SEC Adopts Enhanced Privacy Safeguards

By: Rich Kerr, Sasha Burstein, and Brian Doyle-Wenger

On 16 May 2024, the US Securities and Exchange Commission (SEC) adopted amendments to Regulation S-P’s safeguards and disposal rules. The amendments are designed to address the expanded use of technology and corresponding risks that have emerged since the original adoption of Regulation S-P in 2000. The amendments expand the scope of information and broaden the number of customers protected under both rules. The safeguards and disposal rule will apply to “customer information”, which includes records that contain “nonpublic personal information” as defined in the existing rule. Additionally, the amended rule expands the applicability of the safeguards rule to include transfer agents, and the disposal rules to include all transfer agents including those registered with appropriate regulatory authorities other than the SEC.

Under the amended safeguards rule, brokers-dealers (including crowdfunding portals), investment companies, transfer agents and registered investment advisers will be required to:

• Have written policies and procedures for an incident response program that is reasonably designed to detect, respond to, and recover from an unauthorized access to or use of customer information.
• Notify individuals whose sensitive customer information was or is reasonably likely to have been accessed or used without authorization as soon as reasonably practicable, but not later than 30 days after becoming aware that unauthorized access has or reasonably likely has occurred.
• Have policies and procedures designed to oversee monitoring of service providers.

The effective date for the amendments will be 60 days after publication in the Federal Register, with compliance dates of 18 months for investment companies with net assets of US$1 billion or more, registered investment advisers with assets under management of US$1.5 billion or more, and broker-dealers and transfer agents that are not small entities under the Securities Exchange Act of 1934. Other covered institutions will have 24 months after publication in the Federal Register to comply with the new rules. We will provide more details on the amendments in an upcoming client alert.