Eye Opening New Cybersecurity Rules For Dallas Car Dealerships

Dallas Car Dealerships Must Comply With New Cybersecurity Requirements Or Face Stiff Fines For Noncompliance

The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule protects customers’ nonpublic personal information confidentiality and security.

Dealerships must have a written information security plan containing reasonable safeguards to protect customer information. The updated rule requires dealerships to review their information security programs every two years and maintain records of their findings for five years.

Dealerships will also need to provide customers with an annual notice of their privacy policy and allow customers to opt-out of having their information shared with third parties.

By understanding the requirements of the updated GLBA Safeguards Rule, dealerships can ensure they are taking steps to protect their customers’ information and maintain compliance with the law.

Download The Dealer's Guide To FTC Safeguard Rules

FTC Finalizes Gramm-Leach-Bliley Act Safeguards Rule

The Gramm-Leach-Bliley Act (GLBA) was enacted in 1999 and established the Safeguards Rule to protect the confidentiality of customer information held by financial institutions (including Dallas and Fort Worth car dealerships).

In October 2021, the Federal Trade Commission (FTC) finalized its revisions to the Rule, which is the first update to the Rule in 20 years. The Revised Rule requires financial institutions to take reasonable steps to secure customer information from unauthorized access, use, or disclosure.

Car dealerships must also provide customers with privacy notices that explain how their customer information will be used and shared.

How Does This Rule Impact Dallas Car Dealerships

In a move that consumer advocates have welcomed, the FTC has announced that it will be treating automobile dealerships as "non-banking institutions."

This means they will now be subject to the same compliance measures as banks and other financial institutions. This includes ensuring that customers know their rights, providing clear and concise information about products and services, and ensuring that customers are treated fairly.

In addition, the FTC will be able to take action against dealerships if they engage in unfair or deceptive practices. This is good news for consumers, who will now have greater protection when buying a car.

Car Dealerships In Dallas Must Meet Compliance Standards

As of December 9, 2022, all auto dealers must comply with the Revised Rule. This rule includes a range of measures that dealerships must follow to avoid penalties.

If you are not yet compliant, starting the process is vital. Some of the measures you will need to take include ensuring that your dealership is accessible to people with disabilities, providing adequate signage, and training your staff members.

In addition, you will need to make sure that your vehicles are appropriately labeled and that you have the proper documentation for each vehicle. Failure to comply with these measures can result in significant penalties, so starting the process as soon as possible is vital.

Information Security Program

The first step in compliance is developing and implementing a written information security program. This program must be designed to protect the confidentiality of customer information and must be reviewed and updated regularly.

The program must contain reasonable safeguards to protect customer information, including:

• Access control measures to limit access to customer information to authorized personnel
• Physical security measures to protect customer information from unauthorized access or theft
• Data security measures to protect customer information from unauthorized access, use, or disclosure
• Employee training to ensure that all employees are aware of the importance of protecting customer information

To develop and implement an effective information security program, you will need to take several steps, including:

• Conducting a risk assessment of your dealership to identify potential threats and vulnerabilities
• Developing policies and procedures to address risks and vulnerabilities
• Implementing physical, technical, and administrative safeguards
• Training employees on the importance of protecting customer information

By taking these steps, you can ensure that your dealership complies with the Revised Rule and that your customers' information is secure.

Select A Qualified Individual To Oversee Your Plan

Once you have developed and implemented your information security program, you will need to select a qualified individual to oversee the program.

This individual will ensure that the program is being followed and will report any violations to the FTC.

The individual must have the knowledge and experience necessary to effectively oversee the program and must be able to identify and resolve any issues that may arise.

In addition, the individual must be able to develop and implement new policies and procedures as needed.

By selecting a qualified individual to oversee your information security program, you can ensure that your dealership complies with the Revised Rule and protects your customers' information.

Have A Written Incident Response Plan

In the event of a data breach or other incident that results in the unauthorized access, use, or disclosure of customer information, it is essential to have a written incident response plan in place.

This plan should contain procedures for responding to incidents, including:

• Notifying the FTC
• Notifying affected customers
• Taking steps to prevent future incidents

By having a written incident response plan in place, you can ensure that your dealership is prepared to handle any incidents and that your customers' information is protected.

Conduct Regular Risk Assessments

It is important to conduct regular risk assessments of your dealership to identify potential threats and vulnerabilities.

These assessments should be conducted regularly and should be updated as needed.

By conducting regular risk assessments, you can ensure that your dealership complies with the Revised Rule and secure your customers' information.

The steps outlined above will help you ensure that your dealership complies with the Revised Rule and that your customers' information is protected.

You can create a safe and secure environment for your customers and employees by taking these steps.

Encrypt All Data Including Emails

Another way to ensure compliance with the rule and protect customer information is to encrypt all data, including emails.

Encryption is the process of transforming readable data into an unreadable format.

This makes it difficult for unauthorized individuals to access customer information.

To encrypt data, you will need to use a software program compatible with your email system.

By encrypting all data, you can ensure that your dealership complies with the Revised Rule and that your customers' information is protected.

Use Multi-Factor Authentication On All Information Systems

Multi-factor authentication is an additional layer of security that can be added to information systems.

This type of authentication requires the use of two or more factors to verify the identity of a user.

Factors can include something that the user knows, such as a password or PIN, something that the user has, such as a security token or key, or something that the user is, such as a biometric identifier.

Using multi-factor authentication ensures that your dealership complies with the Revised Rule and that your customers' information is protected.

Have A Data Retention Policy

It is vital to have a data retention policy to ensure that customer information is protected correctly.

This policy should outline how long customer information will be retained and how it will be disposed of when it is no longer needed.

Having a data retention policy in place ensures that your dealership complies with the Revised Rule and that your customers' information is protected.

Implement IT Change Management Procedures

To ensure that your dealership complies with the Revised Rule, it is crucial to implement IT change management procedures.

These procedures should outline how changes to information systems will be made and how those changes will be documented.

Having IT change management procedures in place ensures that your dealership complies with the Revised Rule and that your customers' information is protected.

Monitor All Unauthorized Access To Client Information

To ensure that your dealership complies with the Revised Rule, it is crucial to monitor all unauthorized access to customer information.

This includes access to customer information that is stored electronically, as well as access to paper records.

By monitoring all unauthorized access to customer information, you can ensure that your dealership complies with the Revised Rule and protects your customers' data.

Have A 24/7 Cybersecurity Monitoring System

To ensure that your dealership complies with the Revised Rule, it is vital to have a 24/7 cybersecurity monitoring system in place.

This system should be designed to detect and respond to unauthorized customer information access.

Having a 24/7 cybersecurity monitoring system in place lets you ensure that your dealership complies with the Revised Rule and that your customers' information is protected.

Conduct Regular Cybersecurity Awareness Training

To ensure that your dealership complies with the Revised Rule, it is essential to conduct regular cybersecurity awareness training for all employees.

This training should cover the basics of cybersecurity and the importance of protecting customer information.

By conducting regular cybersecurity awareness training, you can ensure that your dealership complies with the Revised Rule and protects your customers' information.

Ensure All Vendors Meet Your Cybersecurity Standards

To ensure that your dealership complies with the Revised Rule, it is essential to only do business with vendors who meet your cybersecurity standards.

These standards should be based on the Revised Rule requirements and should be regularly reviewed and updated.

By only doing business with vendors who meet your cybersecurity standards, you can ensure that your dealership complies with the Revised Rule and protects your customers' information.

What Happens If Your Dallas Car Dealership Doesn't Comply?

In a nutshell, it will be expensive for you if you violate the new penalties. Penalties can cost as much as $43,792 per violation, and you may be required to pay multiple fines if you commit numerous violations. The new penalties are designed to discourage people from violating these compliance standards. They are likely to significantly impact your finances if you are caught violating these new rules and safeguards.

Regardless of how much it may cost you to manage your compliance, it’s undoubtedly less than it would cost to pay for noncompliance. Dallas car dealerships that don’t follow regulations risk heavy fines, public shaming, and a loss of customer trust. In the age of social media, one negative story can quickly spiral out of control, doing untold damage to a company’s reputation.

Furthermore, compliance violations can lead to criminal charges, resulting in jail time for executives. In other words, the costs of non-compliance are high, and they only continue to increase as regulations become more complex.

As a result, companies need to invest in compliance management solutions that will help them avoid the potentially catastrophic consequences of noncompliance.

Conclusion

The Federal Trade Commission's (FTC) new Revised Rule will take effect on December 9, 2022. This rule will protect consumers by giving them the right to take action against unfair or deceptive practices by car dealerships.

To comply with the Revised Rule, you will need to take several steps, including developing and implementing an information security program, selecting a qualified individual to oversee the program, and training your employees.

By taking these steps, you can ensure that your dealership complies with the Revised Rule and that your customers' information is protected.

Velocity IT supports local Dallas and Ft. Worth organizations with a complete range of IT services, telephone services, and security services. We support car dealerships with all their IT services, and IT support in Dallas, Fort Worth, Arlington, Las Colinas, Irving, Flower Mound, Coppell, Carrollton, Garland, Plano, McKinney, Richardson, Mesquite, Lewisville, Mansfield, and all across the DFW Metro area.

FAQs