The Federal Trade Commission's proposed changes to security
regulations for financial institutions could also affect a broad swath of non-financial companies -- including ad agencies, social networks, lead generators and ad-tech companies -- according to the
Association of National Advertisers.
The organization is urging the FTC to refrain from imposing a slate of potential new regulations.
“The existing Safeguards Rule
already provides meaningful security protections for consumers, while allowing regulated entities to implement reasonable data security that are appropriate for each unique situation and the nature of
the information collected,” ANA group Executive Vice President Dan Jaffe stated.
The comments come in response to the FTC's proposed changes to the “Safeguards Rule” -- a
Gramm-Leach-Bliley Act regulation that sets out security standards for financial institutions. The agency unveiled its proposed changes in March of 2019, and held a virtual workshop on the proposed changes
last month.
Among other potential new regulations, the FTC has proposed that financial institutions implement specific cybersecurity measures -- including encrypting all customer information
and using multi-factor authentication techniques.
The ANA opposes that change, arguing that the FTC should endorse a “flexible framework” rather than mandating specific
measures.
The FTC has also proposed subjecting certain intermediaries -- which the agency calls “finders” -- to the same standards as financial institutions.
The proposed
regulations incorporates definitions used by the Federal Reserve Board in 2000, when it described “finding” as “bringing together buyers and sellers of products or services for
transactions that the buyers and sellers themselves negotiate and consummate.”
That wording is so broad it could “include any activity in which entities bring together buyers and
sellers to consummate transactions of any kind where some type of financial activity, however incidental, may be involved,” the ANA writes in its comments.
“This definition could
be interpreted to include advertisers, social networks, trade associations, data providers, lead generators, ad agencies, advertising technology providers, software providers, and many other
businesses that provide important methods of communication, interaction, and support services to consumers and the business community,” the ANA writes.
“Entities such as ad
agencies who develop creative advertising campaigns could be categorized as 'finders,' because their job is to bring their clients and consumers together so they can engage in commercial transactions
with one another,” the organization adds.
“Nearly every entity that provides a service supporting a business’s ability to identify consumers for its products could be viewed
as bringing together buyers and sellers for transactions,” the ANA says. “As a result, including 'finders' in the ambit of the Rule would unreasonably broaden its scope.”
Two
FTC Commissioners -- Noah Phillips and Christine Wilson -- suggested last year they opposed the proposed changes.
“The Safeguards Rule today is a flexible approach, appropriate to a company’s size and complexity,” Phillips and Wilson stated. “This proposal would move us away from that
approach.”