Pub. 1 2021 Issue 2

15 KENTUCKY AUTO DEALER loan information, etc.), and the FTC sought to hold the mortgage data analytics company responsible for the breach of its hired vendor in failing to develop, implement and maintain a comprehensive information security program in contravention of the Safeguards Rule. The Safeguards Rule requires that third- party service providers also be mandated to protect the security of customers’ personal information. Parenthetically, in the most recent security breach incident involving the OEM and its vendor, the OEM advised its dealers that it has informed the appropriate law enforcement authorities and is working with cybersecurity professionals to assess the scope of the problem. Importantly, the privacy and security consumer protection laws cited above also apply to auto dealers, which is one reason the most recent OEM vendor data security breach should serve as a reminder to all auto dealers to ensure they and their vendors have comprehensive programs in place for the protection and security of customer information. This includes but is not limited to: (i) ensuring any potential third-party service provider has developed, implemented and maintains a comprehensive information security program before the dealer enters into a business relationship with that vendor; (ii) requiring contractually that all third-party vendors comply with applicable federal and state statutory and regulatory requirements and prescribing contractually such vendors’ responsibility for compliance and for ensuring the security of customer information pursuant to the Safeguards Rule and related federal and state law requirements, including listing the safeguards vendors must have in place and follow; and (iii) continuously monitoring third-party service vendors’ compliance with applicable federal and state laws and adherence to the contractual requirements through the dealership’s establishment and implementation of an audit program to effectively monitor the vendors’ practices. Protection of customer data and ensuring your third-party service providers do the same is not only vital to your business, it is also your legal obligation. Ensure your data security programs and those of your vendors are in place, implemented and strictly monitored. Dealerships’ compliance with their legal obligations, including ensuring compliance by their third-party vendors, will serve to protect the security of customer data and preserve the dealership’s goodwill and business success. Julie A. Cardosi is an attorney and president of the private firm, Law Office of Julie A. Cardosi, P.C., of Springfield, Illinois. She has practiced law for 35 years and represents the business interests of franchised new vehicle dealers. Formerly in-house legal counsel for IADA, she concentrates her practice in the areas of mergers and acquisitions and other transfers of dealer ownership, franchise law, commercial law, state and federal regulatory compliance matters, including employment, and other areas impacting day-to-day dealership business operations. She has also served as an Illinois Assistant Attorney General and Deputy Chief of the Consumer Fraud Bureau of the Attorney General’s Office. The material discussed in this article is for general information only and is not intended as legal advice and should not be acted upon as such. Dealers should consult their own private legal counsel for application to their specific circumstances. For more information, Julie can be reached at 217-787-9782, ext. 1, or. jcardosi@autocounsel.com . 1 Vellequette, Larry P., “Vendor Linked to VW Data Breach Named in Memo to Dealers”, Automotive News, June 11, 2021. 2 See In the Matter of ASCENSION DATA & ANALYTICS, LLC, https://www.ftc.gov/enforcement/cases-proceedings/192-3126/ ascension-data-analytics-llc-matter CUSTOMERS’ PRIVACY AND THEIR ASSURANCE OF ITS SECURITY WHEN DOING BUSINESS WITH YOUR DEALERSHIP IS NOT ONLY IMPORTANT TO YOUR DEALERSHIP’S GOODWILL AND REPUTATION IN THE RETAIL COMMUNITY, IT’S ALSO THE DEALERSHIP’S LEGAL OBLIGATION.