[Federal Register: March 13, 2008 (Volume 73, Number 50)]
[Proposed Rules]
[Page 13691-13719]
[DOCID:fr13mr08-32]

-----------------------------------------------------------------------

Part III

Securities and Exchange Commission

-----------------------------------------------------------------------

17 CFR Part 248

Part 248--Regulation S-P: Privacy of Consumer Financial Information and
Safeguarding Personal Information; Proposed Rule

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

17 CFR Part 248

[Release Nos. 34-57427; IC-28178; IA-2712; File No. S7-06-08]
RIN 3235-AK08

Part 248--Regulation S-P: Privacy of Consumer Financial
Information and Safeguarding Personal Information

AGENCY: Securities and Exchange Commission.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: The Securities and Exchange Commission (``Commission'') is
proposing amendments to Regulation S-P, which implements certain
provisions of the Gramm-Leach-Bliley Act (``GLBA'') and the Fair Credit
Reporting Act (``FCRA'') for entities regulated by the Commission. The
proposed amendments would set forth more specific requirements for
safeguarding information and responding to information security
breaches, and broaden the scope of the information covered by
Regulation S-P's safeguarding and disposal provisions. They also would
extend the application of the disposal provisions to natural persons
associated with brokers, dealers, investment advisers registered with
the Commission (``registered investment advisers'') and transfer agents
registered with the Commission (``registered transfer agents''), and
would extend the application of the safeguarding provisions to
registered transfer agents. Finally, the proposed amendments would
permit a limited transfer of information to a nonaffiliated third party
without the required notice and opt out when personnel move from one
broker-dealer or registered investment adviser to another.

DATES: Comments must be received on or before May 12, 2008.

ADDRESSES: Comments may be submitted by any of the following methods:

Electronic Comments

     Use the Commission's Internet comment form (http://
www.sec.gov/rules/proposed.shtml); or
     Send an e-mail to<EMAIL_ADDRESS>Please include
File Number S7-06-08 on the subject line; or
     Use the Federal eRulemaking Portal (http://
www.regulations.gov). Follow the instructions for submitting comments.

Paper Comments

     Send paper comments in triplicate to Nancy M. Morris,
Secretary, Securities and Exchange Commission, 100 F Street, NE.,
Washington, DC 20549-1090.

All submissions should refer to File Number S7-06-08. This file number
should be included on the subject line if e-mail is used. To help us
process and review your comments more efficiently, please use only one
method. The Commission will post all comments on the Commission's
Internet Web site (http://www.sec.gov/rules/proposed.shtml). Comments
are also available for public inspection and copying in the
Commission's Public Reference Room, 100 F Street, NE., Washington, DC
20549, on official business days between the hours of 10 a.m. and 3
p.m. All comments received will be posted without change; we do not
edit personal identifying information from submissions. You should
submit only information that you wish to make available publicly.

FOR FURTHER INFORMATION CONTACT: Catherine McGuire, Chief Counsel, or
Brice Prince, Special Counsel, Office of the Chief Counsel, Division of
Trading and Markets,<PHONE_NUMBER>; or Penelope Saltzman, Acting
Assistant Director, or Vincent Meehan, Senior Counsel, Office of
Regulatory Policy, Division of Investment Management,<PHONE_NUMBER>,
Securities and Exchange Commission, 100 F Street, NE., Washington, DC
20549.

SUPPLEMENTARY INFORMATION: The Commission today is proposing amendments
to Regulation S-P \1\ under Title V of the GLBA,\2\ the FCRA,\3\ the
Securities Exchange Act of 1934 (the ``Exchange Act''),\4\ the
Investment Company Act of 1940 (the ``Investment Company Act''),\5\ and
the Investment Advisers Act of 1940 (the ``Investment Advisers
Act'').\6\
---------------------------------------------------------------------------

    \1\ 17 CFR part 248. Unless otherwise noted, all references to
rules under Regulation S-P will be to Part 248 of the Code of
Federal Regulations (17 CFR 248).
    \2\ 15 U.S.C. 6801-6827.
    \3\ 15 U.S.C. 1681w.
    \4\ 15 U.S.C. 78a.
    \5\ 15 U.S.C. 80a.
    \6\ 15 U.S.C. 80b.
---------------------------------------------------------------------------

Table of Contents

I. Background
    A. Statutory Requirements and Current Regulation S-P Mandates
    B. Challenges Posed by Information Security Breaches
II. Discussion
    A. Information Security and Security Breach Response
Requirements
    B. Scope of the Safeguards and Disposal Rules
    C. Records of Compliance
    D. Exception for Limited Information Disclosure When Personnel
Leave Their Firms
III. General Request for Comments
IV. Paperwork Reduction Act
V. Cost-Benefit Analysis
VI. Initial Regulatory Flexibility Analysis
VII. Consideration of Burden on Competition and Promotion of
Efficiency, Competition and Capital Formation
VIII. Small Business Regulatory Enforcement Fairness Act
IX. Statutory Authority
X. Text of Proposed Rules and Rule Amendments

I. Background

A. Statutory Requirements and Current Regulation S-P Mandates

    Subtitle A of Title V of the GLBA requires every financial
institution to inform its customers about its privacy policies and
practices, and limits the circumstances in which a financial
institution may disclose nonpublic personal information about a
consumer to a nonaffiliated third party without first giving the
consumer an opportunity to opt out of the disclosure.\7\ In enacting
the legislation, Congress also specifically directed the Commission and
other federal financial regulators to establish and implement
information safeguarding standards requiring financial institutions
subject to their jurisdiction to adopt administrative, technical and
physical information safeguards.\8\ The GLBA specified that these
standards were to ``insure the

security and confidentiality of customer records and information,''
``protect against any anticipated threats or hazards to the security or
integrity'' of those records, and protect against unauthorized access
to or use of those records or information, which ``could result in
substantial harm or inconvenience to any customer.'' \9\
---------------------------------------------------------------------------

    \7\ See 15 U.S.C. 6802(a) and (b). The GLBA and Regulation S-P
draw a distinction between ``consumers'' and ``customers.'' A
``consumer'' is defined in Section 3(g)(1) of Regulation S-P to mean
an individual who obtains a financial product or service that is to
be used primarily for personal, family, or household purposes. See
17 CFR 248.3(g)(1). A ``customer'' is defined in Section 3(j) of
Regulation S-P as a consumer who has a continuing relationship with
the financial institution. See 17 CFR 248.3(j). The distinction
between customer and consumer determines the notices that a
financial institution must provide. Pursuant to Sections 4 and 5 of
Regulation S-P, a financial institution must provide customers with
an initial notice describing the institution's privacy policies when
a customer relationship is formed and at least annually throughout
the customer relationship. In contrast, if a consumer is not a
customer, a financial institution must only provide a notice if it
intends to share nonpublic personal information about the consumer
with a nonaffiliated third party (outside of certain exceptions).
See 17 CFR 248.4 and 248.5.
    \8\ The GLBA directed the Commission, the Federal Trade
Commission (``FTC'') and state insurance authorities to implement
the safeguarding standards by rule. See 15 U.S.C. 6805(b)(2). The
GLBA directed the Office of the Comptroller of the Currency, the
Board of Governors of the Federal Reserve System, the Federal
Deposit Insurance Corporation (``FDIC'') and the Office of Thrift
Supervision (collectively, the ``Banking Agencies'') and the
National Credit Union Administration (``NCUA'') to implement the
safeguarding standards by regulation or by guidelines. See 15 U.S.C.
6805(b)(1).
    \9\ 15 U.S.C. 6801(b).
---------------------------------------------------------------------------

    In response to these directives, we adopted Regulation S-P in
2000.\10\ Section 30(a) of Regulation S-P (the ``safeguards rule'')
requires institutions to safeguard customer records and
information,\11\ while other sections of the regulation implement the
notice and opt out provisions of the GLBA.\12\ The safeguards rule
currently requires institutions to adopt written policies and
procedures for administrative, technical, and physical safeguards to
protect customer records and information. The safeguards must be
reasonably designed to meet the GLBA's objectives.\13\ This approach
provides flexibility for institutions to safeguard customer records and
information in accordance with their own privacy policies and practices
and business models. The safeguards rule and the notice and opt out
provisions currently apply to brokers, dealers, registered investment
advisers, and investment companies.\14\
---------------------------------------------------------------------------

    \10\ See Privacy of Consumer Financial Information (Regulation
S-P), Exchange Act Release No. 42974, Investment Company Act
(``ICA'') Release No. 24543, Investment Advisers Act (``IAA'')
Release No. 1883 (June 22, 2000), 65 FR 40334 (June 29, 2000).
Pursuant to the GLBA directive, Regulation S-P is consistent with
and comparable to the financial privacy rules adopted by other
federal financial regulators in 2000. See FTC, Privacy of Consumer
Financial Information, 65 FR 33646 (May 24, 2000); Banking Agencies,
Privacy of Consumer Financial Information, 65 FR 35162 (June 1,
2000); and NCUA, Privacy of Consumer Financial Information;
Requirements for Insurance, 65 FR 31722 (May 18, 2000). See also 15
U.S.C. 6804(a)(2) (directing federal financial regulators to consult
and coordinate to assure, to the extent possible, that each agency's
regulations are consistent and comparable with the regulations
prescribed by the other agencies).
    In 2001, we amended Regulation S-P to permit futures commission
merchants and introducing brokers that are registered by notice as
broker-dealers in order to conduct business in security futures
products under Section 15(b)(11)(A) of the Exchange Act (``notice-
registered broker-dealers'') to comply with Regulation S-P by
complying with financial privacy rules that the Commodity Futures
Trading Commission (``CFTC'') adopted that year. See 17 CFR
248.2(b); Registration of Broker-Dealers Pursuant to Section
15(b)(11) of the Securities Exchange Act of 1934, Exchange Act
Release No. 44730 (Aug. 21, 2001), 66 FR 45138 (Aug. 27, 2001); see
also CFTC, Privacy of Consumer Financial Information, 66 FR 21236
(Apr. 27, 2001).
    \11\ 17 CFR 248.30(a).
    \12\ See 17 CFR 248.1-248.18. As described above, the GLBA and
Regulation S-P require brokers, dealers, investment advisers
registered with the Commission, and investment companies to provide
an annual notice of their privacy policies and practices to their
customers (and notice to consumers before sharing their nonpublic
personal information with nonaffiliated third parties outside
certain exceptions). See supra note 7; 15 U.S.C. 6803(a); 17 CFR
248.4; 17 CFR 248.5. In general, the privacy notices must describe
the institutions' policies and practices with respect to disclosing
nonpublic personal information about a consumer to both affiliated
and nonaffiliated third parties. 15 U.S.C. 6803; 17 CFR 248.6. The
notices also must provide a consumer a reasonable opportunity to
direct the institution generally not to share nonpublic personal
information about the consumer (that is, to ``opt out'') with
nonaffiliated third parties. 15 U.S.C. 6802(b); 17 CFR 248.7. (The
privacy notice also must provide, where applicable under the FCRA, a
notice and an opportunity for a consumer to opt out of certain
information sharing among affiliates.) Sections 13, 14, and 15 of
Regulation S-P (17 CFR 248.13, 17 CFR 248.14, and 17 CFR 248.15) set
out exceptions from these general notice and opt out requirements
under the GLBA. Section 13 includes exceptions for sharing
information with other financial institutions under joint marketing
agreements and with certain service providers. Section 14 includes
exceptions for sharing information for everyday business purposes,
such as maintaining or servicing accounts. Section 15 includes
exceptions for disclosures made with the consent or at the direction
of a consumer, disclosures for particular purposes such as
protecting against fraud, disclosures to consumer reporting
agencies, and disclosures to law enforcement agencies. In March
2007, the Commission, together with the Banking Agencies, the CFTC,
the FTC, and the NCUA, published for public comment in the Federal
Register a proposed model privacy form that financial institutions
could use for their privacy notices to consumers required by the
GLBA. See Interagency Proposal for Model Privacy Form Under the
Gramm-Leach-Bliley Act, Exchange Act Release No. 55497, IAA Release
No. 2598, ICA Release No. 27755 (Mar. 20, 2007), 72 FR 14940 (Mar.
29, 2007) (``Interagency Model Privacy Form Proposal'').
    \13\ Specifically, the safeguards must be reasonably designed to
insure the security and confidentiality of customer records and
information, protect against anticipated threats to the security or
integrity of those records and information, and protect against
unauthorized access to or use of such records or information that
could result in substantial harm or inconvenience to any customer.
See supra note 9 and accompanying text.
    \14\ Regulation S-P applies to investment companies as the term
is defined in Section 3 of the Investment Company Act (15 U.S.C.
80a-3), whether or not the investment company is registered with the
Commission. See 17 CFR 248.3(r). Thus, a business development
company, which is an investment company but is not required to
register as such with the Commission, is subject to Regulation S-P.
In this release, institutions to which Regulation S-P currently
applies, or to which the proposed amendments would apply, are
sometimes referred to as ``covered institutions.''
---------------------------------------------------------------------------

    Pursuant to the Fair and Accurate Credit Transactions Act of 2003
(``FACT Act''), the Commission amended Regulation S-P in 2004 to
protect against the improper disposal of consumer report
information.\15\ Section 30(b) of Regulation S-P (the ``disposal
rule'') currently applies to the institutions subject to the other
provisions of Regulation S-P, except that it excludes notice-registered
broker-dealers and includes registered transfer agents.
---------------------------------------------------------------------------

    \15\ 17 CFR 248.30(b). Section 216 of the FACT Act amended the
FCRA by adding Section 628 (codified at 15 U.S.C. 1681w), which
directed the Commission and other federal financial regulators to
adopt regulations for the proper disposal of consumer information,
and provides that any person who maintains or possesses consumer
information or any compilation of consumer information derived from
a consumer report for a business purpose must properly dispose of
the information. See Disposal of Consumer Report Information,
Exchange Act Release No. 50781, IAA Release No. 2332, ICA Release
No. 26685 (Dec. 2, 2004), 69 FR 71322 (Dec. 8, 2004) (``Disposal
Rule Adopting Release''). When we adopted the disposal rule, we also
amended Regulation S-P to require that the policies and procedures
institutions must adopt under the safeguards rule be in writing.
    The disposal rule requires transfer agents registered with the
Commission, as well as brokers and dealers other than notice-
registered broker-dealers, investment advisers registered with the
Commission, and investment companies that maintain or possess
``consumer report information'' for a business purpose, to take
``reasonable measures to protect against unauthorized access to or
use of the information in connection with its disposal.''
    In order to provide clarity, the Disposal Rule Adopting Release
included five examples intended to provide guidance on disposal
measures that would be deemed reasonable under the disposal rule.
See Disposal Rule Adopting Release at section II.A.2.
---------------------------------------------------------------------------

B. Challenges Posed by Information Security Breaches

    In recent years, we have become concerned with the increasing
number of information security breaches that have come to light and the
potential for identity theft and other misuse of personal financial
information. Once seemingly confined mainly to commercial banks and
retailers, this problem has spread throughout the business community,
including the securities industry.\16\
---------------------------------------------------------------------------

    \16\ See Press Release, NASD, NASD Warns Investors to Protect
Online Account Information, Brokerages Also Reminded of Obligation
to Protect Customer Information from New Threats (July 28, 2005),
http://www.finra.org/PressRoom/NewsReleases/2005NewsReleases/P014775
(last visited Nov. 6, 2007). See also In re NEXT Financial Group,
Inc., Exchange Act Release No. 56316 (Aug. 24, 2007), http://
www.sec.gov/litigation/admin/2007/34-56316.pdf, and Order
Instituting Administrative and Cease-and-Desist Proceedings Pursuant
to Sections 15(b) and 21C of the Securities Exchange Act of 1934
(Aug. 24, 2007) (alleging violations of the notice and opt out
provisions of Regulation S-P and the safeguards rule in connection
with recruiting registered representatives), http://www.sec.gov/
litigation/admin/2007/34-56316-o.pdf.
---------------------------------------------------------------------------

    In the last two years, we have seen a significant increase in
information security breaches involving institutions we regulate.
Perhaps most disturbing is the increase in incidents involving the
takeover of online brokerage accounts, including the use of the
accounts by foreign nationals as part of ``pump-and-dump'' schemes.\17\
The financial

services sector also is a popular target for online targeted attacks,
and ``phishing'' attacks in which fraudsters set up an Internet site
designed to mimic a legitimate site and induce random Internet users to
disclose personal information.\18\ In other recent incidents,
registered representatives of broker-dealers disposed of information
and records about clients or prospective clients in accessible areas,
from which journalists were able to remove them. Sensitive securities-
related data also has been lost or stolen as a result of other
incidents.\19\
---------------------------------------------------------------------------

    \17\ While some account takeovers may have been facilitated by
investors failing to take adequate precautions against security
threats such as ``keylogger'' programs and ``phishing'' attacks,
many online brokerage firms have successfully reduced their exposure
to account takeovers by improving their authentication and
monitoring procedures. The Commission has been active in this area,
and has brought several enforcement cases involving defendants in
foreign jurisdictions. See, e.g., Litigation Release No. 20037 (Mar.
12, 2007), available at http://www.sec.gov/litigation/litreleases/
2007/lr20037.htm (three Indian nationals charged with participating
in an alleged fraudulent scheme to manipulate the prices of at least
fourteen securities through the unauthorized use of other people's
online brokerage accounts); and Litigation Release No. 19949 (Dec.
19, 2006), available at http://www.sec.gov/litigation/litreleases/
2006/lr19949.htm (emergency asset freeze obtained; complaint alleged
an alleged Estonia-based account intrusion scheme that targeted
online brokerage accounts in the U.S. to manipulate the markets).
    \18\ In 2006, Symantec Corporation, a seller of information
security and information management software, reported that in the
first half of 2006, 84 percent of tracked phishing sites targeted
the financial sector and 9 of the top 10 brands phished this period
were from the financial sector. Because the financial services
sector is a logical target for attackers increasingly motivated by
financial gain, that sector was also the second most frequent target
of Internet-based attacks (after home users). See Symantec, Symantec
Internet Security Threat Report, Trends for January 06-June 06, at
9, 23 (Sept. 2006), http://www.symantec.com/specprog/threatreport/
ent-whitepaper_symantec_internet_security_threat_report_x_
09_2006.en-us.pdf (last visited Nov. 6, 2007) (``Symantec September
2006 Internet Security Threat Report''). Reportedly, employees of
financial services firms ``are increasingly being invited to visit
Web sites or download programs by people pretending to be colleagues
or peers,'' followed by attack programs on the sites or in downloads
that ``then open tunnels into the corporate network.'' More
recently, although financial services-related spam reportedly ``made
up 21 percent of all spam in the first six months of 2007, making it
the second most common type of spam during this period,'' there was
a 30-percent decline in stock market ``pump and dump'' spam ``due to
a decline in spam touting penny stocks that was triggered by actions
taken by the United States Securities and Exchange Commission, which
limited the profitability of this type of spam by suspending trading
of the stocks that are touted.'' See Symantec, Symantec Internet
Security Threat Report, Trends for January-June 07, Volume XII, at
107 (Sept. 2007), http://eval.symantec.com/mktginfo/enterprise/
white--papers/ent-whitepaper--internet--security--threat--report--
xii--09--2007.en-us.pdf (last visited Nov. 6, 2007) (citing
Commission Press Release 2007-34, SEC Suspends Trading Of 35
Companies Touted In Spam E-mail Campaigns (Mar. 8, 2007), available
at http://www.sec.gov/news/press/2007/2007-34.htm).
    \19\ For example, in April 2005, a shipping company lost a
computer backup tape containing account information for more than
200,000 broker-dealer customers. The broker-dealer voluntarily
notified its affected customers, although the data was compressed
and the tape was thought to have been destroyed. In December 2005, a
laptop computer containing unencrypted information that included
names and account numbers of 158,000 customers and the names and
Social Security numbers of 68,000 adviser personnel was stolen from
a registered investment adviser, and in March 2006, a laptop
computer containing the names, addresses, Social Security numbers,
dates of birth, and other employment-related information of as many
as 196,000 retirement plan participants was stolen from a benefits
plan administration subsidiary of a registered investment adviser.
In both cases, the laptops were taken from vehicles by thieves who
appear to have stolen them for their value as computer hardware
rather than for the information contained on them. The registered
investment adviser voluntarily notified the more than 200,000
clients and financial advisers whose information was compromised,
while the benefits plan administrator voluntarily notified the
nearly 200,000 retirement plan participants whose information was
compromised, and offered to pay for a year of credit monitoring for
each of them.
---------------------------------------------------------------------------

    Many firms in the securities industry are aware of these problems
and have appropriate safeguards in place to address them.\20\ We are
concerned, however, that some firms do not regularly reevaluate and
update their safeguarding programs to deal with these increasingly
sophisticated methods of attack.\21\ For this reason, and in light of
the increase in reported security breaches and the potential for
identity theft among the institutions we regulate, we believe that our
previous approach, requiring safeguards that must be reasonably
designed to meet the GLBA's objectives, merits revisiting.\22\
---------------------------------------------------------------------------

    \20\ Some institutions regulated by the Commission have already
taken steps to strengthen their policies and procedures for
safeguarding investors' information, such as by offering investors
the use of password-generating tokens for online brokerage accounts.
We also note that some firms have been sharing information about
suspicious activity with one another for the purpose of combating
identity theft. To the extent it might involve sharing nonpublic
personal information about consumers of the firms, Regulation S-P
does not prohibit such information sharing because Section
15(a)(2)(ii) of Regulation S-P permits firms to disclose nonpublic
personal information to a nonaffiliated third party for the purpose
of protecting against fraud without first giving consumers notice of
and an opportunity to opt out of the disclosures.
    \21\ According to a September 2007 report from Deloitte Touche
Tohmatsu, for example, 37 percent of 169 surveyed financial
institutions do not have an information security strategy in place,
and 33 percent of these institutions do not conduct vulnerability
testing, or only do so on an ad hoc basis. See Deloitte Touche
Tohmatsu, 2007 Global Security Survey, at 12, 36 (Sept. 2007),
http://www.deloitte.com/dtt/cda/doc/content/dtt_gfsi_
GlobalSecuritySurvey_20070901%281%29.pdf (last visited Nov. 6,
2007).
    \22\ In 2004 we sought comment on whether to revise our
safeguards rule to require institutions to address certain elements
in designating their safeguarding policies and procedures. See
Disposal of Consumer Report Information, Exchange Act Release No.
50361, IAA Release No. 2293, ICA Release No. 20596 (Sept. 14, 2004),
69 FR 56304 (Sept. 20, 2004) (``Disposal Rule Proposing Release''),
at section II.B. At that time we decided not to revise the
safeguards rule, but noted we would consider the comments we
received in the event we proposed any amendment to the rule. See
Disposal Rule Adopting Release, supra note 15, at section II.B. See
also infra note 31.
---------------------------------------------------------------------------

    We also are concerned that while the information protected under
the safeguards rule and the disposal rule includes certain personal
information, it does not include other information that could be used
to access investors' financial information if obtained by an
unauthorized user. Finally we want to address other issues under
Regulation S-P that have come to our attention, including the
application of the regulation to situations in which a representative
of one broker-dealer or registered investment adviser moves to another
firm. Accordingly, today we are proposing amendments to the safeguards
and disposal rules that are designed to address these concerns.

II. Discussion

    To help prevent and address security breaches in the securities
industry and thereby better protect investor information, we propose to
amend Regulation S-P in four principal ways. First, we propose to
require more specific standards under the safeguards rule, including
standards that would apply to data security breach incidents. Second,
we propose to amend the scope of the information covered by the
safeguards and disposal rules and to broaden the types of institutions
and persons covered by the rules. Third, we propose to require
institutions subject to the safeguards and disposal rules to maintain
written records of their policies and procedures and their compliance
with those policies and procedures. Finally, we are taking this
opportunity to propose a new exception from Regulation S-P's notice and
opt-out requirements to allow investors more easily to follow a
representative who moves from one brokerage or advisory firm to
another.

A. Information Security and Security Breach Response Requirements

    To help prevent and address security breaches at the institutions
we regulate, we propose to require more specific standards for
safeguarding personal information, including standards for responding
to data security breaches. When we adopted Regulation S-P in 2001, the
safeguards rule simply required institutions to adopt policies and
procedures to address the safeguarding objectives stated in the GLBA.
Following our adoption of the rule, the FTC and the Banking Agencies
issued regulations with more detailed standards for safeguarding
customer

records and information applicable to the institutions they
regulate.\23\ We believe these standards include necessary elements
that institutions should address when adopting and implementing
safeguarding policies and procedures. We have therefore looked to the
other agencies' standards in developing our proposal and tailored them,
where appropriate, to develop proposed standards for the institutions
we regulate.
---------------------------------------------------------------------------

    \23\ The Banking Agencies issued their guidelines for
safeguarding customer records and information in 2001. See
Interagency Guidelines Establishing Standards for Safeguarding
Customer Information and Rescission of Year 2000 Standards for
Safety and Soundness, 66 FR 8616 (Feb. 1, 2001) (``Banking
Agencies'' Security Guidelines''). The FTC adopted its safeguards
rule in 2002. See Standards for Safeguarding Customer Information,
67 FR 36484 (May 23, 2002) (``FTC Safeguards Rule''). The Banking
Agencies also have jointly issued guidance on responding to
incidents of unauthorized access or use of customer information. See
Interagency Guidance on Response Programs for Unauthorized Access to
Customer Information and Customer Notice, 70 FR 15736 (Mar. 29,
2005) (``Banking Agencies'' Incident Response Guidance''). More
recently, through the Federal Financial Institutions Examination
Council (``FFIEC''), the Banking Agencies jointly issued guidance on
the authentication of customers in an Internet banking environment,
and the Banking Agencies and the FTC jointly issued final rules and
guidelines for identity theft ``red flags'' programs to detect,
prevent, and mitigate identity theft in connection with the opening
of certain accounts or certain existing accounts. See FFIEC,
Authentication in an Internet Banking Environment (July 27, 2006),
available at www.ffiec.gov/pdf/authentication_guidance.pdf
(``Authentication Guidance''); Banking Agencies and FTC, Identity
Theft Red Flags and Address Discrepancies under the Fair and
Accurate Credit Transactions Act of 2003, 72 FR 63718 (Nov. 9, 2007)
(``Final Red Flag Rules''). See also Banking Agencies and FTC,
Identity Theft Red Flags and Address Discrepancies Under the Fair
and Accurate Credit Transactions Act of 2003, 71 FR 40785 (July 18,
2006) (``Proposed Red Flag Guidelines''). In March of this year, the
FTC also published a brochure on data security, Protecting Personal
Information: A Guide for Business (available at http://www.ftc.gov/
infosecurity/), and the FDIC issued a Supervisory Policy on Identity
Theft, FIL-32-2007 (Apr. 11, 2007), available at http://
www.fdic.gov/news/news/financial/2007/fil07032a.html.
---------------------------------------------------------------------------

1. Revised Safeguarding Policies and Procedures
    As noted above, the safeguards rule requires institutions to adopt
written policies and procedures that address administrative, technical
and physical safeguards to protect customer records and information.
The proposed amendments would further develop this requirement by
requiring each institution subject to the safeguards rule to develop,
implement, and maintain a comprehensive ``information security
program,'' including written policies and procedures that provide
administrative, technical, and physical safeguards for protecting
personal information, and for responding to unauthorized access to or
use of personal information.\24\ This program would have to be
appropriate to the institution's size and complexity, the nature and
scope of its activities, and the sensitivity of any personal
information at issue.\25\ Consistent with current requirements for
safeguarding policies and procedures, the information security program
also would have to be reasonably designed to: (i) Ensure the security
and confidentiality of personal information; (ii) protect against any
anticipated threats or hazards to the security or integrity of personal
information; and (iii) protect against unauthorized access to or use of
personal information that could result in substantial harm or
inconvenience to any consumer, employee, investor or securityholder who
is a natural person.\26\ Although the term ``substantial harm or
inconvenience'' is currently used in the safeguards rule, it is not
defined. We propose to define the term to mean ``personal injury, or
more than trivial financial loss, expenditure of effort or loss of
time.'' \27\ This definition is intended to include harms other than
identity theft that may result from failure to safeguard sensitive
information about an individual. For example, a hacker could use
confidential information about an individual for extortion by
threatening to make the information public unless the individual agrees
to the hacker's demands. ``Substantial harm or inconvenience'' would
not include ``unintentional access to personal information by an
unauthorized person that results only in trivial financial loss,
expenditure of effort or loss of time,'' such as if use of the
information results in an institution deciding to change the
individual's account number or password.\28\ The rule would provide an
example of what would not constitute harm or inconvenience that rises
to the level of ``substantial,'' which should help clarify the scope of
what would constitute ``substantial harm or inconvenience.''
---------------------------------------------------------------------------

    \24\ As amended, Section 30 would be titled, ``Information
security programs for personal information; records of compliance.''
    \25\ See proposed paragraph (a)(1) of Section 30. The term
``information security program'' would mean the administrative,
technical, or physical safeguards used to access, collect,
distribute, process, protect, store, use, transmit, dispose of, or
otherwise handle personal information. See proposed paragraph (d)(6)
of Section 30.
    \26\ See proposed paragraph (a)(2) of Section 30. Compare 17 CFR
248.30(a)(1)-(3).
    \27\ See proposed paragraph (d)(12) of Section 30. ``Substantial
harm or inconvenience'' would include theft, fraud, harassment,
impersonation, intimidation, damaged reputation, impaired
eligibility for credit, or the unauthorized use of the information
identified with an individual to obtain a financial product or
service, or to access, log into, effect a transaction in, or
otherwise use the individual's account.
    \28\ See proposed paragraph (d)(12)(ii) of Section 30. Thus, for
example the proposed definition would not encompass a firm's
occasional, unintentional delivery of an individual's account
statement to an incorrect address if the institution determined that
the information was highly unlikely to be misused. This
determination would have to be made promptly after the institution
becomes aware of an incident of unauthorized access to sensitive
personal information, and documented in writing. See proposed
paragraph (a)(4)(iii) of Section 30.
---------------------------------------------------------------------------

    The proposed amendments also would specify particular elements that
a program meeting the requirements of Regulation S-P must include.\29\
These elements are intended to provide firms in the securities industry
with detailed standards for the policies and procedures that a well-
designed information security program should include to address recent
identity theft-related incidents such as firms in the securities
industry losing data tapes and laptop computers and failing to dispose
properly of sensitive personal information, and hackers hijacking
online brokerage accounts.\30\ These elements also are intended to
maintain consistency with information safeguarding guidelines and rules
adopted by the Banking Agencies and

FTC.\31\ In addition, these elements are consistent with policies and
procedures we understand many institutions in the securities industry
have already adopted. We understand that large and complex
organizations generally have written policies that address information
safeguarding procedures at several layers, from an organization-wide
policy statement to detailed procedures that address particular
controls.\32\
---------------------------------------------------------------------------

    \29\ Many of these elements are addressed by widely accepted
information security standards. See, e.g., National Institute of
Standards and Technology (``NIST''), Special Publication 800 series
(Computer Security), for example Generally Accepted Principals and
Practices for Securing Information Technology Systems (SP 800-14)
(Sept. 1996), Guide to Intrusion Detection and Prevention Systems
(IDPS) (SP 800-94) (Feb. 2007), and Guide to Secure Web Services (SP
800-95) (Aug. 2007) (all available at http://csrc.nist.gov/
publications/PubsSPs.html), and bulletins dealing with computer
security published by the NIST's Information Technology Laboratory
(ITL), for example Secure Web Servers: Protecting Web Sites That Are
Accessed By The Public (ITL January 2008) (available at http://
csrc.nist.gov/publications/PubsITLSB.html); Federal Information
System Controls Audit Manual, General Accounting Office, Accounting
and Information Management Division, Federal Information System
Controls Audit Manual, GAO/AIMD-12.19.6 (known as ``FISCAM'') (Jan.
1999) (available at http://www.gao.gov/special.pubs/ai12.19.6.pdf);
International Organization for Standardization, Code of Practice for
Information Security Management (ISO/IEC 27002:2005) (known among
information security professionals as the ``British Standard,'' and
formerly designated BS ISO/IEC 17799:2005 and BS 7799-1:2005)
(available for purchase at http://www.standardsdirect.org/
iso17799.htm and at http://www.bsi-global.com/en/Shop/Publication-
Detail/?pid=000000000030166440); and Information Systems Audit and
Control Association/IT Governance Institute, Control Objectives for
Information and Related Technology (known as ``COBIT'') (last
updated, and published as version 4.1, May 2007) (available at
http://www.isaca.org).
    \30\ See supra notes 16-19 and accompanying text.
    \31\ See Banking Agencies' Security Guidelines and FTC
Safeguards Rule, supra note 23. As noted above, we sought comment on
whether to revise our safeguards rule in 2004. See supra note 22. At
that time, several commenters noted that Rule 206(4)-7 under the
Investment Advisers Act (17 CFR 275.206(4)-7) and Rule 38a-1 under
the Investment Company Act (17 CFR 270.38a-1) require registered
investment advisers and registered investment companies to have
written policies and procedures reasonably designed to prevent
violation of the federal securities laws, including safeguards for
the protection of customer records and information under Regulation
S-P. These rules also require registered investment advisers and
funds to review, no less frequently than annually, the adequacy of
these policies and procedures. See Comment Letter of the Investment
Counsel Association of America (Oct. 20, 2004), at p. 3; Comment
Letter of the Investment Company Institute (Oct. 20, 2004) at p. 2.
Each of these letters is available at http://www.sec.gov/comments/
s73304.shtml. We do not intend for the proposed amendments to alter
or conflict with these requirements.
    \32\ See Disposal Rule Proposing Release, supra note 22, at 69
FR 56308 & n.29.
---------------------------------------------------------------------------

    Institutions subject to the rule would be required to:
    (i) Designate in writing an employee or employees to coordinate the
information security program; \33\
---------------------------------------------------------------------------

    \33\ See proposed paragraph (a)(3)(i) of Section 30. Of course,
the employee or employees designated to coordinate an institution's
information security program would need to have sufficient authority
and access to the institution's managers, officers and directors to
effectively implement the program and modify it as necessary.
---------------------------------------------------------------------------

    (ii) Identify in writing reasonably foreseeable security risks that
could result in the unauthorized disclosure, misuse, alteration,
destruction or other compromise of personal information or personal
information systems; \34\
---------------------------------------------------------------------------

    \34\ See proposed paragraph (a)(3)(ii) of Section 30. The term
``personal information system'' would mean any method used to
access, collect, store, use, transmit, protect or dispose of
personal information. See proposed paragraph (d)(9) of Section 30.
---------------------------------------------------------------------------

    (iii) Design and document in writing and implement information
safeguards to control the identified risks; \35\
---------------------------------------------------------------------------

    \35\ See proposed paragraph (a)(3)(iii) of Section 30.
---------------------------------------------------------------------------

    (iv) Regularly test or otherwise monitor and document in writing
the effectiveness of the safeguards' key controls, systems, and
procedures, including the effectiveness of access controls on personal
information systems, controls to detect, prevent and respond to
attacks, or intrusions by unauthorized persons, and employee training
and supervision; \36\
---------------------------------------------------------------------------

    \36\ See proposed paragraph (a)(3)(iv) of Section 30.
---------------------------------------------------------------------------

    (v) Train staff to implement the information security program; \37\
---------------------------------------------------------------------------

    \37\ See proposed paragraph (a)(3)(v) of Section 30.
---------------------------------------------------------------------------

    (vi) Oversee service providers by taking reasonable steps to select
and retain service providers capable of maintaining appropriate
safeguards for the personal information at issue, and require service
providers by contract to implement and maintain appropriate safeguards
(and document such oversight in writing); \38\ and
---------------------------------------------------------------------------

    \38\ See proposed paragraph (a)(3)(vi) of Section 30.
---------------------------------------------------------------------------

    (vii) Evaluate and adjust their information security programs to
reflect the results of the testing and monitoring, relevant technology
changes, material changes to operations or business arrangements, and
any other circumstances that the institution knows or reasonably
believes may have a material impact on the program.\39\
---------------------------------------------------------------------------

    \39\ See proposed paragraph (a)(3)(vii) of Section 30. This
requirement is similar to the requirement in the Banking Agencies'
Security Guidelines that institutions covered by those guidelines
monitor, evaluate, and adjust, as appropriate, their information
security program in light of any relevant changes in technology, the
sensitivity of their customer information, internal or external
threats to information, and their own changing business
arrangements, such as mergers and acquisitions, alliances and joint
ventures, outsourcing arrangements, and changes to customer
information systems. See supra note 23, Banking Agencies' Security
Guidelines, 66 FR at 8634, 8635-36, 8637, 8639, 8641. The ``material
impact'' standard in proposed paragraph (a)(3)(iii) is intended to
require adjustment of a covered institution's information security
program only when a reasonable coordinator of the program would
consider adjusting the program important in light of changing
circumstances.
---------------------------------------------------------------------------

    The term ``service provider'' would mean any person or entity that
receives, maintains, processes, or otherwise is permitted access to
personal information through its provision of services directly to a
person subject to the rule.\40\ We understand that in large financial
complexes, a particular affiliate may be responsible for providing a
particular service for all affiliates in the complex. In that
circumstance, each financial institution subject to Regulation S-P
would be responsible for taking reasonable steps to ensure that the
service provider is capable of maintaining appropriate safeguards and
of overseeing the service provider's implementation, maintenance,
evaluation, and modifications of appropriate safeguards for the
institution's personal information. Under the proposed amendments, we
anticipate that a covered institution's reasonable steps to evaluate
the information safeguards of service providers could include the use
of a third-party review of those safeguards such as a Statement of
Auditing Standards No. 70 (``SAS 70'') report, a SysTrust report, or a
WebTrust report.\41\
---------------------------------------------------------------------------

    \40\ See proposed paragraph (d)(11) of Section 30.
    \41\ See Codification of Accounting Standards and Procedures,
Statement on Auditing Standards No. 70, Reports on Processing of
Transactions by Service Organizations (American Inst. of Certified
Public Accountants). See also description and comparison of these
reports at http://infotech.aicpa.org/Resources/
System+Security+and+Reliability/System+Reliability/
Principles+of+a+Reliable+System/
SAS+No+70+SysTrust+and+WebTrust+A+Comparison.htm.
---------------------------------------------------------------------------

    We request comment on the proposed specific standards for
safeguarding personal information.
     Would these standards provide sufficient direction to
institutions? Are there particular standards that should be more or
less prescriptive? For example, should institutions be required to
designate an employee or employees to coordinate the information
security program by name, or should institutions be permitted to make
these designations by position or office?
     Would additional standards be appropriate or are certain
standards unnecessary? Should the proposed standards be modified to
more closely or less closely resemble standards prescribed by the
Banking Agencies or the FTC? For the securities industry, are there any
other standards that a well-designed information security program
should address? Are there any other standards that would provide more
flexibility to covered institutions?
     We also invite comment on the proposed requirement that
entities assess the sufficiency of safeguards in place, to control
reasonably foreseeable risks. Should the rules include more detailed
standards and specifications for access controls? Should the
requirement specify factors such as those identified in the Banking
Agencies' guidance regarding authentication in an Internet banking
environment or include policies and procedures such as those in the
Banking Agencies and the FTC's proposed or final ``red flag''
requirements? \42\ For example, should we require that covered
institutions implement multifactor authentication, layered security, or
other controls for high-risk transactions involving access to customer
information or the movement of funds to third parties? Should we
require that covered institutions include in their information security
programs ``red flag'' elements

that would be relevant to detecting, preventing and mitigating identity
theft in connection with the opening of accounts or existing accounts,
or in connection with particular types of accounts associated with a
reasonably foreseeable risk of identity theft? Should we require that
covered institutions adopt policies and procedures for evaluating
changes of address followed closely by an account change or
transaction, or for processing address discrepancy notices from
consumer reporting agencies? If the rule were to include more detailed
standards and specifications for access controls, how should these
apply to business conducted by telephone?
---------------------------------------------------------------------------

    \42\ See Authentication Guidance, Proposed Red Flag Guidance,
and Final Red Flag Rules, supra note 23. The Authentication Guidance
has been credited with helping to curtail online banking fraud, but
has been characterized as not adequately addressing authentication
in the context of telephone banking. See Daniel Wolfe, How New
Authentication Systems are Altering Fraud Picture, Amer. Banker
(Dec. 26, 2007).
---------------------------------------------------------------------------

     Commenters are invited to discuss the proposed definition
of ``substantial harm or inconvenience.'' Are there circumstances that
commenters believe would create substantial harm or inconvenience to
individuals that would not meet the proposed definition? If so, how
should the definition be revised to address these circumstances?
     Commenters are invited to discuss the proposed
requirements for written documentation of compliance with the proposed
safeguarding provisions.
     Commenters are invited to discuss the proposed definition
of ``service provider.'' They also are invited to discuss whether, if
the proposed amendments are adopted, they should include or be
accompanied by guidance on the use of outside evaluations of third-
party service providers. For example, should the Commission provide
guidance similar to that provided by the FFIEC on the appropriate use
of SAS 70 reports in evaluating the information safeguards of service
providers? \43\
---------------------------------------------------------------------------

    \43\ The FFIEC provided the following guidance on the use of SAS
70 reports in the oversight of third-party service providers
(``TSPs'') by financial institutions regulated by FFIEC member
agencies:
    Financial institutions should ensure TSPs implement and maintain
controls sufficient to appropriately mitigate risk. In higher-risk
relationships the institution by contract may prescribe minimum
control and reporting standards, obtain the right to require changes
to standards as external and internal environments change, and
obtain access to the TSP for institution or independent third-party
evaluations of the TSP's performance against the standard. In lower
risk relationships the institution may prescribe the use of
standardized reports, such as trust services reports or a Statement
of Auditing Standards 70 (SAS 70) report.
    * * * * *
    Financial institutions should carefully and critically evaluate
whether a SAS 70 report adequately supports their oversight
responsibilities. The report may not provide a thorough test of
security controls and security monitoring unless requested by the
TSP. It may not address the effectiveness of the security process in
continually mitigating changing risks. Additionally, the SAS 70
report may not address whether the TSP is meeting the institution's
specific risk mitigation requirements. Therefore, the contracting
oversight exercised by financial institutions may require additional
tests, evaluations, and reports to appropriately oversee the
security program of the service provider.
    FFIEC, FFIEC IT Examination Handbook, Information Security
Booklet--July 2006, at 77, 78 (available at http://www.ffiec.gov/
ffiecinfobase/booklets/information_security/information_
security.pdf).
---------------------------------------------------------------------------

2. Data Security Breach Response
    Because of the potential for harm or inconvenience to individuals
when a data security breach occurs, we are proposing that information
security programs include procedures for responding to incidents of
unauthorized access to or use of personal information. These procedures
would include notice to affected individuals if misuse of sensitive
personal information has occurred or is reasonably possible. The
procedures would also include notice to the Commission (or for certain
broker-dealers, their designated examining authority \44\) under
circumstances in which an individual identified with the information
has suffered substantial harm or inconvenience or an unauthorized
person has intentionally obtained access to or used sensitive personal
information. The proposed rules that would require prompt notice of
information security breach incidents to individuals, as well as the
Commission or designated examining authorities, are intended to
facilitate swift and appropriate action to minimize the impact of the
security breach.
---------------------------------------------------------------------------

    \44\ A broker-dealer's designated examining authority is the
self-regulatory organization (``SRO'') of which the broker-dealer is
a member, or, if the broker-dealer is a member of more than one SRO,
the SRO designated by the Commission pursuant to 17 CFR 240.17d-1 as
responsible for examination of the member for compliance with
applicable financial responsibility rules (including the
Commission's customer account protection rules at 17 CFR 240.15c3-
3).
---------------------------------------------------------------------------

    The data security breach response provisions of the proposed
amendments include elements intended to provide firms in the securities
industry with detailed standards for responding to a breach so as to
protect against unauthorized use of compromised data. The proposed
standards would specify procedures a covered institution's information
security program would need to include. These procedures would be
required to be written to provide clarity for firm personnel and to
facilitate Commission and SRO examination and inspection. The proposed
standards are intended to ensure that covered institutions adopt plans
for responding to an information security breach incident so as to
minimize the risk of identity theft or other significant investor harm
or inconvenience from the incident. These proposed procedures also are
intended to be consistent with security breach notification guidelines
adopted by the Banking Agencies.\45\
---------------------------------------------------------------------------

    \45\ See Banking Agencies' Incident Response Guidance, supra
note 23.
---------------------------------------------------------------------------

    Under the proposed amendments, institutions subject to the rule
would be required to have written procedures to:
    (i) Assess any incident involving unauthorized access or use, and
identify in writing what personal information systems and what types of
personal information may have been compromised; \46\
---------------------------------------------------------------------------

    \46\ See proposed paragraph (a)(4)(i) of Section 30.
---------------------------------------------------------------------------

    (ii) Take steps to contain and control the incident to prevent
further unauthorized access or use and document all such steps taken in
writing; \47\
---------------------------------------------------------------------------

    \47\ See proposed paragraph (a)(4)(ii) of Section 30.
---------------------------------------------------------------------------

    (iii) Promptly conduct a reasonable investigation and determine in
writing the likelihood that the information has been or will be misused
after the institution becomes aware of any unauthorized access to
sensitive personal information; \48\ and
---------------------------------------------------------------------------

    \48\ See proposed paragraph (a)(4)(iii) of Section 30.
---------------------------------------------------------------------------

    (iv) Notify individuals with whom the information is identified as
soon as possible (and document the provision of such notification in
writing) if the institution determines that misuse of the information
has occurred or is reasonably possible.\49\
---------------------------------------------------------------------------

    \49\ See proposed paragraph (a)(4)(iv) of Section 30.
Notification could be delayed, however, if an appropriate law
enforcement agency determines that notification will interfere with
a criminal investigation and requests in writing a delay in
notification. We propose to require notification of individuals only
if misuse of the compromised information has occurred or is
reasonably possible to avoid requiring notification in circumstances
in which there is no significant risk of substantial harm or
inconvenience. If covered institutions were required to notify
individuals of every instance of unauthorized access or use, such as
if an employee accidentally opened and quickly closed an electronic
account record, individuals could receive an excessive number of
data breach notifications and become desensitized to incidents that
pose a real risk of identity theft.
---------------------------------------------------------------------------

    We propose to define the term, ``sensitive personal information,''
to mean ``any personal information, or any combination of components of
personal information, that would allow an unauthorized person to use,
log into, or access an individual's account, or to establish a new
account using the individual's identifying information,'' including the
individual's Social Security number, or any one of the individual's
name, telephone number, street address, e-mail address, or online user
name, in combination with any one

of the individual's account number, credit or debit card number,
driver's license number, credit card expiration date or security code,
mother's maiden name, password, personal identification number,
biometric authentication record, or other authenticating
information.\50\ This definition is intended to cover the types of
information that would be most useful to an identity thief, and to
which unauthorized access would create a reasonable possibility of
substantial harm or inconvenience to an affected individual.
---------------------------------------------------------------------------

    \50\ See proposed paragraph (d)(10) of Section 30.
---------------------------------------------------------------------------

    The amendments also would require an institution to provide notice
to the Commission as soon as possible after the institution becomes
aware of any incident of unauthorized access to or use of personal
information in which there is a significant risk that an individual
identified with the information might suffer substantial harm or
inconvenience, or in which an unauthorized person has intentionally
obtained access to or used sensitive personal information.\51\ This
requirement would allow Commission and SRO investigators or examiners
to review the notices to determine if an immediate investigative or
examination response would be appropriate. In this regard, it is
crucial that institutions respond promptly to any follow-up requests
for records or information from our staff or the staff of the
designated examining authority.\52\ Under the proposed amendments, a
prompt response in accordance with existing Commission guidance on the
timely production of records would be particularly important in
circumstances involving ongoing misuse of sensitive personal
information.
---------------------------------------------------------------------------

    \51\ See proposed paragraph (a)(4)(v) of Section 30.
    \52\ See generally 15 U.S.C. 21(a) (investigative requests); 17
CFR 240.17a 4(j) (examinations of broker-dealers); 17 CFR 275.204-
2(g) (examinations of investment advisers).
---------------------------------------------------------------------------

    The regulatory notification requirement in the Banking Agencies'
guidance requires a report to the appropriate regulator as soon as
possible after the institution becomes aware of an incident involving
unauthorized access to or use of sensitive customer information.\53\
Our proposed notice requirement differs from the Banking Agencies'
approach in that it would require notice to the Commission (or a
designated examining authority) when an incident of unauthorized access
to or use of personal information poses a significant risk that an
individual identified with the information might suffer substantial
harm or inconvenience, or in which an unauthorized person has
intentionally obtained access to or used sensitive personal
information. The proposed notice requirement is intended to avoid
notice to the Commission in every case of unauthorized access, and to
focus scrutiny on information security breaches that present a greater
potential likelihood for harm. We believe that this approach would help
conserve institutions', as well as the Commission's, administrative
resources by allowing minor incidents to be addressed in a way that is
commensurate with the risk they present. The information to be included
in the notice would allow the Commission or a broker-dealer's
designated examining authority to evaluate whether any legal action
against a would-be identity thief or other action is warranted in light
of the circumstances. A broker-dealer, other than a notice-registered
broker dealer, would be required to notify the appropriate designated
examining authority on proposed Form SP-30. An investment company or
registered investment adviser or transfer agent would be required to
notify the Commission on proposed Form SP-30.\54\
---------------------------------------------------------------------------

    \53\ See Banking Agencies' Incident Response Guidance, supra
note 23, at 70 FR 15740-15741 (concluding that the Banking Agencies'
standard for notification to regulators should provide an early
warning to allow an institution's regulator to assess the
effectiveness of an institution's response plan, and, where
appropriate, to direct that notice be given to customers if the
institution has not already done so).
    \54\ We anticipate that this form could be downloaded from our
Web site and would be required to be filed electronically with the
Registrations Branch in the Office of Compliance Inspections and
Examinations. While broker-dealers generally would file the form
with their designated examining authority rather than the
Commission, investment advisers that are dually registered with the
Commission as broker-dealers also would file with the Commission and
indicate their dual-registrant status on the form.
---------------------------------------------------------------------------

    Proposed Form SP-30 would require the institution to disclose
information that the Commission (or the designated examining authority)
needs to understand the nature of the unauthorized access or misuse of
personal information and the institution's intended response to the
incident.\55\ Accordingly, in addition to identifying and contact
information for the covered institution, the form would request a
description of the incident, when it occurred and what offices or parts
of the registrant's business were affected. The form also would require
disclosure of any third-party service providers that were involved, the
type of services provided and, if the service provider is an affiliate,
the nature of the affiliation. This information would help examiners to
assess the information security policies and procedures of the service
provider. In addition, the form would require a description of any
customer account losses.
---------------------------------------------------------------------------

    \55\ See proposed Form SP-30. Information submitted to the
Commission on the form would be accorded confidential treatment to
the extent permitted by law. See, e.g., 17 CFR 200.83. We realize
that the full amount of losses may not be known at the time an
information security breach is discovered, but we would expect
covered institutions to make a good faith effort to complete the
proposed form to the extent possible.
---------------------------------------------------------------------------

    Under the proposed amendments, if a covered institution determined
that an unauthorized person had obtained access to or used sensitive
personal information, and that misuse of the information had occurred
or was reasonably possible, the institution also would be required to
provide notification, in a clear and conspicuous manner, to each
individual identified with the information.\56\ The proposed
requirements for notices to individuals are intended to give investors
information that would help them protect themselves against identity
theft. They also are intended to be consistent with similar
requirements in the Banking Agencies' Incident Response Guidance.\57\
---------------------------------------------------------------------------

    \56\ See proposed paragraph (a)(5) of Section 30.
    \57\ See Banking Agencies' Incident Response Guidance, supra
note 23.
---------------------------------------------------------------------------

    The notices to affected individuals that would be required by the
proposed amendments would have to:
    (i) Describe the incident and the type of information that was
compromised, and what was done to protect the individual's information
from further unauthorized access or use; \58\
---------------------------------------------------------------------------

    \58\ See proposed paragraphs (a)(5)(i) and (a)(5)(ii) of Section
30.
---------------------------------------------------------------------------

    (ii) Include a toll-free telephone number or other contact
information for further information and assistance from the
institution; \59\
---------------------------------------------------------------------------

    \59\ See proposed paragraph (a)(5)(iii) of Section 30.
---------------------------------------------------------------------------

    (iii) Recommend that the individual review account statements and
immediately report any suspicious activity to the institution; \60\ and
---------------------------------------------------------------------------

    \60\ See proposed paragraphs (a)(5)(iv) and (a)(5)(v) of Section
30.
---------------------------------------------------------------------------

    (iv) Include information about FTC guidance regarding the steps an
individual can take to protect against identity theft, a statement
encouraging the individual to report any incidents of identity theft to
the FTC, and the FTC's Web site address and toll-free telephone number
for obtaining identity theft guidance and reporting suspected incidents
of identity theft.\61\
---------------------------------------------------------------------------

    \61\ See proposed paragraph (a)(5)(vi) of Section 30.

---------------------------------------------------------------------------

    We request comment on the proposed specific standards relating to
incidents of unauthorized access to or misuse of personal information.
     Commenters are invited to discuss the proposed
requirements for procedures for responding to incidents of unauthorized
access to or use of personal information. Are there any particular
steps that may not be necessary, or not necessary in all situations?
Are there any other steps that could be taken in response to a security
breach that also should be required in some or all situations?
     We request comment on the proposed provisions regarding
procedures for notifying the Commission (or a broker-dealer's
designated examining authority) of incidents in which an individual
identified with compromised information has suffered substantial harm
or inconvenience, or an unauthorized person has intentionally obtained
access to or used sensitive personal information.
     For example, should firms be required to provide notice
only if the information compromised in an incident is identified with a
certain number of individuals? Should the rule include a numerical or
other threshold for when notice to the Commission (or to a broker-
dealer's designated examining authority) is required? If so, how would
a threshold work for smaller institutions that may be far more likely
than larger institutions to meet the threshold? Will the proposed
standard provide a sufficient early warning to the Commission, or
should the Commission broaden the circumstances under which notices
would be required to be provided to the Commission (or to a broker-
dealer's designated examining authority), such as the standard adopted
by the Banking Agencies? Commenters should explain their views.
     Is the proposed definition of ``sensitive personal
information'' sufficient? Are there particular types of information
that should or should not be included?
     We request comment on proposed Form SP-30. Is the form
easy to understand and use? For example, is the form clear, or would
additional guidance, such as instructions or further explanation of
particular questions or terms be helpful? Would it be easier or more
cost-effective for firms if the rule specified the information they are
required to provide rather than provide a form? Would the form be more
useful if it were in a tabular format? Commenters should be specific
regarding changes they believe should be made to the content or format
of the proposed form.
     Similarly, we invite comment on the proposed provisions
regarding procedures for notifying individuals of incidents of
unauthorized use or access if an institution determines that an
unauthorized person has obtained access to or used the information and
that misuse of sensitive personal information has occurred or is
reasonably possible. Is the information in the proposed notice to
individuals appropriate? Is there additional information that
institutions should include, or information, proposed to be included,
that should be eliminated? Is the proposed threshold for notice
appropriate? If not, are there alternative thresholds for notice to
individuals that would be more appropriate? If so, commenters should
explain their views.
     Commenters are invited to discuss the proposed
requirements for written documentation of compliance with the proposed
incident response provisions.

B. Scope of the Safeguards and Disposal Rules

1. Information Covered by the Safeguards and Disposal Rules
    The Commission adopted the safeguards and disposal rules at
different times under different statutes--respectively, the GLBA and
the FACT Act--that differ in the scope of information they cover. As
noted above, Regulation S-P implements the GLBA privacy provisions
governing requirements for notice and opt out before an institution can
share certain information with nonaffiliates and for safeguarding
information. The regulation's notice and opt out provisions limit
institutions from sharing ``nonpublic personal information'' about
consumers and customers as defined in the GLBA and in Regulation S-P,
with nonaffiliated third parties.\62\ As required under the GLBA, the
safeguards rule requires covered institutions to maintain written
policies and procedures to protect ``customer records and
information,'' \63\ which is not defined in the GLBA or in Regulation
S-P. The disposal rule requires institutions to properly dispose of
``consumer report information,'' a third term, which Regulation S-P
defines consistent with the FACT Act provisions.\64\ Each of these
terms includes a different set of information, although the terms
include some of the same information.\65\ Each term also does not
include some information that, if obtained by an unauthorized user,
could permit access to personal financial information about an
institution's customers. We preliminarily believe that in order to
provide better protection against the unauthorized disclosure of this
personal financial information, the scope of information protected by
both the safeguards rule and the disposal rule should be broader.
Broadening the scope of information covered by the safeguards and
disposal rules would more appropriately implement Section 525 of the
GLBA. Section 525 directs the Commission to revise its regulations as
necessary to ensure that covered institutions have policies,
procedures, and controls in place to prevent the unauthorized
disclosure of ``customer financial information.'' Section 521 of Title
V of the GLBA prohibits persons from obtaining or requesting a person
to obtain, customer information by making false or fraudulent
statements to an officer, employee, agent, or customer of a financial
institution.\66\ In furtherance of these prohibitions, the GLBA directs
the Commission and the other federal financial regulators to review
their regulations and to revise them as necessary to ensure that
financial institutions have policies, procedures and controls in place
to prevent the unauthorized disclosure of ``customer financial
information'' and to deter and detect the activity described in Section
521.\67\ Applying both the safeguards and disposal rules to a
consistent set of information also could reduce any burden that may
have been created by the application of the safeguards and disposal
rules to different information.\68\
---------------------------------------------------------------------------

    \62\ See 15 U.S.C. 6802(a), (b). ``Nonpublic personal
information'' is generally defined in the GLBA and Regulation S-P as
encompassing personally identifiable financial information, as well
as any list, description, or other grouping of consumers (and
publicly available information pertaining to them) derived using any
personally identifiable financial information that is not publicly
available, subject to certain exceptions. See 15 U.S.C. 6809(4); 17
CFR 248.3(t) and 248.3(u). See supra note 12 for a discussion of the
notice and opt out provisions.
    \63\ See 17 CFR 248.30; 15 U.S.C. 6801(b)(1).
    \64\ 17 CFR 248.30(b)(2). Section 628(a)(1) of the FCRA directed
the Commission to adopt rules requiring the proper disposal of
``consumer information, or any compilation of consumer information,
derived from consumer reports for a business purpose.'' 15 U.S.C.
1681w(a)(1). Regulation S-P uses the term ``consumer report
information'' and defines it to mean a record in any form about an
individual ``that is a consumer report or is derived from a consumer
report.'' 17 CFR 248.30(b)(1)(ii). ``Consumer report'' has the same
meaning as in Section 603(d) of the Fair Credit Reporting Act (15
U.S.C. 1681(d)). 17 CFR 248.30(b)(1)(i).
    \65\ See Disposal Rule Adopting Release, supra note 15, at 69 FR
71323 n.13.
    \66\ See 15 U.S.C. 6821(a), (b).
    \67\ See 15 U.S.C. 6825.
    \68\ See David Annecharico, Note, Online Transactions: Squaring
the Gramm-Leach-Bliley Act Privacy Provisions With the FTC Fair
Information Practice Principles, 6 N.C. Banking Inst. 637, 662
(2002), available at http://www.unc.edu/ncbank/
Articles%20and%20Notes%20PDFs/Volume%206/DavidAnnecharico%5Bpp637-
664%5D.pdf (``To require financial institutions to treat the
security of consumer information on par with customer information
may be cost effective and efficient. It could merely mean storing
consumer information within the already mandated secure storage
systems that are being used to store customer information.'').

---------------------------------------------------------------------------

    Accordingly, we propose to amend the safeguards and disposal rules
so that both protect ``personal information,'' and to define that term
to encompass any record containing either ``nonpublic personal
information'' or ``consumer report information.'' \69\ As noted above,
each of these terms is defined in Regulation S-P.\70\ The term
``consumer report information'' would continue to mean any record about
an individual, whether in paper, electronic or other form, that is a
consumer report or is derived from a consumer report, as well as a
compilation of such records, but not including information that does
not identify individuals, such as aggregate information or blind
data.\71\ The proposed amendments would leave the meaning of the term
``consumer report'' unchanged from the definition set forth in Section
603(d) of the FCRA.\72\ Section 603(d) defines ``consumer report'' in
general as encompassing communications of information by a consumer
reporting agency bearing on a consumer's creditworthiness, credit
standing, reputation or particular other factors used in connection
with establishing the consumer's eligibility for credit or insurance,
or for employment purposes or other authorized purposes, subject to
certain exclusions.\73\
---------------------------------------------------------------------------

    \69\ Proposed paragraph (d)(8) of Section 30.
    \70\ See 17 CFR 248.3(t)(1) (definition of ``nonpublic personal
information''); 17 CFR 248.30(b)(ii) (definition of ``consumer
report information'').
    \71\ See proposed paragraph (c)(4) of Section 30 and current
paragraph (b)(ii) of Section 30 (definition governing current
disposal requirements).
    \72\ See proposed paragraph (d)(3) of Section 30.
    \73\ See 15 U.S.C. 1681a(d).
---------------------------------------------------------------------------

    In addition to nonpublic personal information and consumer report
information, ``personal information'' also would include information
identified with any consumer, or with any employee, investor, or
securityholder who is a natural person,\74\ in paper, electronic or
other form, that is handled by the institution or maintained on the
institution's behalf.\75\ Thus, for example, the definition would
include records of employee user names and passwords maintained by a
brokerage firm, and records about securityholders maintained by a
transfer agent. We believe safeguarding employee user names and
passwords promotes information security because unauthorized access to
this information could facilitate unauthorized access to a firm's
network and its clients' personal information.\76\ Safeguarding
information about investors and securityholders, such as maintained by
registered transfer agents, is necessary to protect investors who may,
directly or indirectly, do business with the Commission's regulated
entities even though they may not be ``consumers'' or ``customers'' of
those entities as those terms are defined for purposes of Regulation S-
P.\77\ We also propose to make a conforming change to the definition of
``personally identifiable financial information'' by including within
the definition information that is handled or maintained by a covered
institution or on its behalf, and that is identified with any consumer,
or with any employee, investor, or securityholder who is a natural
person.\78\ We preliminarily believe that this change would be
appropriate in the public interest and for the protection of investors
because it would help protect information identified with an investor
who may not be a ``consumer'' or ``customer'' of a covered institution.
---------------------------------------------------------------------------

    \74\ This element of the definition would exclude information
identified only with persons other than natural persons, such as
corporations. The GLBA limits the protections provided under
subtitle A of the privacy provisions to ``consumers,'' who are
individuals who obtain from a financial institution financial
products or services to be used for personal, family or household
purposes. 15 U.S.C. 6809(9). The FACT Act defines a ``consumer'' to
mean an individual. 15 U.S.C. 1681a(c).
    \75\ See proposed paragraph (d)(8) of Section 30.
    \76\ See supra note 17 and accompanying text.
    \77\ As discussed supra at note 7, Regulation S-P defines the
terms ``consumer'' and ``customer'' at 17 CFR 248.3(g) and 248.3(j),
respectively.
    \78\ See proposed new paragraph (u)(1)(iv) of Section 3. The
proposed amendments also would include technical, conforming changes
to references to Section 30 in Sections 1(b) and 2(b) of Regulation
S-P.
---------------------------------------------------------------------------

    To better protect investors'' and securityholders' information from
unauthorized disclosure, the proposed amendments would apply the
safeguards and disposal rules to nonpublic personal information or
consumer report information that is identified with any individual
consumer, employee, investor or securityholder and handled or
maintained by or on behalf of the institution. The proposal to include
personal information and consumer report information about employees of
covered institutions is intended to reduce the risk that a would-be
identity thief could access investor information by impersonating an
employee or employing ``social engineering'' techniques or bribery.
    Including consumer report information within the definition of
``personal information'' (to which the safeguards rule would apply)
would be consistent with the congressional intent behind making
consumer report information subject to the disposal requirements set
forth in the FACT Act.\79\ Furthermore, the proposed scope of
protection appears to be consistent with the practices of many covered
institutions that currently protect employee information, consumer
report information, and nonpublic personal information about consumers
and customers in the same manner.\80\
---------------------------------------------------------------------------

    \79\ The disposal rule was intended to reduce the risk of fraud
or related crimes, including identity theft, by ensuring that
records containing sensitive financial or personal information are
appropriately redacted or destroyed before being discarded. See 108
Cong. Rec. S13,889 (Nov. 4, 2003) (statement of Sen. Nelson).
    \80\ Based on our staff's informal discussions with industry
representatives about Regulation S-P issues, as well as the
estimated costs and benefits of the proposed amendments we believe
that many covered institutions currently protect both kinds of
information in the same way out of prudence and for reasons of
operational efficiency. See infra section V.B.
---------------------------------------------------------------------------

    We invite comment on the proposed definition of ``personal
information.''
     Should the safeguards rule extend to consumer report
information that is not nonpublic personal information?
     Should the disposal rule extend to nonpublic personal
information that is not consumer report information?
     To what extent do institutions currently take the same
measures in disposing of consumer report information, customer records
and information, nonpublic personal information about consumers and
customers, and information other than consumer report information that
is identified with employees, investors, or securityholders who are not
consumers or customers? To the extent that measures are different, what
is the basis for those differences?
     Is the proposed definition of ``personal information,''
which includes all records containing either consumer report
information or nonpublic personal information, broad enough to
encompass the information that needs to be protected? If not, how
should we expand the definition? Are there any aspects of the proposed
definition that, in the context of the information security
requirements discussed below, may be over-inclusive with regard to
particular types of entities? If so, how should we tailor the
definition?
     The proposed definition of ``personal information''
encompasses

information identified with any consumer, or with any employee,
investor, or securityholder who is a natural person. Are there any
other persons whose information should be protected under the
safeguards rule, or should the safeguards rule cover only information
identified with individuals who are customers of a financial
institution?
     Should the proposed definition of ``personal information''
be expanded to include information identified with non-natural persons,
such as corporate clients? Commenters should explain their views.
2. Institutions Covered by the Safeguards Rule
    As discussed above, the safeguards rule currently applies to
brokers, dealers, registered investment advisers, and investment
companies. The disposal rule currently applies to those entities as
well as to registered transfer agents. We propose to extend the
safeguards rule to apply to registered transfer agents.\81\ These
institutions, like those currently subject to both the safeguards and
disposal rules, may maintain personal information such as Social
Security numbers, account numbers, passwords, account balances, and
records of securities transactions and positions. Unauthorized access
to or misuse of such information could result in substantial harm and
inconvenience to the individuals identified with the information. The
proposed amendments thus would require that covered institutions that
may receive personal information in the course of effecting, processing
or otherwise supporting securities transactions must protect that
information by maintaining appropriate safeguards in addition to taking
measures to properly dispose of the information.\82\ Registered
transfer agents may maintain sensitive personal information about
investors, the unauthorized access to or use of which could cause
investors substantial inconvenience or harm. Therefore, we
preliminarily believe that extending the safeguards rule to registered
transfer agents would be appropriate in the public interest and for the
protection of investors.\83\
---------------------------------------------------------------------------

    \81\ The term ``transfer agent'' would be defined by proposed
paragraph (d)(14) of Section 30 to have the same meaning as in
Section 3(a)(25) of the Exchange Act (15 U.S.C. 78c(a)(25)).
    As discussed below, we also propose to extend the disposal rule
to associated persons of broker-dealers, supervised persons of
registered investment advisers, and associated persons of registered
transfer agents.
    \82\ The proposed definition of ``personal information'' would
include information about individual investors maintained by
registered transfer agents even though transfer agents typically do
not have consumers or customers for purposes of Regulation S-P
because their clients generally are not individuals, but are the
companies in which investors, including individuals, hold shares.
    \83\ Under Section 17A of the Exchange Act (15 U.S.C. 78q-1) the
Commission has authority to prescribe rules and regulations for
transfer agents as necessary or appropriate in the public interest,
for the protection of investors, or otherwise in furtherance of the
purposes of Title I of the Exchange Act.
---------------------------------------------------------------------------

    The proposed amendments also would limit the scope of broker-
dealers covered by the safeguards rule to brokers or dealers other than
those registered by notice with the Commission under Section 15(b)(11)
of the Exchange Act.\84\ Notice-registered broker-dealers must comply
with the privacy rules, including rules requiring the safeguarding of
customer records and information, adopted by the CFTC.\85\ Excluding
notice-registered broker-dealers from the scope of the Commission's
safeguards rule would clarify that both sets of rules do not apply to
notice-registered broker-dealers, and that the CFTC would have primary
responsibility for oversight of those broker-dealers in this area.
---------------------------------------------------------------------------

    \84\ Proposed paragraph (a)(1) of Section 30. See 15 U.S.C.
78o(b)(11). The Commodity Futures Modernization Act of 2000
established a system of notice registration under which trading
facilities and intermediaries that are already registered with
either the Commission or the CFTC may register with the other agency
on an expedited basis for the limited purpose of trading security
futures products. Under the substituted compliance provision in
Section 2(b) of Regulation S-P (17 CFR 248.2(b)), CFTC-regulated
futures commission merchants and introducing brokers that are
registered by notice with the Commission and in compliance with the
financial privacy rules of the CFTC are deemed to be in compliance
with Regulation S-P, except with respect to Regulation S-P's
disposal rule (currently 17 CFR 248.30(b)). Notice-registered
broker-dealers are already excluded from the scope of the disposal
rule.
    \85\ See 17 CFR 160.30.
---------------------------------------------------------------------------

    We seek comment on the proposed scope of the safeguards rule.
     Should registered transfer agents be subject to the
safeguards rule? To what extent are registered transfer agents expected
to possess, or lack, the type of information that could be used to
commit identity theft or otherwise cause individuals substantial harm
or inconvenience? \86\ Are there special issues that registered
transfer agents might have in implementing or meeting the requirements
of the safeguards rule?
---------------------------------------------------------------------------

    \86\ Such information could include address and account
information used to disseminate shareholder communications and
dividend and interest payments, as well as information collected
pursuant to Rule 17Ad-17 under the Exchange Act (17 CFR 240.17Ad-
17), which requires transfer agents registered with the Commission
to use taxpayer identification numbers or names to search databases
for addresses of lost securityholders.
---------------------------------------------------------------------------

     Should the Commission propose to extend the safeguards and
disposal rules to self-regulatory organizations or other types of
institutions in the securities industry? If so, which ones?
     Should notice-registered broker-dealers be excluded from
the scope of the proposed amended safeguards rule? If not, why not?
3. Persons Covered by the Disposal Rule
    As noted above, the disposal rule currently applies to broker-
dealers, investment companies, registered investment advisers and
registered transfer agents. We propose to extend the disposal rule to
apply to natural persons who are associated persons of a broker or
dealer, supervised persons of a registered investment adviser, and
associated persons of a registered transfer agent.\87\ As noted above,
we have become concerned that some of these persons, who may work in
branches far from the registered entity's main office, may not dispose
of sensitive personal financial information consistent with the
registered entity's disposal policies. The proposal is intended to make
persons associated with a covered institution directly responsible for
properly disposing of personal information consistent with the
institution's policies.
---------------------------------------------------------------------------

    \87\ See proposed paragraph (b)(1) of Section 30. The term
``associated person of a broker or dealer'' would be defined by
proposed paragraph (d)(1) of Section 30 to have the same meaning as
in Section 3(a)(18) of the Exchange Act (15 U.S.C. 78c(a)(18)). The
term ``supervised person of an investment adviser'' would be defined
by proposed paragraph (d)(13) of Section 30 to have the same meaning
as in Section 202(a)(25) of the Investment Advisers Act of (15
U.S.C. 80b-2(a)(25)). We are proposing to include ``supervised''
persons of an investment adviser, rather than ``associated'' persons
in order to include all employees, including clerical employees, of
an investment adviser who may be responsible for disposing of
personal information. See 15 U.S.C. 80b-2(a)(17) (defining term
``person associated with an investment adviser'' not to include
associated persons whose functions are clerical or ministerial).
This approach is intended to cover the same range of employees as
investment advisers, broker-dealers, and registered transfer agents.
The term ``associated person of a transfer agent'' would be defined
by proposed paragraph (d)(2) of Section 30 to have the same meaning
as in Section 3(a)(49) of the Exchange Act (15 U.S.C. 78c(a)(49).
    An additional proposed extension to the scope of the disposal
rule is discussed below. See infra section II.B.
---------------------------------------------------------------------------

     We request comment on the proposed extension of the scope
of the disposal rule to apply to natural persons who are associated
with broker-dealers, supervised persons of registered investment
advisers, or who are associated persons of registered transfer agents.
     Are there alternative ways of helping to ensure that these
persons would follow the covered institution's disposal policies and
properly dispose of personal information?

C. Records of Compliance

    We further propose to amend Regulation S-P to require institutions
subject to the safeguards and disposal rules to make and preserve
written records of their safeguards and disposal policies and
procedures. We also propose to require that institutions document that
they have complied with the elements required to develop, maintain and
implement these policies and procedures for protecting and disposing of
personal information, including procedures relating to incidents of
unauthorized access to or misuse of personal information. These records
would help institutions assess their policies and procedures
internally, and help examiners to monitor compliance with the
requirements of the amended rules. The periods of time for which the
records would have to be preserved would vary by institution, because
the requirements would be consistent with existing recordkeeping rules,
beginning with when the records were made, and, for records of written
policies and procedures, after any change in the policies or procedures
they document.\88\ Broker-dealers would have to preserve the records
for a period of not less than three years, the first two years in an
easily accessible place. Registered transfer agents would have to
preserve the records for a period of not less than two years, the first
year in an easily accessible place. Investment companies would have to
preserve the records for a period not less than six years, the first
two years in an easily accessible place. Registered investment advisers
would have to preserve the records for five years, the first two years
in an appropriate office of the investment adviser. We believe that
these proposed recordkeeping provisions, while varying among covered
institutions, would all result in the maintenance of the proposed
records for sufficiently long periods of time and in locations in which
they would be useful to examiners. Moreover, we do not believe that
shorter or longer maintenance periods would be warranted by any
difference between the proposed records and other records that covered
institutions currently must maintain for these lengths of time. We also
believe that conforming the proposed retention periods to existing
requirements would allow covered institutions to minimize their
compliance costs by integrating the proposed requirements into their
existing recordkeeping systems.\89\
---------------------------------------------------------------------------

    \88\ See proposed paragraph (c) of Section 30.
    \89\ See 17 CFR 240.17a-4(b); 240.17Ad-7(b); 270.31a-2(a)(4)-
(6); 275.204-2(e)(1).
---------------------------------------------------------------------------

    We request comment on the proposed requirements for making and
retaining records.
     Are the proposed periods of time for preserving the
records appropriate, or should certain records be preserved for
different periods of time?
     Would the costs associated with preserving records for
periods of time consistent with covered institutions' other
recordkeeping requirements be less than they would be if all
institutions were required to keep these records for the same period of
time?

D. Exception for Limited Information Disclosure When Personnel Leave
Their Firms

    Finally, we propose to amend Regulation S-P to add a new exception
from the notice and opt out requirements to permit limited disclosures
of investor information when a registered representative of a broker-
dealer or a supervised person of a registered investment adviser moves
from one brokerage or advisory firm to another. The proposed exception
is intended to allow firms with departing representatives to share
limited customer information with the representatives' new firms that
could be used to contact clients and offer them a choice about whether
to follow a representative to the new firm. At many firms,
representatives develop close professional and personal relationships
with investors over time. Representatives at such firms likely remember
the basic contact information for their clients or have recorded it in
their own personal records. Some firms discourage departing
representatives from soliciting clients to move to another firm, while
others do not. At any firm, departing representatives may have a strong
incentive to transfer as much customer information as possible to their
new firms, and it has been brought to our attention that, at some
firms, information may have been transferred without adequate
supervision, in contradiction of privacy notices provided to customers,
or potentially in violation of Regulation S-P.\90\
---------------------------------------------------------------------------

    \90\ See, e.g., In re NEXT Financial Group, Inc., supra note 16.
---------------------------------------------------------------------------

    The proposed exception is designed to provide an orderly framework
under which firms with departing representatives could share certain
limited customer contact information and could supervise the
information transfer.\91\ The proposed exception would permit one firm
to disclose to another only the following information: the customer's
name, a general description of the type of account and products held by
the customer, and contact information, including address, telephone
number and e-mail information.\92\ We propose to include this
particular information as it would be useful for a representative
seeking to maintain contact with investors, but appears unlikely to put
an investor at serious risk of identity theft. It also is the type of
information an investor would expect a representative to remember.
Broker-dealers and registered investment advisers seeking to rely on
the exception would have to require their departing representatives to
provide to them, not later than the representative's separation from
employment, a written record of the information that would be disclosed
pursuant to the exception, and broker-dealers and registered investment
advisers would be required to preserve such records consistent with the
proposed recordkeeping provisions of Section 30.\93\ This condition is
intended

to help ensure that firms relying on the exception are appropriately
accounting for the information they are disclosing in connection with
departures of their representatives.\94\
---------------------------------------------------------------------------

    \91\ In 2004, certain large broker-dealers entered into a
protocol under which signatories agreed not to sue one another for
recruiting one another's registered representatives, if the
representatives take only limited client information to another
participating firm. The initial signatories, Citigroup Global
Markets/Smith Barney, Merrill Lynch, and UBS Financial Services,
were joined more recently by Raymond James, Wachovia Securities and
others.
    We understand that, under the protocol, the information that a
departing representative may take to another firm is limited to each
client's name, address, a general description of the type of account
and products held by the client, and the client's phone number and
e-mail address. This information may be used at the representative's
new firm only by the representative, and only for the purpose of
soliciting the representative's former clients.
    We further understand that there may be some confusion in the
securities industry regarding what information may be disclosed to a
departing representative's new firm consistent with the limitations
in Regulation S-P, and that at times these limitations may cause
inconvenience to investors. NASD (now consolidated into FINRA)
issued guidance to its member firms regarding the permissible and
impermissible use of ``negative response letters'' for bulk
transfers of customer accounts and changes in the broker-dealer of
record on certain types of accounts (see NASD NtM 04-72 (Oct. 2004);
NtM 02-57 (Sept. 2002)). More recently, FINRA issued guidance
relating to Regulation S-P in the context special considerations
firms should use to supervise recommendations of newly associated
registered representatives to replace mutual funds and variable
products). See FINRA, Regulatory Notice 07-36, available at http://
www.finra.org/web/groups/rules_regs/documents/notice_to_members/
p036445.pdf. However, our staff reports that scenarios involving
representatives moving from one firm to another continue to create
uncertainty regarding firms' obligations under Regulation S-P.
    \92\ See proposed paragraph (a)(8)(i) of Section 15.
    \93\ See proposed paragraph (a)(8)(iii) of Section 15 and
proposed paragraph (c) of Section 30. For purposes of the proposed
exception, the term ``representative'' would be defined to mean a
natural person associated with a broker or dealer registered with
the Commission, who is registered or approved in compliance with 17
CFR 240.15b7-1, or a supervised person of an investment adviser as
defined in Section 202(a)(25) of the Investment Advisers Act. See
proposed paragraph (a)(8)(iv) of Section 15.
    \94\ Most firms seeking to rely on the proposed exception would
not need to revise their GLBA privacy notices because they already
state in the notices that their disclosures of information not
specifically described include disclosures permitted by law, which
would include disclosures made pursuant to the proposed exception
and the other exceptions provided in Section 15 of Regulation S-P.
---------------------------------------------------------------------------

    The exception would be subject to conditions that are designed to
limit the potential that the information would result in identity theft
or other abuses. The shared information could not include any
customer's account number, Social Security number, or securities
positions.\95\ A representative would not need this type of information
to contact investors, although it would be useful to an identity thief,
and an investor probably would not expect a representative to remember
it. In addition, a representative could solicit only an institution's
customers that were the representative's clients. This condition
recognizes that an investor might expect to be contacted by a
representative with whom the investor has done business before, but not
by another person at the representative's new firm.\96\
---------------------------------------------------------------------------

    \95\ See proposed paragraph (a)(8)(ii) of Section 15.
    \96\ See proposed paragraph (a)(8)(i) of Section 15 (permitting
a representative to solicit customers to whom the representative
personally provided a financial product or service on behalf of the
institution).
---------------------------------------------------------------------------

    As noted above, the proposed exception is designed to facilitate
the transfer of client contact information that would help broker-
dealers and registered investment advisers offer clients the choice of
following a departing representative to a new firm. At firms that
choose to rely on it, the proposed exception also should reduce
potential incentives some representatives may have to take information
with them secretly when they leave. By specifically limiting the types
of information that could be disclosed to the representative's new
firm, the proposed amendments are designed to help firms safeguard more
sensitive client information. This limitation also would clarify that a
firm may not require or expect a representative from another firm to
bring more information than necessary for the representative to solicit
former clients. Because the proposed exception is designed to promote
investor choice, provide legal certainty, and reduce potential
incentives for improper disclosures, we preliminarily believe that it
would be necessary or appropriate in the public interest, and is
consistent with the protection of investors.
    The proposed exception would not limit the disclosure of additional
information to a new firm pursuant to a customer's consent or
direction.\97\ It also would not preclude the disclosure of additional
information required in connection with the transfer of a customer's
account.\98\ Depending on its business organization, its policies
regarding departing representatives and the circumstances of a
representative's departure, a firm could choose to rely on existing
exceptions rather than the proposed new exception.\99\ The proposed
exception is designed to allow firms that choose to share limited
contact information to do so. The proposed exception would not,
however, affect firm policies that prohibit the transfer of any
customer information other than at the customer's specific direction.
---------------------------------------------------------------------------

    \97\ For example, if an investor chooses to move his or her
business to the representative's new firm, he or she may consent to
having the original firm disclose additional information about the
customer's account to the representative's new firm without the firm
first having to provide the customer with an opt out. See 17 CFR
248.15(a)(1).
    \98\ If an investor requests or authorizes the transfer of his
or her account from the representative's old firm to the
representative's new firm, the old firm may disclose additional
information as necessary to effect the account transfer. See 17 CFR
248.14(a)(1) and 248.14(b)(2)(vi)(B). The exception also would not
preclude the disclosure of additional information about the investor
if the firm has provided the investor with a privacy notice
describing the disclosure and given the investor a reasonable
opportunity to opt out of the disclosure, and the customer has not
opted out. See 17 CFR 248.10. Thus, covered institutions that wish
to disclose an investor's nonpublic personal information to a
departing representative's new firm without relying on the proposed
new exception or without first obtaining consent from the investor
to the disclosure or to an account transfer could revise their
privacy notices to describe disclosures the firm would make in the
context of a representative's move to another broker-dealer or
registered investment adviser.
    \99\ See 17 CFR 248.14, 248.15.
---------------------------------------------------------------------------

    We have chosen to propose this approach as opposed to an
alternative approach that would require all firms to include specific
notice and opportunity to opt out of this information sharing in their
initial and annual privacy notices. Under this alternative, a broker-
dealer or registered investment adviser's privacy notice would have to
provide specific disclosure regarding the circumstances under which the
broker-dealer or adviser would share customer information with another
firm when a registered representative or supervised person leaves. We
have chosen this approach because, as indicated earlier, many
representatives develop close professional and personal relationships
with investors. They are likely to remember basic contact information
for their clients or have recorded it in their own personal records,
and investors would expect representatives to have this information.
This type of limited contact information is unlikely to put investors
at serious risk of identity theft. Also, we believe that a description
of disclosures to a departing representative's new firm would be
difficult to distinguish from the description of disclosures made for
the purpose of third-party marketing and would further complicate
already complex privacy notices.
     Commenters are invited to discuss the proposed new
exception. Would it permit the transfer of contact information so as to
promote investor choice and convenience? Would it foreclose the
transfer of particularly sensitive information that, if misused, could
lead to identity theft? Should the transfer of customer contact
information be conditioned on the broker-dealer or registered
investment adviser receiving the information certifying to the sharing
institution that it complies with the safeguards and disposal rules?
     We also invite commenters to share their views on the
likely effect of the proposed new exception on competition in
recruiting broker-dealer and investment adviser representatives. Are
there alternative approaches that would both protect investor
information and not unduly restrict the transfer of representatives
from one firm to another?
     We seek comment on potential alternative approaches,
including requiring specific disclosure. Are investors, particularly
new clients to a firm, likely to understand disclosures about
information that would be given to a departing representative's new
firm in initial or annual privacy notices? \100\ Should the
availability of the proposed exemption be conditioned on providing
investors with specific disclosure regarding whether a covered
institution would disclose personal information in connection with a
representative's departure?
---------------------------------------------------------------------------

    \100\ We expect that if the Banking Agencies, the FTC and the
Commission were to adopt the proposed model privacy form, see
Interagency Model Privacy Form Proposal, supra note 12, the
description of the disclosure to a nonaffiliated firm could be
included on page 2 of the proposed form in the section defining
nonaffiliates.
---------------------------------------------------------------------------

     The proposed exception would permit broker-dealers and
registered investment advisers to transfer limited

information to other broker-dealers and registered investment advisers
without first providing notice and opt out. Should we make the proposed
exception available for information transferred to other types of
financial institutions where a departing representative may go? For
example, should we permit broker-dealers and registered investment
advisers to rely on the exception to share information with investment
advisers that are not registered with the Commission?
     Commenters are invited to express their views on the
proposed exemption's condition that a departing representative of a
covered institution relying on this exemption could solicit only the
institution's customers that were the representative's clients.

III. General Request for Comments

    We request comment on all aspects of the proposed amendments to
Regulation S-P. We particularly urge commenters to suggest other
provisions or changes that could enhance the ways in which securities
industry participants protect personal information. We encourage
commenters to provide empirical data, if available, to support their
views.

IV. Paperwork Reduction Act

    Certain provisions of the proposed amendments contain ``collections
of information'' requirements within the meaning of the Paperwork
Reduction Act of 1995 (``PRA'').\101\ The Commission is submitting
these amendments to the Office of Management and Budget (``OMB'') for
review and approval in accordance with the PRA.\102\ The title for the
collections of information is ``Information security programs for
personal information; records of compliance.'' The safeguards and
disposal rules we propose to amend contain currently approved
collections of information under OMB Control No. 3235-0610, the title
of which is, ``Rule 248.30, Procedures to safeguard customer records
and information; disposal of consumer report information.'' \103\ The
Commission is proposing to amend Regulation S-P's safeguards and
disposal rules, 17 CFR 248.30(a) and (b), pursuant to Sections 501,
504, 505, and 504 of the GLBA,\104\ Sections 17, 17A, 23, and 36 of the
Exchange Act,\105\ Sections 31(a) and 38 of the Investment Company
Act,\106\ and Sections 204 and 211 of the Investment Advisers Act.\107\
Regulation S-P sets forth the Commission's safeguards rule for
institutions covered by the regulation. Among other things, the
safeguards rule requires covered institutions to adopt administrative,
technical, and physical information safeguards to protect customer
records and information. Regulation S-P also contains the Commission's
disposal rule, which requires institutions to properly dispose of
consumer report information possessed for a business purpose by taking
reasonable measures to protect against unauthorized access to or use of
the information in connection with its disposal.
---------------------------------------------------------------------------

    \101\ 44 U.S.C. 3501-3520.
    \102\ 44 U.S.C. 3507(d) and 5 CFR 1320.11.
    \103\ The paperwork burden imposed by Regulation S-P's notice
and opt-out requirements, 17 CFR 248.1 to 248.18, is currently
approved under a separate OMB control number, OMB Control No. 3235-
0537. The proposed amendments would not affect this collection of
information.
    \104\ 15 U.S.C. 6801, 6804, 6805 and 6825.
    \105\ 15 U.S.C. 78q, 78q-1, 78w, and 78mm.
    \106\ 15 U.S.C. 80a-30(a), 80a-37.
    \107\ 15 U.S.C. 80b-4, 80b-11.
---------------------------------------------------------------------------

    The proposed amendments are designed to ensure that covered
institutions maintain a reasonable information security program that
includes safeguarding policies and procedures that are more specific
than those currently required, including policies and procedures for
responding to data security breach incidents, for notifying individuals
for whom the incidents pose a risk of identity theft, and for reporting
certain incidents to the Commission (or to a broker-dealer's designated
examining authority) on proposed Form SP-30. The amendments also would
broaden the scope of information and the types of institutions and
persons covered by the safeguards and disposal rules. Finally, the
amendments would create a new exception from Regulation S-P's notice
and opt-out requirements for disclosures of limited information in
connection with the departure of a representative of a broker-dealer or
registered investment adviser. Firms choosing to rely on the exception
would be required to keep records of the information disclosed pursuant
to it.
    The hours and costs associated with these collections of
information would consist of reviewing the proposed amendments,
collecting and searching for existing policies and procedures,
conducting a risk assessment, developing and recording information
safeguards appropriate to address risks, training personnel, and
adjusting written safeguards on an ongoing basis. Institutions would
also have to respond appropriately to incidents of data security breach
as may occur on an ongoing basis. If misuse of information has occurred
or is reasonably possible, this would include notifying affected
individuals. If there is a significant risk that an individual
identified with the information might suffer substantial harm or
inconvenience, or any unauthorized person has intentionally obtained
access to or used sensitive personal information, this would also
include notifying the Commission or an appropriate designated examining
authority as soon as possible on proposed Form SP-30. Certain of these
collections of information also would require disclosure, reporting,
and recordkeeping burdens, as analyzed below.
    An agency may not conduct or sponsor, and a person is not required
to respond to a collection of information unless a currently valid OMB
control number is displayed. Responses to these collections of
information would not be kept confidential.\108\ The collections of
information would be mandatory, and would have to be maintained by
broker-dealers for not less than three years, the first two years in an
easily accessible place, by registered transfer agents for a period of
not less than two years, the first year in an easily accessible place,
by investment companies for a period not less than six years, the first
two years in an easily accessible place, and registered investment
advisers would have to preserve the records for five years, the first
two years in an appropriate office of the investment adviser.
---------------------------------------------------------------------------

    \108\ Information submitted to the Commission on proposed Form
SP-30 would be kept confidential to the extent permitted by law. See
supra note 55.
---------------------------------------------------------------------------

Information Security and Security Breach Response Requirements
    The proposed amendments contain collections of information
requirements related to the more specific standards we are proposing
for safeguarding personal information, including standards for
responding to data security breaches. We believe these proposed
collections of information are necessary to help prevent and address
security breaches and designed to ensure that covered institutions
maintain a reasonable information security program pursuant to the
statutory requirements. Covered institutions would have to document in
writing steps they would be required to take to develop, implement, and
maintain a comprehensive information security program. We estimate that
there would be 12,432 respondents to this information collection.\109\
Of these

covered institutions, we estimate that 5,862 are smaller institutions
and 6,570 are larger institutions. \110\
---------------------------------------------------------------------------

    \109\ This estimate includes 6,016 broker-dealers, 4,733
investment companies representing portions of 813 fund complexes, 77
business development companies, 9,860 registered investment
advisers, and 501 registered transfer agents. As discussed in more
detail in the cost-benefit analysis below, the staff estimates that
56 percent of these 17,267 institutions, or 9,670 institutions, have
one or more affiliates. The staff estimates, for purposes of this
analysis, that each of the affiliated institutions has one corporate
affiliate. The staff estimates that these affiliated institutions
are likely to bear these paperwork burdens on an organization-wide
basis, rather than being incurred by each institution. Based on
these estimates, the staff estimates there would be 12,432
respondents to this information collection. (17,267 - (9,670 / 2) =
12,432) These estimates are discussed in more detail in the cost-
benefit analysis, see infra note 149 and accompanying text.
    \110\ See infra note 154 and accompanying text.
---------------------------------------------------------------------------

    Based on limited inquiries of covered institutions, the staff
estimates that the amount of time smaller institutions would devote to
initial compliance with the proposed amendments would range from 2 to
80 hours with a midpoint of 41 hours.\111\ This estimate reflects the
following burden hours: 1 hour for the board of directors to designate
an information security program coordinator; 1 hour for the program
coordinator to review the amendments; 4 hours to assess risks and
review procedures; 10 hours to review, revise and implement new
safeguards (including any data breach notification procedures); 8 hours
to test the effectiveness of the safeguards controls and procedures; 7
hours to train staff; and 10 hours to review service providers'
policies and procedures and revise contracts as necessary to require
them to maintain appropriate safeguards. The staff estimates that
initially it would cost smaller institutions approximately $18,560 to
comply with the proposed amendments.\112\ Amortized over three years,
the estimated annual hourly burden would be 14 hours at a cost of
approximately $6,187.
---------------------------------------------------------------------------

    \111\ The staff estimate uses the midpoint of the range of
hours, although the average number of burden hours could be higher
or lower. Our estimates are based on staff contacts with several
institutions regarding their current safeguarding and disposal
policies and procedures as well as the potential costs of the
proposed amendments. Because the staff was able to discuss these
issues with only a small number of very large institutions, and our
estimates in this analysis are based largely on this information,
our estimates may be much higher or lower than the range of actual
current costs related to compliance with Regulation S-P and the
range of potential costs associated with the proposed amendments.
    \112\ This estimate is based on a cost of $2,000 for one hour of
the board of directors' time (at $2,000/hour) and $16,560 for 40
hours of a program coordinators' time (at $414/hour). Staff believes
that the program coordinator would be a senior executive of the
institution, such as a chief compliance officer of an investment
adviser. For purposes of this PRA analysis, the staff is using
salaries for New York-based employees which tend to be higher than
the salaries for comparable positions located outside of New York.
This conservative approach is intended to capture unforeseen costs
and to account for the possibility that a substantial portion of the
work would be undertaken in New York. The salary information is
derived from data compiled by the Securities Industry and Financial
Markets Association. The Commission staff has modified this
information to account for an 1,800-hour work year and multiplied by
5.35 to account for bonuses, firm size, employee benefits, and
overhead. See Securities Industry and Financial Markets Association,
Report on Management and Professional Earnings in the Securities
Industry (2007); Securities Industry and Financial Markets
Association, Report on Office Salaries in the Securities Industry
(``SIFMA Earnings Reports'').
---------------------------------------------------------------------------

    The staff estimates that the amount of time larger institutions
would devote to initial compliance with the proposed amendments would
range from 40 hours to 400 hours with a midpoint of 220 hours.\113\
This estimate reflects the following burden hours: 2 hours for the
board of directors to designate an information security program
coordinator; 2 hours for the program coordinator to review the
amendments; 42 hours to assess risks and review procedures; 60 hours to
review, revise and implement new safeguards (including any data breach
notification procedures); 60 hours to test the effectiveness of the
safeguards controls and procedures; 34 hours to train staff; and 20
hours to review service providers policies and procedures and revise
contracts as necessary to require them to maintain appropriate
safeguards. The staff estimates that larger institutions would spend
approximately $172,732 to comply with the proposed amendments
initially.\114\ Amortized over three years, the estimated annual hourly
burden would be 73 hours at a cost of approximately $57,577.
---------------------------------------------------------------------------

    \113\ The staff estimate uses the midpoint of the range of
hours, although the average number of burden hours could be higher
or lower.
    \114\ This estimate is based on a cost of $4,000 for 2 hours of
board of directors' time (at $2,000/hour) and $168,732 for 218 hours
of a group of compliance professionals' time (at $774/hour). The
staff believes that this group of compliance professionals would
include the program coordinator at a rate of $414 per hour, an in-
house attorney at a rate of $295 per hour, and an administrative
assistant at a rate of $65 per hour. See SIFMA Earnings Reports,
supra note 112. In total, we estimate that this group of compliance
professionals would cost the larger institution $758 per hour. $414
+ $295 + $65 = $774.
---------------------------------------------------------------------------

    On an annual, ongoing basis the staff estimates that the amount of
time smaller institutions would devote to ongoing compliance with the
safeguards and disposal rules, as they are proposed to be amended,
would range from 12 hours to 40 hours per year with a midpoint of 26
hours per year. This estimate reflects the following burden hour
estimates: 5 hours to regularly test or monitor the safeguards' key
controls, systems, and procedures; 3 hours to augment staff training; 3