The deadline to comply with the FTC Safeguards Rule is fast approaching. Car dealerships need to prepare now for the changes. Failing to comply with the Rule risks a fine of up to $46,517 (per incident) for auto dealers. Here’s how car dealerships can get up to speed quickly.
The Federal Trade Commission's Standards for Safeguarding Customer Information, aka the Safeguards Rule, are put in place to ensure entities (such as car dealerships) have proper security measures intended to protect consumers’ personal information. On June 9, 2023, the revised Safeguards Rule will officially go into effect, and it’s part of the FTC’s initiative to keep customer information safe in light of the growing cyber security threat posed by data breaches, ransomware, and various other cyberattacks.
The FTC Safeguards Rule was originally a requirement for businesses and financial institutions that handle sensitive consumer data such as banks, lenders, credit unions, and similar entities. Starting June 9, 2023, these rules will also apply to non-traditional businesses such as car dealerships. They are required to develop, deploy, and maintain a security plan that details how they will protect customers’ personal information.
The Safeguards Rule also states that you must have a formally written information security program that’s appropriate for the size and complexity of your business– i.e. how many customers you serve, the type of data collected, etc.
There are three main objectives of the Safeguards Rule:
The Rule also helps car dealerships because it will improve customer confidence that their information is in safe hands when going through the car buying process.
As mentioned, the updated Safeguards Rule goes into effect on June 9, 2023. If dealerships fail to adequately abide by the new regulations, there could be severe punishment for the business.
If you’re a car dealer, see the checklist to help simplify exactly what you need to do to get compliant:
1) Assign a Qualified Individual to administer and enforce the dealership’s information security program. This person can be an employee or an outside individual that has real-world experience and know-how for your specific business operations.
2) Perform a risk assessment: After taking an inventory of what type of customer data you will collect, perform a risk assessment to determine what kind of internal and external threats could affect the security, confidentiality, and integrity of customer information.
3) Design and put into action safeguards for the risks identified: Your information security program should be multifaceted and include the following precautions:
4) Regularly monitor and assess the efficacy of your information security. Ensure your plan is consistently put to the test to be confident that it works when a real threat attempts to infiltrate.
5) Educate your team and staff members: Ensure your team understands the importance of information security by providing training and reminders of what to do and what not to do (e.g. don’t click on suspicious links).
6) Ensure service providers' security measures are appropriate: Don’t assume third-party vendors provide adequate security. Include your security expectations in your contract and regularly assess service providers to make sure their security protocols are up-to-date.
7) Continuously assess your information security program: Regularly evaluate your security program to ensure it’s robust and up-to-date.
8) Develop a written incident response and recovery plan: It should include goals, internal processes for reporting security events, roles and responsibilities, a process to fix issues, and a plan for documenting security events.
9) Ensure your Qualified Individual reports to the Board of Directors: At least once a year, the Qualified Individual should provide a detailed written compliance report to the board and senior executives.
Failure to comply with the new revised FTC Regulations can cost your car dealership. It also opens the door to civil and class action lawsuits from customers. To avoid these penalties and punishments, it’s imperative that car dealerships make sure they are compliant well before the June 9th deadline.
How Botdoc Can Help your Car Dealership
Botdoc is here to help car dealerships make that list of security standards less overwhelming. In just minutes, dealerships can set up with Botdoc’s solution and receive driver's licenses, bank account information, and more from customers without the use of pins, passwords, logins, accounts, apps, or software to download.
Notice those items on the checklist about end-to-end encryption? Botdoc is the first ever easy, remote, and secure file transport service that works via text messaging and email with end-to-end encryption. Our API automatically moves data to the appropriate area within the system of record, limiting the touchpoints of data. Botdoc even automatically purges documents after a certain amount of time, decreasing the risk and time spent purging documents manually.
Our solution is always simple to use because the customer experience is everything to us. Get started today by scheduling a demo. Let Botdoc help your dealership comply with the FTC safeguards rule and help you avoid a costly penalty.