The FTC extended the compliance deadline for certain provisions of the Safeguards Rule by six months to June 9, 2023, due to challenges like shortage of qualified personnel and supply chain issues exacerbated by the COVID-19 pandemic. The rule requires non-banking financial institutions to implement enhanced data security measures, and the extension aims to facilitate compliance, especially for small entities.
In-house legal teams should review vendor agreements, customer contracts, and employee data handling policies to ensure they incorporate requirements from the Safeguards Rule under the Gramm-Leach-Bliley Act. Specifically, clauses related to data security programs, risk assessments, access controls, encryption, incident response, and vendor management must be updated to mandate compliance with the Rule. Contracts should include audit rights to verify security practices, breach notification obligations aligned with the Rule, and requirements for regular security training. For small entities, consider including provisions for phased implementation or deadline extensions to align with the June 2023 compliance date, and ensure indemnification clauses cover data security failures.
Entity
Financial institutions covered by the Safeguards Rule
Also known as: Financial Institutions
Industry
Financial ServicesOfficial Press Release
https://www.ftc.gov/news-events/news/press-releases/2022/11/ftc-extends-deadline-six-months-compliance-some-changes-financial-data-security-rule
16 cfr part 314 standards safeguarding customer information
https://www.ftc.gov/legal-library/browse/federal-register-notices/16-cfr-part-314-standards-safeguarding-customer-information
concurring statement commissioner wilson regarding effective
https://www.ftc.gov/legal-library/browse/cases-proceedings/public-statements/concurring-statement-commissioner-wilson-regarding-effective-date-certain-provisions-recently
Federal Trade Commission Enforcement Page
https://www.ftc.gov/enforcement
"Financial institutions covered by the Safeguards Rule"
"Gramm-Leach-Bliley Act"
$750K
The FTC finalized an order against Vanilla Chip LLC (doing business as TruHeight) and its principals for deceptively advertising height-enhancing supplements for children and teens without scientific evidence. The company also used fake reviews and incentivized 5-star ratings. The order requires a $750,000 payment and prohibits false health claims and deceptive review practices.
$2.3M
The FTC alleged that RentGrow, a tenant screening company, violated the Fair Credit Reporting Act (FCRA) by failing to use reasonable procedures to ensure the accuracy of its reports, including by reporting duplicate records and failing to disclose data sources. RentGrow agreed to pay a $2.25 million penalty and is prohibited from further FCRA violations and from misrepresenting dispute outcomes.
The FTC and New York Attorney General took action against Handy Technologies for deceptive earnings claims and failure to disclose fees and fines that led to millions of dollars being withheld from workers' wages. The FTC is sending over $2.7 million in refunds to 62,893 affected consumers.
$35.0M
The FTC alleged that Hopper, a travel booking app, charged consumers hidden and pre-selected fees (Tip and VIP Support) without their consent, misrepresented the benefits of VIP Support and Price Freeze services, and failed to clearly disclose total prices. Hopper agreed to pay $35 million for consumer redress and is prohibited from misrepresenting fees under a proposed order.
$1.5M
The FTC finalized a settlement with Publishing.com LLC and its principals for misleading consumers about potential earnings from self-publishing products. The company will pay $1.5 million and is prohibited from making unsubstantiated earnings claims, failing to disclose refund terms, and misrepresenting endorsements and reviews.
The FTC is seeking public comment on a proposed policy statement addressing concerns that AI companies may be manipulating AI system outputs contrary to consumer expectations for objectivity and accuracy. The statement explains that such conduct could be considered deceptive under Section 5 of the FTC Act. The public comment period runs until July 31, 2026.