FTC Safeguards Rule for auto dealers: protecting credit applications at year-end

Are auto dealers covered by the FTC Safeguards Rule?

Yes, auto dealers are covered if they finance, arrange financing for, or lease vehicles for longer than 90 days. The FTC's auto dealer guidance says dealers "who finance (or facilitate the financing of) automobiles for consumers are financial institutions for purposes of the Safeguards Rule, since lending money is considered a financial activity under the relevant federal law."

The rule itself makes the leasing point directly. 16 CFR 314.2(h)(2)(ii) describes a dealership that leases automobiles on a nonoperating basis for longer than 90 days as a financial institution with respect to its leasing business. For most franchise and independent dealers with an F&I office, that settles the coverage question.

Year-end sales events put more credit applications through that office than any other stretch of the calendar. More applications means more Social Security numbers, pay stubs, and credit reports moving through desks, inboxes, and lender portals in a short window, often handled by temporary or newly hired staff. That is the period when the program you wrote has to work as written.

Which deal jacket records count as customer information?

Approved financing and lease applications always do. The rule defines customer information as "any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form." The FTC's dealer FAQ lists "Applications you approved for financing or leasing (that include information like the customer's name, address, Social Security number, and financial account information)" as customer information in every case.

The FAQ also lists spreadsheets of customers who financed or leased, and financial information about those individuals. It treats recall lists, general sales data, and service records as outside the definition unless they are combined with customer information.

Declined applicants are a separate case. Someone who applies and never receives financing is a consumer, not a customer, under the rule's definitions. Their file is still sensitive, and any credit report you pulled on them falls under a different FTC rule covered below.

What safeguards does the rule require for credit applications?

The Safeguards Rule requires six protections for credit applications: encryption, multifactor authentication, access logging, timely disposal, trained staff and oversight of the vendors who touch the data. Each is a specific requirement in 16 CFR 314.4, and each one maps to a place where credit applications tend to leak during a busy month.

• Encryption. Section 314.4(c)(3) requires you to "Protect by encryption all customer information held or transmitted by you both in transit over external networks and at rest." That covers scanned applications on a shared drive, PDFs attached to email, and copies on a laptop in the F&I office. Where encryption is infeasible, the Qualified Individual may approve compensating controls.
• Multifactor authentication. Section 314.4(c)(5) requires MFA "for any individual accessing any information system," unless the Qualified Individual has approved in writing reasonably equivalent or more secure controls. Shared logins to the DMS or a lender portal do not meet this.
• Logging. Section 314.4(c)(8) requires controls "designed to monitor and log the activity of authorized users" and detect unauthorized access or tampering. If a salesperson exports a customer list on the way out the door, the log is how you find out.
• Disposal. Section 314.4(c)(6) requires procedures to dispose of customer information "no later than two years after the last date the information is used" in providing a product or service, with limited exceptions such as legal retention requirements.
• Training. Section 314.4(e) requires security awareness training updated to reflect the risks your risk assessment identified. Seasonal hires belong in it before they touch a deal jacket.
• Service providers. Section 314.4(f) requires you to select capable providers, require safeguards by contract, and periodically assess them based on risk.

What about credit reports from applicants who were declined?

Credit reports pulled on declined applicants fall under the FTC's Disposal Rule, which applies to anyone who keeps consumer report information for a business purpose. 16 CFR 682.3 requires "reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal." The rule gives examples: burning, pulverizing, or shredding paper, and destroying or erasing electronic media, so the information "cannot practicably be read or reconstructed."

That means a printed credit report left in a declined-deal folder is a disposal question whether or not the person ever became a customer. A locked shred bin and a written schedule for clearing old electronic copies cover most of it.

Dealers that arrange auto loans should also look at the Red Flags Rule. It requires each financial institution or creditor that offers or maintains covered accounts, a category whose listed examples include an "automobile loan," to maintain a written Identity Theft Prevention Program. Whether a particular dealership meets the rule's definition of creditor depends on how it handles financing, so confirm that point with counsel.

Where do vendors fit in the dealer's obligations?

Vendors with access to customer information are part of the dealer's own Safeguards program. The FTC's dealer FAQ explains that when a service provider has direct access to a system holding customer information, the dealer must oversee the risk that access creates, and the provider should use multifactor authentication for that access.

The June 2024 CDK Global outage showed how much of a dealership runs through a single vendor. Public dealer groups described the impact in SEC filings. AutoNation reported that its DMS provider was "experiencing a cyber incident impacting its systems," affecting sales, service, inventory, CRM, and accounting functions. Asbury Automotive said it could not yet confirm "whether any customer data was accessed." Sonic Automotive later estimated the incident reduced its second-quarter diluted earnings per share by approximately $0.64 before recoveries.

The FTC has also acted against dealer technology providers directly. In 2019 it settled with DealerBuilt, a DMS vendor, over a breach that exposed data on about 12.5 million consumers stored by 130 of its dealer customers. Section 314.4(f) is the requirement that makes your vendors' security your concern: contract terms, then periodic review.

What happens if credit application data is breached?

If unencrypted customer information on 500 or more consumers is acquired without authorization, you must notify the FTC within 30 days of discovery. Section 314.4(j), in effect since May 13, 2024, requires notice "as soon as possible, and no later than 30 days after discovery of the event," using the FTC's online reporting form. The form warns that a report may be made public.

The trigger is unencrypted data. Encryption at rest and in transit is the control that most directly keeps an incident from becoming a reportable event.

Smaller dealers get some relief. Under 16 CFR 314.6, a dealer holding customer information on fewer than 5,000 consumers is exempt from the written risk assessment, the penetration testing and vulnerability assessment schedule, the written incident response plan, and the annual board report. Encryption, MFA, logging, disposal, training, vendor oversight, and FTC notification still apply. Larger dealer groups still owe the annual report, and our guide to the Qualified Individual's board report covers what it must include.

What should a dealer check before the year-end sales push?

Dealers should run six checks before the year-end push, and most take an afternoon with your IT provider and your F&I manager.

• Confirm MFA is on for every DMS, CRM, lender portal, and email account, including accounts for seasonal staff and outside F&I contractors.
• Find where scanned applications and credit reports actually live: shared drives, desktop folders, email attachments, and phones. Confirm each location is encrypted.
• Disable shared logins. Every person who touches a deal jacket should have a named account so the activity log means something.
• Put a shred bin in the F&I office and set a schedule for purging electronic copies of declined applications.
• Run security awareness training for new and seasonal hires before their first deal, with a section on phishing that impersonates lenders and your DMS vendor.
• Pull your vendor list and confirm each provider with access to customer information has safeguards written into its contract.

If your program has not been tested this year, check section 314.4(d)(2) as well. Absent effective continuous monitoring, it calls for annual penetration testing and vulnerability assessments at least every six months.

How does s90 help dealers?

s90 runs IT and security for regulated firms in Los Angeles and Orange County. For dealers, that means MFA and encryption across the systems that hold credit applications, activity logging you can review, vendor reviews, and the evidence behind your Safeguards program. If you want a second look at your setup before the year-end push, we are glad to walk through it with you.