Information Security and Privacy: Regulation S-P

Once the firm has collected a customer's identifying information, tax status, and investment history, it holds data the customer never intended to share with the outside world. SEC Regulation S-P sets the federal rules for how broker-dealers (BDs), investment advisers, and registered investment companies handle that nonpublic personal information (NPI).

Reg S-P implements Title V of the Gramm-Leach-Bliley Act (GLBA) for SEC registrants.

Who and what does SEC Regulation S-P cover?

Which Firms Are Subject to Regulation S-P?

• SEC-registered broker-dealers
• SEC-registered investment advisers
• Registered investment companies

What Information Counts as Nonpublic Personal Information (NPI)?

NPI includes:

• Information the customer provides: name, address, social security number (SSN), income, account balances
• Information derived from the customer relationship: transaction history, recommendations, holdings
• Any publicly unavailable financial information linked to the customer

Who Is Protected Under Regulation S-P?

Exam Tip: Gotchas

• Reg S-P protects consumers AND customers, but the timing of notices differs. Every customer is a consumer; not every consumer is a customer. A person who buys once and walks away is a consumer; a person who opens an account is a customer. A person who only asks for information is neither, because nothing was obtained.

What are the three notices required under Regulation S-P?

Reg S-P requires three distinct notices.

What Must the Initial Privacy Notice Include?

• Delivered to a customer before establishing the customer relationship (at or before account opening)
• Delivered to a non-customer consumer before disclosing NPI to a nonaffiliated third party

The initial notice must describe:

• Categories of NPI collected
• Categories of NPI disclosed and the categories of affiliates and nonaffiliated third parties to whom it is disclosed
• Categories of NPI disclosed about former customers
• The opt-out right and a reasonable means to opt out
• Policies and practices for protecting the confidentiality and security of NPI

What Must the Opt-Out Notice Include?

Before disclosing NPI to a nonaffiliated third party, the firm must:

• Provide a clear and conspicuous opt-out notice (may be combined with the initial notice)
• Give the consumer a reasonable opportunity to opt out
• Provide a reasonable means to opt out (toll-free number, reply form, electronic opt-out process)

Key features:

• Reasonable opportunity is typically satisfied by giving the consumer 30 days from delivery of the notice
• Partial opt-out is allowed: the consumer may opt out as to certain information or certain third parties
• Opt-out direction is effective until revoked in writing by the consumer

When Is the Annual Privacy Notice Required?

• Firm must deliver a clear and conspicuous annual notice of its privacy policies at least once in any period of 12 consecutive months for the duration of the customer relationship
• Exception: No annual notice is required if both are true:
  • The firm shares NPI only under Reg S-P exceptions (so the opt-out right does not apply)
  • The firm has not changed its policies since the most recent notice

Exam Tip: Gotchas

• Reg S-P requires three notices: initial + opt-out + annual. A question asking which notice comes first is testing the initial notice, which must reach the customer before the relationship is established.

Which Regulation S-P disclosures bypass the opt-out right?

Certain disclosures do not require an opt-out notice. When an exception applies, the firm is not required to list those exceptions in the initial or annual notices.

Common exceptions include disclosures:

• With the consumer's consent (not yet revoked)
• To service providers and for joint marketing (subject to confidentiality and use restrictions)
• To process, service, or enforce the customer's transaction
• For institutional risk control, fraud prevention, resolving consumer disputes, or investigating illegal activities
• To comply with federal, state, or local laws, subpoenas, or SRO requests
• To consumer reporting agencies per the Fair Credit Reporting Act (FCRA)

Exam Tip: Gotchas

• The opt-out right applies to NPI shared with nonaffiliated third parties for marketing or other non-exception purposes. Customers cannot opt out of disclosures that fall under an exception (service providers, law-enforcement compliance, transaction processing, and so on).

What does the Regulation S-P Safeguards Rule require?

The Safeguards Rule requires firms to adopt written policies and procedures reasonably designed to:

• Insure the security and confidentiality of customer records and information
• Protect against anticipated threats or hazards
• Protect against unauthorized access or use that could cause substantial harm or inconvenience to customers

Safeguards cover:

Breach-response duty: Regulation S-P also requires firms to maintain a written incident-response program and to notify affected customers of a breach involving their sensitive information as soon as practicable, and no later than 30 days after the firm becomes aware of it. A service provider faces a separate, shorter clock: it must notify the firm as soon as possible, and no later than 72 hours after becoming aware of a breach, and the firm then starts its own incident-response program. This adds a reactive breach-response duty on top of the proactive safeguarding obligation above.

Notice to customers is not required if a reasonable investigation shows the sensitive information has not been and is not reasonably likely to be used in a way causing substantial harm or inconvenience. Only the U.S. Attorney General may delay the notice, on a written national-security or public-safety finding sent to the SEC.

What does the Regulation S-P Disposal Rule require?

When disposing of consumer information and customer information, the firm must take reasonable measures to protect against unauthorized access to or use of the information during disposal. The scope is broader than credit-report data: a customer's own account statement is covered too. Examples:

• Shredding or burning paper records
• Wiping or physically destroying electronic media (hard drives, USB drives)
• Using licensed third-party disposal vendors

Think of it this way: Reg S-P treats a thrown-away customer statement the same way it treats a statement on a production server: if it's recoverable, it's a breach waiting to happen. The Disposal Rule closes the back door that the Safeguards Rule closes at the front.

What are the most tested Regulation S-P privacy rules?

Exam Tip: Gotchas

• Three notices: initial (before relationship), opt-out (before sharing with nonaffiliates), annual (at least every 12 months).
• Annual notice exception: no annual notice if the firm shares NPI only under exceptions and policies are unchanged.
• No opt-out for excepted disclosures: service providers, law enforcement, transaction processing, and similar categories are carve-outs.
• Reasonable opportunity to opt out is commonly 30 days from notice delivery.
• Partial opt-out is allowed: a customer may opt out as to some third parties and not others.

What Should You Check on Exam Day?

• Can you distinguish a consumer from a customer under Regulation S-P, and explain why someone who only requests a brochure is neither?
• Do you know Regulation S-P requires three notices: initial before the relationship begins, opt-out before sharing with nonaffiliated third parties, and annual at least every 12 months?
• Can you state that a customer cannot opt out of disclosures covered by an exception, such as service providers or law-enforcement compliance?
• Do you know the Safeguards Rule requires written physical, administrative, and technical policies, and that breach notice to customers is due no later than 30 days after the firm becomes aware?
• Can you explain what the Disposal Rule requires when a firm destroys consumer or customer records, whether paper or electronic?