A DELAY IN THE SAFEGUARDS RULE, BUT DEALERS SHOULD NOT WAIT By Hao Nguyen, Esq., Chief Legal Officer, ComplyAuto In this article, we discuss the Federal Trade Commission’s (FTC) delay of the effective date of the revised Safeguards Rule (“Rule”) and its practical impact on your dealerships. We will then explain why you should not wait to implement data protection and cybersecurity safeguards at your dealership because the FTC will still come after you under another section of the FTC Act that gives them broad authority. Safeguards Rule – Some Requirements Delayed Until June 9, 2023 The FTC gave dealers across the country an early Christmas present when it announced on Nov. 15, 2022, that it is extending the deadline for the Rule by six months. However, it is important to note that this extension only affects some of the requirements and will make them effective on June 9, 2023. Specifically, the provisions that have been extended to June include the following: • Designating a qualified individual to oversee the information security program; • Completing written risk assessments; • Monitoring the access and use of sensitive customer information; • Completing a penetration test & vulnerability scan; • Encrypting systems containing customer information; • Training employees on security awareness; • Conducting Vendor & Service Provider risk assessments; • Implementing MFA on all systems containing customer information; and • Creating and updating a device and systems inventory. Notably, the provisions that have not been delayed (and never were) are: • Creating a written Information Security Program (ISP) for your organization; • Obtaining signed contracts from your vendors (“Service Providers”) who collect customer information, promising to implement reasonable safeguards; • Periodically assessing your Service Providers to ensure that they have reasonable safeguards in place; and • Implementing a system capable of detecting attacks and intrusions on your network. Dealers Should Not Wait to Implement Safeguards Rule Solutions On paper, the delay sounded good. However, once you dig into the details, the delay is not as good. Because some aspects of the Rule still became effective in January, dealers should not take this delay for granted. This is the time to press on in reinforcing their data protection and cybersecurity practices. Why? Firstly, completing all requirements of the Rule can be time-consuming because so many players are involved. You will need to coordinate with the vendor to oversee compliance (like ComplyAuto), the dealership staff, any Service Providers they work with (to complete their requirements), and potentially your IT company or Managed Service Provider. Unless you are working with an efficient and responsive team, natural bottlenecks may arise as one party waits on the other. Secondly, you should not “miss the forest for the trees,” meaning that the FTC should not be the main reason why your dealership is establishing these data protection and cybersecurity protocols. Yes, we want to fulfill these requirements to keep the 8 KENTUCKY AUTO DEALER
RkJQdWJsaXNoZXIy MTg3NDExNQ==