Statement on the Proposed Amendments to Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information

Thank you, Chair Gensler, and thank you to the staff for their presentations. Today, the Commission considers three separate, but related proposals. In discussions with the staff, the three proposals have been described as having different objectives and not being limited solely to cybersecurity. Despite that view, each proposal places a significant focus on cybersecurity. In fact, that term is mentioned over 250 times in the Regulation S-P and Regulation SCI proposals, and over 2,000 times in the cybersecurity risk management proposal. However, the Commission has provided little analysis as to how the proposals interact with each other or how, as a group, they mitigate cybersecurity risks in the most efficient manner. The lack of an integrated regulatory structure may even weaken cybersecurity protection by diverting attention to satisfy multiple overlapping regulatory regimes rather than focusing on the real threat of cyber intrusions and other malfeasance. Thus, my preference would be to create a unified approach to cybersecurity where various components are complementary, rather than duplicative, and that counsels for an incremental approach to hardening the markets and its participants against the harms of cybersecurity breaches.

The first matter being considered is the proposal to amend Regulation S-P, which was adopted in 2000 pursuant to the Gramm-Leach-Bliley Act (“GLBA”).[1] The applicable provisions were later amended by Congress in 2015.[2] Regulation S-P requires that financial institutions provide initial and annual privacy notices and explain to customers how they can opt out of disclosing their personal information to nonaffiliated third parties. As relevant to today’s proposals, Regulation S-P generally requires that SEC-registered investment advisers, brokers, dealers, and investment companies adopt written policies and procedures to safeguard customer records and information. It also requires these financial institutions and SEC-registered transfer agents to properly dispose of consumer report information.

Regulation S-P seeks to protect the financial and personal customer information kept by financial institutions from unauthorized access or use. A bad actor who obtains a customer’s personal information, such as a name, address, or social security number, can do significant damage to an individual’s credit score, bank account, and reputation. Since Regulation S-P’s adoption in 2000, advances in technology and communications have changed how individuals interact with financial institutions. Unfortunately, this also means that bad actors have potentially more opportunities to steal personal information and commit identity theft, among other potential harms.

Today’s proposed amendments are a mixed bag of practical improvements and potentially conflicting requirements. The Commission is finally proposing to implement the statutory exception added by the FAST Act in 2015 and to extend Regulation S-P to cover all transfer agents. These aspects are long overdue. In addition, the proposal requires financial institutions to develop policies and procedures for their incident response programs in a manner tailored to their particular risks and businesses.

The Commission is also proposing that financial institutions generally must notify individuals in writing within 30 days if their sensitive customer information was reasonably likely to have been accessed or used without authorization, subject to certain conditions. While customers should receive timely written notice when a financial institution suspects their sensitive information to have been accessed or used, all 50 states and other regulators have already adopted notification obligations. This requirement will thus impose additional compliance obligations for financial institutions and, to the extent that multiple or slightly different notifications are sent to customers for the same security incident, may result in confusion. State standards for notification vary, including the time for notification and the triggering circumstances. If adopted, some investors may receive a notice about their compromised information when they did not before, which may be to their benefit. However, absent a Congressionally-enacted federal data privacy law,[3] the Commission’s proposal could easily add more burdens and confusion to the mix. I look forward to commenters’ views on this and other aspects of the proposal.

Most importantly, I am deeply concerned about the proposal’s potential for overlap with at least four other Commission proposals: the cybersecurity risk management proposal for investment advisers, funds, and business development companies;[4] the cybersecurity risk management proposal for broker-dealers, transfer agents, self-regulatory organizations, and national exchanges;[5] the Regulation SCI proposed amendments;[6] and the investment adviser outsourcing proposal.[7] This kitchen sink approach to cybersecurity raises a number of concerns, such as potentially duplicative policies and procedures and multiple notifications to the Commission and customers. In addition, some of the estimated costs for financial institutions seem completely unrealistic, such as one hour annually to comply with recordkeeping obligations. Notably, the Commission does not attempt to quantify the costs and benefits of these proposals holistically. Instead, the Commission asks commenters to weigh in on the areas of overlap and duplication. We should not be asking commenters to do our work for us.

Despite my reservations, I will support the effort to obtain public comment on this proposal to amend Regulation S-P. It has been over twenty years since its adoption and a review is appropriate to determine whether our rules are satisfactorily protecting the public. I thank the staff in the Divisions of Trading and Markets, Investment Management, and Economic and Risk Analysis, as well as the Office of the General Counsel for their efforts. I also thank the other offices around the Commission for their work on cybersecurity.