collective basis, and each investor shares in the profits and losses in
proportion to that investor's interest in the investment company.
Investment companies that would be subject to the proposed rules
include registered open-end and closed-end funds, business development
companies (``BDCs''), Unit Investment Trusts (``UITs''), and employee
securities' companies. Because they are not operating companies,
investment companies do not have ``customers'' as such, and thus are
unlikely to possess significant amounts of nonpublic ``customer''
information in the conventional sense. They may, however, have access
to nonpublic information about their investors.
    Table 1 summarizes the investment company universe that would be
subject to the proposed rules. In total, as of the end of 2021, there
were 13,965 investment companies, including 12,420 open-end management
investment companies, 681 closed-end managed investment companies, 662
UITs, 103 BDCs, and 43 employees' securities companies. Many of the
investment companies that would be subject to the proposed rules are
part of a ``family'' of investment companies.\401\ Such families often
share infrastructure for operations (e.g., accounting, auditing,
custody, legal) and potentially marketing and distribution. We believe
that many of the compliance costs and other economic costs discussed in
the following sections would likely be borne at the family level.\402\
We estimate that there were up to 1,144 distinct operational entities
(families and unaffiliated investment companies) in the investment
company universe.
---------------------------------------------------------------------------

    \401\ As used here, ``family'' refers to a set of funds
reporting the same family investment company name (Form N-CEN Item
B.5), or filing under the same registrant name (Form N-CEN Item
B.1.A).
    \402\ For example, each investment company in a family is likely
to share common policies and procedures.

              Table 1--Investment Companies Subject to Proposed Rule Amendments, Summary Statistics
  [For each type of investment company, this table presents estimates of the number of investment companies and
  investment company families. Data sources: 2021 N-CEN filings,\a\ Division of Investment Management Business
                                     Development Company Report (2022).\b\]
----------------------------------------------------------------------------------------------------------------
                                                                                # Unaffiliated
                  Inv. Co. type                     # Inv. Co.    # Families \c\        \d\       # Entities \e\
----------------------------------------------------------------------------------------------------------------
Open-End \f\....................................          12,420             426             106             532
Closed-End \g\..................................             681              89             142             231
UIT \h\.........................................             662              51             216             267
BDC \i\.........................................             103  ..............  ..............             103
ESC \j\.........................................              43  ..............  ..............              43
Other \k\.......................................              56              12              12              24
                                                 ---------------------------------------------------------------

    Total \l\...................................          13,965             578             476           1,144
----------------------------------------------------------------------------------------------------------------
\a\ Year 2021 Form N-CEN filings (as of Nov 8, 2022).
\b\ SEC, Business Development Company Report (updated June 2022), available at https://www.sec.gov/open/datasets-bdc.html.
\c\ Number of families calculated from affiliation reported by registrants on Item B.5 of Form N-CEN.
\d\ Number of registrants reporting no family affiliation.
\e\ Number of distinct entities, i.e., the sum of distinct families (# Families) and unaffiliated registrants (#
  Unaffiliated).
\f\ Form N-1A filers; includes all open-end funds, including ETFs registered on Form N-1A.
\g\ Form N-2 filers not classified as BDCs.
\h\ Form N-3, N-4, N-6, N-8[Bgr]-2, and S-6 filers.
\i\ BDCs listed in the Business Development Company Report (note b) which have made a filing in 2022 (as of Aug.
  9 2022).
\j\ Form 40-APP filers [not classified as BDCs].
\k\ Includes N-3 and S-6 filers.
\l\ Cells do not sum to totals as investment company families may span multiple investment company types.

d. Transfer Agents
    Transfer agents maintain records of security ownership and are
responsible for processing changes of ownership (``transfers''),
communicating information from the firm to its security-holders (e.g.,
sending annual reports), replacing lost stock certificates, etc.
However, in practice most U.S.-registered securities are held in
``street name,'' where the ultimate ownership information is not
maintained by the transfer agent, but rather in a hierarchal ledger. In
this structure, securities owned by individuals are not registered in
the name of the individual with the transfer agent. Rather the
individual's broker maintains the records of the individual's ownership
claim on securities. Brokers, in turn, have claims on securities held
by a single nominee owner \403\ who maintains records of the claims of
the various brokers. This arrangement makes securities lending feasible
and facilitates rapid transfers. In such cases, the transfer agent is
not aware of the ultimate owner of the securities and therefore does
not hold sensitive information belonging to those owners.
---------------------------------------------------------------------------

    \403\ In the U.S., this is generally Cede & Co, a partnership
organized by the Depository Trust & Clearing Corporation.
---------------------------------------------------------------------------

    Despite the prevalence of securities held in street name, a large
number of individuals nonetheless hold securities directly through the
transfer agent. Securities held directly may be held either in the form
of a physical stock certificate or in book-entry form through the
Direct Registration System (``DRS''). In either case, the transfer
agent would need to maintain sensitive information about the
individuals who own the securities. For example, to handle a request
for replacement certificate, the transfer agent would need to confirm
the identity of the individual making such a request and to maintain a
record of such confirmation. Similarly, to effect DRS transfers a
transfer agent would need to provide a customer's identification
information in the message to DRS.
    In 2022, there were 335 transfer agents registered with the
Commission, with an additional 67 registered with the Banking
Agencies.\404\ On average, each transfer agent reported 1.2 million
individual accounts, with the largest reporting 56 million.\405\ Figure
5 plots the cumulative distribution of the number of individual
accounts reported by transfer agents registered with the Commission.
Approximately one third of SEC-registered transfer agents reported no
individual accounts,\406\ and half reported fewer than ten thousand
individual accounts.
---------------------------------------------------------------------------

    \404\ Form TA-1 (as of June 20, 2022).
    \405\ Form TA-2 Items 5(a) (as of June 20, 2022).This analysis
is limited to the 151 transfer agents that filed form TA-2.
    \406\ Some registered transfer agents outsource many functions--
including tracking the ownership of securities in individual
accounts--to other transfer agents (``service companies''). See Form
TA-1 Item 6 (as of June 20, 2022).

---------------------------------------------------------------------------

[GRAPHIC] [TIFF OMITTED] TP06AP23.005

e. Service Providers
    The proposed policies and procedures provisions would require
covered institutions, pursuant to a written contract between the
covered institution and its service providers, to require the service
providers to take appropriate measures that are designed to protect
against unauthorized access to or use of customer information.\407\
These contracting requirements on a covered institution would affect a
third party service provider that ``receives, maintains, processes, or
otherwise is permitted access to customer information through its
provision of services directly to [the] covered institution.'' \408\
---------------------------------------------------------------------------

    \407\ See infra section III.D.1.b.
    \408\ Proposed rule 248.30(e)(10).
---------------------------------------------------------------------------

    Covered institutions' relationships with a wide range of service
providers would be affected. Specialized service providers with
offerings geared toward outsourcing of covered institutions' core
functions would generally fall under the proposed contracting
requirements. Those offering of customer relationship management,
customer billing, portfolio management, customer portals (e.g.,
customer trading platforms), customer acquisition, tax document
preparation, proxy voting, and regulatory compliance (e.g., AML/KYC)
would likely fall under the proposed contracting requirements. In
addition, various less-specialized service providers could potentially
fall under these requirements. Service providers offering Software-as-
a-Service (SaaS) solutions for email, file storage, and similar
general-purpose services could potentially be in a position to receive,
maintain, or processes customer information. Similarly, providers of
Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), as
well as those offering more ``traditional'' consulting services (e.g.,
IT contractors) would in many cases be ``otherwise [ ] permitted access
to customer information'' and could fall under the contracting
provisions.
    Due to data limitations, we are unable to quantify or characterize
in much detail the structure of these various service provider
markets.\409\ However, it has long been recognized that the financial
services industry is increasingly relying on service providers through
various forms of outsourcing.\410\
---------------------------------------------------------------------------

    \409\ As noted above, potential service providers include a wide
range of firms fulfilling a variety of functions. The internal
organization of covered entities, including their reliance on
service providers, is not generally publicly observable. Although
certain regulatory filings shed a limited light on the use of third-
party service providers (e.g., transfer agents' reliance on third
parties for certain functions), we are unaware of any data sources
that provide detail on the reliance of covered institutions on
third-party service providers.
    \410\ See Bank for International Settlements, Outsourcing in
Financial Services (Feb. 15, 2005), available at https://www.bis.org/publ/joint12.htm.
---------------------------------------------------------------------------

D. Benefits and Costs of the Proposed Rule Amendments

    The proposed amendments can be divided into four main components.
First, they would create a requirement for covered institutions to
adopt incident response programs, including notification to customers
in the event sensitive customer information was, or is reasonably
likely to have been, accessed or used without authorization. Second,
they would broaden the scope of information covered by the safeguards
rule and the disposal rule \411\ and extend the application of the
safeguards rule to transfer agents. Third, they would require covered
institutions to maintain and retain records related to the foregoing.
Fourth, they would include in regulation an existing statutory
exemption for annual privacy

notices. We discuss costs and benefits of each provision in turn.
---------------------------------------------------------------------------

    \411\ 17 CFR 248.30(a) and 17 CFR 248.30(b), respectively.
---------------------------------------------------------------------------

1. Response Program
    The proposed amendments would require covered institutions to
``develop, implement, and maintain written policies and procedures that
address administrative, technical, and physical safeguards for the
protection of customer information'' \412\ which must include a
response program ``designed to detect, respond to, and recover from
unauthorized access to or use of customer information, including
customer notification procedures.'' \413\ Under the proposal, covered
institutions' response programs would be required to address incident
assessment, containment, as well as customer notification.\414\
---------------------------------------------------------------------------

    \412\ Proposed rule 248.30(b)(1).
    \413\ Proposed rule 248.30(b)(3).
    \414\ Proposed rule 248.30(b)(3).
---------------------------------------------------------------------------

    The question of how best to structure the response to a cyber-
incident has received considerable attention from firms, IT
consultancies, government agencies, standards bodies, and industry
groups, resulting in numerous reports with recommendations and
summaries of best practices.\415\ While the emphasis of these reports
varies, certain key components are common across many cybersecurity
incident response programs. For example, NIST's Computer Security
Incident Handling Guide identifies four main phases to cyber incident
handling: (1) preparation; (2) detection and analysis; (3) containment,
eradication, and recovery; and (4) post-incident activity.\416\ The
assessment, containment, and notification prongs of the proposed
policies and procedures requirement correspond to the latter three
phases of the NIST recommendations. Similar analogues are found in
other reports, recommendations, and other regulators' guidelines.\417\
Thus, the proposed procedures of the incident response program are
substantially consistent with industry best practices and these other
regulatory documents that seek to develop effective policies and
procedures in this area.
---------------------------------------------------------------------------

    \415\ See supra section III.C.1.
    \416\ See NIST Computer Security Incident Handling Guide, supra
note 81.
    \417\ See text accompanying note 367.
---------------------------------------------------------------------------

    In addition to helping ensure that customers are notified when
their data is breached, the proposed requirements for policies and
procedures to address assessment and containment of incidents are
likely to have various other benefits. Having reasonably-designed
strategies for incident assessment and containment ex ante could reduce
the frequency and scale of breaches through more effective intervention
and improved managerial awareness. Any such improvements to covered
institutions' processes would benefit their customers (i.e. by reducing
harms to customers resulting from data breaches), as well as the
covered institutions themselves (i.e. by reducing the expected costs of
handling data breaches).
    In the remainder of this section, we first consider the benefits
and costs associated with requiring covered institutions to develop,
implement, and maintain written policies and procedures for a response
program generally. We then consider costs and benefits of the proposed
service provider provisions. We conclude this section with an analysis
of the proposed notification requirements vis-[agrave]-vis the
notification requirements already in force under the various existing
state laws.
a. Written Policies and Procedures
    Written policies and procedures are a practical prerequisite for
organizations to implement standard operating procedures, which have
long been recognized as necessary to improving outcomes in critical
environments.\418\ While we are not aware of any studies that assess
the efficacy of written policies and procedures specifically in the
context of financial regulation, we expect that requiring written
policies and procedures for the proposed response program would improve
its effectiveness in a number of ways. Although data breach incidents
are increasingly common,\419\ they are nonetheless a relatively rare
event for any given covered institution. As the process for handling
them is unlikely to be routine for a covered institution' staff,
written policies and procedures can help ensure that the covered
institution's personnel know what corrective actions to take and when.
Moreover, written policies and procedures can help ensure that the
incident is handled in an optimal manner. Finally, establishing
incident response procedures ex ante can facilitate discussion among
the covered institution's staff and expose flaws in the incident
response procedures before they are used in a real response.
---------------------------------------------------------------------------

    \418\ Other Commission regulations, such as the Investment
Company Act and Investment Advisers Act compliance rules, require
policies and procedures. 17 CFR 270.38a-1(a)(1), 275.206(4)-7(a).
The utility of written policies and procedures is recognized outside
the financial sector as well; for example, standardized written
procedures have been increasingly embraced in the field of medicine.
See e.g., Robert L. Helmreich, Error Management as Organizational
Strategy, In Proceedings of the IATA Human Factors Seminar, Vol. 1.
Citeseer (1998); see also Alex, Joseph Chaparro Keebler, Elizabeth
Lazzara & Anastasia Diamond, Checklists: A Review of Their Origins,
Benefits, and Current Uses as a Cognitive Aid in Medicine,
Ergonomics in Design: 2019 Q. Hum. Fac. App. 27 (2019):
106480461881918.
    \419\ See ITRC Data Breach Annual Report, supra note 349 (noting
that in 2021, there were more data compromises reported in the
United States than in any year since the first state data breach
notice law became effective in 2003).
---------------------------------------------------------------------------

    As noted in section III.C , all states and the District of Columbia
generally require businesses to notify their customers when certain
customer information is compromised, but they do not typically require
the adoption of written policies and procedures for the handling of
such incidents.\420\ However, despite the lack of explicit statutory
requirements, covered institutions--especially those with a national
presence--may have developed and implemented written policies and
procedures for a response program that incorporates various standard
elements, including the ones being proposed here: assessment,
containment, and notification.\421\ Given the numerous and distinct
state data breach laws, it would be difficult for larger covered
institutions operating in multiple states to comply effectively with
existing state laws without having some written policies and procedures
in place. As such covered institutions are generally larger, they are
more likely to have compliance staff dedicated to designing and
implementing regulatory policies and procedures, which could include
policies and procedures regarding incident response. Moreover, to the
extent covered institutions that have already developed written
policies and procedures for incident response have based such policies
and procedures on common cyber incident response frameworks (e.g., NIST
Computer Security Incident Handling Guide, CISA Cybersecurity Incident
Response Playbook),\422\ generally accepted industry best practices, or
other applicable regulatory guidelines,\423\ these large covered
institutions' written policies and procedures are likely to

include the proposed elements of assessment, containment, and
notification, and to be substantially consistent with the proposed
rule's requirements.
---------------------------------------------------------------------------

    \420\ See e.g., Cal. Civil Code sec. 1798.82 and N.Y. Gen. Bus.
Law. sec. 899-AA.
    \421\ Various industry guidebooks, frameworks, and government
recommendations share many common elements, including the ones being
proposed here. See e.g. NIST Computer Security Incident Handling
Guide, supra note 81; see also CISA Incident Response Playbook,
supra note 75.
    \422\ See supra notes 75 and 81.
    \423\ For example, the Banking Agencies' Guidance states that
covered institutions that are subsidiaries of U.S. bank holdings
companies should develop response programs that include assessment,
containment, and notification elements. See supra discussion of
Banking Agencies' Incident Response Guidance in text accompanying
note 367.
---------------------------------------------------------------------------

    Thus, we do not anticipate that the proposed requirement for
written policies and procedures would result in substantial new
benefits from its application to large covered institutions, those with
a national presence, or those already subject to comparable Federal
regulations.\424\ For the same reasons, it is unlikely to impose
significant new costs for these institutions. Here, we expect the main
cost associated with the proposed requirement to be the cost of
reviewing existing policies and procedures to verify that they satisfy
the new requirement. We further expect that these costs--although not
significant--would ultimately be passed on to customers of these
institutions.\425\
---------------------------------------------------------------------------

    \424\ The nature of the transfer agent and registered investment
company business largely precludes geographic catering and that
these entities will all have a ``national presence.''
    \425\ Costs incurred by larger covered institutions as a result
of the proposed amendments will generally be passed on to their
customers in the form of higher fees. However, smaller covered
institutions--which are likely to face higher average costs--may not
be able to do so. See infra section III.E.
---------------------------------------------------------------------------

    We expect that the proposed written policies and procedures
requirement would have more substantial benefits and costs for smaller
covered institutions without a national presence, such as small
registered investment advisers and broker-dealers who cater to a
clientele based on geography, as compared to larger covered
institutions. For smaller covered institutions the potential
reputational cost of a cybersecurity breach is likely to be relatively
small,\426\ while the cost of developing and implementing written
policies and procedures for a response program is proportionately
large.\427\ Moreover, these smaller covered institutions could
potentially comply effectively with the relevant state data breach
notification laws without adopting written policies and procedures to
deal with customer notification: they may only need to consider--on an
ad hoc basis--the notification requirements of the small number of
states in which their customers reside.
---------------------------------------------------------------------------

    \426\ Smaller firms generally have a lower franchise value (the
present value of the future profits that a firm is expected to earn
as a going concern) and lower brand equity (the value of potential
customers' perceptions of the firm). Thus, the costs of potential
reputational harm are typically lower than at larger firms.
    \427\ See supra discussion in section III.A following note 317.
---------------------------------------------------------------------------

    Thus, we expect that for such covered institutions, the proposed
amendments would likely impose additional compliance costs related to
amending their existing written policies and procedures for
safeguarding customer information.\428\ While these smaller covered
institutions could potentially pass some of these costs on to customers
in the form of higher fees, their ability to do so may be limited due
to the presence of larger competitors with more customers.\429\ In
addition, covered institutions that improve their customer notification
procedures in response to the proposed amendments could suffer
reputational costs resulting from the additional notifications.\430\
---------------------------------------------------------------------------

    \428\ As required under existing Regulation S-P, 17 CFR 248.30.
    \429\ See supra section III.C.3.
    \430\ See supra section III.B; see also infra section III.D.1.c.
---------------------------------------------------------------------------

    Although the relevant baseline for the analysis of this proposal
incorporates only regulations currently in place, we note that several
concurrent Commission proposals would impose broader policies and
procedures requirements relating to cybersecurity and data protection
on some covered institutions.\431\ Insofar as these related proposals
are adopted, the response program being proposed here would represent a
refinement of elements addressing incident response and recovery found
in the concurrent proposals.\432\ Thus, we anticipate that costs of
developing the response programs being proposed here could largely be
subsumed in the costs of developing policies and procedures for these
concurrent proposals (if adopted).
---------------------------------------------------------------------------

    \431\ See Investment Management Cybersecurity Proposal, supra
note 55, Exchange Act Cybersecurity Proposal and Regulation SCI
Proposal, supra note 57. See also supra section II.G.
    \432\ For example, the response program proposed here provides
further specificity to the ``Cybersecurity Incident Response and
Recovery'' element of the policies and procedure required under the
Investment Management Cybersecurity Proposal. See Investment
Management Cybersecurity Proposal, supra note 55, at section
II.A.1.e.
---------------------------------------------------------------------------

    The benefits ensuing from smaller, more geographically limited
covered institutions incorporating incident response programs to their
written policies and procedures can be expected to arise from improved
efficacy in notifying affected customers and--more generally--from
improvements in the manner in which such incidents are handled with
aforementioned attendant benefits to customers and to the covered
institutions themselves.\433\
---------------------------------------------------------------------------

    \433\ See supra text accompanying notes 415-418.
---------------------------------------------------------------------------

    Lacking data on the improvements to efficacy--whether it be
efficacy of customer notification, incident assessment, or incident
containment--that would result from widespread adoption of written
response programs, we cannot quantify the economic benefits of the
proposed requirements. Similarly, quantifying the indirect economic
costs such as reputational cost of any potential increased efficacy in
customer notification is not feasible. However, as noted earlier, the
effects of these requirements are likely to be small for covered
institutions with a national presence who--we understand--are likely to
already have such programs in place. For such institutions, we expect
direct compliance costs to be largely limited to reviews of existing
policies and procedures.\434\ Smaller, more geographically limited
covered institutions--which are less likely to have written policies
and procedures to address incident response--we expect would be more
likely to bear the full costs associated with adopting and implementing
such procedures.\435\
---------------------------------------------------------------------------

    \434\ We expect these reviews to be generally smaller than the
costs of adopting and implementing said procedures as discussed in
section IV.
    \435\ Administrative costs associated with developing and
implementing policies and procedures are estimated to be $11,375.
See infra section IV.
---------------------------------------------------------------------------

    The proposed requirements could potentially provide great benefit
in a specific incident, for example in the case of a data breach at an
institution that does not currently have written policies and
procedures and was unprepared to promptly respond in keeping with law,
and best practice. Such an institution would also bear the highest cost
in complying with the proposal. In the aggregate, however, considering
the proposed amendments in the context of the baseline, these benefits
and costs are likely to be limited. As we have noted above, all states
have previously enacted data breach notification laws with
substantially similar aims and, therefore, we think it likely that many
institutions have written policies and procedures to support compliance
with these laws. In addition, we anticipate that larger covered
institutions with a national presence--who account for the bulk of
covered institutions' customers--have already developed written
incident response programs consistent with the proposed requirements in
most respects.\436\ Thus, the benefits and costs of requiring written
incident response programs would largely be limited to smaller covered
institutions without a national

presence--institutions whose policies affect relatively few customers.
---------------------------------------------------------------------------

    \436\ See supra discussion in this section.
---------------------------------------------------------------------------

b. Service Provider Provisions
    The proposed amendments would require that a covered institution's
incident response program include written policies and procedures that
cover activity by service providers.\437\ Specifically, these policies
and procedures would require covered institutions, pursuant to a
written contract between the covered institution and its service
providers, to require the service providers to take appropriate
measures that are designed to protect against unauthorized access to or
use of customer information, including notification to the covered
institution in the event of any breach in security resulting in
unauthorized access to a customer information system maintained by the
service provider to enable the covered institution to implement its
response program. Under the proposed amendments, ``service provider''
is defined broadly, as ``any person or entity that is a third party and
receives, maintains, processes, or otherwise is permitted access to
customer information through its provision of services directly to a
covered institution.'' \438\ Thus, the proposed requirement could
affect contracts with a broad range of entities, including potentially
email providers, customer relationship management systems, cloud
applications, and other technology vendors.
---------------------------------------------------------------------------

    \437\ Proposed rule 248.30(b)(5)(i).
    \438\ Proposed rule 248.30(e)(10).
---------------------------------------------------------------------------

    As modern business processes increasingly rely on third-party
service providers, ensuring consistency in regulatory requirements
increasingly requires consideration of the functions performed by
service providers, and how these functions interact with the regulatory
regime. Ignoring such aspects would create opportunities for regulatory
arbitrage through outsourcing of functions to unregulated service
providers. Thus, the proposed requirement would function to strengthen
the benefits of the proposal by helping ensure that the proposed
requirements have similar effects regardless of how a covered
institution chooses to implement its business processes (i.e., whether
those processes are implemented in-house or outsourced).
    For service providers that provide specialized services aimed at
covered institutions, the proposed requirement would create additional
market pressure to enhance service offerings so as to facilitate
covered institutions' compliance with the proposed requirements.\439\
These service providers would have increased market pressure to adapt
their services to facilitate covered institutions' compliance with the
proposed amendments. This would entail costs for the service providers,
including the actual cost of adapting business processes to accommodate
the requirements, as well as costs related to renegotiating service
agreements with covered institutions to include the required
contractual provisions. It is difficult for us to quantify these costs,
as we have no data on the number of specialized service providers used
by covered institutions and on the ease with which they could adapt
business processes to satisfy the new contractual provisions. That
said, we preliminarily believe that these costs are justified and would
not represent an undue cost as both the specialized service providers
and the covered institutions contracting with them are adapted to
operating in a highly-regulated industry, and would be accustomed to
adapting their business processes to meet regulatory requirements. We
further expect that such costs would largely be passed on to covered
institutions and ultimately their customers.\440\
---------------------------------------------------------------------------

    \439\ A service provider involved in any business-critical
function likely ``receives, maintains, processes, or otherwise is
permitted access to customer information''. See proposed rule
248.30(e)(10).
    \440\ See supra note 425.
---------------------------------------------------------------------------

    With respect to more generic service providers (e.g., email,
customer-relationship management), the situation could be quite
different. For these providers, covered institutions are likely to
represent a small fraction of their customer base. These generic
service providers may be unwilling to adapt their business processes to
the regulatory requirements of a small subset of their customers. Under
the proposed requirement, some covered institutions could find that
some of their existing generic service providers would be unwilling to
take the steps necessary to facilitate covered institutions' compliance
with the proposed amendments. In such cases, the covered institutions
would need to switch service providers and bear the associated
switching costs, while the service providers would suffer loss of
customers.\441\ Although these costs would be offset by benefits
arising from enhanced efficacy of the regulation,\442\ they would be
particularly acute for smaller covered institutions which lack
bargaining power with generic service providers and would in many cases
be forced to switch providers.
---------------------------------------------------------------------------

    \441\ These costs include the direct costs associated with
reviewing and renegotiating existing agreements as well as indirect
costs arising from service providers requiring additional
compensation for providing the required contractual guarantees.
    \442\ From the perspective of current or potential customers,
the implications of customer information safeguard failures are
similar whether the failure occurs at a covered institution, or at
one of its third-party service providers.
---------------------------------------------------------------------------

    Moreover, in some cases generic service providers may have the
business processes in place to facilitate covered institutions'
compliance, but may be unwilling to enter into suitable written
contracts. This situation is likely to arise with large, best-of-breed
generic service providers with large market share, and could lead to
perverse outcomes where the aims of the proposed amendments are
undermined.\443\ For example, large, established server hosting
providers could be particularly unwilling to make contractual
accommodations.\444\ At the same time, these hosting providers would
have the greatest economic incentive--and means--to reduce generic
vulnerabilities within their control.\445\ Thus, if a covered
institution is forced to switch away from a large, established hosting
provider unwilling to amend its contractual terms, it is likely to end
up relying on a smaller, less established hosting provider that--while
more amenable to specific contractual language--may be less capable of
addressing the generic vulnerabilities within its control.\446\ Given
the increasing reliance of firms on such generic service
providers,\447\ switching could generate substantial costs and bring
with it reduced ability to protect customer information if such generic
service providers are either unwilling to contractually agree to
certain provisions or unable to address the vulnerabilities within
their control.
---------------------------------------------------------------------------

    \443\ For example, it is unlikely that a small investment
adviser would be able to effect any changes in its contracts with
large providers of generic services.
    \444\ For such service providers, the profits earned from
covered institutions may not be sufficient to justify creating a
separate contractual regime. Moreover, actually adapting business
processes--processes that apply to many different types of
customers--to satisfy the contractual terms applicable to only a
small subset of customers is likely to be cost prohibitive and
impracticable.
    \445\ While a hosting provider can address ``generic''
vulnerabilities that apply to all customers (e.g., vulnerabilities
in the physical and virtual access controls to the servers), it may
not be able to mitigate vulnerabilities ``specific'' to a given
customer (e.g., security flaws in applications deployed by
customers).
    \446\ Smaller, ``upstart'' service providers may be more willing
to provide unrealistic contractual assurances as the risk to their
(more limited) reputations is lower.
    \447\ See supra section III.C.3.e.

---------------------------------------------------------------------------

    Finally, even in cases where service providers are willing to adapt
processes and contractual terms to meet covered institutions
requirements, the task of renegotiating service agreements could--in
itself--impose substantial contracting costs on the parties.
Contracting costs are likely to be most acute for larger covered
institutions, which may have hundreds of contracts that would require
renegotiation. These additional costs would likely be passed on to
customers in the form of higher fees.
c. Notification Requirements
    The proposed requirements would provide for a strong minimum
standard for data breach notification, applicable to the sensitive
customer information of all customers of covered institutions
(including customers of other financial institutions whose information
has been provided to a covered institution) \448\ regardless of their
state of residence. The ``strength'' of a data breach notification
standard is a function of its various provisions and how these
provisions interact to provide customers with thorough, timely, and
accurate information about when their information has been compromised.
Customers receiving notices that are more thorough, timely, and
accurate have a better chance of taking effective remedial actions,
such as placing holds on credit reports, changing passwords, and
monitoring account activity. These customers would also be better able
to abandon institutions that have allowed their information to be
compromised. Similarly, non-customers who learn of a data breach, for
example from individuals notified as a result of the minimum standard,
could use this information to avoid covered institutions that allow
compromises to occur.
---------------------------------------------------------------------------

    \448\ See proposed rule 248.30(a); see also infra section
III.D.1.c.i.
---------------------------------------------------------------------------

    As discussed in section III.C.2.a all 50 states and the District of
Columbia already have data breach laws generally applicable to
compromises of their residents' information. Thus, the benefits of the
proposed minimum standard for notification to customers (vis-[agrave]-
vis the baseline) would vary depending on each customer's state of
residence, with the greatest benefits accruing to customers that reside
in states with ``weaker'' data breach laws.
    Unfortunately, with the data available, it is not practicable to
decompose the marginal contributions of the various state law
provisions to the overall ``strength'' of state data breach laws.
Consequently, it is not possible for us to quantify the benefits of the
proposed minimum standard to customers residing in the various states.
Thus, in considering the benefits of the proposed notification
requirement, we limit consideration to the ``strength'' of individual
provisions of the proposal vis-[agrave]-vis the corresponding
provisions under state laws, and consider the number of customers that
could potentially benefit from each.
    Similarly--albeit to a somewhat lesser extent--the costs to covered
institutions will also vary depending on the geographical distribution
of each covered institution's customers. Generally, the costs
associated with this proposal will be greater for covered institutions
whose customers reside in states with weaker data breach laws than for
those whose customers reside in states with stronger data breach laws.
In particular, smaller covered institutions whose customers are
concentrated in states with weak state data breach laws are likely to
face proportionately higher costs.
    In the rest of this section, we consider key provisions of the
proposed notification requirements, their potential benefits to
customers (vis-[agrave]-vis existing state notification laws), and
their costs.
i. Effect With Respect to Customers of Other Financial Institutions
    The scope of customer information subject to protection under the
proposed amendments extends to ``all customer information in the
possession of a covered institutions, and all consumer information that
a covered institution maintains or otherwise possesses for a business
purpose, as applicable, regardless of whether such information pertains
to individuals with whom the covered institution has a customer
relationship, or pertains to the customers of other financial
institutions and has been provided to the covered institution.'' \449\
---------------------------------------------------------------------------

    \449\ Proposed rule 248.30(a).
---------------------------------------------------------------------------

    This aspect of the proposal would generally extend the benefits of
the proposed amendments, and in particular of the proposed notification
requirements,\450\ to a wide range of individuals such as prospective
customers, account beneficiaries, recipients of wire transfers, or any
other individual whose customer information a covered institution comes
to possess, so long as the individuals are customers of a financial
institution.
---------------------------------------------------------------------------

    \450\ As described in more detail in the following subsections.
---------------------------------------------------------------------------

    We do not anticipate that extending the scope of information
covered by the proposed amendments to include these additional
individuals would have a significant effect on costs faced by covered
institutions resulting from a data breach.\451\ We further anticipate
that costs of preventative measures taken by covered institutions to
protect customers in response to the proposed amendments would
generally be effective at protecting these additional individuals.\452\
However, we acknowledge that in certain instances, this may not be the
case. For example, information about prospective customers used for
sales or marketing purposes may be housed in separate systems from the
covered institution's ``core'' customer account management systems and
require additional efforts to secure. That said, given that the
distinction between customers and other individuals is generally not
relevant under existing state notification laws--which apply to
information pertaining to residents of a given state--we expect that
most covered institutions will have already undertaken to protect and
provide notifications of data breaches to these additional individuals.
---------------------------------------------------------------------------

    \451\ These costs would include additional reputational harm and
litigation as well as increased notice delivery costs.
    \452\ For example, measures aimed at strengthening information
safeguards such as improved user access control.
---------------------------------------------------------------------------

ii. Effect With Respect to GLBA Safe Harbors
    A number of state data breach laws provide exceptions to
notification for entities subject to and in compliance with the GLBA.
These ``GLBA Safe Harbors'' may result in customers not receiving any
data breach notification from registered investment advisers, broker
dealers, investment companies, or transfer agents. The proposal would
help ensure customers receive notice of breach in cases where they may
not currently because notice is not required under state law.
    Based on an analysis of state laws, we found that 11 states provide
a GLBA Safe Harbor.\453\ Together, these states account for 15% of the
U.S. population, or approximately 8 million customers who may
potentially benefit from this provision.\454\ While we do not have data

on the exact geographical distribution of customers across all covered
institutions, we are able to identify registered investment advisers
whose customers reside exclusively in GLBA Safe Harbor states.\455\ We
estimate that there are 215 such advisers, representing 1.4% of the
adviser population.\456\ These advisers represent up to 11,000 clients,
and tend to be small, with a median regulatory assets under management
of $223 million. We expect that a similar percentage of broker-dealers
would be found to be operating exclusively in GLBA Safe Harbor states.
---------------------------------------------------------------------------

    \453\ States with GLBA Safe Harbors include Arizona, Iowa,
Kentucky, Minnesota, Missouri, Nevada, New Mexico, Oregon, South
Carolina, Tennessee, and Utah.
    \454\ Estimates of the numbers of potential customers based on
state population adjusted by the percentage of households reporting
direct stock ownership (15.2%). See U.S. Census Bureau,
Apportionment Report (2020), available at https://www2.census.gov/programs-surveys/decennial/2020/data/apportionment/apportionment-2020-table01.xlsx; see also Federal Reserve Board, Survey of
Consumer Finances (2019), available at https://www.federalreserve.gov/econres/scfindex.htm.
    \455\ Based on Form ADV, Item 2.C; see also supra note 399.
    \456\ See id.
---------------------------------------------------------------------------

    Changing the effect of the GLBA Safe Harbors is not likely to
impose significant direct compliance costs on most covered
institutions. For the reasons outlined above, most covered institutions
have customers from states without a GLBA Safe Harbor and we therefore
expect they have existing procedures for notifying customers under
state law. However, covered institutions whose customer base is limited
to these GLBA Safe Harbor states may not have implemented any
procedures to notify customers in the event of a data breach. These
covered institutions would face proportionately higher costs than
entities with some notification procedures already in place.
iii. Accelerating Timing of Customer Notification
    Under the proposed amendments, a covered institution would be
required to provide notice to customers in the event of a data breach
as soon as practicable, but not later than 30 days after becoming aware
that a data breach has occurred. As discussed in section III.C.2.a,
existing state laws vary in terms of notification timing. Most states
(32) do not include a specific deadline, but rather require that the
notice be given in an expedient manner and/or that it be provided
without unreasonable delay; these states account for 61% of the U.S.
population with approximately 31 million potential customers residing
in these states.\457\ Four states have a 30-day deadline; we estimate
that 5 million customers reside in these states. The remaining 15
states provide for longer notification deadlines; we estimate that 14
million customers reside in these states. For the 14 million customers
residing in these 15 states, the proposed 30-day deadline would tighten
the notification timeframes by between 15 to 60 days.\458\ In addition,
the 30-day deadline we are proposing is likely to tighten notification
timeframes for approximately 31 million customers residing in states
with no specific deadline; however, the aggregate effects on these 31
million customers may be limited insofar as the relevant state laws are
not generally interpreted as allowing delays in notification greater
than 30 days.\459\ Finally, because the proposal would not provide for
broad exceptions to the 30-day notification requirement,\460\ in many
cases it would tighten notification timeframes even for the 5 million
customers residing in states with a 30-day deadline.\461\
---------------------------------------------------------------------------

    \457\ See supra Figure 2.
    \458\ State deadlines are either 30, 45, 60, or 90 days.
    \459\ The timing language in state laws without specific
language varies, but generally suggests that notices must be prompt.
For example, California requires that such notice be given ``in the
most expedient time possible and without unreasonable delay;'' see
Cal. Civil Code sec. 1798.82.
    \460\ See supra note 359.
    \461\ For example, in Washington the median notification delay
in 2021 was 37 days, even though the state statute requires notice
be given ``without unreasonable delay, and no more than thirty
calendar days after the breach was discovered, unless the delay is
at the request of law enforcement as provided in subsection (3) of
this section, or the delay is due to any measures necessary to
determine the scope of the breach and restore the reasonable
integrity of the data system'' RCW 19.255.010(8).
---------------------------------------------------------------------------

    Tighter notification deadlines should increase customers' ability
to take effective measures to counter threats resulting from their
sensitive information being compromised. Such measures may include
placing holds on credit reports or engaging in more active monitoring
of account and credit report activity. In practice, however, when it
takes a long time to discover a data breach, a relatively short delay
between discovery and customer notification may have little impact on
customers' ability to take effective countermeasures.\462\
---------------------------------------------------------------------------

    \462\ In other words, the utility of a notice is likely to
exhibit decay. For example, if a breach is discovered immediately,
the utility of receiving a notification within 1 day is considerably
greater than the utility of receiving a notification in 30 days.
However, if a breach is discovered only after 200 days, the
difference in expected utility from receiving a notification on day
201 vs day 231 is smaller: with each passing day some opportunities
to prevent the compromised information from being exploited are lost
(e.g., unauthorized wire transfer), with each passing day
opportunities to discover the compromise grow (e.g., noticing an
unauthorized transaction), and with each passing day the compromised
information becomes less valuable (e.g., passwords, account numbers,
addresses, etc., change over time).
---------------------------------------------------------------------------

    Based on data from the Washington Attorney General's Office,\463\
in 2021 it took an average of 170 days (standard deviation: 209 days)
from the time a breach occurred to its discovery. This suggests that
time to discovery is likely to prevent issuance of timely customer
notices in most cases.\464\ However, as plotted in Figure 6, while some
firms take many months--even years--to discover a data breach, others
do so in a matter of days: 15% of firms were able to detect a breach
within 2 weeks, and 20% were able to do so within 30 days. Thus, while
the proposed 30-day notification deadline may not substantially improve
the timeliness of customer notices in many cases, in some cases it
could.
---------------------------------------------------------------------------

    \463\ Washington State Office of the Attorney General, Data
Breach Notifications, available at https://data.wa.gov/Consumer-Protection/Data-Breach-Notifications-Affecting-Washington-Res/sb4j-ca4h (last visited Mar. 7, 2023). We rely on data from Washington
State as it provides the most detail on the life cycle of incidents.
    \464\ With respect to the time to discovery of a data breach, we
believe that data from Washington State is fairly representative of
the broader U.S. population. Similarly, data from California
regarding breach notices sent to more than 500 California residents
indicates that the average time from discovery to notification in
2021 was 197 days. State of California Department of Justice, Office
of the Attorney General, Search Data Security Breaches (2023),
available at https://oag.ca.gov/privacy/databreach/list (last
visited Feb. 22, 2023). According to IBM, in 2021 it took an average
of 212 days to identify a data breach. See IBM Cost of Data Breach
Report, supra note 350.

---------------------------------------------------------------------------

[GRAPHIC] [TIFF OMITTED] TP06AP23.006

    While we do not preliminarily believe that the proposed 30-day
deadline to customer notifications would impose significant direct
costs relative to a longer deadline (or relative to having no fixed
deadline), the shorter deadline could potentially lead to indirect
costs arising from the reporting deadline potentially interfering with
incident containment efforts. Based on data from the Washington
Attorney General's Office for 2021, ``containment'' of data breaches
generally occurs quickly--4.4 days on average.\465\ However, according
to IBM's study for 2021, it takes an average of 75 days to ``contain''
a data breach.\466\ The discrepancy suggests that there exists some
ambiguity in the interpretation of ``containment,'' raising the
possibility that the 30-day notification deadline could require
customer notification to occur before some aspects of incident
containment have been completed and potentially interfering with
efforts to do so.\467\
---------------------------------------------------------------------------

    \465\ In the data provided by the Washington Attorney General,
``containment'' (data field DaysToContainBreach) is defined as ``the
total number of days it takes a notifying entity to end the exposure
of consumer data, after discovering the breach.'' See supra note
463.
    \466\ In the IBM study, ``containment'' refers to ``the time it
takes for an organization to resolve a situation once it has been
detected and ultimately restore service.'' See IBM Cost of Data
Breach Report, supra note 350.
    \467\ For example, the notice may prompt additional attacks
aimed at taking advantage of vulnerabilities that cannot be
adequately addressed in a 30 day timeframe.
---------------------------------------------------------------------------

    In some circumstances, requiring customers to be notified within 30
days may hinder law enforcement investigation of an incident by
potentially making an attacker aware of the attack's detection. While
the proposal would allow the covered institution to delay notification
in specific circumstances related to national security, most law
enforcement investigations would not rise to this level.\468\ Thus, the
proposed 30-day customer notification requirement could impose costs on
the public insofar as it interferes with law enforcement investigations
that do not raise national security concerns and, thus, decreases
recoveries or impedes deterrence.
---------------------------------------------------------------------------

    \468\ See proposed rule 248.30(b)(4)(iii).
---------------------------------------------------------------------------

iv. Broader Scope of Information Triggering Notification
    In the proposal, ``sensitive customer information'' is defined more
broadly than in most state statutes,\469\ yielding a customer
notification trigger that is broader in scope than the various state
law notification triggers included under the baseline.\470\ The broader
scope of information triggering the notice requirements would cover
more data breaches impacting customers than the notice requirements
under the baseline. This increased sensitivity could benefit customers
who would be made aware of more cases where their information has been
compromised. At the same time, the increased sensitivity could lead to
false alarms--cases where the ``sensitive customer information''
divulged does not ultimately harm the customer. Such false alarms could
be problematic if they reduce customers' sensitivity to data breach
notices. In addition, the proposed scope will also likely imply
additional costs for covered institutions, which may need to adapt
their processes for safeguarding information

to encompass a broader set of customer information, and may need to
issue additional notices.\471\
---------------------------------------------------------------------------

    \469\ See proposed rule 248.30(e)(9).
    \470\ See supra section III.C.2.a.
    \471\ Estimates of administrative costs related to notice
issuance are discussed in section IV.
---------------------------------------------------------------------------

    In the proposal, ``sensitive customer information'' is defined as
``any component of customer information alone or in conjunction with
any other information, the compromise of which could create a
reasonably likely risk of substantial harm or inconvenience to an
individual identified with the information.'' \472\ The proposed
definition's basis in ``any component of customer information'' creates
a broader scope than under state notification laws. In addition to
identification numbers, PINs, and passwords, many other pieces of
nonpublic information have the potential to satisfy this standard. For
example, many financial institutions have processes for establishing
identity that require the user to provide a number of pieces of
information that--on their own--are not especially sensitive (e.g.,
mother's maiden name, name of a first pet, make and model of first
car), but which--together--could allow access to a customer's account.
The compromise of some subset of such information would thus
potentially require a covered institution to notify customers under the
proposed amendments.
---------------------------------------------------------------------------

    \472\ See proposed rule 248.30(e)(9).
---------------------------------------------------------------------------

    The definitions of information triggering notice requirements under
state laws are generally much more circumscribed, and can be said to
fall into one of two types: basic and enhanced.\473\ Basic definitions
are used by 12 states, which account for 20% of the U.S. population. In
these states, only the compromise of a customer's name together with
one or more enumerated pieces of information triggers the notice
requirement. Typically, the enumerated information is limited to Social
Security number, a driver's license number, or a financial account
number combined with an access code. For the estimated 10 million
customers residing in these states, a covered institution's compromise
of the customer's account login and password would not necessarily
result in a notice, nor would a compromise of his credit card number
and PIN.\474\ Such compromises could nonetheless lead to substantial
harm and inconvenience.
---------------------------------------------------------------------------

    \473\ See supra section III.C.2.a.
    \474\ See supra text accompanying note 354.
---------------------------------------------------------------------------

    Thus, the proposed amendments would significantly enhance the
notification requirements applicable to these customers.
    States adopting enhanced definitions for information triggering
notice requirements extend the basic definition to include username/
password and username/security question combinations. They may also
include additional enumerated items whose compromise (when linked with
the customer's name) can trigger the notice requirement (e.g.,
biometric data, tax identification number, and passport number). For
the estimated 40 million customers residing in the states with enhanced
definitions, the benefits from the proposed amendment will be somewhat
more limited. However, even for these customers, the proposal would
tighten the effective notification requirement. There are many pieces
of information not covered by the enhanced definitions the compromise
of which could potentially lead to substantial harm or inconvenience.
For example, under California law, the compromise of information such
as a customer's email address in combination with a security question
and answer would only trigger the notice requirement if that
information would--in itself--permit access to an online account;
moreover, the compromise of information such as a customer's name,
combined with her transaction history, account balance, or other
information not specifically enumerated would not trigger the notice
requirement under California law.\475\
---------------------------------------------------------------------------

    \475\ Cal. Civ. Code sec. 1798.82.
---------------------------------------------------------------------------

    The broader scope of information triggering a notice requirement
under the proposed amendments would benefit customers. As noted
earlier, many pieces of information not covered under state data breach
laws could, when compromised, cause substantial harm or inconvenience.
Under the proposed amendments, data breaches involving such information
could require customer notification in cases where state law does not,
and thus potentially increase customers' ability to take actions to
mitigate the effects of such breaches. At the same time, there is some
risk that the broader minimum standard will lead to notifications
resulting from data compromises that--while troubling--are ultimately
less likely to cause substantial harm or inconvenience.\476\ A large
number of such notices could undermine the effectiveness of the notice
regime.
---------------------------------------------------------------------------

    \476\ This may be the case even though the proposal includes an
exception from notification when the covered institution determines,
after investigation, that the sensitive customer information has not
been, and is not reasonably likely to be, used in a manner that
would result in substantial harm or inconvenience. For example, the
covered institution could decide to forgo investigations and always
report, or could investigate but not reach a conclusion that
satisfied the terms of the exception.
---------------------------------------------------------------------------

    The broader minimum standard for notification is likely to result
in higher compliance costs for covered institutions. In particular, it
is possible the covered institutions have developed processes and
systems designed to provide enhanced information safeguards for the
specific types of information enumerated in the various state laws. For
example, it is likely that IT systems deployed by financial
institutions only retain information such as passwords or answers to
security questions in hashed form, reducing the potential for such
information to be compromised. Similarly, it is likely that such
systems limit access to information such as Social Security numbers to
a limited set of employees.
    It may be costly for covered institutions to upgrade these systems
to expand the scope of enhanced information safeguards. In some cases,
it may be impractical to expand the scope of such systems. For example,
while it may be feasible for covered institutions to strictly limit
access to Social Security numbers, passwords, or answers to secret
questions, it may not be feasible to apply such limits to account
numbers, transaction histories, account balances, related accounts, or
other potentially sensitive customer information. In these cases, the
proposed minimum standard may not have a significant prophylactic
effect, and may lead to an increase in reputation and litigation costs
for covered institutions resulting from more frequent breach
notifications as well as increased administrative costs related to
sending out additional notice.\477\ In addition, because the proposed
notice trigger is based on a determination that there is a reasonably
likely risk of substantial harm or inconvenience, it could increase
costs related to incident evaluation, legal consultation, and
litigation risk. This subjectivity could reduce consistency in the
propensity of covered institutions to provide notice to customers,
reducing the utility of such notices in customer's inferences about
covered institutions' safeguarding efforts.
---------------------------------------------------------------------------

    \477\ See supra note 471.
---------------------------------------------------------------------------

v. Notification Trigger
    Under the proposal, the access or use without authorization of an
individual's sensitive customer information (or the reasonable
likelihood thereof) triggers the customer notice requirement unless the
covered institution is able to determine that sensitive customer

information has not been, and is not reasonably likely to be, used in a
manner that would result in substantial harm or inconvenience.\478\
Moreover, if the covered institution is unable to determine which
customers are affected by a data breach, a notice to all potentially
affected customers would be required.\479\ The resulting presumptions
for notification are important because although it is usually possible
to determine what information could have been compromised in a data
breach, it is often not possible to determine what information was
compromised \480\ or to estimate the potential for such information to
be used in a way that is likely to cause harm. Because of this, it may
not be feasible to establish the likelihood of sensitive customer
information being accessed or used in a way that creates a risk of
substantial harm or inconvenience. Consequently, in the absence of the
presumption for notification, it may be possible for covered
institutions to avoid notifying customers in cases where it is unclear
whether customer information was accessed or used in this way.
Currently, 21 states' notification laws do not include a presumption
for notification.
---------------------------------------------------------------------------

    \478\ Proposed rule 248.30(b)(4)(i).
    \479\ Proposed rule 248.30(b)(4)(ii).
    \480\ Many covered institutions, especially smaller investment
advisers and broker-dealers, are unlikely to have elaborate software
for logging and auditing data access. For such entities, it may be
impossible to determine what specific information was exfiltrated
during a data breach.
---------------------------------------------------------------------------

    We do not have data with which to estimate reliably the effect of
this presumption on the propensity of covered institutions to issue
customer notifications. However, we expect that for the estimated 15
million customers residing in states without the presumption of
notification, some notifications that would be required under the
proposed amendments are not currently occurring. Thus, we anticipate
that the proposed amendments will improve these customers ability to
take actions to mitigate the effects of data breaches.
    The increased sensitivity of the notification trigger resulting
from the presumption for notification would result in additional costs
for covered institutions, who would bear higher reputational costs as
well as some additional direct compliance costs (e.g., mailing notices,
responding to customer questions, etc.) due to more breaches requiring
customer notification. We are unable to quantify these additional
costs.
2. Extend Scope of Customer Safeguards To Transfer Agents
    The proposed amendments would bring transfer agents within the
scope of the safeguards rule.\481\ In addition to the costs and
benefits arising from the proposed response program discussed
separately in section III.D.1 this would create an additional
obligation on transfer agents to develop, implement, and maintain
written policies and procedures that address administrative, technical,
and physical safeguards for the protection of customer information more
generally.\482\
---------------------------------------------------------------------------

    \481\ See infra note 173 and accompanying text.
    \482\ Proposed rule 248.30(b).
---------------------------------------------------------------------------

    As discussed in sections II.C.3 and III.C.3.d, in the U.S.,
transfer agents provide the infrastructure for tracking ownership of
securities. Maintaining such ownership records necessarily entails
holding or accessing non-public information about a large swath of the
U.S. investing public. Given the highly-concentrated nature of the
transfer agent market,\483\ a general failure of customer information
safeguards at a transfer agent could negatively impact large numbers of
customers.\484\ In general, transfer agents with written policies and
procedures to safeguard this information would be at reduced risk of
experiencing such safeguard failures.\485\ Further, because the core of
the transfer agent business is maintaining customer records, and
transfer agents are likely to handle large numbers of customers,
transfer agents are likely to have written policies and procedures in
place to address safeguarding of customer information.\486\ In
addition, transfer agents are currently subject to the notification
requirements in state law, which would require customer notification in
many of the same cases as under the proposed amendments.\487\ Thus, we
do not expect substantial costs or benefits to arise from extending the
scope of the safeguards rule to transfer agents in the aggregate. We
anticipate that most transfer agents have policies and procedures in
place already, and that the compliance costs of the proposal would thus
be limited to the review of those existing policies and procedures for
consistency with the safeguards rule. We discuss these costs in section
IV.\488\
---------------------------------------------------------------------------

    \483\ See supra section III.C.3.
    \484\ Half of the registered transfer agents maintain records
for more than 10,000 individual accounts. See supra Figure 5.
    \485\ See supra section III.D.1.a for a discussion of the
benefits of written policies and procedures generally.
    \486\ See supra text accompanying notes 420-424.
    \487\ See supra section III.D.1.c.
    \488\ See supra note 435.
---------------------------------------------------------------------------

3. Recordkeeping
    Under the new recordkeeping requirements, covered institutions
would be required to make and maintain written records documenting
compliance with the requirements of the safeguards rule and of the
disposal rule.\489\ A covered institution would be required to make and
maintain written records documenting its compliance with, among other
things: its written policies and procedures required under the proposed
rules, including those relating to its service providers and its
consumer information and customer information disposal practices; its
assessments of the nature and scope of any incidents involving
unauthorized access to or use of customer information; any
notifications of such incidents received from service providers; steps
taken to contain and control such incidents; and, where applicable, any
investigations into the facts and circumstances of an incident
involving sensitive customer information, and the basis for determining
that sensitive customer information has not been, and is not reasonably
likely to be, used in a manner that would result in substantial harm or
inconvenience.\490\
---------------------------------------------------------------------------

    \489\ See proposed rule 248.30(d).
    \490\ See the various provisions of proposed rule 248.30(b) and
248.30(c)(2).
---------------------------------------------------------------------------

    These proposed recordkeeping requirements would help facilitate the
Commission's inspection and enforcement capabilities. As a result, the
Commission would be better able to detect deficiencies in a covered
institution's response program so that such deficiencies could be
remedied. Insofar as correcting deficiencies results in material
improvement in the response capabilities of covered institutions and
mitigates potential harm resulting from the lack of an adequate
response program, the proposed amendments would benefit customers
through channels described in section III.D.1.
    We do not expect the proposed recordkeeping requirements to impose
substantial compliance costs. As covered institutions are currently
subject to similar recordkeeping requirements applicable to other
required policies and procedures, we do not anticipate covered
institutions will need to invest in new recordkeeping staff, systems,
or procedures to satisfy the new recordkeeping requirements.\491\

The incremental administrative costs arising from maintaining
additional records related to these provisions using existing systems
are covered in the Paperwork Reduction Act analysis in section IV and
estimated to be $381/year.
---------------------------------------------------------------------------

    \491\ See, e.g., 17 CFR 240.17a-3; 17 CFR 275.204-2; 17 CFR
270.31a-1; and 17 CFR 240.17Ad-7. Where permitted, entities may
choose to use third-party providers in meeting their recordkeeping
obligations under the proposed rule, see supra note 217.
---------------------------------------------------------------------------

4. Exception From Annual Notice Delivery Requirement
    The proposed amendments would incorporate into the regulation an
existing statutory exception to the requirement that a broker-dealer,
investment company, or registered investment adviser deliver an annual
privacy notice to its customers.\492\ An institution may only rely on
the exception if it has not changed its policies and practices with
regard to disclosing nonpublic personal information from those it most
recently provided to the customer via privacy notice.\493\ Reliance on
the exception is further limited to cases where the institution
provides information to a third party to perform services for, or
functions on behalf of, the institution \494\ in accordance with one of
a number of existing exemptions that contain notice provisions.\495\
---------------------------------------------------------------------------

    \492\ See supra note 220.
    \493\ See proposed rule 248.5(e)(1)(ii).
    \494\ See id; see also 15 U.S.C. 6802(b)(2) (providing the
statutory basis to this exception).
    \495\ See proposed rule 248.5(e)(1)(i). These existing
exemptions address a number of cases, such as information sharing
necessary to perform transactions on behalf of the customer,
information sharing directed by the customer, reporting to credit
reporting agencies, information sharing resulting from business
combination transactions (mergers, sales, etc.). See 15 U.S.C.
6802(e) (providing the statutory basis to these additional
criteria).
---------------------------------------------------------------------------

    The effect of the exception would be to eliminate the requirement
to send the same privacy policy notice to customers on multiple
occasions. As such notices would provide no new information, we do not
believe that receiving multiple copies of such notices provides any
significant benefit to customers. Moreover, we expect that widespread
reliance on the proposed exception is more likely to benefit customers,
by providing clearer signals of when privacy policies have
changed.\496\ At the same time, reliance on the exception would reduce
costs for covered entities. However, we expect these cost savings to be
limited to the administrative burdens discussed in section IV.
---------------------------------------------------------------------------

    \496\ In other words, reducing the number of privacy notices
with no new content allows customers to devote more attention to
parsing notices that do contain new content.
---------------------------------------------------------------------------

    Because the exception became effective when the statute was
enacted, we believe that the aforementioned benefits have already been
realized. Consequently, we do not believe that its inclusion would have
any economic effects relative to the current status quo.\497\
---------------------------------------------------------------------------

    \497\ We distinguish here between the theoretical ``baseline''
in which the self-effectuating provisions of the statute have not
come into effect and the current ``status quo'' (in which they
have). See supra note 221 and accompanying text.
---------------------------------------------------------------------------

E. Effects on Efficiency, Competition, and Capital Formation

    As discussed in the foregoing sections, market imperfections could
lead to underinvestment in customer information safeguards, and to
information asymmetry about cybersecurity incidents.\498\ Various
elements of the proposed amendments aim to mitigate the inefficiency
resulting from these imperfections by imposing mandates for policies
and procedures. Specifically, the proposal would require covered
entities to include a response program for incidents involving
unauthorized access to or use of customer information, which would
address assessment and containment of such incidents, and could thereby
reduce potential underinvestment in these areas, and thereby improve
customer information safeguards.\499\ In addition, by requiring
notification to customers about certain safeguard failures, the
proposal could reduce the aforementioned information asymmetry.
---------------------------------------------------------------------------

    \498\ See supra section III.B.
    \499\ See supra section III.D (discussing benefits and costs of
response program requirement).
---------------------------------------------------------------------------

    While the proposed amendments have the potential to mitigate these
inefficiencies, the scale of the overall effect is likely to be limited
due to the presence of state notification laws, and existing security
practices, as well as existing regulations.\500\ Moreover, insofar as
the proposed amendments alter covered institutions' practices, the
improvement--in terms of the effectiveness of covered institutions'
response to incidents, customers' ability to respond to breaches of
their sensitive customer information, and in reduced information
asymmetry about covered institutions' efforts to safeguard this
information--is generally impracticable to quantify due to data
limitations discussed previously.\501\ The proposed provisions would
not have first order effects on channels typically associated with
capital formation (e.g., taxation policy, financial innovation, capital
controls, investor disclosure, market integrity, intellectual property,
rule-of-law, and diversification). Thus, the proposed amendments are
unlikely to lead to significant effects on capital formation.
---------------------------------------------------------------------------

    \500\ See supra sections III.C.1 and III.C.2.
    \501\ See, e.g., supra sections III.A., III.D.1.a. and
III.D.1.c.
---------------------------------------------------------------------------

    Because the proposed amendments are likely to impose
proportionately larger costs on smaller and more geographically-limited
covered institutions, this may affect their competitiveness vis-
[agrave]-vis their larger peers. Such covered institutions--which may
be less likely to have written policies and procedures for incident
response programs already in place--would face disproportionately
higher costs resulting from the proposed amendments.\502\ Thus, the
proposed amendments could tilt the competitive playing field in favor
of larger covered institutions. On the other hand, if clients and
investors believe that the proposed amendments effectively induce the
appropriate level of effort, smaller covered institutions would likely
reap disproportionately large benefits from these improved
perceptions.\503\
---------------------------------------------------------------------------

    \502\ The development of policies and procedures entails a fixed
cost component that imposes a proportionately larger burden on
smaller firms. We expect smaller investment advisers and broker
dealers would be most affected. See supra sections III.C.3.a and
III.C.3.b.
    \503\ Given the aforementioned disproportionately large costs
faced by smaller institutions, it is reasonable for potential
customers to suspect that smaller entities would be more inclined to
avoid such costs than their larger peers; such suspicions would be
mitigated by a regulatory requirement.
---------------------------------------------------------------------------

    With respect to competition among covered institutions' service
providers, the overall effect of the proposed amendments is similarly
ambiguous. The standardized terms of service used by some service
providers may already contain appropriate measures designed to protect
against unauthorized access to or use of customer information. If they
do not, however, it is likely that some service providers would decline
to negotiate contractual terms with respect to customer information
safeguards, effectively causing these service providers to cease
offering services to affected covered institutions.\504\ This would
reduce competition. On the other hand, service providers with fewer
customer information safeguards (i.e., those unwilling to provide said
assurances) would be unable to undercut service providers with greater
information safeguards. This would improve the competitive position of
this latter group.
---------------------------------------------------------------------------

    \504\ See supra section III.C.3.e.
---------------------------------------------------------------------------

    Finally, we anticipate that neither the proposed recordkeeping
provisions,\505\ nor the proposed exception from annual privacy notice
delivery requirements \506\

will have a notable impact on efficiency, competition, or capital
formation due to their limited economic effects.\507\ As discussed
elsewhere in this proposal, we do not expect the proposed recordkeeping
requirements to impose material compliance costs, and we expect the
economic effects of the proposed exception to be limited.
---------------------------------------------------------------------------

    \505\ Proposed rule 248.30(d).
    \506\ Proposed rule 248.5.
    \507\ See supra sections III.D.3 and III.D.4.
---------------------------------------------------------------------------

F. Reasonable Alternatives Considered

    In formulating our proposal, we have considered various reasonable
alternatives. These alternatives are discussed below.
1. Reasonable Assurances From Service Providers
    Rather than requiring policies and procedures that require covered
institutions to enter into a written contract with each service
provider requiring that it take appropriate measures designed to
protect against unauthorized access to or use of customer
information,\508\ the Commission considered requiring covered
institutions to obtain ``reasonable assurances'' from service providers
instead. This would be a lower threshold than the proposed provision
requiring a written contract, and as such would be less costly to reach
but also less protective.
---------------------------------------------------------------------------

    \508\ See supra section III.D.1.b.
---------------------------------------------------------------------------

    Under this alternative we would use the proposal's definition of
``service provider,'' which is ``any person or entity that is a third
party and receives, maintains, processes, or otherwise is permitted
access to customer information through its provision of services
directly to a covered institution.'' \509\ Thus, similar to the
proposal, this alternative could affect a broad range of service
providers including, potentially: email providers, customer
relationship management systems, cloud applications, and other
technology vendors. Depending on the states where they operate, these
service providers may already be subject to state laws applicable to
businesses that ``maintain'' computerized data containing private
information.\510\ Additionally, it is likely that any service provider
that offers a service involving the maintenance of customer information
to U.S. financial firms generally, or to any specific financial firm
with a national presence, has processes in place to ensure compliance
with these state laws; we request public comment on this assumption.
---------------------------------------------------------------------------

    \509\ Proposed rule 248.30(e)(10).
    \510\ See, e.g., Cal. Civil Code sec. 1798.82(b), N.Y. Gen. Bus.
Law sec. 899-AA(3).
---------------------------------------------------------------------------

    For service providers that provide specialized services aimed at
covered institutions, this alternative would, like the proposal, create
market pressure to enhance service offerings so as to provide the
requisite assurances and facilitate covered institutions' compliance
with the proposed requirements.\511\ These service providers would have
little choice other than to adapt their services to provide the
required assurances, which would result in additional costs for the
service providers related to adapting business processes to accommodate
the requirements. In general, we expect these costs would be limited in
scale in the same ways the costs of the proposal are limited in scale:
specialized service providers are adapted to operating in a highly-
regulated industry, and are likely to have policies and procedures in
place to facilitate compliance with state data breach laws. And, as
with the proposal, we generally anticipate that such costs would
largely be passed on to covered institutions and ultimately their
customers. As compared to the proposal's requirement for written
contracts, we expect that ``reasonable assurances'' would require fewer
changes to business processes and, accordingly, lower costs. Assuming
the covered institution did not use written contracts to document the
``reasonable assurances,'' however, this alternative would also be less
protective than the proposed requirement for contractual language. As
compared to ``reasonable assurances,'' a written contract is clearer,
more easily enforced as between the covered institution and the service
provider, and more likely to ensure customer notification in the event
of a data breach.
---------------------------------------------------------------------------

    \511\ A service provider involved in any business-critical
function likely ``receives, maintains, processes, or otherwise is
permitted access to customer information''. See proposed rule
248.30(e)(10).
---------------------------------------------------------------------------

    With respect to more generic service providers (e.g., email, or
customer-relationship management), the situation could be quite
different. For these providers, covered institutions are likely to
represent a small fraction of their customer base. As under the
proposed service provider provisions, generic service providers may
again be unwilling to adapt their business processes to the regulatory
requirements of a small subset of their customers under this
alternative.\512\ Some generic service providers may be unwilling to
make the assurances needed, although we anticipate that they would be
generally more willing to make assurances than to provide contractual
guarantees.\513\ If the covered institution could not obtain the
reasonable assurances required under this alternative, the covered
institution would need to switch service providers and bear the
associated switching costs, while the service providers would suffer
loss of customers. Although the costs of obtaining reasonable
assurances would likely be lower than under the proposed service
provider provisions, and the need to switch providers less frequent,
these costs could nonetheless be particularly acute for smaller covered
institutions who lack bargaining power with generic service providers.
And, as outlined above, this alternative would be less protective than
contractual language.
---------------------------------------------------------------------------

    \512\ See supra section III.D.1.b (discussing the proposed
requirement for covered institutions to enter into written contracts
with their service providers).
    \513\ See id. Additionally, the service provider's standard
terms and conditions might in some situations provide reasonable
assurances adequate to meet the requirement.
---------------------------------------------------------------------------

2. Lower Threshold for Customer Notice
    The Commission considered lowering the threshold for customer
notice, such as one based on the ``possible misuse'' of sensitive
customer information (rather than the proposed threshold requiring
notice when sensitive customer information was, or is reasonably likely
to have been, accessed or used without authorization), or even
requiring notification of any breach without exception. A lower
threshold would increase the number of notices customers receive.
Although more frequent notices could potentially reveal incidents that
warrant customers' attention and thereby potentially increase the
benefits accruing to customers from the notice requirement discussed in
section III.D.1.c, they would also increase the number of false alarms.
As discussed in section III.D.1.c.iv, such false alarms could be
problematic if they reduce customers' ability to discern which notices
require action.
    Although a lower threshold could impose some additional compliance
costs on covered institutions (due to additional notices being sent),
we would not anticipate the additional direct compliance costs to be
significant.\514\ Of more economic significance to covered institutions
would be the resulting reputational effects.\515\ However, the
direction of these effects is ambiguous. On the one hand, increased
notices resulting from a lower threshold can be expected to lead to
additional

reputation costs for firms required to issue more of such notices. On
the other hand, lower thresholds could inundate customers with notices,
such that notices are no longer notable, likely leading the negative
reputation effects associated with such notices to be reduced.
---------------------------------------------------------------------------

    \514\ The direct compliance costs of notices are discussed in
section IV.
    \515\ See supra section III.B.
---------------------------------------------------------------------------

3. Encryption Safe Harbor
    The Commission considered including a safe harbor to the
notification requirement for breaches in which only cipher text was
compromised. Assuming that such an alternative safe harbor would be
sufficiently circumscribed to prevent its application to insecure
encryption algorithms, or to secure algorithms used in a manner as to
render them insecure, we believe that the economic effects of its
inclusion would be largely indistinguishable from the proposal. This is
because, as proposed, notification is triggered by the ``reasonable
likelihood'' that sensitive customer information was accessed or used
without authorization.\516\ Given the computational complexity involved
in cracking the cipher texts of modern encryption algorithms generally
viewed as secure, the compromise of cipher text produced by such
algorithms in accordance with secure procedures \517\ would generally
not give rise to ``a reasonably likely risk of substantial harm or
inconvenience to an individual identified with the information.'' \518\
It would thus not constitute ``sensitive customer information,''
meaning that the threshold for providing notice would not be met and
thereby rendering an explicit encryption safe harbor superfluous in
such cases. In certain other cases, however, an express safe harbor may
not be as protective as the proposal's minimum nationwide standard for
determining whether the compromise of customer information could create
``a reasonably likely risk of substantial harm or inconvenience to an
individual identified with the information.'' \519\ It may also become
outdated as technologies and security practices evolve. Thus, while an
explicit (and appropriately circumscribed) safe harbor could provide
some procedural efficiencies from streamlined application, it could
also be misapplied.
---------------------------------------------------------------------------

    \516\ Proposed rule 248.30(b)(3)(iii).
    \517\ Here, ``secure procedures'' refers to the secure
implementation of encryption algorithms and encompasses proper key
generation and management, timely patching, user access controls,
etc.
    \518\ Proposed rule 248.30(e)(9); see also supra note 112 and
accompanying text.
    \519\ See proposed rule 248.30(e)(9). The August 2022 breach of
the LastPass cloud-based password manager provides an illustrative
example. In this data breach a large database of website credentials
belonging to LastPass' customers was exfiltrated. The customer
credentials in this database were encrypted using a secure algorithm
and the encryption keys could not have been exfiltrated in the
breach, so an encryption safe harbor could be expected to apply in
such a case. Nonetheless, customers whose encrypted passwords were
divulged in the breach became potential targets for brute force
attacks (i.e., attempts to decrypt the passwords by guessing a
customer's master password) and to phishing attacks (i.e., attempts
to induce an affected customer to divulge the master password). See
Karim Toubba, Notice of Recent Security Incident, LastPass (Dec. 22,
2022), available at https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/; see also Craig Clough, LastPass Security
Breach Drained Bitcoin Wallet, User Says, Portfolio Media (Jan. 4,
2023), available at https://www.law360.com/articles/1562534/lastpass-security-breach-drained-bitcoin-wallet-user-says.
---------------------------------------------------------------------------

4. Longer Customer Notification Deadlines
    The Commission considered incorporating longer customer
notification deadlines, such as 60 or 90 days, as well as providing no
fixed customer notification deadline. Although longer notification
deadlines would provide more time for covered institutions to rebut the
presumption in favor of notification discussed in section II.A.4.a, we
expect that longer investigations would, in general, correlate with
more serious or complicated incidents and would therefore be unlikely
to end in a determination that sensitive customer information has not
been and is not reasonably likely to be used in a manner that would
result in substantial harm or inconvenience. We therefore do not
believe that longer notification deadlines would ultimately lead to
significantly fewer required notifications. Compliance costs
conditional on notices being required (i.e., the actual furnishing of
notices to customers) would be largely unchanged under alternative
notice deadlines. That said, costs related to incident assessment would
likely be somewhat lower due to the reduced urgency of determining the
scope of an incident and a reduced likelihood that notifications would
need to be made before an incident has been contained.\520\ Arguably,
longer notification deadlines may increase reputation costs borne by
covered institutions that choose to take advantage of the longer
deadlines. Overall, however, we do not expect that longer notification
deadlines would lead to costs for covered institutions that differ
significantly from the costs of the proposed 30-day deadline.
---------------------------------------------------------------------------

    \520\ See supra section III.D.1.c.iii.
---------------------------------------------------------------------------

    Providing for longer notifications deadlines would likely reduce
the promptness with which some covered institutions issue notifications
to customers, potentially reducing their customers' ability to take
effective mitigating actions. In particular, as discussed in section
III.D.1.c.iii, some breaches are discovered very quickly. For customers
whose sensitive customer information is compromised in such breaches, a
longer notification deadline could significantly reduce the
timeliness--and value--of the notice.\521\ On the other hand, where a
public announcement could hinder containment efforts, a longer
notification timeframe could yield benefits to the broader public (and/
or to the affected investors).\522\
---------------------------------------------------------------------------

    \521\ See supra note 462 and accompanying text.
    \522\ See supra section II.A.4.e
---------------------------------------------------------------------------

5. Broader Law Enforcement Exception From Notification Requirements
    The Commission considered providing for a broader exception to the
30-day notification deadline, for example by extending its
applicability to cases where any appropriate law enforcement agency
requests the delay, and not limiting the length of the delay. This
alternative law enforcement exception would more closely align with the
law enforcement exceptions adopted by the Banking Agencies \523\ and
many states.\524\
---------------------------------------------------------------------------

    \523\ See Banking Agencies' Incident Response Guidance, supra
note 47.
    \524\ See, e.g., RCW 19.255.010(8); Fla. Stat. sec.
501.171(4)(b).
---------------------------------------------------------------------------

    The principal function of a law enforcement exception would be to
allow a law enforcement or national security agency to keep
cybercriminals unaware of their detection. Observing a cyberattack that
is in progress can allow investigators to take actions that can assist
in revealing the attacker's location, identity, or methods.\525\
Notifying affected customers has the potential to alert attackers that
their intrusion has been detected, hindering these efforts.\526\ Thus,
a broader law enforcement exception could generally be expected to
enhance law enforcement's efficacy in cybercrime investigations, which
would potentially benefit affected customers through damage mitigation
and benefit the general public through improved deterrence and
increased recoveries,

and by enhancing law enforcement's knowledge of attackers' methods.
---------------------------------------------------------------------------

    \525\ Cybersecurity Advisory: Technical Approaches to Uncovering
and Remediating Malicious Activity, Cybersecurity & Infrastructure
Sec. Agency (Sept. 24, 2020), available at https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-245a (explaining how and
why investigators may ``avoid tipping off the adversary that their
presence in the network has been discovered'').
    \526\ Id.
---------------------------------------------------------------------------

    That said, use of the exception would necessarily delay notice to
customers affected by a cyber-attack, reducing the value to customers
of such notices.\527\ Incidents where law enforcement would like to
delay customer notifications are likely to involve numerous customers,
who--without timely notice--may be unable to take timely mitigating
actions that could prevent additional harm.\528\ Law enforcement
investigations can also take time to resolve and, even when successful,
their benefits to affected customers (e.g., recovery of criminals' ill-
gotten gains) may be limited.
---------------------------------------------------------------------------

    \527\ See supra note 462 and accompanying text.
    \528\ See supra section III.D.1.c.iii.
---------------------------------------------------------------------------

    Information about cybercrime investigations is often confidential.
The Commission does not have data on the prevalence of covert
cybercrime investigations, their success or lack of success, their
deterrent effect if any, or the impact of customer notification on
investigations. Thus, we are unable to quantify the costs and benefits
of this alternative. We invite public comment on these topics.

G. Request for Comment on Economic Analysis

    To assist the Commission in better assessing the economic effects
of the proposal, we request comment on the following questions:
    107. What additional qualitative or quantitative information should
be considered as part of the baseline for the economic analysis of the
proposals?
    108. Are the effects on competition, efficiency, and capital
formation arising from the proposed amendments accurately
characterized? If not, why not?
    109. Are the economic effects of the alternatives accurately
characterized? If not, why not?
    110. Are the costs and benefits of the proposals accurately
characterized? If not, why not? What, if any, other costs or benefits
should be taken into account? Please provide data that could help us
quantify any of the aforementioned costs and benefits that we have been
unable to quantify.
    111. Do institutions that would be covered by this proposal already
comply with one or more state data breach notification requirements? If
so, how similar or different are the compliance obligations under the
state data breach notification laws and our proposal?
    112. Do existing contracts between covered institutions and service
providers address notification in the event of a data breach? If so, in
what circumstances does the service provider notify either the covered
institution or the customer whose data was compromised?
    113. Do you believe the Commission has accurately characterized the
cost of service providers adapting business practices to accommodate
the proposed requirements? Please state why or why not, in as much
detail as possible.
    114. Do policies and procedures implemented to comply with
Regulation S-ID incorporate red flags related to potential compromise
of customer information?
    115. Have potentially covered institutions developed and
implemented written policies and procedures for response to data breach
incidents?
    a. If so, please indicate whether these policies and procedures are
written to comply with state data breach notification laws,
international law, contracts, and/or other law or guidance.
    b. If so, please indicate which elements (e.g., detection,
assessment, containment, lessons learned, notification) such policies
contain.
    c. Please indicate what kind of institution (e.g., broker, transfer
agent, etc.) your experience reflects.
    116. Have service providers to potentially covered institutions
developed and implemented written policies and procedures for response
to data breach incidents?
    a. If so, please indicate whether these policies and procedures are
written to comply with state data breach notification laws,
international law, contracts, and/or other law or guidance.
    b. If so, please indicate which elements (e.g., detection,
assessment, containment, lessons learned, notification) such policies
contain.
    c. Please indicate what kind of service provider your experience
reflects.
    117. Do you believe that written policies and procedures to
safeguard information lead to reduced risk of safeguard failures?
Please share your experience or the basis for your belief.
    118. Do you believe that safeguarding the customer information of
customers of other financial institutions, or notifying these
individuals in the event their sensitive customer information is
compromised would entail additional costs?
    a. If so, please indicate the nature and scale of the costs.
    b. If so, please characterize the population of individuals whose
sensitive customer information would entail these significant
additional costs.
    119. Do you believe a broader law enforcement exception would
provide benefits?
    a. If so, please indicate the nature and scale of these benefits.
    b. If so, to the extent possible, please provide data or case
studies that could help establish the scale of these benefits.
    120. Do you believe that use of a broader law enforcement exception
would entail significant costs to individuals whose sensitive customer
information is compromised?
    a. If so, please indicate the nature and scale of these costs.
    b. If so, to the extent possible, please provide data or case
studies that could help establish the scale of these costs.

IV. Paperwork Reduction Act

A. Introduction

    Certain provisions of the proposed amendments contain ``collection
of information'' requirements within the meaning of the Paperwork
Reduction Act of 1995 (``PRA'').\529\ We are submitting the proposed
collection of information to the Office of Management and Budget
(``OMB'') for review in accordance with the PRA.\530\ The safeguards
rule and the disposal rule we propose to amend would have an effect on
the currently approved existing collection of information under OMB
Control No. 3235-0610, the title of which is, ``Rule 248.30, Procedures
to safeguard customer records and information; disposal of consumer
report information.'' \531\
---------------------------------------------------------------------------

    \529\ 44 U.S.C. 3501 through 3521.
    \530\ 44 U.S.C. 3507(d); 5 CFR 1320.11.
    \531\ The paperwork burden imposed by Regulation S-P's notice
and opt-out requirements, 17 CFR 248.1 to 248.18, is currently
approved under a separate OMB control number, OMB Control No. 3235-
0537. The proposed amendments would implement a statutory exception
that has been in effect since late 2015. We do not believe that the
proposed amendment to implement the statutory exception makes any
substantive modifications to this existing collection of information
requirement or imposes any new substantive recordkeeping or
information collection requirements within the meaning of the PRA.
Similarly, we do not believe that the proposed amendments to: (i)
Investment Company Act rules 31a-1(b) (OMB control number 3235-0178)
and 31a-2(a) (OMB control number 3235-0179) for investment companies
that are registered under the Investment Company Act, (ii)
Investment Advisers Act rule 204-2 (OMB control number 3235-0278)
for investment advisers, (iii) Exchange Act rule 17a-4 (OMB control
number 3235-0279) for broker-dealers, and (iv) Exchange Act rule
17Ad-7 (OMB control number 3235-0291) for transfer agents, makes any
modifications to this existing collection of information requirement
or imposes any new recordkeeping or information collection
requirements. Accordingly, we believe that the current burden and
cost estimates for the existing collection of information
requirements remain appropriate, and we believe that the proposed
amendments should not impose substantive new burdens on the overall
population of respondents or affect the current overall burden
estimates for this collection of information. We are, therefore, not
revising any burden and cost estimates in connection with these
amendments.

---------------------------------------------------------------------------

    An agency may not conduct or sponsor, and a person is not required
to respond to, a collection of information unless it displays a
currently valid OMB control number. The proposed requirement to adopt
policies and procedures constitutes a collection of information
requirement under the PRA. The collection of information associated
with the proposed amendments would be mandatory, and responses provided
to the Commission in the context of its examination and oversight
program concerning the proposed amendments would be kept confidential
subject to the provisions of applicable law. A description of the
proposed amendments, including the need for the information and its
use, as well as a description of the types of respondents, can be found
in section II above, and a discussion of the expected economic effects
of the proposed amendments can be found in section III above.

B. Amendments to the Safeguards Rule and Disposal Rule

    As discussed above, the proposed amendments to the safeguards rule
would require covered institutions to develop, implement, and maintain
written policies and procedures that include incident response programs
reasonably designed to detect, respond to, and recover from
unauthorized access to or use of customer information, including
customer notification procedures. The response program must include
procedures to assess the nature and scope of any incident involving
unauthorized access to or use of customer information; take appropriate
steps to contain and control the incident; and provide notice to each
affected individual whose sensitive customer information was, or is
reasonably likely to have been, accessed or used without authorization
(unless the covered institution makes certain determinations as
specified in the proposed rule).
    The proposed amendments to the disposal rule would require covered
institutions that maintain or otherwise possess customer information or
consumer information for a business purpose to adopt and implement
written policies and procedures that address proper disposal of such
information, which would include taking reasonable measures to protect
against unauthorized access to or use of the information in connection
with its disposal.
    Finally, the proposed amendments would require covered institutions
to make and maintain written records documenting compliance with the
requirements of the safeguards rule and the disposal rule. Under the
proposed rules, the time periods for preserving records would vary by
covered institution to be consistent with existing recordkeeping
rules.\532\
---------------------------------------------------------------------------

    \532\ The proposed amendments would also broaden the scope of
information covered by the safeguards rule and the disposal rule (to
include all customer information in the possession of a covered
institution, and all consumer information that a covered institution
maintains or otherwise possesses for a business purpose) and extend
the application of the safeguards provisions to transfer agents
registered with the Commission or another appropriate regulatory
agency. These amendments do not contain collections of information
beyond those related to the incident response program analyzed
above.
---------------------------------------------------------------------------

    Based on FOCUS Filing and Form BD-N data, as of December 2021,
there were 3,401 brokers or dealers other than notice-registered
brokers or dealers. Based on Investment Adviser Registration Depository
data, as of June 2022, there were 15,129 investment advisers registered
with the Commission. As of December 2021, there were 13,965 investment
companies.\533\ Based on Form TA-1, as of December, 2021, there were
335 transfer agents registered with the Commission and 67 transfer
agents registered with the Banking Agencies.
---------------------------------------------------------------------------

    \533\ Data on investment companies registered with the
Commission comes from Form N-CEN filings; data on BDCs comes from
Forms 10-K and 10-Q; and data on employees' securities companies
comes from Form 40-APP. See supra Table 1.
---------------------------------------------------------------------------

    Table 2 below summarizes our PRA initial and ongoing annual burden
estimates associated with the proposed amendments to the safeguards
rule and the disposal rule.

                     Table 2--Proposed Amendments to Safeguards Rule and Disposal Rule--PRA
----------------------------------------------------------------------------------------------------------------
                                 Internal     Internal annual
                              initial burden    burden hours    Wage rate \2\    Internal time   Annual external
                                   hours            \1\                               cost         cost burden
----------------------------------------------------------------------------------------------------------------
                                               PROPOSED ESTIMATES
----------------------------------------------------------------------------------------------------------------
Adopting and implementing                 60  25 hours \3\...  $455 (blended    $11,375 (equal   $2,655 \4\
 policies and procedures.                                       rate for         to the
                                                                compliance       internal
                                                                attorney and     annual burden
                                                                assistant        x the wage
                                                                general          rate).
                                                                counsel).
Preparation and distribution               9  8 hours \5\....  $300 (blended    $2,400 (equal    $2,018 \6\
 of notices.                                                    rate for         to the
                                                                senior           internal
                                                                compliance       annual burden
                                                                examiner and     x the wage
                                                                compliance       rate).
                                                                manager).
Recordkeeping...............               1  1 hour.........  $381 (blended    $381...........  $0
                                                                rate for
                                                                compliance
                                                                attorney and
                                                                senior
                                                                programmer).
Total new annual burden per   ..............  34 hours (equal  ...............  $14,156 (equal   $4,673 (equal
 covered institution.                          to the sum of                     to the sum of    to the sum of
                                               the above                         the above        the above two
                                               three boxes).                     three boxes).    boxes)
Number of covered             ..............  x 32,897         ...............  x 32,897         16,449 \8\
 institutions.                                 covered                           covered
                                               institutions                      institutions.
                                               \7\.
Total new annual aggregate    ..............  1,118,498 hours  ...............  $465,689,932...  $76,866,177
 burden.
----------------------------------------------------------------------------------------------------------------
                                  TOTAL ESTIMATED BURDENS INCLUDING AMENDMENTS
----------------------------------------------------------------------------------------------------------------
Current aggregate annual      ..............  + 47,565 hours.  ...............  ...............  + $0
 burden estimates.
Revised aggregate annual      ..............  1,166,063 hours  ...............  ...............  $76,866,177
 burden estimates.
----------------------------------------------------------------------------------------------------------------
Notes:
\1\ Includes initial burden estimates annualized over a 3-year period.
\2\ The Commission's estimates of the relevant wage rates are based on the SIFMA Wage Report. The estimated
  figures are modified by firm size, employee benefits, overhead, and adjusted to account for the effects of
  inflation.

\3\ Includes initial burden estimates annualized over a three-year period, plus 5 hours of ongoing annual burden
  hours. The estimate of 2560 hours is based on the following calculation: ((60 initial hours/3) + 5 hours of
  additional ongoing burden hours) = 25 hours.
\4\ This estimated burden is based on the estimated wage rate of $531/hour, for 5 hours, for outside legal
  services. The Commission's estimates of the relevant wage rates for external time costs, such as outside legal
  services, takes into account staff experience, a variety of sources including general information websites,
  and adjustments for inflation.
\5\ Includes initial burden estimate annualized over a three-year period, plus 5 hours of ongoing annual burden
  hours. The estimate of 8 hours in based on the following calculation: ((9 initial hours/3 years) + 5 hours of
  additional ongoing burden hours) = 8 hours.
\6\ This estimated burden is based on the estimated wage rate of $531/hour, for 3 hours, for outside legal
  services and $85/hour, for 5 hours, for a senior general clerk.
\7\ Total number of covered institutions is calculated as follows: 3,401 broker-dealers other than notice-
  registered broker-dealers + 15,129 investment advisers registered with the Commission + 13,965 investment
  companies + 335 transfer agents registered with the Commission + 67 transfer agents registered with the
  Banking Agencies = 32,897 covered institutions.
\8\ We estimate that 50% of covered institutions will use outside legal services for these collections of
  information. This estimate takes into account that covered institutions may elect to use outside legal
  services (along with in-house counsel), based on factors such as budget and the covered institution's standard
  practices for using outside legal services, as well as personnel availability and expertise.

C. Request for Comment

    We request comment on whether these estimates are reasonable.
Pursuant to 44 U.S.C. 3506(c)(2)(B), the Commission solicits comments
in order to: (1) evaluate whether the proposed collection of
information is necessary for the proper performance of the functions of
the Commission, including whether the information will have practical
utility; (2) evaluate the accuracy of the Commission's estimate of the
burden of the proposed collection of information; (3) determine whether
there are ways to enhance the quality, utility, and clarity of the
information to be collected; and (4) determine whether there are ways
to minimize the burden of the collection of information on those who
are to respond, including through the use of automated collection
techniques or other forms of information technology.
    Persons wishing to submit comments on the collection of information
requirements of the proposed amendments should direct them to the OMB
Desk Officer for the Securities and Exchange Commission,
[email protected], and should send a copy to
Vanessa A. Countryman, Secretary, Securities and Exchange Commission,
100 F Street NE, Washington, DC 20549-1090, with reference to File No.
S7-05-23. OMB is required to make a decision concerning the collections
of information between 30 and 60 days after publication of this
release; therefore, a comment to OMB is best assured of having its full
effect if OMB receives it within 30 days after publication of this
release. Requests for materials submitted to OMB by the Commission with
regard to these collections of information should be in writing, refer
to File No. S7-05-23, and be submitted to the Securities and Exchange
Commission, Office of FOIA Services, 100 F Street NE, Washington, DC
20549-2736.

V. Initial Regulatory Flexibility Act Analysis

    The Regulatory Flexibility Act \534\ (``RFA'') requires an agency,
when issuing a rulemaking proposal, to prepare and make available for
public comment an Initial Regulatory Flexibility Analysis (``IRFA'')
that describes the impact of the proposed rule on small entities,
unless the Commission certifies that the rule, if adopted, would not
have a significant economic impact on a substantial number of small
entities.\535\ This IRFA has been prepared in accordance with the RFA.
It relates to the proposed new rules and amendments described in
sections II through IV above.
---------------------------------------------------------------------------

    \534\ See 5 U.S.C. 601 et seq.
    \535\ See 5 U.S.C. 603(a); 5 U.S.C. 605(b).
---------------------------------------------------------------------------

A. Reason for and Objectives of the Proposed Action

    The objectives of the proposed amendments are to: (i) establish a
Federal minimum standard for providing notification to all customers of
a covered institution affected by a data breach (regardless of state
residency) and providing consistent disclosure of important information
to help affected customers respond to a data breach; (ii) require
covered institutions to develop, implement, and maintain written
policies and procedures for an incident response program that is
reasonably designed to detect, respond to, and recover from
unauthorized access to or use of customer information; (iii) enhance
the protection of customers' nonpublic personal information by aligning
the information protected under the safeguards rule and the disposal
rule by applying the protections of both rules to ``customer
information,'' while also broadening the group of customers whose
information is protected under both rules; and (iv) bring all transfer
agents within the scope of the safeguards rule and the disposal rule.
The proposed amendments also would update applicable recordkeeping
requirements and conform Regulation S-P's annual privacy notice
delivery provisions to the terms of a statutory exception. The proposed
amendments are intended to:
    A. Prevent and mitigate the unauthorized access to or use of
customer information;
    B. Improve covered institutions' preparedness to respond to data
breaches involving customer information, and the effectiveness of their
response programs to such data breaches when they do occur;
    C. Ensure that firms consistently monitor their systems to
identify, contain, and control data breach incidents involving customer
information quickly;
    D. Help affected individuals through the adoption of a minimum
standard for notification in response to unauthorized access or use of
sensitive customer information that leverages some of the more
protective state law practices already in existence;
    E. Expand the coverage of the safeguards rule to provide for
greater protection of customer information that is maintained by
transfer agents;
    F. Extend the protections of Regulation S-P to cover customer
information that covered institutions receive from another financial
institution in the process of conducting business;
    G. Create more consistent standards across the safeguards rule and
the disposal rule for the handling of the same types of nonpublic
personal information; and
    H. Require that a covered institution's response program include
policies and procedures that require a covered institution, by
contract, to require that its service providers take appropriate
measures that are designed to protect against unauthorized access to or
use of customer information.

B. Legal Basis

    We are proposing the new rules and rule amendments described above
under the authority set forth in sections 17, 17A, 23, and 36 of the
Exchange Act [15 U.S.C. 78q, 78q-1, 78w, and 78mm], sections 31 and 38
of the Investment Company Act [15 U.S.C. 80a-30 and

80a-37], sections 204, 204A and 211 of the Investment Advisers Act [15
U.S.C. 80b-4, 80b-4a and 80b-11], section 628(a) of the FCRA [15 U.S.C.
1681w(a)], and sections 501, 504, 505, and 525 of the GLBA [15 U.S.C.
6801, 6804, 6805 and 6825].

C. Small Entities Subject to Proposed Rule Amendments

    The proposed amendments to Regulation S-P would affect brokers,
dealers, registered investment advisers, investment companies, and
transfer agents, including entities that are considered to be a small
business or small organization (collectively, ``small entity'') for