Agency advises automobile vendors to safeguard consumer information
The Federal Trade Commission (FTC) has issued a warning to auto dealers, emphasising the need to protect customer data in light of updated regulations. The Safeguards Rule, one of the FTC's core cybersecurity regulations, mandated in a 1999 law, has been modernised twice in the past five years, with the latest updates coming in 2021 and 2023.
The Safeguards Rule applies to car dealers that offer financing to customers. In 2023, the FTC broadened the requirements to include notifications within 30 days of data breaches affecting at least 500 people. The updated rule also requires covered companies to develop, implement, and maintain a comprehensive written information security program that is sufficient to protect customer information.
The FTC's guidance on the Safeguards Rule is contained in a document that provides details on 10 elements of a compliant program. The document also differentiates compliance with the Safeguards Rule and the Privacy Rule.
The security and privacy of car customers' data, including data collected by cars themselves, has become a pressing issue due to increased internet-connected technology. This concern is not limited to the US, as other carmakers, such as General Motors, have also faced scrutiny for selling driving data without notice.
The Texas attorney general's office is scrutinising car companies' sale of driving data to third parties, including insurance companies. In January, the Texas attorney general's office sued the insurer Allstate as part of that investigation.
The FTC's interest in protecting driver privacy remains, despite the change in political leadership following President Donald Trump's election in 2024. This is a reflection of the commission's continued interest in the matter.
Republicans have grown increasingly willing to hold companies accountable for mishandling data. This is evident in the FTC's updates to the Safeguards Rule, which require more specific security precautions from covered companies.
Tesla's car privacy issues have garnered significant attention. The commission has explained in a Frequently Asked Questions document how car dealers should comply with the rule's requirements. The document also answers questions about potential dealership practices and explains how dealers must ensure their third-party service providers comply with the law.
The document is a testament to the FTC's commitment to protecting consumer privacy and safeguarding sensitive information. As the world becomes more interconnected, it is crucial that companies take the necessary steps to protect their customers' data.
