Association Events
Learn about NHADA's major events and fundraisers.
.png?width=150&name=Ally_Final%20Logos%20and%20Pairings_11.14.2018-01%20(2).png)
-2.png?width=150&name=Wipfli%20Logo%20Blue%20RGB%20(1)-2.png)
.jpg?width=150&name=NHADA_Partner_FTR_Img_NHADA_Insurance%20(1).jpg)
.jpg?width=150&name=NHADA_Partner_FTR_Img_JMA(1).jpg)
.png?width=150&name=corp_logo_horz_on_light_with_trademark_symbol_1200w%20(002).png){kind=logo}
On October 27, 2023, the FTC announced a final rule amending its Safeguards Rule that will require non-banking financial institutions, such as dealers, to report certain data breaches and other security events, which they refer to as “notification events.” This means that dealers and others will be required to notify the FTC, which will post the reports on a publicly available website.
What counts as a notification event?
The trigger for filing a report is what is called a “notification event,” which is defined as “[t]he acquisition of unencrypted customer information without the authorization of the individual to which the information pertains.” This likely applies to data breaches or other security events that compromise unencrypted consumer data, but unfortunately, the exact scope of this definition is somewhat unclear.
If a notification event occurs that affects the unencrypted information of 500 or more consumers, then it must be reported to the FTC as soon as possible and no later than 30 days after it is discovered. Notice to the FTC must be provided electronically through a forthcoming form located on the FTC’s website. Dealers may need to report notification events that occur in dealer-controlled systems as well as those that occur at a vendor if they affect that dealer’s customer data.
This new reporting obligation begins on May 12, 2024. Dealers should review NADA’s previous Safeguards guidance (membership required) and consult the newly updated Driven Guide, A Dealer Guide to the FTC Safeguards Rule (L43), before the May 12 compliance deadline. Dealers should also work with their IT professionals and counsel to understand and prepare for the new requirements and should update their incident response plans and information security programs accordingly.
