Banks advised to notify customers of data breaches


The Federal Reserve Board has issued guidance that calls on financial institutions to notify customers of security breaches involving their sensitive data.

"If the institution determines that misuse of its information about a customer has occurred or is reasonably possible, it should notify the affected customer as soon as possible," the guidance states.

Notification may be delayed if a law enforcement agency believes that it will interfere with a criminal investigation.

The guidance defines sensitive customer information as a personal identification number (PIN), password, account number, or Social Security number, in conjunction with a customer's name, address, or phone number.

The guidance was issued earlier this week by the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency, and the Office of Thrift Supervision.

The advisory comes in the wake of a string of breaches involving customer data at Choice Point, Bank of America, and LexisNexis.

California already has a security breach notification law while other states are eyeing similar requirements.


Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.