IAA Requests Extension on Compliance Deadline for Reg S-P Amendments

The Investment Adviser Association ("IAA") requested (i) clarification on the SEC amendments to Regulation S-P ("Privacy of Consumer Financial Information and Safeguarding Personal Information") and (ii) a twelve month extension of the compliance deadline.   

The SEC rule amendments mandated that covered institutions adopt incident response programs, including procedures for providing timely notification to affected individuals about the theft of sensitive customer information. The amendments also broadened the scope of information covered by the requirements for safeguarding and disposing of customer records. (See previous coverage.)

In a comment letter to SEC Chairman Paul S. Atkins, the IAA urged the SEC to grant a 12-month extension for compliance with the final amendments citing the "overly prescriptive" nature of the requirements and the complexity of aligning them with existing federal and state data privacy laws. The IAA stated that advisers needed additional time to complete gap analyses, update their policies and renegotiate breach notification terms with vendors. 

The IAA also asked the SEC to clarify:

1. Key Definitions. The IAA urged the SEC to narrow the definitions of "customer information" and "sensitive customer information." The IAA recommended limiting customer information to "nonencrypted" data and specifying the types of data that qualify as "sensitive."

2. Provider Definition. The IAA asked the SEC to confirm that adviser affiliates sharing information on security infrastructure would not be considered "service providers" to each other.  The IAA also requested that brokers and custodians be excluded from the definition, along with entities with which advisers have no contractual relationship.

3. Notification Triggers. The IAA urged clarification on when breach notification requirements begin. The IAA recommended that the clock should not start until a "reasonable forensic investigation" concludes that unauthorized access has occurred or is likely to occur.

4. Risk-Based Oversight. The IAA recommended a principles-based framework for advisers’ oversight obligations when vendors are unwilling or unable to fully cooperate.

5. Notification Obligations. The IAA asked the SEC to confirm that advisers are only required to notify individuals or institutions with whom they have a preexisting relationship.

6. Law Enforcement Exception. The IAA argued that the existing exception for national security or public safety was too narrow. The IAA also urged the SEC to allow notification delays in cases where disclosure could jeopardize "an active investigation or similar risks."