Compliance

Safeguards – Continued from page 5

rule change was first announced.

Adam Crowell, president and general counsel for ComplyNet, discussed the issue during the National Auto Auction Association Convention & Expo last fall.

The FTC noticed there was “data breach, after data breach, after data breach,” Crowell said. “And the FTC was taking enforcement action after enforcement action after enforcement action.”

Every time they did it, they would have the same sort of framework for those who suffered the data breach. So, the FTC took the criteria that they had already expected and just put it in writing as a revised rule, Crowell said.

“The fines (for violating the rule) are very significant that could be up to $46,517 per customer record,” he added.

The FTC also has a Section 5 rule, which can apply to anyone who has consumer information, so the FTC has gone after those businesses. Crowell pointed out it went after an advertising company for covering up a data breach.

Steve Levine, of Ignite Consulting Partners, has held several webinars and presentations, warning his clients and others about being in compliance with the new rule.

“It seems like I’ve been writing and speaking about the FTC’s Safeguards Rule for years now,” he recently wrote. “Quite frankly, I think my audience is tired of hearing about it and if I’m being perfectly honest, I’m a bit worn out discussing it. After all, how many different ways are there to say, ‘take this seriously and make sure you are doing what is expected when it comes to protecting customer information?’”

Levine said he keeps hearing about dealers who are not taking the issue seriously.

“A used car dealer called me out of the blue after discussing the subject at an industry meeting. For the next thirty minutes I listened patiently as he recited reason after reason why he’s not going to do anything when it comes to Safeguards,” Levine said.

The excuses range from, “my business isn’t big enough to be a target,” to “the cost of the fine would be less than all the time and money I’d have to spend.”

Levine said he shared a story involving a business that had to defend itself against claims which were based on existing laws, not even the bigger changes coming with the Safeguards Rule.

“It started with a demand letter from a former credit applicant,” he said. “This person had applied for financing at this dealership about six months previously and was denied. Thereafter, she alleges that her identity was stolen, which caused her all sorts of headaches and inconvenience.”

The resulting lawsuit has chewed up a lot of this client’s time and expenses and there is still a concern the matter could become a class action suit, Levine said.

The new rule is in effect, whether a dealer ignores it or not.

“Some of you have already started down your Safeguards journey and are making progress, some are going to read this and choose to forget about it, and some of you may take this as a call to action,” he said. “You are all business people that can evaluate risk and decide your own comfort level.

“What you can’t do, though, is deny that the risk does exist. The ball is in your court. Do you want to play offense and be proactive, or do you want to play defense? Either way, you’re already in the game.”