SUPPLEMENTARY INFORMATION:

Title: Standards for Safeguarding Customer Information (the Safeguards Rule), 16 CFR part 314.

OMB Control Number: 3084-0171.

Type of Review: Extension of a currently approved collection.

Background: The Gramm Leach Bliley Act, Public Law 106-102, 113 Stat. 1338 (1999), required the FTC and other federal agencies to establish standards for financial institutions relating to administrative, technical, and physical safeguards for certain information.^[1] Pursuant to this directive, the Commission promulgated the Safeguards Rule in 2002, which requires financial institutions, among other things, to develop, implement, and maintain a comprehensive written information security program that contains administrative, technical, and physical safeguards that are appropriate to the institution's size and complexity, the nature and scope of the institution's activities, and the sensitivity of any customer information at issue. The Safeguards Rule became effective on May 23, 2003. The Commission amended the Safeguards Rule in 2021 and again in 2023.

The Safeguards Rule as amended requires financial institutions to report to the Commission a notification event where unencrypted customer information involving 500 or more consumers is acquired without authorization.^[2] This reporting requirement constitutes a “collection of information” for purposes of the PRA.^[3]

As required by section 3506(c)(2)(A) of the PRA, 44 U.S.C. 3506(c)(2)(A), the FTC is providing this opportunity for public comment before requesting that OMB extend the existing clearance for this information collection requirement contained in the Safeguards Rule.

Burden Statement

Total annual hours burden: 815.

FTC staff estimates that the reporting requirement will affect approximately 163 financial institutions each year. ⁴ ( printed page 54873) FTC staff estimates that compliance with this reporting requirement will require approximately five hours for affected financial institutions, for a total annual burden of approximately 815 hours (163 responses × 5 hours). FTC staff anticipates that the burden associated with the reporting requirement will consist of the time necessary to compile and report the requested information via the electronic form located on the Commission's website. The Commission does not expect that the reporting requirement will impose any new investigative costs on financial institutions, because the information requested by the reporting requirement is (1) information that financial institutions acquire in the normal course of responding to a security event, and (2) similar to information entities are already required to disclose under states' data breach notification laws.

Total annual labor cost: $60,310.

The estimated labor cost reflects the hourly wages necessary to prepare the required reports. FTC staff anticipates that the required information will be compiled by information security analysts in the course of assessing and responding to a notification event, resulting in 3 hours of labor at a mean hourly wage of $63.71 (3 hours × $63.71 = $191.13).^[5] FTC staff also anticipates that affected financial institutions may use attorneys to formulate and submit the required report, resulting in 2 hours of labor at a mean hourly wage of $89.35 (2 hours × $89.35 = $178.70).^[6] Accordingly, FTC staff estimates the approximate labor cost to be $370 per report (rounded to the nearest dollar). This yields a total annual cost burden of $60,310 (163 annual responses × $370).

Total annual capital or other non-labor costs: De minimis.

Covered financial institutions are not likely to require any significant capital costs to comply with the reporting requirement. To reduce burden on affected financial institutions, the Commission provides an online reporting form on the Commission's website to facilitate reporting of qualifying security events. As a result, the Commission does not anticipate that covered financial institutions will incur any new capital or non-labor costs in complying with the reporting requirement.

Request for Comment

Pursuant to section 3506(c)(2)(A) of the PRA, the FTC invites comments on: (1) whether the proposed collection of information is necessary for the proper performance of the functions of the agency, including whether the information will be practically useful; (2) the accuracy of the agency's estimate of the burden of the proposed collection of information, including whether the methodology and assumptions used are valid; (3) ways to enhance the quality, utility, and clarity of the information to be collected; and (4) ways to minimize the burden of the collection of information.

For the FTC to consider a comment, we must receive it on or before October 26, 2026. Your comment, including your name and your state, will be placed on the public record of this proceeding, including the www.regulations.gov website.

You can file a comment online or on paper. Due to heightened security screening, postal mail addressed to the Commission will be subject to delay. We encourage you to submit your comments online through the www.regulations.gov website.

If you file your comment on paper, write “Paperwork Reduction Act Comment: FTC File No. R021101,” on your comment and on the envelope, and mail it to the following address: Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144 (Annex E), Washington, DC 20580.

Because your comment will become publicly available at www.regulations.gov, you are solely responsible for making sure that your comment does not include any sensitive or confidential information. In particular, your comment should not include any sensitive personal information, such as your or anyone else's Social Security number; date of birth; driver's license number or other state identification number, or foreign country equivalent; passport number; financial account number; or credit or debit card number. You are also solely responsible for making sure that your comment does not include any sensitive health information, such as medical records or other individually identifiable health information. In addition, your comment should not include any “trade secret or any commercial or financial information which . . . is privileged or confidential”—as provided by Section 6(f) of the FTC Act, 15 U.S.C. 46(f), and FTC Rule 4.10(a)(2), 16 CFR 4.10(a)(2)—including, in particular, competitively sensitive information, such as costs, sales statistics, inventories, formulas, patterns, devices, manufacturing processes, or customer names.

Comments containing material for which confidential treatment is requested must (1) be filed in paper form, (2) be clearly labeled “Confidential,” and (3) comply with FTC Rule 4.9(c). In particular, the written request for confidential treatment that accompanies the comment must include the factual and legal basis for the request and must identify the specific portions of the comment to be withheld from the public record. See FTC Rule 4.9(c). Your comment will be kept confidential only if the General Counsel grants your request in accordance with the law and the public interest. Once your comment has been posted publicly at www.regulations.gov, we cannot redact or remove your comment unless you submit a confidentiality request that meets the requirements for such treatment under FTC Rule 4.9(c), and the General Counsel grants that request.

The FTC Act and other laws that the Commission administers permit the collection of public comments to consider and use in this proceeding as appropriate. The Commission will consider all timely and responsive public comments that it receives on or before October 26, 2026. For information on the Commission's privacy policy, including routine uses permitted by the Privacy Act, see www.ftc.gov/​site-information/​privacy-policy.

91 FR 54872