On March 15, 2023, the SEC proposed amendments to Regulation S-P that aim to enhance the protection of customer information. The proposed amendments would require broker-dealers, investment companies, registered investment advisers, and transfer agents to provide notice to individuals affected by certain types of data breaches that may put them at risk of identity theft or other harm.
Currently, Regulation S-P requires covered firms to adopt written policies and procedures for the protection of customer records and information, as well as the proper disposal of consumer report information. However, there is no requirement for covered firms to notify customers about data breaches. Under the proposed amendments, covered firms would be required to notify customers of breaches that might put their personal financial data at risk.
The proposed amendments would also require covered institutions to adopt written policies and procedures for an incident response program to address unauthorized access to or use of customer information. Covered institutions would be required to provide notice to individuals whose sensitive customer information was or is reasonably likely to have been accessed or used without authorization, with certain limited exceptions. The notice must be provided as soon as practicable, but not later than 30 days after the covered institution becomes aware of the incident.
The proposed amendments would also broaden and align the scope of the safeguards rule and disposal rule to cover “customer information,” extend the safeguards rule to transfer agents registered with the Commission or another appropriate regulatory agency and expand the existing scope of the disposal rule to include transfer agents registered with another appropriate regulatory agency.
The proposing release will be published in the Federal Register, and the public comment period will remain open until 60 days after the date of publication. SEC Chair Gary Gensler believes that the proposed amendments if adopted would help customers maintain their privacy and protect themselves.
Have a securities law question? Call New York Securities Lawyers at 212-509-6544.
Mark Astarita is a nationally recognized securities attorney, who represents investors, financial professionals and firms in securities litigation, arbitration and regulatory matters, including SEC and FINRA investigations and enforcement proceedings.
He is a partner in the national securities law firm Sallah Astarita & Cox, LLC, and the founder of The Securities Law Home Page - SECLaw.com, which was one of the first legal topic sites on the Internet. It went online in 1995 and is updated daily with news, commentary and securities law related links.