US SEC updates customer data hacking rules for Wall Street

WALL Street’s top regulator on Thursday (May 16) said it had updated rules to ensure investment companies and others work to detect and respond to hackers’ theft of customer data.

The changes, approved unanimously by the five-member US Securities and Exchange Commission (SEC), apply to rules first adopted in 2000.

“Over the last 24 years, the nature, scale, and impact of data breaches has transformed substantially,” SEC chair Gary Gensler said, adding that this required regulations to keep pace.

Under the changes announced on Thursday, broker-dealers, investment companies, registered investment advisers and others will be required to maintain incident response programmes to detect, respond to and recover from cyber-theft of customers’ personal data as well as notify individuals whose information may have been accessed without authorisation, according to the SEC.

Companies affected by the rules will have to come into compliance 18 months to two years from the date the changes appear in the Federal Register, according to the agency. REUTERS