When a Seller That Extends Credit Picks Up a Second Data Rule

Answer first: this rule is defined by the entity, not the data

16 CFR part 314 is titled "Standards for Safeguarding Customer Information." Section 314.1(a) states its purpose: it "implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act" and "sets forth standards for developing, implementing, and maintaining reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information."

Section 314.1(b) then draws the boundary, and it is a boundary around entities rather than around information. The part "applies to the handling of customer information by all financial institutions over which the Federal Trade Commission has jurisdiction," meaning those "'financial institutions' over which the Commission has rulemaking authority pursuant to section 501(b) of the Gramm-Leach-Bliley Act."

The definition of that class is functional. "An entity is a 'financial institution' if its business is engaging in an activity that is financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956," and § 314.2 adds that "An institution that is significantly engaged in financial activities, or significantly engaged in activities incidental to such financial activities, is a financial institution."

Section 314.1(b) offers a non-exhaustive list of examples: "mortgage lenders, 'pay day' lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, travel agencies operated in connection with financial services, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, investment advisors that are not required to register with the Securities and Exchange Commission, and entities acting as finders."

The rule's own definitional example is worth quoting because it shows how a non-financial business can arrive inside the class: "A retailer that extends credit by issuing its own credit card directly to consumers is a financial institution because extending credit is a financial activity... and issuing that extension of credit through a proprietary credit card demonstrates that a retailer is significantly" engaged in it.

Whether any particular company falls inside that definition is a question about that company's activities. This page does not answer it for anyone, and nothing here says that a health seller is or is not within the rule.

What the rule protects, and what a program has to achieve

Section 314.2(d) defines "customer information" as "any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates." The phrase "or on behalf of" pulls in records held by vendors.

Section 314.1(b) extends the reach further: the part "applies to all customer information in your possession, regardless of whether such information pertains to individuals with whom you have a customer relationship, or pertains to the customers of other financial institutions that have provided such information to you."

Section 314.3(a) requires a covered institution to "develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue."

Section 314.3(b) states three objectives: to "Insure the security and confidentiality of customer information"; to "Protect against any anticipated threats or hazards to the security or integrity of such information"; and to "Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer."

The scaling language in § 314.3(a) matters. The program must be appropriate to the institution's size and complexity and to the sensitivity of the information — which means the rule does not prescribe one architecture, but it does prescribe that the reasoning behind the architecture exists in writing.

The elements the rule names by hand

Section 314.4 lists what a program must include, and several items are unusually specific for a security regulation.

There must be a named person. The institution must "Designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program." That individual may be employed by the institution, an affiliate or a service provider — but where a service provider or affiliate is used, the institution must "Retain responsibility for compliance," designate a senior member of its own personnel "responsible for direction and oversight of the Qualified Individual," and require the provider to maintain a program protecting it.

The program must rest on a written risk assessment that identifies "reasonably foreseeable internal and external risks" and "assesses the sufficiency of any safeguards in place to control these risks," including criteria for evaluating and categorizing risks, criteria for assessing confidentiality, integrity and availability, and "Requirements describing how identified risks will be mitigated or accepted." Additional assessments must be performed periodically.

Two technical requirements are stated outright. The institution must "Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest," with an escape only where encryption is determined infeasible and "effective alternative compensating controls reviewed and approved by your Qualified Individual" are used instead. And it must "Implement multi-factor authentication for any individual accessing any information system, unless your Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls." Section 314.2 defines multi-factor authentication as verification of at least two of knowledge factors, possession factors and inherence factors.

There is a disposal clock. The institution must maintain procedures "for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates," unless the information is needed for business operations or other legitimate business purposes, is required to be retained by law, or targeted disposal is not reasonably feasible given how it is maintained.

Vendors are covered by § 314.4(f), which requires "Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards," "Requiring your service providers by contract to implement and maintain such safeguards," and "Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards."

Incident response, and who has to be told inside the company

Section 314.4(h) requires a "written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information in your control," and names seven things the plan must address: its goals; internal response processes; "clear roles, responsibilities, and levels of decision-making authority"; external and internal communications and information sharing; remediation requirements for identified weaknesses; documentation and reporting of events and response activities; and evaluation and revision of the plan after an event.

Section 314.2 defines a "security event" broadly as "an event resulting in unauthorized access to, or disruption or misuse of, an information system, information stored on such information system, or customer information held in physical form." Physical records are inside the definition.

Section 314.4(i) requires the Qualified Individual to "report in writing, regularly and at least annually, to your board of directors or equivalent governing body," or, where none exists, to "a senior officer responsible for your information security program." The report must cover "The overall status of the information security program and your compliance with this part," and material matters including risk assessment, risk management and control decisions, service provider arrangements, testing results, "security events or violations and management's responses thereto," and recommended changes.

That reporting requirement is the part of the rule that puts security in front of the people who decide budgets, which is a different thing from putting it in front of the people who run systems.

Section 314.6 carves out smaller institutions from four of these requirements. The written risk assessment requirement at § 314.4(b)(1), the requirement at (d)(2), the incident response plan at (h) and the board reporting at (i) "do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."

The thirty-day notice to the agency

Section 314.4(j) adds a reporting duty that runs to the regulator rather than to the individual. Section 314.5 states that this paragraph "is effective as of May 13, 2024."

The trigger is a "notification event," which § 314.2 defines as "acquisition of unencrypted customer information without the authorization of the individual to which the information pertains." Information is treated as unencrypted "if the encryption key was accessed by an unauthorized person," and the definition adds a presumption: "Unauthorized acquisition will be presumed to include unauthorized access to unencrypted customer information unless you have reliable evidence showing that there has not been, or could not reasonably have been, unauthorized acquisition of such information."

Where such an event "involves the information of at least 500 consumers," the institution "must notify the Federal Trade Commission as soon as possible, and no later than 30 days after discovery of the event," electronically on a form on the Commission's website.

The notice must include the reporting institution's name and contact information; "A description of the types of information that were involved"; the date or date range if determinable; "The number of consumers affected or potentially affected"; "A general description of the notification event"; and whether a law enforcement official has provided a written determination that notifying the public would impede a criminal investigation or cause damage to national security, together with a means of contacting that official. Such an official "may request an initial delay of up to 30 days," extendable in writing "for an additional period of up to 60 days," with further delay only where Commission staff determines that disclosure continues to impede an investigation or cause damage to national security.

Discovery is defined so that it does not depend on the right person noticing. An event "shall be treated as discovered as of the first day on which such event is known to you," and the institution "shall be deemed to have knowledge of a notification event if such event is known to any person, other than the person committing the breach, who is your employee, officer, or other agent."

The reason this matters for anyone comparing sellers is a single structural point. Which data rule a company answers to depends on what the company does, not on how sensitive its records feel — and a company can be inside more than one regime, or, on a given set of facts, outside the one a reader assumed. Determining which applies to a particular business is a legal question about that business, and this page does not answer it.