Industry Alert: FTC's New Data Breach Reporting Rule and Implications for Dealerships

Information provided by ComplyAuto, Chris Cleveland, Co-Founder and CEO

The Federal Trade Commission (FTC) has recently intensified its stance on consumer data protection by unveiling a significant amendment to the FTC Safeguards Rule. This directive, centered around data breach reporting, is of paramount importance to all dealerships across the country. The legal team at ComplyAuto has reviewed the published amendment and FTC comments at length and have summarized their findings below.

Mandatory Reporting and Increased Accountability

Dealerships are now obligated to promptly report any data breach affecting 500 or more customers directly to the FTC. Beyond the act of reporting, this rule ushers in heightened accountability. An electronic report to the FTC not only standardizes the process but also triggers an immediate investigation into the dealership's security protocols and compliance with the Safeguards Rule.

FTC's Unambiguous Position on Data Breaches

Within the FTC's comments, it states that "[t]he Commission believes that taking action to correct a potential Safeguards Rule violation before additional security events can harm consumers is appropriate and desirable." This statement underscores the FTC's commitment to proactive consumer data protection and to go after violating businesses with the full force of the federal government.

Encryption:  A Non-Negotiable Requirement

The amendment specifically places a significant emphasis on encryption. Dealerships must report breaches involving "unencrypted" data, making it imperative for dealers to adopt encrypted messaging tools and ensure the encryption of device hard drives in order to secure their customer information. Not doing so would not only put you at significant risk to a data breach but also squarely in the FTC's crosshairs.

Time-Sensitive Reporting and Public Disclosure Risks

Dealerships are afforded a mere 30 days from the discovery of a breach to report it to the FTC. The FTC's decision to make these reports public heightens the risk of negative media attention, reputational damage, and a potential erosion of customer trust. In such a highly competitive industry and the importance of personal information, being publicly named in a data breach could mean the difference between losing a customer or losing a dealership.

ComplyAuto:  Your Partner in Data Breach Compliance

Dealerships that are currently lagging in compliance are treading very dangerous waters, but by mid-2024, when this amendment becomes effective, the full force of the Safeguards Rule will be in play. "Flying under the radar" will no longer be an option and non-compliance could lead to serious regulatory and reputational consequences.

As an NADA Affinity Provider that is endorsed by over 35 state dealer associations, including OADA, ComplyAuto is the singular one-stop solution for the Safeguards Rule and all of its iterations. It is the only platform that offers encryption tools for messaging and devices, directly catering to the stringent encryption requirements of the amendment.

Key Takeaways:  Navigating the New Data Breach Reporting Landscape

For dealerships to stay ahead of the curve, understanding the crux of the new rules is essential:

• Mandatory reporting of breaches affecting 500+ customers.
• Required electronic reporting via an FTC-provided form.
• Emphasis on encrypted messaging tools and device hard drive encryption.
• Only breaches involving "unencrypted" data are reportable.
• A strict 30-day reporting window post breach discovery.
• Public disclosure by the FTC, with associated reputational risks.
• Full rule enforcement expected by mid-2024^*.

For more information about ComplyAuto's Safeguards Rule solutions, please visit their website at https://www.complyauto.com or email them at info@complyauto.com.

* The amendment becomes effective 180 days after it is published in the Federal Registrar. ComplyAuto and OADA will keep you up-to-date and notify you when that occurs.