Proposed FTC rules mean dealers should bolster consumer data protection

Proposed changes to two rules under the Gramm-Leach-Bliley Act will require dealers to step up consumer data protection, experts say.

Dealers should be most concerned about proposed amendments to the Safeguards Rule, according to compliance experts, which would require the use of encryption and multitiered authentication for access to sensitive customer data and periodic reports on customer data protection to the dealership group's leadership team.

Still, many of the proposed changes require dealers to adopt policies that compliance experts have recommended for years, and most larger dealership management systems already include some of the proposed data safeguards.

David Lincicum, a senior attorney in the Federal Trade Commission's Division of Privacy and Identity Protection, said the impact of the changes would depend on the dealership.

"Some will have a lot to do, and some will have nothing to do," Lincicum told Automotive News.

The FTC is seeking comment on proposed amendments to the Safeguards Rule and Privacy Rule, but Jim Ganther, CEO of Mosaic Compliance Services, said dealers should start preparing now.

"It's just a notice of proposed rule making, but we are assuming that something very close to this is going to exit the sausage-making machine," Ganther said.

There are five proposed changes to the Safeguards Rule, but only two will likely impact dealership operations: additional guidance on the development and implementation of an overall information security program, and increased accountability measures such as the implementation of a chief compliance officer and periodic reports to the dealership's leadership team.

For example, under the new rules, dealers would be required to either continuously monitor the systems that house private consumer data or conduct annual penetration tests and biannual vulnerability tests of their software — something Ganther doesn't believe most dealers are doing.

Ganther said he anticipates a spike in "frenzied" compliance activity among dealers to catch up with the new regulations before they potentially take effect.

Most dealers, Ganther said, aren't adhering to the protocol outlined in the proposed changes, Ganther said. Though their software might already be protecting customer data in the background, most dealers with information security programs in place likely won't meet the requirements.

Ganther said he believes the proposed changes mean "F&I personnel must really get serious about the safeguards they should be following already," he said.

Even more attention should be paid to the F&I office locking doors and filing cabinets to keep customer information secure. Other than the deal jacket an F&I manager is currently working on, no jackets should be visible, Ganther said.

In the case of a data breach, he added, the new rules could act as a roadmap for consumers formulating lawsuits against dealerships.

"The bar for protection has gone up. It will be easier for plaintiffs' lawyers to successfully sue dealers in class actions," Ganther said. "That would worry me much more than the thought of random FTC enforcement."

Dealers still need to adequately test software and assign a lead for data protection in the dealership, according to Terry O'Loughlin, director of compliance for Reynolds and Reynolds, but most dealer software systems on the market already require some of the safeguards the new rules propose.

Especially for large dealership groups, "this is a nothing burger," O'Loughlin said. "It sounds to me that this is doable, and should not be overly taxing of franchised dealers."

For single-point dealers, the role of a data protection lead could be consolidated into that of compliance officer, according to O'Loughlin, however, larger groups should designate a separate, specialized individual. And in attempts to be compliant with the new rule, dealers should not lessen oversight in other departments such as F&I.

"Anytime you have a new regulation, it should not impede or interfere with the current operations. It should not in any way detract from what the dealers are doing currently," O'Loughlin said.

For dealerships that outsource IT, a service provider can be the person in charge of data security so long as someone within the dealership is supervising them, Lincicum said.

Dealership software providers Reynolds and Reynolds, CDK Global and Cox Automotive said in separate statements that they are monitoring the FTC's process and are supportive of stronger data protection and security standards.

While the policies haven't yet been adopted, O'Loughlin and Ganther expect the changes will go into effect, and dealers and their software providers need to be ready.