Privacy and Data Management Discussion with our Compliance Attorney - Josh Stevens

Foreign, everybody. Today I'm pinch hitting for Jake on a couple volley rallies with our incredible compliance attorney, Josh Stevens. He's a partner at McMurray and Schuster. What we're going to do, we've got two of them that we're going to record today, run as two separate sections and this is the first one. We're going to talk about privacy and data management, glba, all these things that come down, and we'll release these each, each a week or so at a time. Very apropos with what's going on in automotive. So with that, I want to introduce Josh. Josh, how you doing today?

I'm doing well. It's good to see you, Scott, as always.

Yeah. By the way, at the end of the call, I'm going to shamelessly share, have Josh share his information. Anything that you guys have for questions. The best detailed, most knowledgeable compliance attorney I've ever worked with. And you know, he's, he's helped a lot of people. We know. They do a great job. So I would, I would really. I'll give it at the end, you guys can also contact me. But in any event, let's, let's dig right in. Privacy. So, kind of a topic that is in current events nowadays with the CDK data, cyber security issue. Right. What can we learn from this data breach as far as, from you're not in automotive, though you do have automotive clients. Some. But from the outside looking in, is there anything we can learn from this occurrence?

Yeah, there definitely is. And I think the, the first main point is it doesn't matter how big you are, how much security you have in place, there's always a risk. Right. And the Gramm Leach Bliley act for automotive dealerships, which act as financial institutions under the Grammleach Bliley act, there is the safeguards rule. And the safeguards rule says you have to have certain data security practices and that has to come under a written information security plan overseen by a designated person. Right. It sets out all of these requirements, but it doesn't matter what you do. At some point, almost every business is going to face some type of security incident. And I think what we can learn from CDK is you really want to have that data breach response plan rehearsed. You want to know exactly who to call, how to run things up the chain. If you need to shut systems down, which CDK did in order to stop the immediate breach, and then work on a patch, sometimes that's what you have to do. It's highly disruptive. As dealerships who use CDK well know, but you have to take the steps you have to take to protect the consumer data. The other thing that I think CDK teaches us is if you are a dealership and you are using a vendor, have a business continuity or a disaster response plan, so if something goes wrong with that vendor, you can get back up and running. I saw plenty of articles about dealerships going back to using, you know, pen and paper and hand tickets to do things. That's great, that's all well and good, but you know, having a backup system is always a responsible choice.

Could we back up a little bit to the glba?

Yeah.

A lot of our dealers are in, well, compliance. Some of them don't really understand their responsibilities and obligations as they work with companies like ours or how they safeguard their customer data and such. Could you talk about more at a broad case of what that act is, what their responsibility is, how they can get in trouble if they don't do it, and steps they should take, you know, and shamelessly how you can help. But yeah, let's dig into that a little bit.

Sure. So automotive dealerships are considered financial institutions under the Grammleach Wiley act, the GLBA for short. And that law has two main parts. There's what's referred to as the privacy rule. And that side of the law dictates how you can use consumer data that's subject to the law and privacy disclosures that you need to give around that data. It's more of an informational side. And we find most dealers do pretty well with the privacy side of glba. The other half is the safeguards rule. And that side has been recently updated. In the last couple years, the FTC issued much more restrictive requirements around how you protect data. And remember, this isn't all data. This is data that's subject to glba, which is, without getting into all the technical details, generally data that is related to finance, lease, credit applications, things that are connected to that financial side of the business. Right. And so under the safeguards rule, every financial institution has to have a written information security program. And that program has to be overseen by a designated person. And that program has to have multiple components which are explained in the rule. Some of those are things like a data breach response plan using multi factor authentication for systems that have data that's subject to JLBA performing vulnerability testing or pen testing on a, on a reasonable basis and overseeing service providers.

Right.

Which, which for you, Scott, is Bali is a service provider to a lot of auto dealerships, that's where you come in. Right. And so the dealerships have a responsibility to vet their vendors, to vet the companies that are going to hold this data on their behalf and to oversee them. And that can be easier to do with a business like yours where you engage with your clients really well and can answer their questions and help them out as they need. That can be harder to do sometimes with bigger vendors that, for lack of a better term, have set responses and set documents that they're willing to provide. And they're not really keen on doing individualized conversations with their clients. And so if a situation comes up with a vendor, that financial institution, that auto dealership can potentially be liable. And we have seen regulators aggressively go after financial institutions for data issues.

So they have, basically, they need to put plans in place, they need to have someone in charge of it. They need to make sure all their service providers are complying and have written agreements with them. Did I, did I cover that correctly?

Yeah, yeah. And they need to. And one of the things that we tell a lot of our clients who are financial institutions is when it comes to your vendors, for example, and when it comes to your own internal policies and procedures, refresh those. Right. Go back once a year, take a look through them, make sure that they're all still current and you still know what's going on.

Obviously you guys can help every dealer with it. For all you folks who are listening, there are automotive specific vendors that use this as, you know, they do it as a SaaS program. What are the penalties if a dealership is not in compliance with GLBA?

Yeah. So you can see penalties upwards of over $50,000 per violation. And per violation can be every consumer or every piece of data. There are ways that regulators can take the term violation and really pile up penalties. So it's not something to mess with.

Yeah, I mean, I'm not a lawyer. Thank goodness. No one wants to make their lawyer. And if I were, if I, even if I was using one of these companies that services auto, because I think they do have a good program and do a good job, they're not your lawyer either. Keep in mind, everyone, they're representing themselves. So I would, I would make sure, don't say they give me good advice for them to, to either, you know, talk with you and this isn't a sales pitch with Josh or, you know, if I mean, or find someone who has proficiency in this to be their representative, to look over at what they're doing.

Yeah, yeah. And I guess, I guess Actually, on that note, Scott, I should probably give the normal disclaimer that I'm not a, I'm not the lawyer to everyone on the call today either. And so this is an educational session, but obviously talk to your lawyer before acting on anything I mentioned.

Yeah, just go out and have someone who is your representative double check what you're doing. If a data breach occurs with a vendor, can the dealer be liable?

They can, and we have seen instances where financial institutions have been held liable for the, a data breach at the vendor level. Now, regulators will often look favorably if the vendor, or rather the financial institution, has a vendor management program and performs oversight and does due diligence, all those things that they should be doing to oversee the vendor. And then something happens. A lot of times the regulators will look favorably on that and try to focus more on the vendor rather than the financial institution. But yeah, I mean, at the end of the day, you are the one as the auto dealership who's got the relationship with the client, with the consumer whose data you, you hold. And so you're the first point of liability in that chain.

If you were the dealer, what would you do to mitigate the risk?

Yeah. So first off, obviously have the, the written information security plan. I would have a documented vendor management program that sets certain cadences for performing due diligence on my vendors and that sets out contract terms that I require for my vendors. And then I would do that due diligence. And at least once a year I would ask the vendor to send me a questionnaire, responses to a questionnaire on their data security. And if they have a SOC report, maybe send that, do that due diligence to show I'm doing what I need to do to oversee the vendor.

Okay. Now, what makes this complex? And we're going to get into the TCPA also with a few things, but you have to comply with states as well. California has their own privacy laws. Anything, anything there you want to address as far as any new regulations for states in regards to privacy or what you do? I mean, obviously, you know, those things are out of, you know, anything super specifics out of the scope of this, this volley rally. But what do you think?

Yeah. So everybody probably remembers California, right. Coming into effect a couple years ago and really shaken up privacy regulation in the US we're now up to, I believe it's 18 states last time I checked, that passed comprehensive privacy legislation. So far we had several new ones this year alone. It seems to be this is going to be a trend every, every year more States adding for auto dealerships, many of these state laws probably aren't going to apply because they have what we call an entity based GLBA exception. And what I mean by that is the law exempts businesses that are subject to GLBA as long as they're in compliance with glba. Right. It's different for California. California has what's called a data based GLBA exemption, which means that data that is subject to the GLBA is exempt from the California law. But all the other personal information that the business has that's not subject to GLBA is then subject to the California law, assuming you meet the other trigger thresholds. For California, a couple other states have followed suit. Oregon, whose law comes into effect July 1st of 2024 of this year, also has a data based. And Minnesota, which just passed a law, it won't be in effect until, I believe, summer of 2025, if I'm recalling correctly, also has a data based exemption. So if you have personal information of individuals in California, Oregon or Minnesota, you really need to think about those state privacy laws in addition to the glba.

Okay. It's complex. What about. Consumers are really kind of keying into this. Some bad actors, most just honest folks who are worried, you know, they read something in the news and they want their information deleted. Or I guess I'm just going to just toss that one over the fence to you. Any comments on that?

Yeah. So we are definitely seeing consumers are getting more attuned to these issues. And as you see more things in the press about data breaches, about misuse of data, more and more consumers are going to businesses and saying, yeah, I want my data deleted. California, Oregon and Minnesota, for residents of that state, obviously have a deletion right now. There are exceptions under those laws that can be applied so you might be able to retain certain data, but it really requires developing a nuanced policy for what you're willing to do. But the other thing that we see is a lot of businesses now saying, you know what, from a brand perspective and from a customer service perspective, I'm just going to give those rights, even if technically I don't have to, because it's going to make my customers happy. And, and we're seeing that more and more. And I think that's a decent position to take from a, from a customer service standpoint.

Okay. So when I look, when I go into a dealership, a few of the things I see when we interact with them, I see customer list printed off and sitting on Desk, you know, we don't allow our customers to email us list, you know, if they've got to upload it securely into Valley. Any. Any just good basic daily habits to have good data privacy that I didn't ask you about or you'd like to highlight.

Yeah, I encourage clean desk policies so, you know, don't have printed documents sitting on a desk, or if you do have a printed document, that document is with you, it's in your possession, and then it gets locked in a cabinet or something when you're away from your desk so that it's not just sitting out for everyone to see. Secure data transfer mechanisms like what Volley has are obviously encouraged. And frankly, if there's any sort of sensitive personal information like a Social Security number or a credit card number or anything like that, I would say that's pretty much required in order to be an adequate safeguard. We are increasingly seeing clients using encrypted email and other techniques like that to allow some of the flexibility of email, but giving it an extra layer of protection. And obviously you have to figure out what's the right level of protection for what you need to do. But the other thing I would encourage the viewers here today to check out is the NIST Cybersecurity Framework, which is a voluntary cybersecurity program that was put together by nist, which is a government agency. And it provides a lot of really great insight in how to build a cybersecurity program, how to think through these issues, weigh the risks and the ways that you can respond to them, and is actually a very helpful tool.

Is there a link that we can share with everyone for that?

Obviously, NIST, I think it's. NIST.gov is their main page. If you just Google NIST Cybersecurity Framework, you'll find it. It's pretty easy to find.

Yeah. Okay. This has been a great Volley rally. Anything else you'd like to close out with data privacy?

Yeah, the last thing I would say is this is changing. It's constantly changing. We've seen dramatic shifts over the last four years. And auto dealers, because they have a lot of sensitive data like socials, like bank account information. Right. Really need to pay attention to these issues and stay on top of them.

They shouldn't be scared to run their business though, right?

No, of course not. Right. I mean, you can. Banks do it every day. Right. You can run a business with good cybersecurity and privacy practices and still be profitable, successful, and make your customers happy.

Wow. Okay. Give everyone your contact information, how they can reach you?

Yeah, sure. So if you want to reach out, my email is jstevens s t e v e n s@mms.law group.com and you can also visit our website, ms.law group.com where we've got tons of blogs, webinars and other resources that can help you out.

Thanks, Josh. I hope everyone likes this. Heck, you know, I thought it'd be a good resource for you guys, but I learned a lot on this one as well. So in any event, we'll be back very shortly with with our with our update on TCPO and covering some of those. Thank you everyone.

Pure data transfer mechanisms like what Volley has are obviously encouraged. And frankly, if there's any sort of sensitive personal information like a Social Security number or a credit card number or anything like that, I would say that's pretty much required in order to be an adequate safeguard. We are increasingly seeing clients using encrypted email and other techniques like that to allow some of the flexibility of email, but giving it an extra layer of protection. And obviously you have to figure out what's the right level of protection for what you need to do. But the other thing I would encourage the viewers here today to check out is the NIST Cybersecurity Framework, which is a voluntary cybersecurity program that was put together by nist, which is a government agency. And it provides a lot of really great insight in how to build a cybersecurity program, how to think through these issues, weigh the risks and the ways that you can respond to them, and is actually a very helpful tool.

Is there a link that we can share with everyone for that?

Obviously, NIST, I think it's nist.gov is their main page. If you just Google NIST Cybersecurity Framework, you'll find it. It's pretty easy to find.

Yeah. Okay.