Joint Trades Letter on Regulation S-P Privacy of Consumer Financial Information

Dear Chairman Atkins,

The Securities Industry and Financial Markets Association ("SIFMA"), SIFMA Asset Management Group ("SIFMA AMG"), American Bankers Association ("ABA"), Bank Policy Institute ("BPI"), Financial Services Institute ("FSI"), Institute of International Bankers ("IIB"), Investment Company Institute ("ICI"), Insured Retirement Institute ("IRI"), and the Committee of Annuity Insurers ("CAI") (collectively, the "associations") appreciate the opportunity to provide suggested changes to the recent amendments to Regulation S-P issued by the Securities and Exchange Commission (the "Commission" or "SEC") on May 16, 2024 (the "Regulation S-P Amendments").

Regulation S-P should be further amended to provide further clarity and guidance to its existing rules. Our members appreciate the importance of strong cybersecurity practices for companies and our country, including appropriate notification of cybersecurity incidents to individuals. The joint trades comment letter on the Regulation S-P Amendments ("Joint Trades Letter") as originally proposed urged the Commission to reconsider certain aspects of its Regulation S-P Proposal, which at times is too prescriptive and does not provide enough flexibility to covered institutions in responding to the unique circumstances that can arise during an incident. Such prescriptive requirements may subject covered institutions to unnecessary and adverse enforcement actions if such requirements are not followed to the letter which may happen due to any number of circumstances surrounding a cyber event. As such, Appendix B includes detailed proposed revisions to improve the Regulation S-P Amendments, which takes into account a covered institution's need to comply with existing data breach notification laws and the benefit of coordinating with a range of law enforcement, cybersecurity, intelligence, and national security agencies during a security incident.

Further, the associations continue to urge the Commission to extend the compliance date for the Regulation S-P Amendments by an additional year. The associations believe that additional time is absolutely necessary to achieve our members' compliance with the prescriptive requirements in the Regulation S-P Amendments. Regardless of the Commission's decision on that extension request, we believe these additional changes are necessary to ensure that compliance can be achieved efficiently and without jeopardizing the security of customer information.

Download the joint comment letter to read the full text.