WASHINGTON—Senate Banking Committee members are looking at the adequacy of Securities and Exchange Commission (SEC) rules for determining when public companies must disclose data breaches.
In a letter to SEC Chairman Jay Clayton, the Committee asked that commission staff review and possibly update those rules.
The letter comes in the wake of multiple data breaches, including one to the SEC's corporate filing database. Clayton appeared before the Senate Banking Committee this week to provide information on its hack, which happened in 2016 but was just disclosed last week, NAFCU noted in its analysis.
In addition to answering questions about whether information taken in the SEC breach led to insider trading and why the commission waited so long to disclose it, Clayton was also asked about the Equifax hack that revealed 143 million Americans' personal financial information.
Clayton didn't comment on possible SEC investigations into wrongdoing by Equifax executives, but said he's "not ignoring" the issue and that it's his duty to enforce the law, NAFCU noted.
He also indicated his support for companies releasing details of cyber breaches earlier than is current practice and that commission staff are working to revise guidelines to do so, NAFCU said.
Also on Tuesday, the Senate Commerce Subcommittee on Consumer Protection, Product Safety and Data Security held a hearing on the Federal Trade Commission (FTC), which included discussions on whether the FTC may need additional authorities considering the Equifax data breach, noted NAFCU.
NAFCU said that it continues to advocate for improved data security standards that prioritize protecting consumers' personal financial information and fairly hold appropriate stakeholders accountable.