The integration of software and hardware Delivery

Categories

Archives

FTC Getting Serious About Identity Theft Safeguards

Fines Up to $3,500 for Failure to
Draft IT Security Plans
new FTC rules require written plans for data protection
New Safeguard rule from the FTC require an expanded list of businesses and organizations to submit data security plans

ADDITIONAL LINKS:

  • FACTA rule for disposal of sensitive consumer data.
  • The Sarbanes-Oxley Act
  • The Gramm-Leach-Bliley Act
  • HIPAA privacy rule summary
  • NIST special publication 800-88 media sanitization guidelines
  • Search all government regulations
 Following a decade of state and federal data security legislation activity, the executive branch now appears poised to start enforcing those laws. Beginning August 1, the Federal Trade Commission will require businesses, non-profits and other organizations to draft written identity theft preparedness policies. The Safeguards Rule requires all affected organizations to design, implement and maintain safeguards to protect customer information.

The rule is intended to detail systemic procedures put in place to prevent breaches and theft of private electronic data. The plans pertain to the entire data life cycle, including data in motion, data at rest and end of life scenarios. The new rules apply to businesses that collect and store sensitive personal information, including names, addresses, Social Security numbers, bank-account and credit-card numbers, etc. Included in the new rules are retailers, financial institutions, credit card issuers, educational institution, medical facilities, government agencies and trade associations.

Authorized under the Fair and Accurate Credit Transactions Act, the new “Red Flag” rules apply to a broader range of businesses than previously targeted. It authorizes fines of up to $3,500 per incident.

The Gramm-Leach-Bliley Act grants authority to eight federal agencies and individual states to administer and enforce the Financial Privacy Rule and the Safeguards Rule. These two regulations apply to “financial institutions,” which include not only banks, securities firms, and insurance companies, but also companies providing many other types of financial products and services to consumers. Among these services are lending, brokering or servicing any type of consumer loan, transferring or safeguarding money, preparing individual tax returns, providing financial advice or credit counseling, providing residential real estate settlement services, collecting consumer debts and an array of other activities. Such non-traditional “financial institutions” are regulated by the FTC.

For an in depth treatment of end-of-life PC / Hard drive sanitation practices, please visit this link.