The U.S. Securities and Exchange Commission (SEC) published a final rule on May 16 adopting amendments to Regulation S-P (Reg S-P) that update certain requirements of the safeguards and disposal rules.1 The final rule requires registered investment advisers, registered and unregistered investment companies, brokers and dealers, and transfer agents (together, covered institutions) to, among other things, adopt written policies and procedures for incident response programs that address unauthorized access to or use of customer information, including customer notification procedures. The final rule was supported by all five commissioners.2
Key Takeaways
- Covered institutions will need to review and likely update their policies and procedures to comply with the requirements of Reg S-P, including developing policies and procedures for an incident response program to address the unauthorized access or use of customer information. Policies and procedures also must include provisions to oversee service providers, and if a service provider is not a covered institution and has a breach, the covered institution likely will be required to institute a response.
- The definition of customer is now broader than just direct customers. It also includes information about the customers of other financial institutions where such information has been provided to the covered institution.
- Covered institutions generally must provide notification to customers of data breaches unless they determine, following a reasonable investigation, that sensitive customer information has not been, and is not reasonably likely to be, used in a manner that would result in substantial harm or inconvenience.
Read the full article here.
2 Commissioner Hester Peirce voted in support of the amendments but expressed some reservations with the breadth of the final rule and the likelihood of overnotification. (Please Mr. Postman – Statement on Regulation S-P, Statement of Commissioner Hester Peirce, SEC (May 16, 2024).)
Information contained in this publication should not be construed as legal advice or opinion or as a substitute for the advice of counsel. The articles by these authors may have first appeared in other publications. The content provided is for educational and informational purposes for the use of clients and others who may be interested in the subject matter. We recommend that readers seek specific advice from counsel about particular matters of interest.
© 2024 Stradley Ronon Stevens & Young, LLP. All rights reserved.