‘Time right now' to prepare for new data rules

The new Federal Trade Commission Safeguards Rule will be enacted in December, but dealerships may have a lot of preparation to do before then.

While many of the new rule requirements were already mandatory for dealerships, some featuring less flexibility also have been put in place to ensure the safety of their customers' private information.

"It's time right now that you need to get started because there's a lot of things that you need to start doing to be able to be in compliance with this rule come Dec. 9," ComplyNet President Adam Crowell said at a webinar last month for dealers presented by 700Credit and ComplyNet.

In October, the FTC issued its long-debated final amendments to the rule. The amended rule strengthens the requirements financial institutions, including auto dealers, must follow as part of their information security programs to protect sensitive consumer data.

Dealers — and their service providers that access any customer data — have one year from the rule's publication in the Federal Register to comply with most of the new requirements, such as designating a "qualified individual" to manage their information security programs and preparing written risk assessments and incident response plans.

Other requirements that largely mirror the existing rule take effect 30 days after publication.

One of the most significant rule changes for dealers is the requirement to implement multifactor authentication for any system containing nonpublic personal information. Others include implementing programs to train employees and regularly testing safety systems.

Another major new rule is the need for either a continuous monitoring system or annual penetration testing and biannual vulnerability scans. Crowell said if dealers are smart, they will go with the continuous monitoring system.

"Continuous monitoring is like having 24/7 security at your facility or inside your network so we can detect when things are actually happening in real time," he said. "So, if you can find the correct provider that's providing things like the continuous monitoring, that is the better way to go."

Another thing dealerships should start working on is their new mandatory annual report to the board of directors, Crowell said. The report must state the overall status of the system and compliance with the new rule, among other things. It needs to be ready by the end of this year, he said.

One new guideline that Crowell warned could be tricky is the requirement to secure information disposal within two years for customers' personal information. He said that while this may sound easy, dealerships need to be aware there are many exceptions to this rule. An example is the Equal Credit Opportunity Act, which requires certain documents to be retained for 25 months.

If a dealership has the information of fewer than 5,000 consumers on hand, it does not need to test its systems or have an annual report for its board. However, it is unlikely that most dealerships qualify for this exemption, he said.

Credit applications or dead deals, which need to be kept for 25 months, are included in this requirement. So do deal jackets and information obtained through emails, social media and dealership websites.

"Any of these systems that have consumer information would count towards that total if they're coming to you potentially seeking an evaluation for credit services," Crowell said.

These new requirements are not to be taken lightly and have been put into place for a reason, Jim Lawrence, co-founder of Sensitive Data Protect, told Automotive News.

"The FTC Safeguards Rule is a thing definitely you want to comply with. But the beauty of compliance also means you're going to be funding gaps in your cybersecurity, which is really where the big killer business threat lies," he said.

Cybersecurity attacks have been increasing for dealerships, and an attack can put a dealership out of commission for weeks, he said.

One quick and highly effective thing dealerships can do right away to comply with the new rule is have all their systems require multifactor authentication.

Lawrence said the importance of training for employees should be stressed and dealerships should think seriously about how they implement this training.

Lawrence said he has seen hackers break into a system with a simple email an employee opens because they are not trained to spot these emails.

The most important thing to remember is implementing these rule requirements will be an ongoing process and each step should be a thought out, 700Credit Managing Director Ken Hill said during the webinar.

"There is no cookie-cutter solutions or magic pill," he said.