Paige Taylor Bennett (in-house counsel for Seven Figure MSP) explains the FTC’s recent amendment to the Safeguards Rule and its practical implications for Managed Service Providers. Major points: the amendment broadens who counts as a “financial institution,” expands the types of companies covered (potentially including many MSPs), lowers the reporting trigger to incidents affecting 500 or more customer records, and requires reporting “as promptly as possible” but no later than 30 days. Paige urges MSPs to review FTC guidance, implement incident response plans and reasonable security measures, consult attorneys, and watch for enforcement and clarifying case law going forward.
Questions this video answers
500 customer records/data points.
As promptly as possible, but no later than 30 days after becoming aware.
January 2024 (speaker said it was passed around October 2023 and went into effect in January 2024).
Paige Taylor Bennett, in-house counsel for Seven Figure MSP.
Some of you may not know that the ftc, the Federal Trade Commission, just came out with an amendment to its safeguard rule. And it's very important for especially MSPs to be aware of what the amendment says and how it affects you. Hi everyone, I'm Paige Taylor Bennett. I'm in House counsel for Seven Figure msp. I'm really excited to be part of this team and to be here today chatting with you about the new FTC safeguard rule. The safeguard rule is not really new, right? But we say it's new because there's been an amendment that really kind of changes the landscape of what you should do and how you should protect yourself, protect your clients and then what you need to do when you find out that there's a data breach. Really, there's really two main changes. I would say the first change is that it has widened the scope of when you need to report a data breach and now it applies. If you have or you know that 500 of your customers data has been compromised in a data breach, that is a big change because that's going to apply to a lot more data breaches across the board. Another wide reaching change is that they have actually broadened the scope of the type of companies that would need to report a data breach. And that applies to MSPs for the most part, in typical legislation fashion, they have not clearly defined what a financial institution is because, and I'm paraphrasing here, the FTC has defined a financial institution as basically any company that deals with money or tangentially deals with money, right? So that could theoretically apply to a lot of companies, if not 99% of the companies that do business in the United states. Of course, MSPs are saying, well, wait a minute, I'm not a financial institution. But the FTC has broadened its scope, right? It does not only apply to banks anymore. That doesn't mean that you're not liable for other potential statutes that might apply to you, like state statutes. There might be state equivalents of the FTC safeguard rule that you should also make yourself familiar with. Because a state's statute, even though it might be be more narrow or stricter as we say, than the federal FTC statute, you would have to follow whichever is strictest. Now, if the two conflict, right? If the FTC safeguard rule conflicts with a state rule that's similar addressing the same subject, the federal rule wins. So you want to make sure that you're familiar with your local laws and your federal laws and that's what we're here for, to help you out because it's not always easy. And one thing that's not easy about it is knowing when you have to report. The requirement is that you must report as promptly as possible, but no later than 30 days to the FTC when you are aware of a data breach. Again, the data breach is that of 500 or more customer files or customer data points. Coming back to the definition of what is a financial institution and why does it include MSPs? A lot of people are frustrated with that because the FTC has broadly defined a financial institution like we already said, and they've exempted certain businesses from a financial institution, none of which I think it would apply to MSPs, except for the last, the fourth exception to the law, which just says it's anything that is not related to handling money or tangentially related to handling money. Basically the opposite of what the definition says it is. So it's not super helpful because we still have yet to see how the FTC is going to enforce its safeguard rule. You guys, this just went into effect in January. It was passed, I think back in October of 2023, but it went to effect in January of this year, 2024. So this now means you have to comply as an msp. If you fit the definition as a financial institution, you have to comply with this law. So not only are you liable for a potential fine if you don't comply with the law, right? And that fine could be upwards of hundreds of thousands of dollars. It really is at the discretion of the ftc. I don't want to unnecessarily startle you all, but I just want you to know that the FTC has a lot of leeway with determining what a fine should be for a potential lack of reporting. So not only are you making yourself susceptible to fines, you have this affirmative duty to report now. And you know the FTC is going to come down hard on that because the government wants a piece of the pie, right? The government sees all these hacks happening, the government's getting a lot of calls from their constituents being mad that their data is being leaked, that their data is not processed properly secured. That brings me to my next big point that the FTC has specified is what are the reasonable measures that your company should follow in order to try? Try is the keyword there. Ensure that there is not a data breach. And again, in true government fashion, the law is not entirely clear what reasonable measures are. But thankfully, thankfully, the FTC has put up guidelines on its website that give you some ideas of what a good incident response plan would be. The FTC is clear that it would change. It is variable, depending on the type of business that you have, depending on the type of security risk that you face, depending on the type of data you have. But the nice thing is, is that you can, I think if you have a good attorney, you can put in place reasonable measures. What the FTC would see as reasonable measures that protects you from being separately liable under the new safeguard rule, right? Not just for not reporting a data breach, but for not protecting it in the first place. So you want to make sure that you've reviewed that FTC rule, you want to make sure that you have good attorneys who have helped you prepare an incident response plan to protect yourself from being liable, just from not protecting your data well enough. And then we need to watch the changing landscape. Honestly, there's going to be a lot of changes in the next few years over the course of lawsuits that are brought by the FTC or fines that are brought by the ftc. And they're going to be enforcing the safeguard rule. And that's how we are really going to find out. What do they mean by financial institution? What do they really expect is a reasonable security measure that the financial institutions should have in place to try and ensure that there is no data breach. So I hope that you all will take a minute, go to the FTC website. They have a lot of good places where you can at least start in order to try to see what a reasonable security measure would be. But again, I really encourage you to consult with your own attorney to help you put in place an incident response plan especially, and we can talk about this on a whole other podcast, but especially because you're going to be arguing with the insurance companies, right, about whether or not those security measures were reasonable and adequate in the first place. And that is going to be something you're definitely going to want an attorney's help with. Thank you guys again so much for listening. I want to let you know that if you need an attorney to help you look over your contracts, to look over your incident response plan, to look over any policies, handbooks, other types of agreements that you have, whether it's with clients, vendors or employees, you have US seven figure msp, but you also have the new MSP law firm. And that's where I am going to be there to help you along the way. And you can call me, you can email me, you should be able to see it in the link below. Please let me like and share this post because as we know, there's really a shortage of good, reliable MSP lawyers out there. So we're really excited to be able to come alongside you and help you navigate this new changing landscape. If you want to book a consultation with the MSP law firm, you can click the link below. Please again, remember to, like, comment and subscribe to this podcast so that we can get the word out about these new changing laws. Thank you.
