 
In such cases, the covered institutions will need to either switch 
service providers and bear the associated switching costs or perform 
the functions in-house and establish the appropriate processes as a 
result.\933\ We expect that these costs will be particularly acute for 
smaller covered institutions which lack bargaining power with large 
service providers, and that these costs might be passed on to 
customers.\934\ However, the amendments will create benefits arising 
from enhanced efficacy of the regulation.\935\
---------------------------------------------------------------------------

    \932\ See supra footnote 718.
    \933\ Such switching costs could include the time and other 
resources necessary to find an alternative service provider, conduct 
appropriate due diligence, and negotiate prices and services 
provided. Performing the functions in-house may also be more costly 
than outsourcing them for covered institutions. A recent report 
finds that 73% of surveyed asset managers cite cost considerations 
when deploying outsourcing solutions. See Cerulli Report. The 
competitive effects associated with the cases where service 
providers choose to stop providing services to covered institutions 
as a result of the final amendments are discussed below. See infra 
section IV.E.
    \934\ We expect that smaller covered institutions may be less 
able to pass these costs to customers. See supra footnote 718.
    \935\ From the perspective of current or potential customers, 
the implications of customer information safeguard failures are 
similar whether the failure occurs at a covered institution or at 
one of its service providers.
---------------------------------------------------------------------------

    The proposal included a requirement that a covered institution's 
response program must include written policies and procedures requiring 
the institution, pursuant to a written contract between the covered 
institution and its service providers, to require that service 
providers take appropriate measures that are designed to protect 
against unauthorized access to or use of customer information.\936\ 
While one commenter supported this proposed requirement,\937\ other 
commenters suggested that the final amendments not require written 
contracts with service providers,\938\ stating that doing so would 
impose significant costs on covered institutions.\939\ After 
considering these comments, we are requiring that covered institutions 
establish, maintain, and enforce written policies and procedures to 
require oversight of service providers instead of requiring written 
contracts.\940\ This change, while enhancing the policies and 
procedures obligations, will provide covered institutions with greater 
flexibility in achieving compliance with the requirements, which could 
reduce compliance costs without significantly reducing the benefits of 
the final

[[Page 47767]]

amendments.\941\ Providing this flexibility will also help address 
commenters' concerns that requiring a written contractual agreement 
could harm covered institutions, particularly those that are relatively 
small and may not have sufficient negotiating power or leverage to 
demand specific contractual provisions from a larger third-party 
service provider.\942\ However, in a scenario where a covered 
institution has an existing contract with a service provider that is 
renegotiated as a result of the final amendments, the covered 
institution may incur additional costs.\943\ In addition, in a scenario 
where a service provider would have agreed to a written contract under 
the proposed amendments but will not under the final amendments, a 
covered institution may have to exert greater efforts to oversee this 
service provider than would have been necessary had it signed a written 
contract with this service provider.\944\
---------------------------------------------------------------------------

    \936\ See proposed rule 248.30(b)(5)(i).
    \937\ See ICI Comment Letter 1.
    \938\ See, e.g., SIFMA Comment Letter 2; IAA Comment Letter 1.
    \939\ See, e.g., SIFMA Comment Letter 2 (``Requiring each 
service provider to revise its contract with a covered institution 
within 12 months of the Proposal's finalization would add an 
unnecessary burden to both covered institutions and service 
providers, as well as a potential significant cost.''); IAA Comment 
Letter 1 (``Even if Service Providers agreed to enter into written 
agreements with advisers as proposed, advisers and Service Providers 
would both likely incur significant negotiation and implementation 
costs, which we do not believe are justified, especially when an 
alternative and less burdensome approach is available.''); STA 
Comment Letter 2 (stating that ``transfer agents, because of their 
relatively small size, simply do not have the negotiating power to 
demand contractual terms requiring third party service providers to 
maintain certain policies and procedures, or to demand permission to 
perform due diligence on a service provider's systems, policies, and 
procedures.'').
    \940\ See supra section II.A.4 and final rule 248.30(a)(5).
    \941\ See supra section II.A.4; see also, e.g., AWS Comment 
Letter.
    \942\ See, e.g., IAA Comment Letter 1.
    \943\ It is difficult for us to quantify these costs, as we have 
no data on the provisions of existing contracts between covered 
institutions and their service providers relating to customer 
information safeguards, and no commenter suggested such data. Such 
costs are likely to be contract specific, as they will depend on the 
degree to which each existing contract may be revised as a result of 
the final amendments. Many such contracts may not be revised at all, 
while others may undergo more revisions. Moreover, in many cases, 
even where a contract could be revised as a means of complying with 
the final requirements, the covered institution may pursue 
compliance by other means.
    \944\ There are a variety of ways in which covered institutions 
will be able to satisfy the oversight requirement. See supra section 
II.A.4.
---------------------------------------------------------------------------

    We also proposed that the measures taken by service providers 
include notification to the covered institution as soon as possible, 
but no later than 48 hours after becoming aware of a breach in security 
resulting in unauthorized access to a customer information system 
maintained by the service provider.\945\ While one commenter supported 
this proposed requirement,\946\ other commenters stated that a longer 
deadline would be preferable.\947\ One commenter also suggested a 
change from ``becoming aware'' to ``determining'' that a breach has 
occurred in order to minimize pressure to report on service providers 
while an investigation is being conducted.\948\
---------------------------------------------------------------------------

    \945\ See proposed rule 248.30(b)(5)(i).
    \946\ See ICI Comment Letter 1 (``We concur with the Commission 
requiring service providers to notify a covered institution notice 
within 48 hours of a breach impacting the covered institution or its 
affected individuals.'').
    \947\ See, e.g., Microsoft Comment Letter (``Specifically, where 
the SEC determines that a cybersecurity incident reporting 
requirement is appropriate, the applicable rule should provide that 
the entity with the notification responsibility shall provide the 
required notice to the recipient as soon as possible but no later 
than 72 hours. The reporting deadline should begin to run once the 
entity with notification responsibilities has a reasonable basis to 
conclude that a notifiable incident has occurred or is 
occurring.''); ACLI Comment Letter (``In the early days of 
containment and remediation it is often difficult to determine 
exactly what data has been compromised, making the 48-hour timeframe 
overly short and burdensome.'').
    \948\ See Google Comment Letter.
---------------------------------------------------------------------------

    After considering these comments, we have changed this provision. 
The final amendments require covered institutions to ensure that their 
service providers notify them of a breach as soon as possible, but no 
later than 72 hours after becoming aware that an applicable breach has 
occurred.\949\ We expect that the change to 72 hours will reduce the 
cost to service providers not only because it will give them more time 
to assess an incident before notifying the covered institution, but 
also because it aligns with existing regulation.\950\ Hence, we expect 
that this change will decrease compliance costs for covered 
institutions by making service providers more likely to agree to the 
requirements, which will decrease negotiation and switching costs for 
covered institutions.\951\ We also expect that this will alleviate some 
of the commenters' concerns about having insufficient negotiating power 
to negotiate specific with service providers.\952\ While this change 
may result in a longer period of time before customers receive 
notification of a breach, thereby decreasing the benefits of such 
notification,\953\ it might also reduce the number of unnecessary 
notifications to covered institutions and, in turn, to customers.\954\
---------------------------------------------------------------------------

    \949\ See final rule 248.30(a)(5)(i).
    \950\ See supra footnote 257 and accompanying text.
    \951\ Alignment with existing regulation makes it more likely 
that service providers already have policies and procedures in place 
to comply with this requirement.
    \952\ See, e.g., STA Comment Letter 2.
    \953\ See supra section IV.D.1.b(2) for a discussion of the 
benefits of a timely notice to customers.
    \954\ See Microsoft Comment Letter (``Premature reporting 
according to a 48-hour or shorter deadline, in our experience, 
increases the likelihood of reporting inaccurate or incomplete 
information, which is of little-to-no value and tends to create 
confusion and uncertainty.''). See also supra section IV.D.1.b(4) 
for a discussion of the effects of unnecessary notification. We 
expect that the change made to the notification timing requirements 
for service providers will mitigate these effects.
---------------------------------------------------------------------------

    The final amendments provide, as proposed, that a covered 
institution may enter into a written agreement with a service provider 
to notify individuals affected by a breach on the covered institution's 
behalf.\955\ Some commenters supported this proposed requirement.\956\ 
We expect that this provision could reduce the compliance costs of the 
amendments, especially in the case where the breach happens at the 
service provider. In this case, the service provider may be in a better 
position to collect the relevant information and provide the required 
notice to customers.\957\
---------------------------------------------------------------------------

    \955\ See final rule 248.30(a)(5)(ii).
    \956\ See Schulte Comment Letter (``Covered Institutions should 
be permitted to reach commercial agreements that delegate notice 
obligations to service providers, as long as the notice actually 
provided to customers with potentially impacted data satisfies the 
Covered Institution's notice obligations.''); ICI Comment Letter 1 
(``We also concur with the Commission that covered institutions 
should be permitted to have their service providers send breach 
notices to affected individuals on behalf of the covered 
institution.'').
    \957\ One commenter stated that ``if the service provider was 
the victim of a cyber attack that included unauthorized access to 
Covered Institution sensitive customer information, then the service 
provider would be better situated to notify the affected 
customers.'' See Schulte Comment Letter. Even when the service 
provider notifies customers directly, the obligation to ensure that 
the affected individuals are notified rests with the covered 
institution. See supra section II.A.4 and final rule 
248.30(a)(5)(iii).
---------------------------------------------------------------------------

    It is possible that a breach that will trigger a notification 
obligation might occur at a covered institution that will also be a 
service provider to another covered institution.\958\ The final 
amendments provide that the obligation to ensure that affected 
individuals are notified rests with the covered institution where the 
breach occurred.\959\ If this covered institution is also a service 
provider to another covered institution, it retains the obligation, as 
a service provider, to notify this other covered institution of the 
breach.\960\ This will allow the other covered institution to initiate 
its own incident response program and to perform its oversight duties 
on its service providers, and contribute to enhance the protection of 
customer information. We modified the final amendments such that only 
one covered institution needs to notify the affected customers.\961\ By 
requiring only one

[[Page 47768]]

notice to be sent for a given incident, this modification will reduce 
compliance costs--since only one covered institution will have to 
devote resources to preparing and sending the notice--and reduce 
potential confusion for the affected customers.\962\ We do not expect 
this modification to reduce the benefit for such customers, who will 
still receive a timely notice.
---------------------------------------------------------------------------

    \958\ For additional discussions of the cases where multiple 
covered institutions are involved in the same incident, see supra 
section II.A.3.a and infra section IV.D.2.a.
    \959\ The amendments allow the two covered institutions to 
coordinate with each other as to which institution will send the 
notice to the affected individuals. See supra section II.A.3.a.
    \960\ Because this service provider is itself a covered 
institution, it will have appropriate policies and procedures in 
place. Hence, we do not expect that notifying the other covered 
institution will imply significant costs.
    \961\ See supra section II.A.3.a. Some commenters stated that 
the proposed amendments could be interpreted to lead to duplicative 
notices. See, e.g., CAI Comment Letter (``This dynamic could also 
create duplicative notification obligations where there is 
unauthorized access to sensitive customer information that is held 
or maintained by one financial institution on behalf of another, 
since proposed Rule 30 [sic--rule 248.30] notification obligations 
would appear to apply to both financial institutions simultaneously 
even though only one set of customer information was accessed.''). 
The revisions specify that only one notification is required in that 
circumstance.
    \962\ Duplicative notices may nevertheless happen as a result of 
different requirements from other existing regulations. See supra 
section IV.C.2.a(3).
---------------------------------------------------------------------------

2. Extending the Scope of the Safeguards Rule and the Disposal Rule
a. Definition of Customer Information
    The final amendments more closely align the scope of the safeguards 
rule with the scope of the disposal rule. They also broaden the scope 
of information covered by the rules to all customer information, 
regardless of whether the customers are a covered institution's own, or 
those of another financial institution whose customer information has 
been provided to the covered institution.\963\ The final amendments 
define customer information, for any covered institution other than a 
transfer agent, as ``any record containing nonpublic personal 
information'' about a customer of a financial institution, whether in 
paper, electronic or other form, that is in the possession of a covered 
institution or that is handled or maintained by the covered institution 
or on its behalf. Such information is customer information regardless 
of whether it pertains to (a) individuals with whom the covered 
institution has a customer relationship or (b) the customers of other 
financial institutions where such information has been provided to the 
covered institution.\964\ For transfer agents, customer information is 
defined as any record containing nonpublic personal information 
``identified with any natural person, who is a securityholder of an 
issuer for which the transfer agent acts or has acted as transfer 
agent, that is handled or maintained by the transfer agent or on its 
behalf.'' \965\
---------------------------------------------------------------------------

    \963\ See supra section II.A.3.a.
    \964\ Final rule 248.30(d)(5)(i).
    \965\ Final rule 248.30(d)(5)(ii).
---------------------------------------------------------------------------

    While some commenters supported the proposed scope of the rules 
regarding the definition of customer information,\966\ one commenter 
stated that the rule should focus on sensitive customer information, 
and that the breadth of the proposed amendments was disproportionate to 
the risks of disclosure.\967\ This commenter also stated that applying 
the service provider requirements to all service providers that have 
access to any customer information would be disproportionate to the 
benefits and risk presented and suggested that it apply only to service 
providers with access to sensitive customer information.\968\
---------------------------------------------------------------------------

    \966\ See, e.g., EPIC Comment Letter; Better Markets Comment 
Letter.
    \967\ See IAA Comment Letter 1.
    \968\ See IAA Comment Letter 1.
---------------------------------------------------------------------------

    We acknowledge that applying the policies and procedures 
requirements to all customer information will impose costs that would 
not be incurred if the amendments covered only sensitive customer 
information. However, this approach creates important benefits. For 
example, the disclosure of customer information could be used for 
phishing attacks or similar efforts to access sensitive customer 
information. Moreover, with respect to policies and procedures 
specifically, the costs of creating policies and procedures for all 
information should not be much larger than the cost of creating them 
for only sensitive customer information, because the cost is in the 
creation of the policies and procedures rather than in their 
application. We acknowledge, however, that in some organizations the 
sensitive customer information could be located in different systems or 
accessible to different employees, such that policies and procedures 
for non-sensitive information would be different. In addition, covered 
institutions' existing policies and procedures may be less likely to 
meet the new requirements as a result of the breadth of the definition 
and would thus require modifications.
    Because the final amendments extend the scope of customer 
information subject to protection to information possessed by a covered 
institution regardless of whether the customers are a covered 
institution's own, or those of another financial institution whose 
customer information has been provided to the covered institution, the 
benefits of the final amendments will extend to a wide range of 
individuals such as prospective customers, account beneficiaries, 
recipients of wire transfers, or any other individual whose customer 
information a covered institution comes to possess, so long as the 
individuals are customers of a financial institution.\969\ We 
anticipate that, in many instances, the preventative measures taken by 
covered institutions to safeguard customer information in response to 
the final amendments will generally also protect these additional 
individuals.\970\ Hence, while we expect that these measures could have 
potential significant benefits for these additional individuals, we do 
not expect them to result in significant additional costs for the 
covered institutions. However, we acknowledge that, in certain 
instances, this may not be the case. For example, information about 
prospective customers used for sales or marketing purposes may be 
housed in separate systems from the covered institution's ``core'' 
customer account management systems and require additional efforts to 
secure. Regarding the measures taken by covered institutions to comply 
with the final amendments' incident response program requirements, 
following a data breach, we do not anticipate that extending the scope 
of information covered by the final amendments to include these 
additional individuals will have a significant effect. These costs will 
include additional reputational harm and litigation as well as 
increased notice delivery costs. However, given that the distinction 
between customers and other individuals is generally not relevant under 
existing State notification laws--which apply to information pertaining 
to residents of a given State--we expect that most covered institutions 
will have already undertaken to protect and provide notification of 
data breaches to these additional individuals.
---------------------------------------------------------------------------

    \969\ See final rule 248.30(d)(5).
    \970\ For example, measures aimed at strengthening information 
safeguards such as improved user access control or staff training 
will likely protect a covered institution's customer information 
systems regardless of whether they house the information of the 
covered institution's own customers or those of another financial 
institution.
---------------------------------------------------------------------------

    Some commenters agreed that covered institutions should safeguard 
the customer information they receive from other financial 
institutions.\971\ Other commenters disagreed with the proposed 
requirement that a covered institution would have to notify individuals 
whose sensitive customer information was compromised even when these 
individuals were not the covered institution's customers.\972\ Some 
commenters stated that it would be impractical for covered institutions 
to identify and contact such individuals, or that it could confuse 
these

[[Page 47769]]

individuals.\973\ However, such individuals will benefit from their 
information being included in the scope of the amendments' 
requirements. Another commenter stated that this provision of the 
requirement could lead to duplicative notification obligations if the 
two financial institutions involved--that is, the institution that 
received the information and the institution that provided the 
information--were both covered institutions.\974\ After considering 
comments, we have modified the amendments to avoid requiring that 
multiple covered institutions notify the same affected individuals for 
a given incident.\975\ The final amendments require that when an 
incident occurs at a covered institution or at one of its service 
providers that is not itself a covered institution, the covered 
institution has the obligation to ensure that a notice is provided to 
affected individuals, regardless of whether this covered institution 
has a customer relationship with the individuals. If this covered 
institution received the customer information from another covered 
institution, the two covered institutions can coordinate with each 
other to decide who will send the notice. As discussed above,\976\ we 
expect that this modification will reduce compliance costs without 
reducing the benefits of the final amendments.
---------------------------------------------------------------------------

    \971\ See, e.g., ICI Comment Letter 1; Better Markets Comment 
Letter.
    \972\ See, e.g., SIFMA Comment Letter 2; CAI Comment Letter.
    \973\ See ACLI Comment Letter; SIFMA Comment Letter 2; Federated 
Comment Letter.
    \974\ See CAI Comment Letter.
    \975\ See final rule 248.30(a)(4); see also supra sections 
II.A.3.a and IV.D.1.c.
    \976\ See supra section IV.D.1.c.
---------------------------------------------------------------------------

b. Extension To Cover All Transfer Agents
    The final amendments extend both the safeguards rule and the 
disposal rule to apply to any transfer agent registered with the 
Commission or another appropriate regulatory agency. Before this 
adoption, the safeguards rule did not apply to any transfer agents, and 
the disposal rule only applied to transfer agents registered with the 
Commission.\977\ In addition to requiring transfer agents to design an 
incident response program, the benefits and costs of which are 
discussed separately above,\978\ the amendments create an additional 
obligation on transfer agents to develop, implement, and maintain 
written policies and procedures that address administrative, technical, 
and physical safeguards for the protection of customer 
information.\979\ Moreover, the final amendments create an obligation 
on transfer agents registered with a regulatory agency other than the 
Commission to develop, implement, and maintain written policies and 
procedures that address the proper disposal of customer 
information.\980\
---------------------------------------------------------------------------

    \977\ See supra section II.B.2.
    \978\ See supra section IV.D.
    \979\ See final rule 248.30(a).
    \980\ See 17 CFR 248.30(a).
---------------------------------------------------------------------------

    As discussed in sections II.B.2 and IV.C.3.e, in the U.S., transfer 
agents provide the infrastructure for tracking ownership of securities. 
Maintaining such ownership records necessarily entails holding or 
accessing non-public information about a large swath of the U.S. 
investing public.\981\ Given the highly concentrated nature of the 
transfer agent market,\982\ a general failure of customer information 
safeguards at a transfer agent could negatively impact large numbers of 
customers.\983\
---------------------------------------------------------------------------

    \981\ One commenter disagreed with this notion, stating that 
many transfer agents do not have the type or scope of personal 
information which could lead to further complications for 
shareholders. See STA Comment Letter 2. Transfer agents that do not 
possess customer information as defined in final rule 248.30(d)(5) 
will not be covered by the amendments and as such will not be 
subject to its associated costs.
    \982\ See supra section IV.C.3.e.
    \983\ More than 40% of registered transfer agents maintain 
records for more than 10,000 individual accounts. See supra Figure 
8.
---------------------------------------------------------------------------

    One commenter stated that because transfer agents' customers are 
not the individuals whose information they hold but the issuers of 
securities, the proposed amendments were ill-fitting, which decreased 
their efficacy and increased their complications.\984\ This commenter 
also stated that the proposed amendments were not well-suited for 
transfer agents, and that this highlighted the need for a more in-depth 
analysis of how the final amendments may impact transfer agents, their 
customers (the issuers of securities), and securityholders.\985\ In 
response to this commenter, we have supplemented below the analysis of 
the benefits and costs of extending the scope of Regulation S-P to 
transfer agents.\986\
---------------------------------------------------------------------------

    \984\ See STA Comment Letter 2.
    \985\ See STA Comment Letter 2.
    \986\ Additional context is provided in section IV.C.3.f. See 
also supra section II.B.2 for a discussion of why the amendments are 
appropriate for transfer agents.
---------------------------------------------------------------------------

    The final amendments extend the scope of the safeguards rule to 
cover any transfer agent registered with the Commission or another 
appropriate regulatory agency. As discussed above,\987\ the safeguards 
rule requires covered institutions to develop written policies and 
procedures, including a response program reasonably designed to detect, 
respond to, and recover from unauthorized access to or use of customer 
information, including customer notification procedures. The benefits 
and costs of the response program, as detailed above,\988\ will also 
apply to transfer agents. Additionally, because transfer agents may be 
considered service providers under State law, or may maintain but not 
own or license customer information data, they are likely to be 
required by State law to notify the entity that owns or licenses the 
data (the issuer of the securities), which in turn could be required to 
notify the affected individuals (the holders of the securities).\989\ 
Hence, it is possible that the final amendments will result in two 
notices being sent for the same incident--one by the issuer of the 
securities, as required by State law, and one by the issuer's transfer 
agent, as required by the final amendments.
---------------------------------------------------------------------------

    \987\ See supra section IV.D.1.
    \988\ See supra section IV.D.1.a; see also infra footnote 1003 
and accompanying text for a discussion on additional costs for 
transfer agents.
    \989\ See supra section IV.C.2.a(3).
---------------------------------------------------------------------------

    Some commenters stated that a second notification would have 
negative consequences for customers without providing any 
benefits.\990\ One commenter stated that the proposed requirements 
would not provide shareholders with helpful, new information but rather 
that two different notices, from two different entities, concerning the 
same breach would likely result in shareholder confusion.\991\ Another 
commenter added that this second notice could potentially result in 
confusion, questions, and unnecessary costs to the transfer agent and 
the issuer.\992\
---------------------------------------------------------------------------

    \990\ See, e.g., STA Comment Letter 2.
    \991\ See STA Comment Letter 2.
    \992\ See Computershare Comment Letter.
---------------------------------------------------------------------------

    We disagree that no helpful, new information will be provided to 
the affected customers. In the situation where State law requires a 
notification from the issuer and the final amendments require a 
notification from the transfer agent as a covered institution, the 
final amendments will help ensure that the individuals whose 
information has been breached receive an informative and timely notice, 
with the benefits over the baseline described above.\993\ 
Securityholders will benefit by potentially receiving additional and 
more timely information on a given breach.\994\ In addition, in 
response to

[[Page 47770]]

commenters' concerns, we have modified the final amendments such that, 
for the cases where multiple notifying entities are covered 
institutions, only one notice needs to be sent to satisfy the 
amendments' requirements.\995\ Furthermore, some States allow for the 
entity that is the victim of a breach, but does not own or license the 
data, to notify individuals directly.\996\ Hence, we expect that in 
some instances, the notice required by the final amendments will 
satisfy the State law requirements and only one notice will be sent. In 
these instances, additional costs related to the second notice will be 
avoided. For the instances where two notices will nevertheless be sent, 
we acknowledge that a second notification will impose costs on the 
transfer agent or its customer the issuer. As discussed below, we 
estimate that certain costs associated with the preparation and 
distribution of notices will be, on average, $5,178 per year per 
covered institution.\997\ We understand it is possible that, in some 
cases, customers may be confused when receiving a notice from an entity 
they do not recognize and may read the notification as a phishing 
attempt or another nefarious scheme. However, we do not expect that a 
second notice will impose significant costs on the affected customers, 
and we expect that this confusion will be mitigated by the content of 
the notice. As discussed in section IV.D.1.b(5), the notice is required 
to include a description of the incident in general terms. We expect 
that this description will help explain the situation in the case where 
customers do not have a direct relationship with the transfer agent 
sending the notice and, therefore, that it will reduce potential 
customer confusion from duplicative notification, as discussed 
above.\998\
---------------------------------------------------------------------------

    \993\ See supra section IV.D.1.b.
    \994\ See supra section IV.D.1.b. Commenters stated that issuers 
may already have adopted policies and procedures to adhere to the 
strictest standards thereby already notifying securityholders 
consistent with the proposed amendments. See Computershare Comment 
Letter; STA Comment Letter 2. We acknowledge that this may be the 
case.
    \995\ See supra sections IV.D.1.c and IV.D.2.a for additional 
discussions of the case where two covered institutions are involved 
in the same incident.
    \996\ See, e.g., Wyo. Stat. section 40-12-502(g) (``The person 
who maintains the data on behalf of another business entity and the 
business entity on whose behalf the data is maintained may agree 
which person or entity will provide any required notice as provided 
in subsection (a) of this section, provided only a single notice for 
each breach of the security of the system shall be required.''). See 
also supra section IV.C.2.a(3).
    \997\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $3,862 per year per covered 
institution. See infra section V.
    \998\ See supra section II.B.2.
---------------------------------------------------------------------------

    Before this adoption, transfer agents that are registered with the 
Commission were not required to notify customers directly in case of a 
breach under Federal law.\999\ As discussed above, we also expect that, 
under State law, transfer agents are likely to be considered service 
providers (or entities that use or maintain but do not own or license 
data) and as such are typically only required to notify the issuer of 
securities in case of breach.\1000\ Hence, we expect that to satisfy 
the amendments' requirements, these transfer agents might need to 
design and implement a response program and notification procedures, 
which will require some resources.\1001\ As discussed below, we 
estimate that certain costs associated with developing and implementing 
policies and procedures, which include the response program and 
notification procedures, to comply with the final amendments will be, 
on average, $17,950 per year per transfer agent.\1002\ In addition, as 
for other types of covered institutions, if transfer agents respond to 
this requirement by improving their customer information safeguards 
beyond what is required by the final amendments, they will incur 
additional costs.\1003\ We expect that the different costs resulting 
from the written policies and procedures requirement will be passed on 
to the transfer agents' customers (the issuers of securities) and 
ultimately to the holders of these securities.
---------------------------------------------------------------------------

    \999\ In 2023, there were 251 such transfer agents. See supra 
section IV.C.3.e.
    \1000\ However, there are some States where transfer agents may 
be required by State law to notify the affected individuals 
directly. See supra footnote 574 and accompanying text.
    \1001\ Transfer agents registered with the Commission may 
already have such procedures in place and may already be notifying 
customers. See ICI Comment Letter 1 (``We understand that this is a 
common practice today for investment companies wherein their 
transfer agents assume responsibility for sending affected customers 
breach notices.''). However, we do not have data on how common such 
arrangements are and commenters did not provide such data.
    \1002\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $5,425 per year per transfer 
agent. See infra section V. These estimated costs are higher than 
for other types of covered institutions because transfer agents were 
not, before this adoption, covered by the safeguards rule. In 
addition, transfer agents registered with a regulatory agency other 
than the Commission were not, before this adoption, covered by the 
disposal rule. The final amendments extend both the safeguards rule 
and the disposal rule to apply to any transfer agent registered with 
the Commission or another appropriate regulatory agency. The 
additional costs that could be incurred by transfer agents as a 
result are discussed below. See infra text accompanying footnote 
1021.
    \1003\ We are unable to quantify expected costs resulting from 
such enhancements. See supra footnote 717 and accompanying text.
---------------------------------------------------------------------------

    Transfer agents that are registered with an appropriate regulatory 
agency other than the Commission may already be required to notify 
affected individuals in case of a breach under the Banking Agencies' 
Incident Response Guidance.\1004\ As discussed above, although the 
notification requirement under the final amendments is largely aligned 
with the Banking Agencies' Incident Response Guidance, there are some 
differences.\1005\ Hence, for these institutions, we expect that the 
costs of the requirements will primarily be to review and, if needed, 
update their notification procedures to ensure consistency with the 
amendments, though there may be some costs associated with updating 
procedures to achieve consistency with the final amendments.\1006\ As 
discussed below, we estimate that certain costs associated with 
developing and implementing policies and procedures to comply with the 
final amendments will be, on average, $17,950 per year per transfer 
agent.\1007\
---------------------------------------------------------------------------

    \1004\ In 2023, there were 64 such transfer agents; see supra 
section IV.C.3.e; see also supra section IV.C.2.b.
    \1005\ For example, the Banking Agencies' Incident Response 
Guidance requires entities to notify customers ``as soon as 
possible,'' but does not specify a precise deadline, whereas the 
final amendments require that the notice be sent as soon as 
practicable, but not later than 30 days, after becoming aware that 
unauthorized access to or use of sensitive customer information has 
occurred or is reasonably likely to have occurred. In addition, the 
Banking Agencies' Incident Response Guidance has a different 
definition of ``sensitive customer information'' and has different 
requirements regarding an entity's service providers. See supra 
section IV.C.2.b for a description of the Banking Agencies' Incident 
Response Guidance's requirements.
    \1006\ We expect these reviews and updates will result in the 
entities incurring costs generally smaller than the costs of 
adopting and implementing new policies and procedures, as discussed 
in Section V.
    \1007\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $5,425 per year per transfer 
agent. See infra section V.
---------------------------------------------------------------------------

    One commenter supported the proposed inclusion of transfer agents 
in the safeguards rule, stating that it would eliminate the asymmetry 
between the transfer agents registered with the Commission and those 
registered with another regulatory agency and that it would promote 
investor protection, regulatory parity, and fair competition among 
firms.\1008\ We agree with this commenter. Another commenter stated 
that expanding the regulation's scope to include transfer agents was 
long overdue.\1009\
---------------------------------------------------------------------------

    \1008\ See Better Markets Comment Letter.
    \1009\ See ICI Comment Letter 1.
---------------------------------------------------------------------------

    Other commenters opposed the proposed inclusion.\1010\ One 
commenter

[[Page 47771]]

stated that requiring transfer agents to notify customers directly 
would create undue costs for transfer agents, that the proposed 
amendments included a potential for conflicting regulations where there 
are overlapping State and Federal regulations, and that this would lead 
to unnecessary expenses as transfer agents attempt to develop policies 
and procedures capable of addressing these potentially conflicting 
regulations.\1011\ This commenter suggested that the Commission either 
preempt State law or prepare and produce a cost-benefit analysis 
identifying the specific ways in which the amendments would be an 
improvement over existing regulations.\1012\ Another commenter--a 
transfer agent--stated that it already had policies and procedures to 
notify issuers of securities in accordance with State law and that 
notifying the securityholders directly could violate some of its 
existing contracts with issuers.\1013\
---------------------------------------------------------------------------

    \1010\ See STA Comment Letter 2; Computershare Comment Letter.
    \1011\ See STA Comment Letter 2. The commenter did not describe 
such conflicts.
    \1012\ See STA Comment Letter 2.
    \1013\ See Computershare Comment Letter (``However, as state 
breach notification laws have been in effect for nearly two decades, 
Computershare has long-standing policies and procedures for 
notification, and contractual obligations to clients that are 
designed to track state law requirements. Such contract provisions 
may specifically prohibit Computershare as the transfer agent from 
notifying securityholders as the issuers have the requirement to 
notify their securityholders under state law.'').
---------------------------------------------------------------------------

    In response to commenters and as discussed above,\1014\ we have 
modified the final amendments to minimize the likelihood of multiple 
notices being sent for the same incident, which will decrease 
compliance costs.\1015\ The final amendments do not necessarily require 
covered institutions to notify affected customers directly in case of 
breach, but instead provide that a covered institution must ensure that 
the required notice is sent.\1016\ Hence, if a transfer agent has a 
contract with an issuer that prevents it from notifying securityholders 
directly, the transfer agent will be able to, under the final 
amendments, enter into an agreement with the issuer so that the issuer 
sends the notice on its behalf.\1017\ In consideration of the 
commenter's request for an analysis that considers the incremental 
effects of the rule over existing regulations, we have (i) conducted 
supplemental analyses of the baseline regarding State law 
requirements,\1018\ and (ii) supplemented the analysis of the benefits 
and costs of the final amendments over this baseline, highlighting the 
different areas where the final amendments will improve over existing 
regulations.\1019\
---------------------------------------------------------------------------

    \1014\ See supra section IV.D.
    \1015\ See also supra section II.B.2 for a discussion of how the 
final amendments permit transfer agents and issuers to develop 
arrangements to address potentially conflicting regulations.
    \1016\ See final rule 248.30(a)(4).
    \1017\ Such contract renegotiation will involve some costs for 
the transfer agents. It is difficult for us to quantify these costs, 
as we have no data on the provisions of existing contracts between 
transfer agents and security issuers relating to customer 
notification of data breaches, and no commenter suggested such data. 
Such costs are likely to be contract specific, as they will depend 
on the degree to which each existing contract may be revised as a 
result of the final amendments. Many such contracts may not be 
revised at all, while others may undergo more revisions. Moreover, 
in many cases, even where a contract could be revised as a means of 
complying with the final requirements, the covered institution may 
pursue compliance by other means.
    \1018\ See supra section IV.C.2.
    \1019\ See supra section IV.D.1.b.
---------------------------------------------------------------------------

    The final amendments to the safeguards rule also require transfer 
agents to develop, implement, and maintain written policies and 
procedures that address administrative, technical, and physical 
safeguards for the protection of customer information.\1020\ In 
general, transfer agents with written policies and procedures to 
safeguard customer information would be at reduced risk of experiencing 
such safeguard failures.\1021\ Because some State laws require written 
policies and procedures to protect customer information,\1022\ and 
because transfer agents, by the nature of their business models, are 
likely to hold information about individuals residing in a large number 
of States, we expect that most transfer agents already have policies 
and procedures in place.\1023\ In addition, transfer agents registered 
with a regulatory agency other than the Commission may also be subject 
to the Banking Agencies' Safeguards Guidance or other Federal 
regulation.\1024\ Hence, we expect the costs of this requirement to be 
limited and to consist mostly of reviewing and updating existing 
policies and procedures to ensure consistency with the safeguards 
rule.\1025\ As discussed below, we estimate that certain costs 
associated with developing and implementing policies and procedures to 
comply with the final amendments will be, on average, $17,950 per year 
per transfer agent.\1026\
---------------------------------------------------------------------------

    \1020\ See final rule 248.30(a)(1).
    \1021\ See supra section IV.D.1 for a discussion of the benefits 
of written policies and procedures generally.
    \1022\ See supra section IV.C.2.b.
    \1023\ In addition, some transfer agents may also be subject to 
other regulations, such as the GDPR, and already have customer 
information safeguards in place as a result. See supra section 
IV.C.2.b.
    \1024\ See supra footnote 604 and accompanying text.
    \1025\ We expect these reviews and updates will result in the 
entities incurring costs generally smaller than the costs of 
adopting and implementing new policies and procedures, as discussed 
in section V.
    \1026\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $5,425 per year per transfer 
agent. See infra section V. As discussed above, these estimates 
reflect all of the policies and procedures required by the final 
amendments, including those regarding the incident response program. 
See supra footnote 1003 and accompanying text.
---------------------------------------------------------------------------

    The final amendments extend the disposal rule to transfer agents 
registered with a regulatory agency other than the Commission.\1027\ 
The amendments require these transfer agents to properly dispose of 
customer information by taking reasonable measures to protect against 
unauthorized access to or use of the information in connection with its 
disposal.\1028\ Because these transfer agents are subject to regulatory 
requirements and to State laws which require proper disposal of 
customer information,\1029\ we expect that they are likely to already 
have procedures in place for the disposal of customer information. 
Therefore, to the extent that transfer agents already have in place 
procedures that are consistent with these provisions of the final 
amendments, the benefits and costs relating to this requirement will be 
reduced for these institutions and for the customers whose information 
is covered by this requirement. Hence, we expect the costs of this 
requirement to be limited and to consist mostly of reviewing and 
updating existing policies and procedures to ensure consistency with 
the safeguards rule.\1030\ As discussed below, we estimate that certain 
costs associated with developing and implementing policies and 
procedures to comply with the final amendments will be, on average, 
$17,950 per year per transfer agent.\1031\
---------------------------------------------------------------------------

    \1027\ Transfer agents registered with the Commission were 
already subject to the disposal rule before this adoption. See 17 
CFR 248.30(b).
    \1028\ See 17 CFR 248.30(b).
    \1029\ The Banking Agencies' Safeguards Guidance requires that a 
covered entity's information security program be designed to ensure 
the proper disposal of customer information and consumer 
information. See supra footnote 612 and accompanying text; see also 
supra section IV.C.2.b for a discussion of State law disposal 
requirements.
    \1030\ We expect these reviews and updates will result in the 
entities incurring costs generally smaller than the costs of 
adopting and implementing new policies and procedures, as discussed 
in section V.
    \1031\ This estimate is an annual average for the first three 
years. The corresponding ongoing annual costs beyond the first three 
years are estimated to be on average $5,425 per year per transfer 
agent. See infra section V. As discussed above, these estimates 
reflect all of the policies and procedures required by the final 
amendments, including those regarding the incident response program. 
See supra footnote 1003 and accompanying text.

---------------------------------------------------------------------------

[[Page 47772]]

3. Recordkeeping
    The recordkeeping provisions of the final amendments require 
covered institutions (other than funding portals) to make and maintain 
written records documenting compliance with the requirements of the 
safeguards rule and of the disposal rule.\1032\ Each covered 
institution (other than funding portals) is required to make and 
maintain written records documenting its compliance with, among other 
things: its written policies and procedures required under the final 
amendments, including those relating to its service providers and its 
consumer information and customer information disposal practices; its 
assessments of the nature and scope of any incidents involving 
unauthorized access to or use of customer information; any 
notifications of such incidents received from service providers; steps 
taken to contain and control such incidents; and, where applicable, any 
investigations into the facts and circumstances of an incident 
involving sensitive customer information, and the basis for determining 
that sensitive customer information has not been, and is not reasonably 
likely to be, used in a manner that would result in substantial harm or 
inconvenience.\1033\
---------------------------------------------------------------------------

    \1032\ See final rule 248.30(c). As discussed above, funding 
portals have recordkeeping requirements that are different from 
those of other covered institutions under the final amendments. See 
supra footnote 385.
    \1033\ See the various provisions of final rule 248.30(a) and 
248.30(b)(2).
---------------------------------------------------------------------------

    These recordkeeping requirements will help facilitate the 
Commission's inspection and enforcement capabilities. Covered 
institutions may react to this enhanced ability of the Commission staff 
to detect deficiencies and impose sanctions against non-compliance due 
to the recordkeeping requirements by taking more care to comply with 
the substance of the amendments, which may result in material 
improvement in the response capabilities of covered institutions and 
mitigate potential harm resulting from the lack of an adequate response 
program. As such, the amendments' recordkeeping requirements might 
benefit customers through channels described in section IV.D.1.
    One commenter supported the proposed recordkeeping 
requirements.\1034\ Another commenter requested a clarification of the 
proposed requirements, suggesting that the text in the final amendments 
include more detail.\1035\ In response to this commenter, we have 
provided a more detailed description of the requirements in the rule 
text of the final amendments.\1036\ We expect that this change will 
mitigate compliance costs for covered institutions.
---------------------------------------------------------------------------

    \1034\ See ICI Comment Letter 1.
    \1035\ See IAA Comment Letter 1.
    \1036\ See supra section II.C and final rule 240.30(d)(1).
---------------------------------------------------------------------------

    We do not expect the final recordkeeping requirements to impose 
substantial compliance costs. As covered institutions are currently 
subject to similar recordkeeping requirements applicable to other 
required policies and procedures, we do not anticipate that covered 
institutions will need to invest in new recordkeeping staff, systems, 
or procedures to satisfy the new recordkeeping requirements.\1037\ The 
incremental administrative costs arising from maintaining additional 
records related to these provisions using existing systems are covered 
in the Paperwork Reduction Act analysis in section V and are estimated 
to be $420 per year per covered institution other than funding portals, 
and $630 per year per funding portal.\1038\
---------------------------------------------------------------------------

    \1037\ See, e.g., 17 CFR 240.17a-3; 17 CFR 275.204-2; 17 CFR 
270.31a-1; and 17 CFR 240.17Ad-7. Where permitted, entities may 
choose to use third-party providers in meeting their recordkeeping 
obligations. See, e.g., 17 CFR 275.204-2(e)(2).
    \1038\ See infra section V. As discussed above, funding portals 
have recordkeeping requirements that are different from those of 
other types of covered institutions. See supra footnote 385.
---------------------------------------------------------------------------

4. Exception From Annual Notice Delivery Requirement
    The final amendments incorporate into the regulation an existing 
statutory exception to the requirement that a broker-dealer, investment 
company, or registered investment adviser deliver an annual privacy 
notice to its customers.\1039\ An institution may rely on the exception 
to forgo notice if it has not changed its policies and practices with 
regard to disclosing nonpublic personal information from those it most 
recently provided to the customer via privacy notice.\1040\ The effect 
of the exception is to eliminate the requirement to send the same 
privacy policy notice to customers on multiple occasions. As such 
notices would provide no new information, receiving multiple copies of 
such notices is unlikely to provide any significant benefit to 
customers. Moreover, we expect that widespread reliance on the proposed 
exception is more likely to benefit customers, by providing clearer 
signals of when privacy policies have changed.\1041\ At the same time, 
reliance on the exception will reduce costs for covered institutions. 
However, we expect these cost savings to be limited to the 
administrative burdens discussed in section V.\1042\ We received one 
comment supporting the proposed exception.\1043\ We did not receive any 
comments suggesting alternatives to the proposed exception or 
suggesting that we not proceed with it.
---------------------------------------------------------------------------

    \1039\ See supra section II.D; see also 15 U.S.C. 6803(f). 
Additionally, under existing statutory exceptions notice is not 
required when the institution provides certain information to a 
third party to perform services for or functions on behalf of the 
institution, such as information sharing necessary to perform 
transactions on behalf of the customer, information sharing directed 
by the customer, or reporting to credit reporting agencies. See 15 
U.S.C. 6802(e).
    \1040\ See final rule 248.5(e)(1)(ii).
    \1041\ In other words, reducing the number of privacy notices 
with no new content allows customers to devote more attention to 
parsing notices that do contain new content.
    \1042\ See infra footnote 1119.
    \1043\ See ICI Comment Letter 1.
---------------------------------------------------------------------------

    Because the exception became effective when the statute was 
enacted, the aforementioned benefits are likely to have already been 
realized. Consequently, we do not expect that its inclusion will have 
any economic effects relative to the current status quo.

E. Effects on Efficiency, Competition, and Capital Formation

    As discussed above, market imperfections might lead to 
underinvestment in customer information safeguards, and to information 
asymmetry about incidents resulting in unauthorized access to or use of 
customer information.\1044\ This information asymmetry might prevent 
customers whose sensitive information was compromised from taking 
timely mitigating actions. The final amendments aim to mitigate the 
inefficiency resulting from these imperfections by imposing mandates 
for policies and procedures. Specifically, the amendments require 
covered institutions to include a response program for incidents 
involving unauthorized access to or use of customer information. This 
response program must address assessment and containment of such 
incidents, and might thereby reduce potential underinvestment in these 
areas, improving customer information safeguards as a result.\1045\ In 
addition, by requiring notification to customers about certain 
safeguard failures, the amendments could reduce the aforementioned 
information asymmetry and help customers choose a covered

[[Page 47773]]

institution that meets their needs or preferences. The notification 
requirement, by imposing reputational costs on institutions whose 
safeguards of customer information fail, might also provide covered 
institutions with greater incentives to improve their safeguards, 
contributing to lowering the probability of a breach even further.
---------------------------------------------------------------------------

    \1044\ See supra section IV.B.
    \1045\ See supra section IV.D (discussing the benefits and costs 
of the response program requirements).
---------------------------------------------------------------------------

    While the amendments have the potential to mitigate these 
inefficiencies, the scale of the overall effect is difficult to 
estimate. Due to the presence of existing regulations, including State 
notification laws, and existing security practices,\1046\ these 
inefficiencies are likely to be of limited magnitude. However, to the 
extent that they remain, the amendments might contribute to reduce 
them.\1047\ Insofar as the proposed amendments alter covered 
institutions' practices, the improvement--in terms of the effectiveness 
of covered institutions' response to incidents, customers' ability to 
respond to breaches of their sensitive customer information, and in 
reduced information asymmetry about covered institutions' efforts to 
safeguard this information--is impracticable to quantify due to data 
limitations discussed previously.\1048\
---------------------------------------------------------------------------

    \1046\ See supra sections IV.C.1 and IV.C.2.
    \1047\ Section IV.D.1.b discusses in detail how the amendments' 
requirements differ from existing State notification laws.
    \1048\ See, e.g., supra sections IV.A. and IV.D.1.
---------------------------------------------------------------------------

    The final provisions will not have first order effects on channels 
typically associated with capital formation (e.g., taxation policy, 
financial innovation, capital controls, investor disclosure, market 
integrity, intellectual property, rule-of-law, and diversification). 
Thus, the final amendments are unlikely to lead to significant effects 
on capital formation.\1049\
---------------------------------------------------------------------------

    \1049\ While we do not expect first-order effects on capital 
formation, we agree with one commenter who stated that the 
amendments would contribute to promote transparency and consistency 
on capital markets, which would benefit investors, issuers, and 
other market participants. See Nasdaq Comment Letter. In addition, 
as discussed below, there might be incremental effects on the 
capital formation associated with issuers relying on funding 
portals. See infra text accompanying footnote 1053.
---------------------------------------------------------------------------

    Because the amendments are likely to impose proportionately larger 
direct and indirect costs on smaller and more geographically limited 
covered institutions, these institutions' competitiveness vis-[agrave]-
vis their larger peers might be affected. Such covered institutions--
which may be less likely to have written policies and procedures for 
incident response programs already in place--will face 
disproportionately higher costs resulting from the proposed 
amendments.\1050\ Thus, the amendments might have negative effects on 
competition, to the extent these higher costs represent a barrier to 
entry or limit smaller institutions' viability as a competitive 
alternative to larger institutions. However, given the considerable 
competitive challenges arising from economies of scale and scope 
already faced by smaller firms, we do not anticipate that the costs 
associated with this adoption will significantly alter these challenges 
and therefore expect the incremental effects of these amendments on 
competition to be limited.
---------------------------------------------------------------------------

    \1050\ The development of policies and procedures entails a 
fixed cost component that imposes a proportionately larger burden on 
smaller firms. We expect smaller broker-dealers and investment 
advisers will be most affected. See supra sections IV.C.3.a and 
IV.C.3.c.
---------------------------------------------------------------------------

    On the other hand, the amendments may have positive competitive 
effects also. Because safeguarding customer information, including 
through cybersecurity, is disproportionately more expensive for smaller 
institutions,\1051\ customers today may already suspect that smaller 
institutions have more severe under-investments in cybersecurity than 
larger institutions and may therefore avoid smaller institutions. If 
disproportionately large costs faced by smaller institutions cause 
existing and potential customers to suspect that these institutions are 
more likely to avoid such costs, the existing information asymmetry may 
be greater for these institutions. Smaller institutions may be unable 
to overcome these suspicions on their own absent regulatory policy, and 
so asymmetries of information may represent a barrier to entry for 
smaller institutions. In this case, if the amendments result in 
customers having better information on the covered institutions' 
efforts towards protecting customer information, there will be a 
positive effect on competition. Hence, the overall effect on smaller 
and more geographically limited covered institutions' competitiveness 
remains difficult to predict.
---------------------------------------------------------------------------

    \1051\ See, e.g., Anna Cartwright et al., Cascading Information 
On Best Practice: Cyber Security Risk Management in UK Micro and 
Small Businesses and the Role of IT Companies, Computers & Security 
131 (2023) for a list of articles discussing the cybersecurity 
challenges faced by small businesses.
---------------------------------------------------------------------------

    With respect to funding portals, the situation could be different. 
As discussed above, the final amendments are likely to impose 
proportionately larger costs on smaller covered institutions,\1052\ 
including smaller funding portals. At the margin, it is possible that 
the final amendments will result in a smaller number of funding 
portals, which could result in a smaller number of crowdfunding 
intermediaries available to potential issuers. Crowdfunding 
intermediaries facilitate capital raising by smaller issuers relying 
upon Regulation Crowdfunding to offer or sell securities. To the extent 
that the final amendments result in a decrease in the availability of 
funding portals or in an increase in the costs of utilizing 
crowdfunding intermediaries for issuers or investors, they may have 
incremental negative effects on capital formation associated with 
issuers relying on such intermediaries. However, we expect the 
incremental negative effect on competition that could result from this 
to be mitigated by the already significant degree of concentration 
among crowdfunding intermediaries observed today.\1053\ We further 
expect these effects to be mitigated to the extent that issuers may be 
able to switch to using other intermediaries for their Regulation 
Crowdfunding offerings, such as larger funding portals. Lastly, the 
amendments may have a positive effect on capital formation in offerings 
under Regulation Crowdfunding to the extent that the additional 
procedural requirements in the final amendments increase protection of 
customer information and thereby attract additional potential 
investors. Hence, the overall effect remains difficult to predict.
---------------------------------------------------------------------------

    \1052\ See supra footnote 1051.
    \1053\ See supra section IV.C.3.b.
---------------------------------------------------------------------------

    Two commenters raised concerns about barriers to entry 
disproportionately affecting smaller covered institutions. One 
commenter stated that smaller advisers had been significantly affected 
by ``one-size-fits-all'' regulations that effectively require 
substantial fixed investments in infrastructure, personnel, technology, 
and operations, adding that they were concerned that these stressors 
and barriers would negatively affect smaller advisers' ability to 
continue to serve their clients.\1054\ Another commenter stated that we 
had done ``little analysis'' about the impact of recent proposals on 
small broker-dealers, competition within the brokerage industry, and 
whether the proposals could contribute to barriers for new entrants 
into the markets.\1055\ We acknowledge these

[[Page 47774]]

commenters' concerns about smaller covered institutions and, as 
discussed above, understand that smaller covered institutions might be 
disproportionately affected by the final amendments.\1056\ In response 
to these concerns, we have changed the final amendments from the 
proposal. We expect that some of these changes may mitigate costs and 
may reduce, but not eliminate, the degree to which the final amendments 
act as a barrier to entry.\1057\ We have also responded to commenters' 
concerns by adopting longer compliance periods for all covered 
institutions relative to the proposal and an even longer compliance 
period for smaller covered institutions.\1058\ The final amendments 
provide 24 months for smaller covered institutions to comply with the 
final amendments after the date of publication in the Federal Register, 
compared to 18 months for larger covered institutions.\1059\ Since 
smaller covered institutions are those most likely to exit the market 
in response to high compliance costs, this longer compliance period 
will mitigate the negative effect of the final amendments on 
competition, for example by giving smaller covered institutions 
opportunities to learn about compliance with the final requirements 
from larger covered institutions' earlier compliance.\1060\
---------------------------------------------------------------------------

    \1054\ See IAA Comment Letter 1.
    \1055\ See ASA Comment Letter. In the Proposing Release, we 
discussed that the compliance costs of the proposed amendments could 
be higher for smaller covered institutions such as small broker-
dealers who do not have a national presence. See Proposing Release 
at section III.D.1.a. We also discussed the potential negative 
competitive effects of the proposed amendments on smaller covered 
institutions and requested comments on the way we characterized the 
effects on competition. See Proposing Release at sections III.F. and 
III.G. We received no comment letter discussing specifically how the 
proposed amendments would affect the level of competition in the 
different markets in which covered institutions operate.
    \1056\ See supra footnote 1051 and accompanying text.
    \1057\ These changes include (1) requiring that a service 
provider notify the affected covered institution of a breach in a 
period of 72 hours instead of 48 hours; and (2) requiring that 
covered institutions oversee, monitor, and conduct due diligence on 
their service providers to ensure that they take appropriate 
measures to protect customer information and notify the covered 
institution in case of breach instead of requiring written 
contracts. See supra section IV.D.1.c on the expected effects of 
these changes. Because smaller covered institutions are more likely 
to have limited bargaining power when negotiating with their service 
providers, we expect that these changes may particularly reduce the 
burdens on those entities and may reduce, but will not eliminate, 
the extent to which these requirements act as a barrier to entry.
    \1058\ The proposed compliance period was 12 months from 
effective date for all covered institutions. See Proposing Release 
at section II.I.
    \1059\ See supra Table 3 for a description of small covered 
institutions for the purposes of the final amendments' tiered 
compliance period.
    \1060\ See FSI Comment Letter (``We propose a longer 
implementation period for smaller broker-dealers and investments 
advisers to allow these firms to benefit from implementation for 
larger industry participants.'').
---------------------------------------------------------------------------

    With respect to competition among transfer agents, the situation 
could be different. Because transfer agents registered with a 
regulatory agency other than the Commission may already have been 
required to notify customers in case of breach,\1061\ whereas the 
transfer agents registered with the Commission may, before this 
adoption, have only been required, by State law, to notify the security 
issuer, the latter group may face disproportionately high compliance 
costs compared to the former group since they might have to design and 
implement new policies and procedures, including the required incident 
response program and notification procedures.\1062\ This might affect 
their competitiveness vis-[agrave]-vis the transfer agents registered 
with a regulatory agency other than the Commission.\1063\ Because 
transfer agents registered with the Commission may already have 
procedures in place to notify individuals affected by a data 
breach,\1064\ the magnitude of this effect is difficult to estimate.
---------------------------------------------------------------------------

    \1061\ See supra section IV.C.2.b.
    \1062\ In 2023, there were 251 transfer agents registered with 
the Commission and 64 transfer agents registered with another 
appropriate regulatory agency. See supra section IV.C.3.e.
    \1063\ In addition, because designing and implementing new 
policies and procedures entails fixed costs, competition among 
transfer agents registered with the Commission may be affected. See 
supra discussion of potential competition effects on covered 
institutions of different sizes.
    \1064\ See supra footnote 1002. In addition, we expect that many 
transfer agents already have some processes in place to contact 
customers since communicating information from the issuer to its 
security-holders is one of the core functions of transfer agents.
---------------------------------------------------------------------------

    One commenter supported the proposed extension of the scope of the 
safeguard and disposal rules to all transfer agents and stated that it 
would promote fair competition among these firms by reducing asymmetry 
in the requirements with which different types of transfer agents must 
comply.\1065\ We agree with this commenter that including all transfer 
agents in the scope of both the safeguards rule and the disposal rule 
will contribute to enhanced competition in the market for transfer 
agents.\1066\
---------------------------------------------------------------------------

    \1065\ See Better Markets Comment Letter.
    \1066\ In particular, applying the final amendments to all 
transfer agents may be beneficial for competition, to the extent 
that applying different regulations to different entities could 
exacerbate existing differences in the competitive landscape. See 
supra section IV.C.3.e (discussing that transfer agents registered 
with the Banking Agencies are on average smaller than transfer 
agents registered with the Commission).
---------------------------------------------------------------------------

    With respect to efficiency and competition among covered 
institutions' service providers, the overall effects of the final 
amendments are difficult to predict. The final amendments require 
covered institutions to ensure that their service providers protect 
against unauthorized access to or use of customer information and 
notify the covered institution in case of a breach. The final 
amendments also require covered institutions to oversee their service 
providers to ensure that these measures are enforced.\1067\ As 
discussed above,\1068\ we expect that most service providers will 
continue their relationships with covered institutions, but some 
service providers might not. We expect that four possible scenarios may 
happen:
---------------------------------------------------------------------------

    \1067\ See final rule 248.30(a)(5).
    \1068\ See supra section IV.D.1.c.
---------------------------------------------------------------------------

     Scenario 1: The service provider already has the processes 
and procedures in place to satisfy the covered institution's 
obligations under the final amendments and is willing to cooperate with 
the oversight activities of the covered institution.
     Scenario 2: The service provider does not have the 
necessary processes and procedures in place but is willing to adapt 
them to satisfy the covered institution's obligations under the final 
amendments and to cooperate with the oversight activities of the 
covered institution.
     Scenario 3: The service provider does not have the 
necessary processes and procedures in place and is not willing to adapt 
to satisfy the covered institution's obligation under the final 
amendments.\1069\
---------------------------------------------------------------------------

    \1069\ See supra section IV.C.3.f. Because taking the 
appropriate measures to satisfy the amendments' requirements entails 
fixed costs, we expect that smaller service providers are more 
likely to exit (or not enter) this market than larger service 
providers.
---------------------------------------------------------------------------

     Scenario 4: The service provider already has the processes 
and procedures in place to satisfy the covered institution's 
obligations under the final amendments but is not willing to cooperate 
with the oversight activities of the covered institution.
    Under scenarios 1 and 2, the relationship between the covered 
institution and its service provider is maintained. Hence, we do not 
expect significant effects on efficiency and competition in these 
cases.\1070\ On the other hand, scenarios 3 and 4 imply that the 
covered institution will have to either switch to a new service 
provider or perform the former service provider's functions in-house. 
If the covered institution is unable to find a new service provider 
that is equivalent in its ability to provide the services, this is 
likely to result in a second-best outcome for the covered institution 
and therefore to result in a loss of efficiency.\1071\

[[Page 47775]]

Scenario 4 could also lead to covered institutions being forced to 
switch away from large, established service providers and instead to 
rely on smaller, less established providers that may be less capable of 
addressing the vulnerabilities within its control. This situation could 
result in a reduced ability to protect customer information.
---------------------------------------------------------------------------

    \1070\ The other benefits and costs of these scenarios are 
discussed in section IV.D.1.c.
    \1071\ Under scenario 3, we expect this effect on efficiency to 
be limited since the service providers who are the most efficient at 
the outsourced function are likely to also be more effective at 
protecting customer information. We expect this effect to be more 
significant under scenario 4.
---------------------------------------------------------------------------

    Commenters identified service providers exiting the market as a 
significant potential cost of the proposed requirements.\1072\ We 
expect that the changes that we have made to the final amendments, 
including the change from a written contract requirement to a 
requirement to oversee service providers and the change to an extended 
notification deadline of 72 hours, will reduce the likelihood of 
scenario 4 by giving covered institutions more flexibility in how they 
choose to satisfy the service provider requirements of the final 
amendments.\1073\ This will reduce the likelihood of this potential 
negative outcome. However, such an outcome is still possible and to the 
extent that it occurs, it will represent a cost of the final 
amendments.
---------------------------------------------------------------------------

    \1072\ See ACLI Comment Letter (``If service providers are 
unable or unwilling to change their practices, this requirement 
could cause regulated entities to end essential service provider 
arrangements with inadequate alternatives''); SIFMA Comment Letter 2 
(``Indeed, some service providers may not agree to the contemplated 
new terms, which could limit the number of service providers that 
agree to such requirements, causing an undue reliance on a small 
group of service providers in the industry. Another possible result 
is that the least commercially savvy service providers would agree 
to these terms, which could increase unqualified providers working 
in the industry.''); CAI Comment Letter (``In practice, this will 
often force covered institutions to choose between either using the 
best and most dependable service providers or complying with these 
regulatory requirements, since many leading service providers (such 
as cloud service providers) do not negotiate the standard terms of 
their services with customers and those standard terms generally 
would not meet the proposed contractual requirements.'').
    \1073\ See supra section II.A.4. In addition, some commenters 
mentioned costs associated specifically with written contracts. See, 
e.g., ASA Comment Letter; IAA Comment Letter 1. These contracting 
costs could also apply to service providers and potentially result 
in these service providers terminating their relationship with 
covered institutions.
---------------------------------------------------------------------------

    Because scenarios 3 and 4 result in service providers exiting the 
market, they also have effects on competition. While scenario 3 would 
result in an overall decrease in the number of service providers 
available to covered institutions, it would not necessarily reduce 
competition among service providers who are able and willing to satisfy 
covered institutions' requirements. In fact, the final amendments will 
prevent service providers that are not willing to satisfy the minimum 
requirements from operating in that market and from potentially 
undercutting service providers who do satisfy the requirements. This 
will improve the competitiveness of the service providers who are able 
and willing to satisfy the requirements. The situation is different for 
scenario 4, which would result in a decrease in the number of service 
providers with adequate customer information safeguards and 
notification procedures. This would result in a decrease in 
competition, and this is a potential cost of the regulation.
    One commenter stated that the proposed amendments could lead to 
service providers not agreeing with the new requirements, adding that 
it could result in covered institutions relying on a small group of 
service providers in the industry.\1074\ This commenter also stated 
that some service providers may choose not to enter into agreements 
with covered institutions as a result of the proposed amendments.\1075\ 
We acknowledge that this is a risk of the final amendments. However, we 
expect that the modifications that we have made to the service provider 
provisions of the final amendments will reduce the costs to service 
providers of satisfying covered institutions' requirements,\1076\ and 
might therefore reduce the likelihood of this potential negative 
outcome.
---------------------------------------------------------------------------

    \1074\ See SIFMA Comment Letter 2.
    \1075\ See id.
    \1076\ See supra section IV.D.1.c.
---------------------------------------------------------------------------

    Because of the reasons described above,\1077\ we are unable to 
estimate the likelihood of the different scenarios and, therefore, we 
are unable to quantify the efficiency and competition effects of the 
service provider provisions of the final amendments.
---------------------------------------------------------------------------

    \1077\ See id.
---------------------------------------------------------------------------

    Some commenters requested that the Commission consider interactions 
between the effects of the proposed rule and other recent Commission 
rules, as well as practical realities such as implementation 
timelines.\1078\ As discussed above, the Commission acknowledges that 
overlapping compliance periods may in some cases increase costs, 
particularly for smaller entities with more limited compliance 
resources.\1079\ This effect can negatively impact competition because 
these entities may be less able to absorb or pass on these additional 
costs, making it difficult for them to remain in business or compete. 
We acknowledge that to the extent overlap occurs, there could be costs 
that could affect competition. However, we do not expect these costs to 
be significant, for two reasons. First, the final amendments mitigate 
overall costs relative to the proposal,\1080\ including by adopting 
longer compliance periods for all covered institutions, and an even 
longer compliance period for smaller covered institutions because they 
may have more limited compliance resources. The final amendments also 
reduce costs for both larger and smaller entities, relative to the 
proposal, notably by removing the proposed requirement to have a 
written contract with service providers. Thus, any higher costs or 
potential negative effects on competition due to overlapping compliance 
periods raised in the context of the proposal may be mitigated under 
the final amendments. Second, as explained in section IV.D, many of the 
rules commenters named affect limited sets of covered institutions, and 
the compliance dates are generally spread out over a more than three-
year period, including several that precede the compliance dates of the 
final amendments. These factors will limit the incidence of covered 
institutions affected by overlapping compliance dates.
---------------------------------------------------------------------------

    \1078\ See supra section IV.C.
    \1079\ See supra section IV.D.
    \1080\ See supra section IV.B.
---------------------------------------------------------------------------

    Additionally, we anticipate that neither the recordkeeping 
provisions nor the exception from annual privacy notice delivery 
requirements will have a notable impact on efficiency, competition, or 
capital formation due to their limited economic effects.\1081\ As 
discussed elsewhere, we do not expect the recordkeeping requirements to 
impose material compliance costs, and we therefore expect the economic 
effects of the exception to be limited. And, as the economic effects of 
the recordkeeping provisions are limited, any overlapping compliance 
dates involving recordkeeping will likewise have limited effect on 
competition.
---------------------------------------------------------------------------

    \1081\ See final rule 248.30(c) and final rule 248.5; see also 
supra sections IV.D.3 and IV.D.4.
---------------------------------------------------------------------------

F. Reasonable Alternatives Considered

    In formulating the final amendments, we have considered various 
reasonable alternatives. These alternatives are discussed below.
1. Reasonable Assurances From Service Providers
    Rather than requiring the establishment, maintenance, and 
enforcement of written policies and procedures reasonably designed to

[[Page 47776]]

require oversight, including through due diligence and monitoring, of 
service providers to ensure service providers take appropriate measures 
to protect against unauthorized access to or use of customer 
information and provide notification to the covered institution if a 
breach of security occurs,\1082\ the Commission considered requiring 
covered institutions to obtain ``reasonable assurances'' from service 
providers instead. One commenter supported this alternative for some 
service providers.\1083\ This alternative requirement would be a lower 
threshold than the final provisions requiring the establishment, 
maintenance, and enforcement of written policies and procedures 
designed to require oversight, and as such would be less costly to 
reach but also less protective for customers.
---------------------------------------------------------------------------

    \1082\ See final rule 248.30(a)(5)(i).
    \1083\ See SIFMA Comment letter 2. Other commenters also 
suggested alternative thresholds that would be lower than the final 
amendments' provisions. See, e.g., IAA Comment Letter 1; AWS Comment 
Letter.
---------------------------------------------------------------------------

    Under this alternative we would have used the final amendments' 
definition of ``service provider,'' which is ``any person or entity 
that receives, maintains, processes, or otherwise is permitted access 
to customer information through its provision of services directly to a 
covered institution.'' \1084\ Thus, similar to the final amendments, 
this alternative could affect a broad range of service providers 
including, potentially: email providers, customer relationship 
management systems, cloud applications, and other technology vendors. 
Depending on the States where they operate, these service providers may 
already be subject to State laws applicable to businesses that 
``maintain'' computerized data containing private information.\1085\ 
Additionally, it is likely that any service provider that offers a 
service involving the maintenance of customer information to U.S. 
financial firms generally, or to any specific financial firm with a 
national presence, has processes in place to ensure compliance with 
these State laws.
---------------------------------------------------------------------------

    \1084\ Final rule 248.30(d)(10).
    \1085\ See, e.g., Cal. Civil Code section 1798.81.5(b) and 
1798.82(b); N.Y. Gen. Bus. Law section 899-AA(3).
---------------------------------------------------------------------------

    For those service providers that provide specialized services aimed 
at covered institutions, this alternative would, like the final 
amendments, create market pressure to enhance service offerings so as 
to provide the requisite assurances and facilitate covered 
institutions' compliance with the requirements.\1086\ These service 
providers might have little choice other than to adapt their services 
to provide the required assurances, which would result in additional 
costs for the service providers related to adapting business processes 
to accommodate the requirements. In general, we expect these costs 
would be limited in scale in the same ways the costs of the final 
amendments are limited in scale: specialized service providers are 
adapted to operating in a highly regulated industry and are likely to 
have policies and procedures in place to facilitate compliance with 
State data breach laws. And, as with the final amendments, we generally 
anticipate that such costs would largely be passed on to covered 
institutions and ultimately their customers. As compared to the final 
amendments' requirements, we expect that ``reasonable assurances'' 
would in many cases require fewer changes to business processes and, 
accordingly, lower costs.\1087\ However, this alternative--without 
more--could also be less protective than the final amendments.
---------------------------------------------------------------------------

    \1086\ A service provider involved in any business-critical 
function likely ``receives, maintains, processes, or otherwise is 
permitted access to customer information.'' See final rule 
248.30(d)(10).
    \1087\ See supra section II.A.4 for a discussion of sufficient 
safeguards for ensuring compliance with covered institution's 
obligations under the final amendments.
---------------------------------------------------------------------------

    With respect to service providers providing services aimed at a 
broad range of institutions (e.g., email, or customer-relationship 
management), the situation could be different. For these providers, 
covered institutions are likely to represent a small fraction of their 
customer base. As under the final service provider provisions, these 
service providers may again be unwilling to adapt their business 
processes to the regulatory requirements of a small subset of their 
customers under this alternative.\1088\ Some may be unwilling to make 
the assurances needed, although we anticipate that they would be 
generally more willing to make assurances than to participate in the 
covered institutions' oversight activities.\1089\ If the covered 
institution could not obtain the reasonable assurances required under 
this alternative, the covered institution would need to switch service 
providers and bear the associated switching costs, while the service 
providers would suffer loss of customers. Although the costs of 
obtaining reasonable assurances would likely be lower than under the 
final service provider provisions, and the need to switch providers 
less frequent, these costs could nonetheless be particularly acute for 
smaller covered institutions who lack bargaining power with some 
service providers. And, as outlined above, this alternative would be 
less protective than the final amendments' requirements.
---------------------------------------------------------------------------

    \1088\ See supra section IV.D.1.c (discussing the final 
requirement for covered institutions to require policies and 
procedures reasonably designed to oversee, monitor, and conduct due 
diligence on service providers).
    \1089\ See id. Additionally, the service provider's standard 
terms and conditions might in some situations provide reasonable 
assurances adequate to meet the requirement.
---------------------------------------------------------------------------

2. Lower Threshold for Customer Notice
    The Commission considered lowering the threshold for customer 
notice, such as one based on the ``possible misuse'' of sensitive 
customer information (rather than the adopted threshold requiring 
notice when sensitive customer information was, or is reasonably likely 
to have been, accessed or used without authorization), or even 
requiring notification of any breach without exception. One commenter 
suggested that the final amendments require notification when the 
unauthorized access to or use of sensitive customer information was 
``reasonably possible'' instead of ``reasonably likely.'' \1090\ A 
lower threshold would increase the number of notices customers receive. 
Although more frequent notices could potentially reveal incidents that 
warrant customers' attention and thereby potentially increase the 
benefits accruing to customers from the notice requirement discussed in 
section IV.D.1.b, they would also increase the number of false alarms. 
Such false alarms could be problematic if they reduce customers' 
ability to discern which notices require action.
---------------------------------------------------------------------------

    \1090\ See NASAA Comment Letter. In addition, another commenter 
suggested requiring customer notification for any incident of 
unauthorized access to or use of sensitive customer information 
regardless of the risk of use in a manner that would result in 
substantial harm or inconvenience. See Better Markets Comment 
Letter.
---------------------------------------------------------------------------

    Although a lower threshold could impose some additional compliance 
costs on covered institutions (due to additional notices being sent), 
we would not anticipate the additional direct compliance costs to be 
significant.\1091\ Of more economic significance to covered 
institutions would be the resulting reputational effects.\1092\ 
However, the direction of these effects is difficult to predict. On the 
one hand, increased notices resulting from a lower threshold can be 
expected to lead to additional reputational costs for firms

[[Page 47777]]

required to issue more of such notices. On the other hand, lower 
thresholds could result in customers receiving a large number of 
notices. In this case, notices could become no longer notable, likely 
leading to the negative reputation effects associated with such notices 
being reduced.
---------------------------------------------------------------------------

    \1091\ The direct compliance costs of notices are discussed in 
section V.
    \1092\ See supra section IV.B.
---------------------------------------------------------------------------

3. Encryption Safe Harbor
    The Commission considered including a safe harbor to the 
notification requirement for breaches in which only encrypted 
information was compromised. Several commenters supported an encryption 
safe harbor.\1093\ An encryption safe harbor would also align with many 
existing State laws.\1094\ Assuming that such an alternative safe 
harbor would be sufficiently circumscribed to prevent its application 
to insecure encryption algorithms, or to secure algorithms used in a 
manner as to render them insecure, the economic effects of its 
inclusion would be largely indistinguishable from the final amendments. 
This is because under the final amendments, notification is triggered 
by the ``reasonable likelihood'' that sensitive customer information 
was accessed or used without authorization.\1095\ Given the 
computational complexity involved in deciphering information encrypted 
using modern encryption algorithms and secure procedures,\1096\ the 
compromise of such encrypted information would generally not give rise 
to ``a reasonably likely risk of substantial harm or inconvenience to 
an individual identified with the information.'' \1097\ It would thus 
not constitute ``sensitive customer information,'' meaning that the 
threshold for providing notice would not be met. In addition, when 
determining that the compromised sensitive customer information has not 
been, and is not reasonably likely to be, used in a manner that would 
result in substantial harm or inconvenience, a covered institution may 
consider encryption as a factor.\1098\ Hence, in some cases, an 
explicit encryption safe harbor would be superfluous. In certain other 
cases, however, an explicit encryption safe harbor may not be as 
protective as the final amendments' Federal minimum standard for 
determining whether the compromise of customer information could create 
``a reasonably likely risk of substantial harm or inconvenience to an 
individual identified with the information.'' \1099\ It may also become 
outdated as technologies and security practices evolve. Thus, while an 
explicit (and appropriately circumscribed) safe harbor could provide 
some procedural efficiencies from streamlined application, it could 
also be misapplied.
---------------------------------------------------------------------------

    \1093\ See, e.g., SIFMA Comment Letter 2; AWS Comment Letter 1. 
See also supra section II.A.3.b for a discussion of the comments 
received on this matter.
    \1094\ See supra section IV.C.2.a(1).
    \1095\ See final rule 248.30(a)(3)(iii).
    \1096\ Here, ``secure procedures'' refers to the secure 
implementation of encryption algorithms and encompasses proper key 
generation and management, timely patching, user access controls, 
etc.
    \1097\ See final rule 248.30(d)(9); see also supra footnotes 139 
and 141 and accompanying text.
    \1098\ See final rule 248.30(a)(4); see also supra footnote 138 
and accompanying text.
    \1099\ See final rule 248.30(d)(9). The Aug. 2022 breach of the 
LastPass cloud-based password manager provides an illustrative 
example. In this data breach a large database of website credentials 
belonging to LastPass customers was exfiltrated. The customer 
credentials in this database were encrypted using a secure algorithm 
and the encryption keys could not have been exfiltrated in the 
breach, so an encryption safe harbor could be expected to apply in 
such a case. Nonetheless, customers whose encrypted passwords were 
divulged in the breach became potential targets for brute force 
attacks (i.e., attempts to decrypt the passwords by guessing a 
customer's master password) and to phishing attacks (i.e., attempts 
to induce an affected customer to divulge the master password). See 
Karim Toubba, Notice of Recent Security Incident, LastPass (Dec. 22, 
2022), available at https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/; see also Craig Clough, LastPass Security 
Breach Drained Bitcoin Wallet, User Says, Portfolio Media (Jan. 4, 
2023), available at https://www.law360.com/articles/1562534/lastpass-security-breach-drained-bitcoin-wallet-user-says.
---------------------------------------------------------------------------

4. Longer Customer Notification Deadlines
    The Commission considered incorporating longer customer 
notification deadlines, such as 60 or 90 days instead of the adopted 30 
days, as well as providing no fixed customer notification deadline. 
Several commenters suggested longer customer notification 
deadlines.\1100\ Although longer notification deadlines would provide 
more time for covered institutions to rebut the presumption of 
notification discussed in section II.A.3.a, we expect that longer 
investigations would, in general, correlate with more serious or 
complicated incidents and would therefore be unlikely to end in a 
determination that sensitive customer information has not been and is 
not reasonably likely to be used in a manner that would result in 
substantial harm or inconvenience. We therefore do not expect that 
longer notification deadlines would ultimately lead to significantly 
fewer required notifications. Compliance costs conditional on notices 
being required (i.e., the actual furnishing of notices to customers) 
would be largely unchanged under alternative notice deadlines. That 
said, costs related to incident assessment would likely be somewhat 
lower due to the reduced urgency of determining the scope of an 
incident and a reduced likelihood that notifications would need to be 
made before an incident has been contained.\1101\ Arguably, longer 
notification deadlines may increase reputational costs borne by covered 
institutions that choose to take advantage of the longer deadlines. 
Overall, however, we do not expect that longer notification deadlines 
would lead to costs for covered institutions that differ significantly 
from the costs of the adopted 30-day outside timeframe.
---------------------------------------------------------------------------

    \1100\ See, e.g., FSI Comment Letter; IAA Comment Letter 1. See 
also supra footnote 796 and accompanying text and supra section 
II.A.3.d(1) for a discussion of the comments received on this 
matter.
    \1101\ See supra section IV.D.1.b(2).
---------------------------------------------------------------------------

    Providing for longer notifications deadlines would likely reduce 
the promptness with which some covered institutions issue notifications 
to customers, potentially reducing their customers' ability to take 
effective mitigating actions. In particular, as discussed in section 
IV.D.1.b(2), some breaches are discovered very quickly. For customers 
whose sensitive customer information is compromised in such breaches, a 
longer notification deadline could significantly reduce the 
timeliness--and value--of the notice.\1102\ On the other hand, where a 
public announcement could hinder containment efforts, a longer 
notification timeframe could yield benefits to the broader public (and/
or to the affected investors).\1103\
---------------------------------------------------------------------------

    \1102\ See supra footnote 784 and accompanying text.
    \1103\ See supra footnote 803 and accompanying text.
---------------------------------------------------------------------------

5. Broader National Security and Public Safety Delay in Customer 
Notification
    The Commission considered providing for a broader delay to the 30-
day notification outside timeframe by extending its applicability to 
cases where any appropriate law enforcement agency requests the 
delay.\1104\ This alternative delay would more closely align with the 
delays adopted by other regulators, such as the Banking

[[Page 47778]]

Agencies,\1105\ and by many States.\1106\ Several commenters suggested 
broader delays.\1107\ On the other hand, another commenter stated that 
the Commission should not allow for any law enforcement delay.\1108\
---------------------------------------------------------------------------

    \1104\ The final amendments differ from the proposal in that 
they allow for a longer national security and public safety delay 
under certain circumstances and allow for a delay if the notice 
poses a substantial risk to either public safety or national 
security (the proposal referred to national security risk only). 
However, the final amendments allow for such a delay only if the 
Attorney General informs the Commission, in writing, of such risk. 
See supra section II.A.3.d(2).
    \1105\ See Banking Agencies' Incident Response Guidance.
    \1106\ See, e.g., RCW 19.255.010(8); Fla. Stat. section 
501.171(4)(b).
    \1107\ See, e.g., Nasdaq Comment Letter; ICI Comment Letter 1.
    \1108\ See Better Markets Comment Letter.
---------------------------------------------------------------------------

    The principal function of a law enforcement delay is to allow a law 
enforcement or national security agency to prevent cybercriminals from 
becoming aware of their detection. Observing a cyberattack that is in 
progress can allow investigators to take actions that can assist in 
revealing the attacker's location, identity, or methods.\1109\ 
Notifying affected customers has the potential to alert attackers that 
their intrusion has been detected, hindering these efforts.\1110\ Thus, 
a broader delay could generally be expected to enhance law 
enforcement's efficacy in cybercrime investigations, which would 
potentially benefit affected customers through damage mitigation and 
benefit the general public through improved deterrence and increased 
recoveries, and by enhancing law enforcement's knowledge of attackers' 
methods. It would also potentially reduce compliance costs for covered 
institutions by aligning more closely with the existing regulations 
discussed above.\1111\
---------------------------------------------------------------------------

    \1109\ Cybersecurity Advisory: Technical Approaches to 
Uncovering and Remediating Malicious Activity, Cybersecurity & 
Infrastructure Sec. Agency (Sept. 24, 2020), available at https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-245a 
(explaining how and why investigators may ``avoid tipping off the 
adversary that their presence in the network has been discovered'').
    \1110\ Id.
    \1111\ See supra section IV.C.2.
---------------------------------------------------------------------------

    That said, use of the delay provisions would necessarily result in 
customers affected by a cyberattack being notified later, reducing the 
value to customers of such notices.\1112\ Incidents where law 
enforcement would like to delay customer notifications are likely to 
involve numerous customers, who--without timely notice--may be unable 
to take timely mitigating actions that could prevent additional 
harm.\1113\ Law enforcement investigations can also take time to 
resolve and, even when successful, their benefits to affected customers 
(e.g., recovery of criminals' ill-gotten gains) may be limited.
---------------------------------------------------------------------------

    \1112\ See supra footnote 784 and accompanying text.
    \1113\ See supra section IV.D.1.b(2).
---------------------------------------------------------------------------

    Information about cybercrime investigations is often confidential. 
The Commission does not have data on the prevalence of covert 
cybercrime investigations, their success or lack of success, their 
deterrent effect if any, or the impact of customer notification on 
investigations.\1114\ No commenter suggested such data. Thus, we are 
unable to quantify the costs and benefits of this alternative.\1115\
---------------------------------------------------------------------------

    \1114\ We do, however, have evidence that requests by law 
enforcement to delay customer notification are relatively rare 
events. See supra footnote 806.
    \1115\ We requested public comment on these topics in the 
Proposing Release but did not receive any.
---------------------------------------------------------------------------

V. Paperwork Reduction Act

A. Introduction

    Certain provisions of the final amendments contain ``collection of 
information'' requirements within the meaning of the Paperwork 
Reduction Act of 1995 (``PRA'').\1116\ We are submitting the final 
collection of information to the Office of Management and Budget 
(``OMB'') for review in accordance with the PRA.\1117\ The safeguards 
rule and the disposal rule we are amending will have an effect on the 
currently approved existing collection of information under OMB Control 
No. 3235-0610, the title of which is, ``Rule 248.30, Procedures to 
safeguard customer records and information; disposal of consumer report 
information.'' \1118\ An agency may not conduct or sponsor, and a 
person is not required to respond to, a collection of information 
unless it displays a currently valid OMB control number. The amended 
requirement to adopt policies and procedures constitutes a collection 
of information requirement under the PRA. The collection of information 
associated with the final amendments will be mandatory, and responses 
provided to the Commission in the context of its examination and 
oversight program concerning the final amendments will be kept 
confidential subject to the provisions of applicable law. A description 
of the final amendments, including the need for the information and its 
use, as well as a description of the types of respondents, can be found 
in section II above, and a discussion of the expected economic effects 
of the final amendments can be found in section III above. The 
Commission published notice soliciting comments on the collection of 
information requirements in the Proposing Release and submitted the 
proposed collections of information to OMB for review in accordance 
with 44 U.S.C. 3507(d) and 5 CFR 1320.11.
---------------------------------------------------------------------------

    \1116\ 44 U.S.C. 3501 through 3521.
    \1117\ 44 U.S.C. 3507(d); 5 CFR 1320.11.
    \1118\ The paperwork burden imposed by Regulation S-P's notice 
and opt-out requirements, 17 CFR 248.1 to 248.18, is currently 
approved under a separate OMB control number, OMB Control No. 3235-
0537. The final amendments will implement a statutory exception that 
has been in effect since late 2015. We do not believe that the 
amendment to implement the statutory exception makes any substantive 
modifications to this existing collection of information requirement 
or imposes any new substantive recordkeeping or information 
collection requirements within the meaning of the PRA. Similarly, we 
do not believe that the final amendments to: (i) Investment Company 
Act rules 31a-1(b) (OMB control number 3235-0178) and 31a-2(a) (OMB 
control number 3235-0179) for investment companies that are 
registered under the Investment Company Act, (ii) Investment 
Advisers Act rule 204-2 (OMB control number 3235-0278) for 
investment advisers, (iii) Exchange Act rule 17a-4 (OMB control 
number 3235-0279) for broker-dealers, and (iv) Exchange Act rule 
17Ad-7 (OMB control number 3235-0291) for transfer agents, makes any 
modifications to this existing collection of information requirement 
or imposes any new recordkeeping or information collection 
requirements. Accordingly, we believe that the current burden and 
cost estimates for the existing collection of information 
requirements remain appropriate, and we believe that the final 
amendments should not impose substantive new burdens on the overall 
population of respondents or affect the current overall burden 
estimates for this collection of information. We are, therefore, not 
revising any burden and cost estimates in connection with these 
amendments.
---------------------------------------------------------------------------

    The Commission did not receive any comments that specifically 
addressed the estimated PRA analysis in the Proposing Release but did 
receive comments regarding the costs and burdens of the proposed rules 
generally. Those comments are discussed in more detail in section IV 
above. In particular, several commentators raised concerns regarding 
the costs associated with negotiating and renegotiating written 
contracts with service providers.\1119\ One commenter did support the 
proposed written contract provision due to its very narrow scope.\1120\ 
In response to commenters' concerns about the costs of negotiating 
contracts, we have replaced the proposed requirement for a covered 
institution to have a written contract with a service provider with a 
requirement to implement written policies and procedures to oversee, 
monitor, and conduct due diligence on the service provider. In a 
modification from the proposal, rather than requiring written policies 
and procedures requiring the covered institution to

[[Page 47779]]

enter into a written contract with its service providers to take 
certain appropriate measures, the policies and procedures required by 
the final amendments must be reasonably designed to ensure service 
providers take appropriate measures to: (A) protect against 
unauthorized access to or use of customer information; and (B) provide 
notification to the covered institution regarding an incident affecting 
customer information in the timeframes and circumstances discussed 
above. The modifications to the proposal are designed to address many 
of commenters' concerns regarding the costs associated with the service 
provider provisions of the proposed amendments. We have not reduced the 
Proposing Release's PRA estimates, however, because the final 
amendments still require policies and procedures regarding service 
providers that we estimate will involve PRA burdens consistent with 
those we estimated for the proposed requirement. As discussed above, 
some commenters urged for more time to investigate incidents, 
suggesting that failing to do so would result in an increase in the 
amount of notices being provided.\1121\ We are increasing the estimates 
associated with the final rule with regards to the preparation and 
distribution of notices because these comments seem to suggest a view 
that the proposed estimates related to these burdens were too low. We 
have also adjusted the proposal's estimated annual burden hours and 
total time costs to reflect updated wage rates.
---------------------------------------------------------------------------

    \1119\ See STA and ComputerShares Comment Letters (transfer 
agents don't have the leverage to negotiate contracts with service 
providers); ASA Comment Letter (no discussion or estimate of the 
costs the written contract requirement would impose on brokers); IAA 
Comment Letter (individual advisers, particularly smaller advisers, 
lack leverage to engage in contractual negotiations with many 
service providers); ACLI Comment Letter; Cambridge Comment Letter; 
CAI Comment Letter; AWS Comment Letter; Google Comment Letter. Other 
commenters raised this issue but suggested extending the 
implementation period as a remedy. See NASDAQ Comment Letter; FIF 
Comment Letter; SIFMA Comment Letter 2.
    \1120\ See ICI Comment Letter.
    \1121\ See, e.g., supra footnote 165 and accompanying text.
---------------------------------------------------------------------------

B. Amendments to the Safeguards Rule and Disposal Rule

    As discussed above, the final amendments to the safeguards rule 
will require covered institutions to develop, implement, and maintain 
written policies and procedures that include incident response programs 
reasonably designed to detect, respond to, and recover from 
unauthorized access to or use of customer information, including 
customer notification procedures. The response program must include 
procedures to assess the nature and scope of any incident involving 
unauthorized access to or use of customer information; take appropriate 
steps to contain and control the incident; and provide notice to each 
affected individual whose sensitive customer information was, or is 
reasonably likely to have been, accessed or used without authorization 
(unless the covered institution makes certain determinations as 
specified in the final amendments).
    The final amendments to the disposal rule will require covered 
institutions that maintain or otherwise possess customer information, 
or consumer information to adopt and implement written policies and 
procedures that address proper disposal of such information, which will 
include taking reasonable measures to protect against unauthorized 
access to or use of the information in connection with its disposal.
    Finally, the final amendments will require covered institutions 
other than funding portals to make and maintain written records 
documenting compliance with the requirements of the safeguards rule and 
the disposal rule. Under the final amendments, the time periods for 
preserving records will vary by covered institution to be consistent 
with existing recordkeeping rules.\1122\
---------------------------------------------------------------------------

    \1122\ The final amendments will also broaden the scope of 
information covered by the safeguards rule and the disposal rule (to 
include all customer information in the possession of a covered 
institution or is handled or maintained on its behalf, and all 
consumer information that a covered institution maintains or 
otherwise possesses for a business purpose) and extend the 
application of the safeguards provisions to transfer agents 
registered with the Commission or another appropriate regulatory 
agency. These amendments do not contain collections of information 
beyond those related to the incident response program analyzed 
above.
---------------------------------------------------------------------------

    Based on FOCUS Filing, Form BD Filing, and Form BD-N data, as of 
the third quarter of 2023, there were 3,476 brokers or dealers, other 
than notice-registered brokers or dealers or funding portals. Based on 
Investment Adviser Registration Depository data, as of Oct. 5, 2023, 
there were 15,565 investment advisers registered with the Commission. 
As of Sept. 30, 2023, there were 13,766 investment companies.\1123\ 
Based on Form TA-1, as of Sept. 30, 2023, there were 251 transfer 
agents registered with the Commission and 64 transfer agents registered 
with the Banking Agencies. Based on staff analysis and publicly 
available filings, as of Dec. 31, 2023, there were 92 funding portals.
---------------------------------------------------------------------------

    \1123\ Data on investment companies registered with the 
Commission comes from Form N-CEN filings; data on BDCs comes from 
LSEG BDC Collateral; and data on employees' securities companies 
comes from Form 40-APP. See supra Table 4.
---------------------------------------------------------------------------

    Table 5 below summarizes our PRA initial and ongoing annual burden 
estimates associated with the final amendments to the safeguards rule 
and the disposal rule.

                                              Table 5--Amendments to Safeguards Rule and Disposal Rule--PRA
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                        Internal initial     Internal annual burden                                                 Annual external cost
                                          burden hours              hours \1\            Wage rate \2\        Internal time cost           burden
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                   PROPOSED ESTIMATES
--------------------------------------------------------------------------------------------------------------------------------------------------------
Adopting and implementing policies   60 hours..............  25 hours \3\..........  $455 (blended rate     $11,375 (equal to the  $2,655.\4\
 and procedures.                                                                      for compliance         internal annual
                                                                                      attorney and           burden x the wage
                                                                                      assistant general      rate).
                                                                                      counsel).
Preparation and distribution of      9 hours...............  8 hours \5\...........  $300 (blended rate     $2,400 (equal to the   $2,018.\6\
 notices.                                                                             for senior             internal annual
                                                                                      compliance examiner    burden x the wage
                                                                                      and compliance         rate).
                                                                                      manager).
Recordkeeping......................  1 hour................  1 hour................  $381 (blended rate     $381.................  $0.
                                                                                      for compliance
                                                                                      attorney and senior
                                                                                      programmer).
Total new annual burden per covered  ......................  34 hours (equal to the  .....................  $14,156 (equal to the  $4,673 (equal to the
 institution.                                                 sum of the above                               sum of the above       sum of the above two
                                                              three boxes).                                  three boxes).          boxes).
Number of covered institutions.....  ......................  x 32,897 covered        .....................  x 32,897 covered       16,449.\8\
                                                              institutions \7\.                              institutions.
Total new annual aggregate burden..  ......................  1,118,498 hours.......  .....................  $465,689,932.........  $76,866,177.
--------------------------------------------------------------------------------------------------------------------------------------------------------

[[Page 47780]]

 
                                                                     FINAL ESTIMATES
         Broker-dealers other than notice registered broker-dealers, investment advisers registered with the Commission and investment companies
--------------------------------------------------------------------------------------------------------------------------------------------------------
Adopting and implementing policies   60 hours..............  25 hours \3\..........  $501 (blended rate     $12,525 (equal to the  $2,920.\9\
 and procedures.                                                                      for compliance         internal annual
                                                                                      attorney and           burden x the wage
                                                                                      assistant general      rate).
                                                                                      counsel).
Preparation and distribution of      12 hours..............  9 hours \5\...........  $329 (blended rate     $2,961 (equal to the   $2,217.\10\
 notices.                                                                             for senior             internal annual
                                                                                      compliance examiner    burden x the wage
                                                                                      and compliance         rate).
                                                                                      manager).
Recordkeeping......................  1 hour................  1 hour................  $420 (blended rate     $420.................  $0.
                                                                                      for compliance
                                                                                      attorney and senior
                                                                                      programmer).
Total new annual burden per          ......................  35 hours (equal to the  .....................  $15,906 (equal to the  $5,137 (equal to the
 applicable covered institution.                              sum of the above                               sum of the above       sum of the above two
                                                              three boxes).                                  three boxes).          boxes).
Number of applicable covered         ......................  x 32,807 covered        .....................  x 32,807 covered       16,404.\8\
 institutions.                                                institutions \11\.                             institutions.
New annual applicable covered        ......................  1,148,245 hours.......  .....................  $521,828,142.........  $84,267,348.
 institutions aggregate burden.
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                     Transfer Agents
--------------------------------------------------------------------------------------------------------------------------------------------------------
Adopting and implementing policies   75 hours..............  30 hours \12\.........  $501 (blended rate     $15,030 (equal to the  $2,920.\9\
 and procedures.                                                                      for compliance         internal annual
                                                                                      attorney and           burden x the wage
                                                                                      assistant general      rate).
                                                                                      counsel).
Preparation and distribution of      12 hours..............  9 hours \5\...........  $329 (blended rate     $2,961 (equal to the   $2,217.\10\
 notices.                                                                             for senior             internal annual
                                                                                      compliance examiner    burden x the wage
                                                                                      and compliance         rate).
                                                                                      manager).
Recordkeeping......................  1 hour................  1 hour................  $420 (blended rate     $420.................  $0.
                                                                                      for compliance
                                                                                      attorney and senior
                                                                                      programmer).
Total new annual burden per          ......................  40 hours (equal to the  .....................  $18,411 (equal to the  $5,137 (equal to the
 transfer agent.                                              sum of the above                               sum of the above       sum of the above two
                                                              three boxes).                                  three boxes).          boxes).
Number of transfer agents..........  ......................  x 315 \13\............  .....................  x 315................  158.\8\
New annual transfer agent aggregate  ......................  12,600................  .....................  $5,799,465...........  $811,646.
 burden.
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                                     Funding Portals
--------------------------------------------------------------------------------------------------------------------------------------------------------
Adopting and implementing policies   60 hours..............  25 hours \3\..........  $501 (blended rate     $12,525 (equal to the  $2,920.\9\
 and procedures.                                                                      for compliance         internal annual
                                                                                      attorney and           burden x the wage
                                                                                      assistant general      rate).
                                                                                      counsel).
Preparation and distribution of      12 hours..............  9 hours \5\...........  $329 (blended rate     $2,961 (equal to the   $2,217.\10\
 notices.                                                                             for senior             internal annual
                                                                                      compliance examiner    burden x the wage
                                                                                      and compliance         rate).
                                                                                      manager).
Recordkeeping......................  1.5 hours \14\........  1.5 hours.............  $420 (blended rate     $630.................  $0.
                                                                                      for compliance
                                                                                      attorney and senior
                                                                                      programmer).
Total new annual burden per funding  ......................  35.5 hours (equal to    .....................  $16,116 (equal to the  $5,137 (equal to the
 portal.                                                      the sum of the above                           sum of the above       sum of the above two
                                                              three boxes).                                  three boxes).          boxes).
Number of funding portals..........  ......................  x 92..................  .....................  x 92.................  46.\8\
New annual funding portal aggregate  ......................  3,266.................  .....................  $1,482,672...........  $236,302.
 burden.
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                     Total Estimated Burdens of the Final Amendments
--------------------------------------------------------------------------------------------------------------------------------------------------------
Total new annual aggregate burden..  ......................  1,164,111 hours.......  .....................  $529,110,279.........  $85,315,296.
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                      TOTAL ESTIMATED BURDENS INCLUDING AMENDMENTS
--------------------------------------------------------------------------------------------------------------------------------------------------------
Current aggregate annual burden      ......................  +65,760 hours.........  .....................  .....................  +$0.
 estimates.
Revised aggregate annual burden      ......................  1,229,871 hours.......  .....................  $529,110,279.........  $85,315,296.
 estimates.
--------------------------------------------------------------------------------------------------------------------------------------------------------
Notes:
\1\ Includes initial burden estimates annualized over a 3-year period.
\2\ The Commission's estimates of the relevant wage rates are based on the SIFMA Wage Report. The estimated figures are modified by firm size, employee
  benefits, overhead, and adjusted to account for the effects of inflation.
\3\ Includes initial burden estimates annualized over a three-year period, plus 5 hours of ongoing annual burden hours. The estimate of 25 hours is
  based on the following calculation: ((60 initial hours/3) + 5 hours of additional ongoing burden hours) = 25 hours.

[[Page 47781]]

 
\4\ This estimated burden is based on the estimated wage rate of $531/hour, for 5 hours, for outside legal services. The Commission's estimates of the
  relevant wage rates for external time costs, such as outside legal services, takes into account staff experience, a variety of sources including
  general information websites, and adjustments for inflation.
\5\ Includes initial burden estimate annualized over a three-year period, plus 5 hours of ongoing annual burden hours. The estimate of 9 hours is based
  on the following calculation: ((12 initial hours/3 years) + 5 hours of additional ongoing burden hours) = 9 hours.
\6\ This estimated burden is based on the estimated wage rate of $531/hour, for 3 hours, for outside legal services and $85/hour, for 5 hours, for a
  senior general clerk.
\7\ Total number of covered institutions is calculated as follows: 3,401 broker-dealers other than notice registered broker-dealers + 15,129 investment
  advisers registered with the Commission + 13,965 investment companies + 335 transfer agents registered with the Commission + 67 transfer agents
  registered with the Banking Agencies = 32,897 covered institutions.
\8\ We estimate that 50% of covered institutions will use outside legal services for these collections of information. This estimate takes into account
  that covered institutions may elect to use outside legal services (along with in-house counsel), based on factors such as budget and the covered
  institution's standard practices for using outside legal services, as well as personnel availability and expertise.
\9\ This estimated burden is based on the estimated wage rate of $584/hour, for 5 hours, for outside legal services. The Commission's estimates of the
  relevant wage rates for external time costs, such as outside legal services, takes into account staff experience, a variety of sources including
  general information websites, and adjustments for inflation.
\10\ This estimated burden is based on the estimated wage rate of $584/hour, for 3 hours, for outside legal services and $93/hour, for 5 hours, for a
  senior general clerk.
\11\ Total number of applicable covered institutions is calculated as follows: 3,476 broker-dealers other than notice-registered broker-dealers or
  funding portals + 15,565 investment advisers registered with the Commission + 13,766 investment companies = 32,807 covered institutions. The burdens
  for funding portals and transfer agents are calculated separately.
\12\ Includes initial burden estimates annualized over a three-year period, plus 5 hours of ongoing annual burden hours. The estimate of 30 hours is
  based on the following calculation: ((75 initial hours/3) + 5 hours of additional ongoing burden hours) = 30 hours.
\13\ The number of transfer agents includes 251 transfer agents registered with the Commission + 64 transfer agents registered with the Banking Agencies
  = 315 transfer agents.
\14\ Funding portals are not subject to the recordkeeping obligations for brokers found under Rule 17a-4. Instead, they are obligated, pursuant to Rule
  404 of Regulation Crowdfunding, to make and preserve all records required to demonstrate their compliance with, among other things, Regulation S-P.
  While the final amendments do not modify funding portals' recordkeeping requirements to include the same enumerated list of obligations as those
  applied to brokers under the amendments to Rule 17a-4, funding portals generally should look to make and preserve the same scope of records in
  connection with demonstrating their compliance with this portion of Regulation S-P. Further, Rule 404 requires funding portals to preserve these
  records for a longer period of time than brokers are required to preserve records under Rule 17a-4. Due to this longer required period for records
  preservation, the estimated burden for funding portals is higher than for brokers.

VI. Final Regulatory Flexibility Act Analysis

    The Regulatory Flexibility Act (``RFA'') requires the Commission, 
in promulgating rules under Section 553 of the Administrative Procedure 
Act,\1124\ to consider the impact of those rules on small entities. We 
have prepared this Final Regulatory Flexibility Analysis (``FRFA'') in 
accordance with Section 604 of the RFA.\1125\ An Initial Regulatory 
Flexibility Analysis (``IRFA'') was prepared in accordance with the RFA 
and was included in the Proposing Release.\1126\
---------------------------------------------------------------------------

    \1124\ 5 U.S.C. 553.
    \1125\ 5 U.S.C. 604.6.
    \1126\ Proposing Release at section V.
---------------------------------------------------------------------------

A. Need for, and Objectives of, the Final Amendments

    The purpose of the final amendments is to limit potential harmful 
impacts to customers by enhancing and modernizing the protection of 
customer information. Among other things, the amendments update the 
rule's requirements to address the expanded use of technology and 
corresponding risks.
    The need for, and objectives of, the final amendments are described 
in Sections I and II above. We discuss the economic impact and 
potential alternatives to the amendments in Section IV, and the 
estimated compliance costs and burdens of the amendments under the PRA 
in Section V.

B. Significant Issues Raised by Public Comments

    In the Proposing Release, the Commission requested comment on any 
aspect of the IRFA, and particularly on the number of small entities 
that would be affected by the proposed amendments, the existence or 
nature of the potential impact of the proposed amendments on small 
entities discussed in the analysis, how the proposed amendments could 
further lower the burden on small entities, and how to quantify the 
impact of the proposed amendments.
    One commenter urged the Commission to conduct a more holistic cost-
benefit analysis, and in particular consider the disproportionate costs 
on smaller advisers.\1127\ The commenter noted that smaller advisers 
have been significantly burdened by one-size-fits-all regulations--both 
in isolation and cumulatively--that effectively require substantial 
fixed investments in infrastructure, personnel, technology, and 
operations.\1128\ Another commenter stated that the Commission did 
little analysis about the impact of these proposals on small broker-
dealers, competition within the brokerage industry, and whether they 
could contribute to barriers for new entrants into the markets.\1129\ 
We discuss the cost-benefit analysis and challenges small entities may 
face above.\1130\
---------------------------------------------------------------------------

    \1127\ See IAA Comment Letter 2.
    \1128\ See IAA Comment Letter 1.
    \1129\ See ASA Comment Letter.
    \1130\ See supra section IV.
---------------------------------------------------------------------------

    Additionally, multiple commenters discussed the burden small 
entities would face. For instance, several commenters stated that an 
increased compliance cost for implementing new systems, training 
employees, and conducting audits, may disproportionately affect smaller 
firms, inhibiting their ability to compete and grow.\1131\ Multiple 
commenters asserted small covered institutions, who may not have the 
negotiating power or leverage to demand specific contract provisions 
from large third-party service providers, would potentially be harmed 
by the written contract requirement for service providers.\1132\ 
Another commenter noted the outsized impact small broker-dealers 
face.\1133\ However, another commenter noted while small firms may be 
impacted by increased costs, this should not come at the expense of 
customer protection, and stated that driving competition towards better 
protections will ultimately benefit customers and promote a healthier 
market.\1134\
---------------------------------------------------------------------------

    \1131\ See Grey Comment Letter, Robinson Comment Letter, and 
Scouten Comment Letter; see also ASA Comment Letter.
    \1132\ See IAA Comment Letter 2; see also STA Comment Letter 2 
and Computershare Comment Letter.
    \1133\ See FSI Comment Letter.
    \1134\ See Wohlfahrt Comment Letter.
---------------------------------------------------------------------------

    Commenters proposed multiple alternatives to lower the burden on 
small entities. One commenter urged the Commission to provide a longer 
time to transition for smaller advisers.\1135\ Additionally, the 
commenter stated that it has frequently called on the Commission to 
take steps to tailor its rules to minimize impacts the proposed 
amendments would have on smaller advisers, for example through 
preserving a flexible, risk- and principles-based approach, excluding 
or exempting smaller advisers from specific requirements where the 
burdens on those advisers outweigh the benefits, and tiering and 
staggering

[[Page 47782]]

compliance timetables.\1136\ Likewise, another commenter proposed a 
longer implementation period for smaller broker-dealers and investments 
advisers to allow these firms to benefit from implementation for larger 
industry participants.\1137\
---------------------------------------------------------------------------

    \1135\ See IAA Comment Letter 1.
    \1136\ See IAA Comment Letter 2; see also STA Comment Letter 
suggesting exempting transfer agents that do not maintain a 
threshold number of shareholder accounts. See supra section IV.E for 
further discussion of exemption based upon size.
    \1137\ See FSI Comment Letter.
---------------------------------------------------------------------------

    We expect the benefits and the costs of the final amendments to 
vary across covered institutions.\1138\ For example, because smaller 
covered institutions are less likely to have an existing incident 
response program than larger covered institutions, some small entities 
may be more likely to face greater costs but also expect greater 
benefits complying with the final amendments, because they must adopt 
and implement new procedures. Creating new programs will likely cost 
more, but the new programs would result in improved efficacy in 
notifying customers and improve the manner incidents are handled. 
Smaller entities may have less negotiating power than larger entities, 
so requiring contracts with service providers could potentially be more 
detrimental to them than other entities. Additionally, smaller covered 
institutions are less likely to have a national presence, so small 
entities whose customers are concentrated in States with less 
informative customer notification laws are likely to face higher costs 
to comply with the final amendments. These costs and benefits may have 
an effect on competition for smaller entities.\1139\
---------------------------------------------------------------------------

    \1138\ See supra section IV.
    \1139\ See supra section IV.E.
---------------------------------------------------------------------------

    We have revised the final amendments in several ways to mitigate 
potential compliance costs that small entities may face, as raised by 
commenters. As previously discussed, the changes made to the service 
provider provisions of the amendments requiring that the covered 
institution's policies and procedures are reasonably designed to 
oversee, monitor, and conduct due diligence on service providers 
instead of requiring written contracts between covered institutions and 
their service providers, and requiring that the covered institution's 
policies and procedures be reasonably designed to ensure service 
providers take appropriate measures to notify covered institutions of 
an applicable breach in security within 72 hours instead of 48 hours) 
may reduce some costs relative to the proposal and facilitate their 
implementation, especially for smaller covered institutions.\1140\ For 
example, it could potentially reduce compliance costs by reducing the 
number of notices being sent (e.g., if the covered institution is able 
to determine that a notice is not needed or if it is able to determine 
with more precision which individuals must be notified).\1141\ 
Additionally, we are now adopting a longer compliance period of 24 
months for smaller covered institutions, who are less likely to already 
have policies and procedures broadly consistent with the final 
amendments.
---------------------------------------------------------------------------

    \1140\ See supra section IV.
    \1141\ See supra section IV.
---------------------------------------------------------------------------

    Moreover, the final amendments still maintain that the incident 
response program must include policies and procedures containing 
certain general elements but will not prescribe specific steps a 
covered institution must undertake when carrying out incident response 
activities, thereby enabling covered institutions to create policies 
and procedures best suited to their particular circumstances, including 
size. This design balances the necessity of maintaining general 
elements to achieve the investor protection objectives the amendments 
are designed to achieve, while still providing covered institutions the 
ability to tailor policies to their individual needs. We will not 
exempt small entities from any specific requirements, because entities 
of all sizes are vulnerable to the types of data security breach 
incidents we are trying to address, and therefore, no entity should be 
exempted from requirements, regardless of size.\1142\
---------------------------------------------------------------------------

    \1142\ See infra section VI.E for further discussion of 
exemption based upon size.
---------------------------------------------------------------------------

    Additionally, one commenter argued that the Commission does not 
accurately analyze the impact of its regulations on small advisers as 
required under the RFA because according to the commenter, virtually no 
SEC-registered advisers fall under the ``asset-based'' definition of 
small adviser adopted by the Commission.\1143\ However, the commenter 
believes that the vast majority of advisers are small businesses.\1144\ 
The commenter stated that the Commission adopted Rule 0-7 under the 
Advisers Act defining ``small business'' or ``small organization'' for 
purposes of treatment as a ``small entity'' under the RFA as including 
an investment adviser that has less than $25 million in assets under 
management, but with few exceptions, advisers are not permitted to 
register with the Commission unless they have at least $100 million in 
assets under management.\1145\ The commenter argued that this makes any 
analysis the Commission does regarding the impact on smaller advisers 
virtually meaningless.\1146\ As discussed below, we estimate that 
approximately 872 broker-dealers,\1147\ 132 transfer agents, 81 
investment companies, and 579 registered investment advisers may be 
considered small entities under the Regulatory Flexibility Act.\1148\ 
The Commission takes seriously the potential impact of any new rule on 
these advisers who meet this definition and on other smaller advisers 
that do not meet the definition of small entity under the Regulatory 
Flexibility Act, as considered and discussed throughout this release.
---------------------------------------------------------------------------

    \1143\ See IAA Comment Letter 2.
    \1144\ See IAA Comment Letter 2.
    \1145\ See IAA Comment Letter 2.
    \1146\ See IAA Comment Letter 2.
    \1147\ This 872 broker-dealers includes 89 funding portals.
    \1148\ See infra section VI.C.
---------------------------------------------------------------------------

C. Small Entities Subject to Final Amendments

    The final amendments to Regulation S-P will affect brokers, 
dealers, registered investment advisers, investment companies, and 
transfer agents, including entities that are considered to be a small 
business or small organization (collectively, ``small entity'') for 
purposes of the RFA. For purposes of the RFA, under the Exchange Act a 
broker or dealer is a small entity if it: (i) had total capital of less 
than $500,000 on the date in its prior fiscal year as of which its 
audited financial statements were prepared or, if not required to file 
audited financial statements, on the last business day of its prior 
fiscal year; and (ii) is not affiliated with any person that is not a 
small entity.\1149\ A transfer agent is a small entity if it: (i) 
received less than 500 items for transfer and less than 500 items for 
processing during the preceding six months; (ii) transferred items only 
of issuers that are small entities; (iii) maintained master shareholder 
files that in the aggregate contained less than 1,000 shareholder 
accounts or was the named transfer agent for less than 1,000 
shareholder accounts at all times during the preceding fiscal year; and 
(iv) is not affiliated with any person that is not a small 
entity.\1150\ Under the Investment Company Act, investment companies 
are considered small entities if they, together with other funds in the 
same

[[Page 47783]]

group of related funds, have net assets of $50 million or less as of 
the end of its most recent fiscal year.\1151\ Under the Investment 
Advisers Act, a small entity is an investment adviser that: (i) manages 
less than $25 million in assets; (ii) has total assets of less than $5 
million on the last day of its most recent fiscal year; and (iii) does 
not control, is not controlled by, and is not under common control with 
another investment adviser that manages $25 million or more in assets, 
or any person that has had total assets of $5 million or more on the 
last day of the most recent fiscal year.\1152\
---------------------------------------------------------------------------

    \1149\ 17 CFR 240.0-10. Funding portals, who are considered 
``brokers'' for purposes of this release unless otherwise noted, are 
also included in this definition. See 17 CFR 227.403(b); See also 
supra footnote 5.
    \1150\ Id.
    \1151\ 17 CFR 270.0-10.
    \1152\ 17 CFR 275.0-7.
---------------------------------------------------------------------------

    Based on Commission filings, we estimate that approximately 872 
broker-dealers,\1153\ 132 transfer agents,\1154\ 81 investment 
companies,\1155\ and 579 registered investment advisers \1156\ may be 
considered small entities.
---------------------------------------------------------------------------

    \1153\ Estimate based on Q3 2023 FOCUS Report data, staff 
analysis and public filings. This 872 broker-dealers includes 89 
funding portals.
    \1154\ Estimate based on the number of transfer agents that 
reported a value of fewer than 1,000 for items 4(a) and 5(a) on Form 
TA-2 collected by the Commission as of September 30, 2023.
    \1155\ Based on Commission staff approximation that 
approximately 41 open-end funds (including 10 exchange-traded 
funds), 23 closed-end funds, 3 UITs and 14 business development 
companies are small entities. This estimate is derived from an 
analysis of data obtained from Morningstar Direct and data reported 
to the Commission (e.g., N-PORT, N-CSR, 10-Q and 10-K) for the 
second quarter of 2023.
    \1156\ Based on SEC-registered adviser responses to Items 5.F. 
and 12 of Form ADV as of October 5, 2023.
---------------------------------------------------------------------------

D. Projected Reporting, Recordkeeping, and Other Compliance 
Requirements

    The final amendments to Regulation S-P will require covered 
institutions to develop incident response programs for unauthorized 
access to or use of customer information, as well as imposing a 
customer notification obligation in instances where sensitive customer 
information was, or is reasonably likely to have been, accessed or used 
without authorization. The final amendments also would include new 
mandatory recordkeeping requirements and language conforming Regulation 
S-P's annual privacy notice delivery provisions to the terms of a 
statutory exception.
    Under the final amendments, covered institutions would have to 
develop, implement, and maintain, within their written policies and 
procedures designed to comply with Regulation S-P, a program that is 
reasonably designed to detect, respond to, and recover from 
unauthorized access to or use of customer information, including 
customer notification procedures. Such policies and procedures will 
also need to require that covered institutions oversee, monitor, and 
conduct due diligence on service providers and ensure that service 
providers take appropriate measures to notify covered institutions of 
an applicable breach in security within 72 hours. Upon receipt of such 
notification, the covered institution must initiate its incident 
response program. As part of its incident response program, a covered 
institution may also enter into a written agreement with its service 
provider to have the service provider notify affected individuals on 
its behalf. However, the covered institution's obligation to ensure 
that affected individuals are notified in accordance with paragraph 
(a)(4) of the final amendments rests with the covered institution.
    In addition, covered institutions will be required to make and 
maintain specified written records designed to evidence compliance with 
these requirements.\1157\ Such records will be required to be 
maintained starting from when the record was made, or from when the 
covered institution terminated the use of the written policy or 
procedure, for the time periods stated in the amended recordkeeping 
regulations for each type of covered institution.
---------------------------------------------------------------------------

    \1157\ With regard to funding portals, please see discussion as 
to their applicable recordkeeping obligations supra footnote 385 and 
accompanying discussion.
---------------------------------------------------------------------------

    Some covered institutions, including covered institutions that are 
small entities, will incur increased costs involved in reviewing and 
revising their current safeguarding policies and procedures to comply 
with these obligations, including their cybersecurity policies and 
procedures. Initially, this will require covered institutions to 
develop as part of their written policies and procedures under the 
safeguards rule, a program reasonably designed to detect, respond to, 
and recover from any unauthorized access to or use of customer 
information, including customer notification procedures, in a manner 
that provides clarity for firm personnel. Further, in developing these 
policies and procedures, covered institutions will need to include 
policies and procedures requiring the covered institution to ensure its 
service providers take appropriate measures to protect against 
unauthorized access to or use of customer information, and notify the 
covered institution as soon as possible, but no later than 72 hours 
after becoming aware that a breach in security has occurred resulting 
in unauthorized access to a customer information system maintained by 
the service provider, and upon receipt of such notification, the 
covered institution must initiate its response program. However, as the 
Commission recognizes the number and varying characteristics (e.g., 
size, business, and sophistication) of covered institutions, these 
final amendments would help covered institutions to tailor these 
policies and procedures and related incident response program based on 
the individual facts and circumstances of the firm, and provide 
flexibility in addressing the general elements of the response program 
requirements based on the size and complexity of the covered 
institution and the nature and scope of its activities.
    In addition, the Commission acknowledges that the final amendments 
will impose greater costs on those transfer agents that are registered 
with another appropriate regulatory agency, if they are not currently 
subject to Regulation S-P, as well as those transfer agents registered 
with the Commission who are not currently subject to the safeguards 
rule. Such costs will include the development and implementation of 
necessary policies and procedures, the ongoing costs of required 
recordkeeping and maintenance requirements, and, where necessary, the 
costs to comply with the customer notification requirements of the 
final amendments. Such costs will also include the same minimal costs 
for employee training or establishing clear procedures for consumer 
report information disposal that are imposed on all covered 
institutions. To the extent that such costs are being applied to a 
transfer agent for the first time as a result of new obligations being 
imposed, the final amendments would incur higher present costs on those 
transfer agents than those covered institutions that are already 
subject to the safeguards rule and the disposal rule.
    To comply with these amendments on an ongoing basis, covered 
institutions will need to respond appropriately to incidents that 
entail the unauthorized access to or use of customer information. This 
will entail carrying out the established response program procedures to 
(i) assess the nature and scope of any incident involving unauthorized 
access to or use of customer information and identify the customer 
information systems and types of customer information that may have 
been accessed or used without authorization; (ii) take appropriate 
steps to contain and control the incident to prevent further 
unauthorized access to

[[Page 47784]]

or use of customer information; and (iii) notify each affected 
individual whose sensitive customer information was, or is reasonably 
likely to have been, accessed or used without authorization, unless the 
covered institution determines, after a reasonable investigation of the 
facts and circumstances of the incident of unauthorized access to or 
use of sensitive customer information, that the sensitive customer 
information has not been, and is not reasonably likely to be, used in a 
manner that would result in substantial harm or inconvenience.
    Where the covered institution determines notice is required, the 
covered institution will need to provide a clear and conspicuous 
notice, or ensure that such notice is provided, to each affected 
individual whose sensitive customer information was, or is reasonably 
likely to have been, accessed or used without authorization. This 
notice must be provided as soon as reasonably practicable, but not 
later than 30 days, after the covered institution becomes aware that 
unauthorized access to or use of sensitive customer information has, or 
is reasonably likely to have, occurred, absent an applicable request 
from the Attorney General. This notice will need to be transmitted by a 
means designed to ensure that each affected individual can reasonably 
be expected to receive actual notice in writing. Further, the covered 
institution will need to satisfy the specified content requirements of 
that notice,\1158\ the preparation of which will incur some incremental 
additional costs on covered institutions.
---------------------------------------------------------------------------

    \1158\ See final rule 248.30(a)(4)(iv). In particular, the 
covered institution would need to: (i) describe in general terms the 
incident and the type of sensitive customer information that was or 
is reasonably believed to have been accessed or used without 
authorization; (ii) include, if the information is reasonably 
possible to determine at the time the notice is provided, any of the 
following: the date of the incident, the estimated date of the 
incident, or the date range within which the incident occurred; 
(iii) include contact information sufficient to permit an affected 
individual to contact the covered institution to inquire about the 
incident, including the following: a telephone number (which should 
be a toll-free number if available), an email address or equivalent 
method or means, a postal address, and the name of a specific office 
to contact for further information and assistance; (iv) if the 
individual has an account with the covered institution, recommend 
that the customer review account statements and immediately report 
any suspicious activity to the covered institution; (v) explain what 
a fraud alert is and how an individual may place a fraud alert in 
the individual's credit reports to put the individual's creditors on 
notice that the individual may be a victim of fraud, including 
identity theft; (vi) recommend that the individual periodically 
obtain credit reports from each nationwide credit reporting company 
and that the individual have information relating to fraudulent 
transactions deleted; (vii) explain how the individual may obtain a 
credit report free of charge; and (viii) include information about 
the availability of online guidance from the FTC and usa.gov 
regarding steps an individual can take to protect against identity 
theft, a statement encouraging the individual to report any 
incidents of identity theft to the FTC, and include the FTC's 
website address where individuals may obtain government information 
about identity theft and report suspected incidents of identity 
theft.
---------------------------------------------------------------------------

    Finally, covered institutions will also face costs in complying 
with the new recordkeeping requirements imposed by these amendments 
that are incrementally more than those costs covered institutions 
already incur from their existing regulatory recordkeeping obligations, 
in light of their already existing record retention systems. However, 
the record maintenance provisions align with those most frequently 
employed as to each covered institution subject to this rulemaking, 
partially in an effort to minimize these costs to firms.
    Overall, incremental costs will be associated with the final 
amendments to Regulation S-P.\1159\ Some proportion of large or small 
institutions would be likely to experience some increase in costs to 
comply with the amendments.
---------------------------------------------------------------------------

    \1159\ Covered institutions are currently subject to similar 
recordkeeping requirements applicable to other required policies and 
procedures. Therefore, covered institutions will generally not need 
to invest in new recordkeeping staff, systems, or procedures to 
satisfy the new recordkeeping requirements.
---------------------------------------------------------------------------

    More specifically, we estimate that many covered institutions will 
incur one-time costs related to reviewing and revising their current 
safeguarding policies and procedures to comply with these obligations, 
including their cybersecurity policies and procedures. Additionally, 
some covered institutions, including transfer agents, may incur costs 
associated with establishing such policies and procedures as these 
amendments require if those covered institutions do not already have 
such policies and procedures. We also estimate that the ongoing, long-
term costs associated with the final amendments could include costs of 
responding appropriately to incidents that entail the unauthorized 
access to or use of customer information.

E. Agency Action To Minimize Effect on Small Entities

    The RFA directs us to consider alternatives that would accomplish 
our stated objectives, while minimizing any significant adverse impact 
on small entities. Accordingly, we considered the following 
alternatives:
    1. Establishing different compliance or reporting standards that 
take into account the resources available to small entities;
    2. The clarification, consolidation, or simplification of the 
reporting and compliance requirements under the rule for small 
entities;
    3. Use of performance rather than design standards; and
    4. Exempting small entities from coverage of the rule, or any part 
of the rule.
    With regard to the first alternative, the final amendments to 
Regulation S-P that will continue to permit institutions substantial 
flexibility to design safeguarding policies and procedures appropriate 
for their size and complexity, the nature and scope of their 
activities, and the sensitivity of the personal information at issue. 
However, it is necessary to require that covered institutions, 
regardless of their size, adopt a response program for incidents of 
unauthorized access to or use of customer information, which will 
include customer notification procedures.\1160\ The amendments to 
Regulation S-P arise from our concern with the increasing number of 
information security breaches that have come to light in recent years, 
particularly those involving institutions regulated by the Commission. 
Establishing different compliance or reporting requirements for small 
entities could lead to less favorable protections for these entities' 
customers and compromise the effectiveness of the amendments. However, 
we are providing smaller covered institutions a longer compliance 
period to establish and implement processes to comply with the final 
amendments.
---------------------------------------------------------------------------

    \1160\ See final rule 248.30(a)(3).
---------------------------------------------------------------------------

    With regard to the second alternative, the final amendments will, 
by their operation, simplify reporting and compliance requirements for 
small entities. Small covered institutions are likely to maintain 
personal information on fewer individuals than large covered 
institutions, and they are likely to have relatively simple personal 
information systems. The amendments will not prescribe specific steps a 
covered institution must take in response to a data breach, but instead 
would give the institution flexibility to tailor its policies and 
procedures to its individual facts and circumstances. The amendments 
therefore are intended to give covered institutions the flexibility to 
address the general elements in the response program based on the size 
and complexity of the institution and the nature and scope of its 
activities. Accordingly, the requirements of the amendments already 
will be simplified for small entities. In addition, the requirements of 
the amendments could

[[Page 47785]]

not be further simplified, or clarified or consolidated, without 
compromising the investor protection objectives the amendments are 
designed to achieve.
    With regard to the third alternative, the final amendments are 
design based. Rather than specifying the types of policies and 
procedures that an institution would be required to include in its 
response program, the amendments will require a response program that 
is reasonably designed to detect, respond to, and recover from both 
unauthorized access to and unauthorized use of customer information. 
With respect to the specific requirements regarding notifications in 
the event of a data breach, institutions provide only the information 
that seems most relevant for an affected customer to know in order to 
assess adequately the potential damage that could result from the 
breach and to develop an appropriate response.
    Finally, with regard to alternative four, an exemption for small 
entities would not be appropriate. Small entities are as vulnerable as 
large ones to the types of data security breach incidents we are trying 
to address. In this regard, the specific elements the final amendments 
must be considered and incorporated into the policies and procedures of 
all covered institutions, regardless of their size, to mitigate the 
potential for fraud or other substantial harm or inconvenience to 
investors. Exempting small entities from coverage of the amendments or 
any part of the amendments could compromise the effectiveness of the 
amendments and harm investors by lowering standards for safeguarding 
investor information maintained by small covered institutions. 
Excluding small entities from requirements that would be applicable to 
larger covered institutions also could create competitive disparities 
between large and small entities, for example by undermining investor 
confidence in the security of information maintained by small covered 
institutions.

Statutory Authority

    The Commission is amending Regulation S-P pursuant to authority set 
forth in sections 17, 17A, 23, and 36 of the Exchange Act [15 U.S.C. 
78q, 78q-1, 78w, and 78mm], sections 31 and 38 of the Investment 
Company Act [15 U.S.C. 80a-30 and 80a-37], sections 204, 204A, and 211 
of the Investment Advisers Act [15 U.S.C. 80b-4, 80b-4a, and 80b-11], 
section 628(a) of the FCRA [15 U.S.C. 1681w(a)], and sections 501, 504, 
505, and 525 of the GLBA [15 U.S.C. 6801, 6804, 6805, and 6825].

List of Subjects

17 CFR Part 240

    Reporting and recordkeeping requirements; Securities.

17 CFR Part 248

    Brokers, Consumer protection, Dealers, Investment advisers, 
Investment companies, Privacy, Reporting and recordkeeping 
requirements, Securities, Transfer agents.

17 CFR Parts 270 and 275

    Reporting and recordkeeping requirements; Securities.

Text of Rule Amendments

    For the reasons set out in the preamble, title 17, chapter II of 
the Code of Federal Regulations is amended as follows:

PART 240--GENERAL RULES AND REGULATIONS, SECURITIES EXCHANGE ACT OF 
1934

0
1. The authority citation for part 240 and the sectional authorities 
for Sec. Sec.  240.17a-14 and 240.17Ad-7 are revised to read, as 
follows:

    Authority: 15 U.S.C. 77c, 77d, 77g, 77j, 77s, 77z-2, 77z-3, 
77eee, 77ggg, 77nnn, 77sss, 77ttt, 78c, 78c-3, 78c-5, 78d, 78e, 78f, 
78g, 78i, 78j, 78j-1, 78j-4, 78k, 78k-1, 78l, 78m, 78n, 78n-1, 78o, 
78o-4, 78o-10, 78p, 78q, 78q-1, 78s, 78u-5, 78w, 78x, 78dd, 78ll, 
78mm, 80a-20, 80a-23, 80a-29, 80a-37, 80b-3, 80b-4, 80b-11, 
1681w(a)(1), 6801-6809, 6825, 7201 et seq., and 8302; 7 U.S.C. 
2(c)(2)(E); 12 U.S.C. 5221(e)(3); 18 U.S.C. 1350; Pub. L. 111-203, 
939A, 124 Stat. 1376 (2010); and Pub. L. 112-106, sec. 503 and 602, 
126 Stat. 326 (2012), unless otherwise noted.
* * * * *
    Section 240.17a-14 is also issued under Public Law 111-203, sec. 
913, 124 Stat. 1376 (2010).
* * * * *
    Section 240.17ad-7 is also issued under 15 U.S.C. 78b, 78q, and 
78q-1.
* * * * *

0
2. Amend Sec.  240.17a-4 by adding a reserved paragraph (e)(13) and 
adding paragraph (e)(14) to read as follows:


Sec.  240.17a-4  Records to be preserved by certain exchange members, 
brokers and dealers.

* * * * *
    (e) * * *
    (13) [Reserved]
    (14)(i) The written policies and procedures required to be adopted 
and implemented pursuant to Sec.  248.30(a)(1) of this chapter until 
three years after the termination of the use of the policies and 
procedures;
    (ii) The written documentation of any detected unauthorized access 
to or use of customer information, as well as any response to, and 
recovery from such unauthorized access to or use of customer 
information required by Sec.  248.30(a)(3) of this chapter for three 
years from the date when the records were made;
    (iii) The written documentation of any investigation and 
determination made regarding whether notification is required pursuant 
to Sec.  248.30(a)(4) of this chapter, including the basis for any 
determination made, any written documentation from the United States 
Attorney General related to a delay in notice, as well as a copy of any 
notice transmitted following such determination, for three years from 
the date when the records were made;
    (iv) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(a)(5)(i) of this chapter until 
three years after the termination of the use of the policies and 
procedures;
    (v) The written documentation of any contract or agreement entered 
into pursuant to Sec.  248.30(a)(5) of this chapter until three years 
after the termination of such contract or agreement; and
    (vi) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(b)(2) of this chapter until three 
years after the termination of the use of the policies and procedures;
* * * * *


Sec.  240.17Ad-7  [Redesignated as Sec.  240.17ad-7].

0
3. Redesignate Sec.  240.17Ad-7 as Sec.  240.17ad-7.

0
4. Amend newly redesignated Sec.  240.17ad-7 by:
0
a. Revising the section heading;
0
b. Adding a reserved paragraph (j); and
0
c. Adding paragraph (k).
    The revision and additions read as follows:


Sec.  240.17ad-7  (Rule 17Ad-7) Record retention.

* * * * *
    (j) [Reserved]
    (k) Every registered transfer agent shall maintain in an easily 
accessible place:
    (1) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(a)(1) of this chapter for no less 
than three years after the termination of the use of the policies and 
procedures;
    (2) The written documentation of any detected unauthorized access 
to or use of customer information, as well as any

[[Page 47786]]

response to, and recovery from such unauthorized access to or use of 
customer information required by Sec.  248.30(a)(3) of this chapter for 
no less than three years from the date when the records were made;
    (3) The written documentation of any investigation and 
determination made regarding whether notification is required pursuant 
to Sec.  248.30(a)(4) of this chapter, including the basis for any 
determination made, any written documentation from the United States 
Attorney General related to a delay in notice, as well as a copy of any 
notice transmitted following such determination, for no less than three 
years from the date when the records were made;
    (4) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(a)(5)(i) of this chapter until 
three years after the termination of the use of the policies and 
procedures;
    (5) The written documentation of any contract or agreement entered 
into pursuant to Sec.  248.30(a)(5) of this chapter until three years 
after the termination of such contract or agreement; and
    (6) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(b)(2) of this chapter for no less 
than three years after the termination of the use of the policies and 
procedures.

PART 248--REGULATIONS S-P, S-AM, and S-ID

0
5. The authority citation for part 248 continues to read as follows:

    Authority: 15 U.S.C. 78q, 78q-1, 78o-4, 78o-5, 78w, 78mm, 80a-
30, 80a-37, 80b-4, 80b-11, 1681m(e), 1681s(b), 1681s-3 and note, 
1681w(a)(1), 6801-6809, and 6825; Pub. L. 111-203, secs. 1088(a)(8), 
(a)(10), and sec. 1088(b), 124 Stat. 1376 (2010).
* * * * *

0
6. Amend Sec.  248.5 by revising paragraph (a)(1) and adding paragraph 
(e) to read as follows:


Sec.  248.5  Annual privacy notice to customers required.

    (a)(1) General rule. Except as provided by paragraph (e) of this 
section, you must provide a clear and conspicuous notice to customers 
that accurately reflects your privacy policies and practices not less 
than annually during the continuation of the customer relationship. 
Annually means at least once in any period of 12 consecutive months 
during which that relationship exists. You may define the 12-
consecutive-month period, but you must apply it to the customer on a 
consistent basis.
* * * * *
    (e) Exception to annual privacy notice requirement--(1) When 
exception available. You are not required to deliver an annual privacy 
notice if you:
    (i) Provide nonpublic personal information to nonaffiliated third 
parties only in accordance with Sec.  248.13, Sec.  248.14, or Sec.  
248.15; and
    (ii) Have not changed your policies and practices with regard to 
disclosing nonpublic personal information from the policies and 
practices that were disclosed to the customer under Sec.  248.6(a)(2) 
through (5) and (9) in the most recent privacy notice provided pursuant 
to this part.
    (2) Delivery of annual privacy notice after financial institution 
no longer meets the requirements for exception. If you have been 
excepted from delivering an annual privacy notice pursuant to paragraph 
(e)(1) of this section and change your policies or practices in such a 
way that you no longer meet the requirements for that exception, you 
must comply with paragraph (e)(2)(i) or (ii) of this section, as 
applicable.
    (i) Changes preceded by a revised privacy notice. If you no longer 
meet the requirements of paragraph (e)(1) of this section because you 
change your policies or practices in such a way that Sec.  248.8 
requires you to provide a revised privacy notice, you must provide an 
annual privacy notice in accordance with the timing requirement in 
paragraph (a) of this section, treating the revised privacy notice as 
an initial privacy notice.
    (ii) Changes not preceded by a revised privacy notice. If you no 
longer meet the requirements of paragraph (e)(1) of this section 
because you change your policies or practices in such a way that Sec.  
248.8 does not require you to provide a revised privacy notice, you 
must provide an annual privacy notice within 100 days of the change in 
your policies or practices that causes you to no longer meet the 
requirement of paragraph (e)(1) of this section.
    (iii) Examples. (A) You change your policies and practices in such 
a way that you no longer meet the requirements of paragraph (e)(1) of 
this section effective April 1 of year 1. Assuming you define the 12-
consecutive-month period pursuant to paragraph (a) of this section as a 
calendar year, if you were required to provide a revised privacy notice 
under Sec.  248.8 and you provided that notice on March 1 of year 1, 
you must provide an annual privacy notice by December 31 of year 2. If 
you were not required to provide a revised privacy notice under Sec.  
248.8, you must provide an annual privacy notice by July 9 of year 1.
    (B) You change your policies and practices in such a way that you 
no longer meet the requirements of paragraph (e)(1) of this section, 
and so provide an annual notice to your customers. After providing the 
annual notice to your customers, you once again meet the requirements 
of paragraph (e)(1) of this section for an exception to the annual 
notice requirement. You do not need to provide additional annual notice 
to your customers until such time as you no longer meet the 
requirements of paragraph (e)(1) of this section.


Sec.  248.17  [Amended]

0
7. Amend Sec.  248.17 in paragraph (b) by removing the words ``Federal 
Trade Commission'' and adding in their place ``Consumer Financial 
Protection Bureau'' and removing the words ``Federal Trade 
Commission's'' and adding in their place ``Consumer Financial 
Protection Bureau's''.

0
8. Revise Sec.  248.30 to read as follows:


Sec.  248.30  Procedures to safeguard customer information, including 
response programs for unauthorized access to customer information and 
customer notice; disposal of customer information and consumer 
information.

    (a) Policies and procedures to safeguard customer information--(1) 
General requirements. Every covered institution must develop, 
implement, and maintain written policies and procedures that address 
administrative, technical, and physical safeguards for the protection 
of customer information.
    (2) Objectives. These written policies and procedures must be 
reasonably designed to:
    (i) Ensure the security and confidentiality of customer 
information;
    (ii) Protect against any anticipated threats or hazards to the 
security or integrity of customer information; and
    (iii) Protect against unauthorized access to or use of customer 
information that could result in substantial harm or inconvenience to 
any customer.
    (3) Response programs for unauthorized access to or use of customer 
information. Written policies and procedures in paragraph (a)(1) of 
this section must include a program reasonably designed to detect, 
respond to, and recover from unauthorized access to or use of customer 
information, including customer notification procedures. This response 
program must include procedures for the covered institution to:
    (i) Assess the nature and scope of any incident involving 
unauthorized access

[[Page 47787]]

to or use of customer information and identify the customer information 
systems and types of customer information that may have been accessed 
or used without authorization;
    (ii) Take appropriate steps to contain and control the incident to 
prevent further unauthorized access to or use of customer information; 
and
    (iii) Notify each affected individual whose sensitive customer 
information was, or is reasonably likely to have been, accessed or used 
without authorization in accordance with paragraph (a)(4) of this 
section unless the covered institution determines, after a reasonable 
investigation of the facts and circumstances of the incident of 
unauthorized access to or use of sensitive customer information, that 
the sensitive customer information has not been, and is not reasonably 
likely to be, used in a manner that would result in substantial harm or 
inconvenience.
    (4) Notifying affected individuals of unauthorized access or use--
(i) Notification obligation. Unless a covered institution has 
determined, after a reasonable investigation of the facts and 
circumstances of the incident of unauthorized access to or use of 
sensitive customer information that occurred at the covered institution 
or one of its service providers that is not itself a covered 
institution, that sensitive customer information has not been, and is 
not reasonably likely to be, used in a manner that would result in 
substantial harm or inconvenience, the covered institution must provide 
a clear and conspicuous notice, or ensure that such notice is provided, 
to each affected individual whose sensitive customer information was, 
or is reasonably likely to have been, accessed or used without 
authorization. The notice must be transmitted by a means designed to 
ensure that each affected individual can reasonably be expected to 
receive actual notice in writing.
    (ii) Affected individuals. If an incident of unauthorized access to 
or use of customer information has occurred or is reasonably likely to 
have occurred, but the covered institution is unable to identify which 
specific individuals' sensitive customer information has been accessed 
or used without authorization, the covered institution must provide 
notice to all individuals whose sensitive customer information resides 
in the customer information system that was, or was reasonably likely 
to have been, accessed or used without authorization. Notwithstanding 
the foregoing, if the covered institution reasonably determines that a 
specific individual's sensitive customer information that resides in 
the customer information system was not accessed or used without 
authorization, the covered institution is not required to provide 
notice to that individual under this paragraph.
    (iii) Timing. A covered institution must provide the notice as soon 
as practicable, but not later than 30 days, after becoming aware that 
unauthorized access to or use of customer information has occurred or 
is reasonably likely to have occurred unless the United States Attorney 
General determines that the notice required under this rule poses a 
substantial risk to national security or public safety, and notifies 
the Commission of such determination in writing, in which case the 
covered institution may delay providing such notice for a time period 
specified by the Attorney General, up to 30 days following the date 
when such notice was otherwise required to be provided. The notice may 
be delayed for an additional period of up to 30 days if the Attorney 
General determines that the notice continues to pose a substantial risk 
to national security or public safety and notifies the Commission of 
such determination in writing. In extraordinary circumstances, notice 
required under this section may be delayed for a final additional 
period of up to 60 days if the Attorney General determines that such 
notice continues to pose a substantial risk to national security and 
notifies the Commission of such determination in writing. Beyond the 
final 60-day delay under this paragraph (a)(4)(iii), if the Attorney 
General indicates that further delay is necessary, the Commission will 
consider additional requests for delay and may grant such delay through 
Commission exemptive order or other action.
    (iv) Notice contents. The notice must:
    (A) Describe in general terms the incident and the type of 
sensitive customer information that was or is reasonably believed to 
have been accessed or used without authorization;
    (B) Include, if the information is reasonably possible to determine 
at the time the notice is provided, any of the following: the date of 
the incident, the estimated date of the incident, or the date range 
within which the incident occurred;
    (C) Include contact information sufficient to permit an affected 
individual to contact the covered institution to inquire about the 
incident, including the following: a telephone number (which should be 
a toll-free number if available), an email address or equivalent method 
or means, a postal address, and the name of a specific office to 
contact for further information and assistance;
    (D) If the individual has an account with the covered institution, 
recommend that the customer review account statements and immediately 
report any suspicious activity to the covered institution;
    (E) Explain what a fraud alert is and how an individual may place a 
fraud alert in the individual's credit reports to put the individual's 
creditors on notice that the individual may be a victim of fraud, 
including identity theft;
    (F) Recommend that the individual periodically obtain credit 
reports from each nationwide credit reporting company and that the 
individual have information relating to fraudulent transactions 
deleted;
    (G) Explain how the individual may obtain a credit report free of 
charge; and
    (H) Include information about the availability of online guidance 
from the Federal Trade Commission and usa.gov regarding steps an 
individual can take to protect against identity theft, a statement 
encouraging the individual to report any incidents of identity theft to 
the Federal Trade Commission, and include the Federal Trade 
Commission's website address where individuals may obtain government 
information about identity theft and report suspected incidents of 
identity theft.
    (5) Service providers. (i) A covered institution's response program 
prepared in accordance with paragraph (a)(3) of this section must 
include the establishment, maintenance, and enforcement of written 
policies and procedures reasonably designed to require oversight, 
including through due diligence and monitoring, of service providers, 
including to ensure that the covered institution notifies affected 
individuals as set forth in paragraph (a)(4) of this section. The 
policies and procedures must be reasonably designed to ensure service 
providers take appropriate measures to:
    (A) Protect against unauthorized access to or use of customer 
information; and
    (B) Provide notification to the covered institution as soon as 
possible, but no later than 72 hours after becoming aware that a breach 
in security has occurred resulting in unauthorized access to a customer 
information system maintained by the service provider. Upon receipt of 
such notification, the covered institution must initiate its incident 
response program adopted pursuant to paragraph (a)(3) of this section.
    (ii) As part of its incident response program, a covered 
institution may enter into a written agreement with its

[[Page 47788]]

service provider to notify affected individuals on the covered 
institution's behalf in accordance with paragraph (a)(4) of this 
section.
    (iii) Notwithstanding a covered institution's use of a service 
provider in accordance with paragraphs (a)(5)(i) and (ii) of this 
section, the obligation to ensure that affected individuals are 
notified in accordance with paragraph (a)(4) of this section rests with 
the covered institution.
    (b) Disposal of consumer information and customer information--(1) 
Standard. Every covered institution, other than notice-registered 
broker-dealers, must properly dispose of consumer information and 
customer information by taking reasonable measures to protect against 
unauthorized access to or use of the information in connection with its 
disposal.
    (2) Written policies, procedures, and records. Every covered 
institution, other than notice-registered broker-dealers, must adopt 
and implement written policies and procedures that address the proper 
disposal of consumer information and customer information according to 
the standard identified in paragraph (b)(1) of this section.
    (3) Relation to other laws. Nothing in this paragraph (b) shall be 
construed:
    (i) To require any covered institution to maintain or destroy any 
record pertaining to an individual that is not imposed under other law; 
or
    (ii) To alter or affect any requirement imposed under any other 
provision of law to maintain or destroy records.
    (c) Recordkeeping. (1) Every covered institution that is an 
investment company under the Investment Company Act of 1940 (15 U.S.C. 
80a), but is not registered under section 8 thereof (15 U.S.C. 80a-8), 
must make and maintain:
    (i) The written policies and procedures required to be adopted and 
implemented pursuant to paragraph (a)(1) of this section;
    (ii) The written documentation of any detected unauthorized access 
to or use of customer information, as well as any response to, and 
recovery from such unauthorized access to or use of customer 
information required by paragraph (a)(3) of this section;
    (iii) The written documentation of any investigation and 
determination made regarding whether notification is required pursuant 
to paragraph (a)(4) of this section, including the basis for any 
determination made, any written documentation from the United States 
Attorney General related to a delay in notice, as well as a copy of any 
notice transmitted following such determination;
    (iv) The written policies and procedures required to be adopted and 
implemented pursuant to paragraph (a)(5)(i) of this section;
    (v) The written documentation of any contract or agreement entered 
into pursuant to paragraph (a)(5) of this section; and
    (vi) The written policies and procedures required to be adopted and 
implemented pursuant to paragraph (b)(2) of this section.
    (2) In the case of covered institutions described in paragraph 
(c)(1) of this section, such records, apart from any policies and 
procedures, must be preserved for a time period not less than six 
years, the first two years in an easily accessible place. In the case 
of policies and procedures required under paragraphs (a) and (b)(2) of 
this section, covered institutions described in paragraph (c)(1) of 
this section must maintain a copy of such policies and procedures in 
effect, or that at any time within the past six years were in effect, 
in an easily accessible place.
    (d) Definitions. As used in this section, unless the context 
otherwise requires:
    (1) Consumer information means:
    (i) Any record about an individual, whether in paper, electronic or 
other form, that is a consumer report or is derived from a consumer 
report, or a compilation of such records, that a covered institution 
maintains or otherwise possesses for a business purpose regardless of 
whether such information pertains to:
    (A) Individuals with whom the covered institution has a customer 
relationship; or
    (B) To the customers of other financial institutions where such 
information has been provided to the covered institution.
    (ii) Consumer information does not include information that does 
not identify individuals, such as aggregate information or blind data.
    (2) Consumer report has the same meaning as in section 603(d) of 
the Fair Credit Reporting Act (15 U.S.C. 1681a(d)).
    (3) Covered institution means any broker or dealer, any investment 
company, and any investment adviser or transfer agent registered with 
the Commission or another appropriate regulatory agency (``ARA'') as 
defined in section 3(a)(34)(B) of the Securities Exchange Act of 1934.
    (4) Customer. (i) Customer has the same meaning as in Sec.  
248.3(j) unless the covered institution is a transfer agent registered 
with the Commission or another ARA.
    (ii) With respect to a transfer agent registered with the 
Commission or another ARA, for purposes of this section, customer means 
any natural person who is a securityholder of an issuer for which the 
transfer agent acts or has acted as a transfer agent.
    (5) Customer information. (i) Customer information for any covered 
institution other than a transfer agent registered with the Commission 
or another ARA means any record containing nonpublic personal 
information as defined in Sec.  248.3(t) about a customer of a 
financial institution, whether in paper, electronic or other form, that 
is in the possession of a covered institution or that is handled or 
maintained by the covered institution or on its behalf regardless of 
whether such information pertains to:
    (A) Individuals with whom the covered institution has a customer 
relationship; or
    (B) To the customers of other financial institutions where such 
information has been provided to the covered institution.
    (ii) With respect to a transfer agent registered with the 
Commission or another ARA, customer information means any record 
containing nonpublic personal information as defined in Sec.  248.3(t) 
identified with any natural person, who is a securityholder of an 
issuer for which the transfer agent acts or has acted as transfer 
agent, that is in the possession of a transfer agent or that is handled 
or maintained by the transfer agent or on its behalf, regardless of 
whether such information pertains to individuals with whom the transfer 
agent has a customer relationship, or pertains to the customers of 
other financial institutions and has been provided to the transfer 
agent.
    (6) Customer information systems means the information resources 
owned or used by a covered institution, including physical or virtual 
infrastructure controlled by such information resources, or components 
thereof, organized for the collection, processing, maintenance, use, 
sharing, dissemination, or disposition of customer information to 
maintain or support the covered institution's operations.
    (7) Disposal means:
    (i) The discarding or abandonment of consumer information or 
customer information; or
    (ii) The sale, donation, or transfer of any medium, including 
computer equipment, on which consumer information or customer 
information is stored.

[[Page 47789]]

    (8) Notice-registered broker-dealer means a broker or dealer 
registered by notice with the Commission under section 15(b)(11) of the 
Securities Exchange Act of 1934 (15 U.S.C. 78o(b)(11)).
    (9) Sensitive customer information. (i) Sensitive customer 
information means any component of customer information alone or in 
conjunction with any other information, the compromise of which could 
create a reasonably likely risk of substantial harm or inconvenience to 
an individual identified with the information.
    (ii) Examples of sensitive customer information include:
    (A) Customer information uniquely identified with an individual 
that has a reasonably likely use as a means of authenticating the 
individual's identity, including
    (1) A Social Security number, official State- or government-issued 
driver's license or identification number, alien registration number, 
government passport number, employer or taxpayer identification number;
    (2) A biometric record;
    (3) A unique electronic identification number, address, or routing 
code;
    (4) Telecommunication identifying information or access device (as 
defined in 18 U.S.C. 1029(e)); or
    (B) Customer information identifying an individual or the 
individual's account, including the individual's account number, name 
or online user name, in combination with authenticating information 
such as information described in paragraph (d)(9)(ii)(A) of this 
section, or in combination with similar information that could be used 
to gain access to the customer's account such as an access code, a 
credit card expiration date, a partial Social Security number, a 
security code, a security question and answer identified with the 
individual or the individual's account, or the individual's date of 
birth, place of birth, or mother's maiden name.
    (10) Service provider means any person or entity that receives, 
maintains, processes, or otherwise is permitted access to customer 
information through its provision of services directly to a covered 
institution.
    (11) Transfer agent has the same meaning as in section 3(a)(25) of 
the Securities Exchange Act of 1934 (15 U.S.C. 78c(a)(25)).

PART 270--RULES AND REGULATIONS, INVESTMENT COMPANY ACT OF 1940

0
9. The authority citation for part 270 is revised to read as follows:

    Authority:  15 U.S.C. 80a-1 et seq., 80a-34(d), 80a-37, 80a-39, 
1681w(a)(1), 6801-6809, 6825, and Pub. L. 111-203, sec. 939A, 124 
Stat. 1376 (2010), unless otherwise noted.
* * * * *
    Section 270.31a-2 is also issued under 15 U.S.C. 80a-30.

0
10. Amend Sec.  270.31a-1 by adding paragraph (b)(13) to read as 
follows:


Sec.  270.31a-1  Records to be maintained by registered investment 
companies, certain majority-owned subsidiaries thereof, and other 
persons having transactions with registered investment companies.

* * * * *
    (b) * * *
    (13)(i) The written policies and procedures required to be adopted 
and implemented pursuant to Sec.  248.30(a)(1);
    (ii) The written documentation of any detected unauthorized access 
to or use of customer information, as well as any response to, and 
recovery from such unauthorized access to or use of customer 
information required by Sec.  248.30(a)(3);
    (iii) The written documentation of any investigation and 
determination made regarding whether notification is required pursuant 
to Sec.  248.30(a)(4), including the basis for any determination made, 
any written documentation from the United States Attorney General 
related to a delay in notice, as well as a copy of any notice 
transmitted following such determination;
    (iv) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(a)(5)(i);
    (v) The written documentation of any contract or agreement entered 
into pursuant to Sec.  248.30(a)(5); and
    (vi) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(b)(2).
* * * * *

0
11. Amend Sec.  270.31a-2 by:
0
a. In paragraph (a)(7), removing the period at the end of the paragraph 
and adding ``; and'' in its place; and
0
b. Adding paragraph (a)(8).
    The addition reads as follows:


Sec.  270.31a-2  Records to be preserved by registered investment 
companies, certain majority-owned subsidiaries thereof, and other 
persons having transactions with registered investment companies.

    (a) * * *
    (8) Preserve for a period not less than six years, the first two 
years in an easily accessible place, the records required by Sec.  
270.31a-1(b)(13) apart from any policies and procedures thereunder and, 
in the case of policies and procedures required under Sec.  270.31a-
1(b)(13), preserve a copy of such policies and procedures in effect, or 
that at any time within the past six years were in effect, in an easily 
accessible place.
* * * * *

PART 275--RULES AND REGULATIONS, INVESTMENT ADVISERS ACT OF 1940

0
12. The authority citation for part 275 is revised to read as follows:

    Authority:  15 U.S.C. 80b-2(a)(11)(G), 80b-2(a)(11)(H), 80b-
2(a)(17), 80b-3, 80b-4, 80b-4a, 80b-6(4), 80b-6a, 80b-11, 
1681w(a)(1), 6801-6809, and 6825, unless otherwise noted.
* * * * *
    Section 275.204-2 is also issued under 15 U.S.C. 80b-6.
* * * * *

0
13. Amend Sec.  275.204-2 by adding paragraph (a)(25) to read as 
follows:


Sec.  275.204-2  Books and records to be maintained by investment 
advisers.

    (a) * * *
    (25)(i) The written policies and procedures required to be adopted 
and implemented pursuant to Sec.  248.30(a)(1);
    (ii) The written documentation of any detected unauthorized access 
to or use of customer information, as well as any response to, and 
recovery from such unauthorized access to or use of customer 
information required by Sec.  248.30(a)(3) of this chapter;
    (iii) The written documentation of any investigation and 
determination made regarding whether notification is required pursuant 
to Sec.  248.30(a)(4) of this chapter, including the basis for any 
determination made, any written documentation from the United States 
Attorney General related to a delay in notice, as well as a copy of any 
notice transmitted following such determination;
    (iv) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(a)(5)(i) of this chapter;
    (v) The written documentation of any contract or agreement entered 
into pursuant to Sec.  248.30(a)(5) of this chapter; and
    (vi) The written policies and procedures required to be adopted and 
implemented pursuant to Sec.  248.30(b)(2) of this chapter.
* * * * *

    By the Commission.

    Dated: May 16, 2024.
Vanessa A. Countryman,
Secretary.
[FR Doc. 2024-11116 Filed 5-31-24; 8:45 am]
 BILLING CODE 8011-01-P

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.