The Qualified Individual: What is it and Who Should it Be?

SEE ALL EPISODES

Requirement of the Revised FTC Safeguards Rule

One of the revised Safeguards Rule's requirements is that a dealership designates a Qualified Individual. What does that mean and who should it be?

To start, notice that the rule requires a qualified individual, not qualified individuals. There must be one person in the dealership (or dealership group) whose name is on the blame line. The buck needs to stop somewhere.

Having said that, it is a best practice to have a designated individual at each dealership location to oversee Safeguards compliance efforts at that store. But that person is not the Qualified Individual.

What Qualifications Are Needed?

What qualifies a person to be a Qualified Individual or QI? The primary qualification is the ability to oversee the organization's Information Security Program. The QI does not need to be a computer science major or IT professional. You don't need to know how to conduct a Network Vulnerability Assessment to ensure that one has occurred.

In fact, many of the necessary tasks can be performed by dealership employees or outside vendors such as Managed Service Providers. But the ultimate responsibility cannot be outsourced. It has to remain within the dealership or group in the person of the QI.

Certifying a Qualified Individual

Automotive Compliance Education (ACE) has created a Safeguards Specialist Certification. If your QI needs a framed qualification on the wall, this is it. It explains what a QI needs to know and what to do. At least one such certified individual at each location is itself a good Safeguard.

Discrimination in the Hiring Process

Originally published in P&A Magazine on March 31, 2021.

"We all know that terminating an employee may lead to a charge of discrimination. But it can happen at the other end of the employment lifecycle, too – the hiring process."

I swear this story is true.

Once upon a time, in the summer of 1993, I ran into a woman that my wife and I knew outside of church one Sunday morning. She and her husband were expecting their first child. Attempting to make polite conversation, I asked her, “Esmerelda, when are you going to have that baby?”

“Last Tuesday,” came her icy reply...

Read More

Why Comply? 3 Reasons Dealers Should Comply with the Revised FTC Safeguards Rule

SEE ALL EPISODES

Why Comply with the Revised Safeguards Rule?

The original rule became law in 2003 and saw very little enforcement in the years since. Many dealers essentially ignored it with little consequence.

But that's why the rule was revised.

The squishy requirement of "reasonable safeguards appropriate to your operations" became mandatory and thus easier to enforce. A good reason to comply.

Malicious Attacks

But there is also enlightened self-interest. Protecting your customer's data also protects your own from malicious attacks.

How many units can you sell if a ransomware attack froze you out of your computer network?

Regulatory Enforcement

The FTC has enforcement authority over dealerships, but let's face it, the odds of regulators knocking on your door before a data breach occurs is remote. But the odds of a class-action lawsuit being filed against you post-breach is a stone-cold lock.

The FTC has defined failure to follow the Rule as a deceptive trade practice. That creates exposure to punitive damages and attorney's fees—a strong incentive to follow the rule.

Banks May Not Buy Your Paper

Finally, we've already seen banks saying they won't buy the paper of non-complying stores. And if you can't sell your paper you're going out of business. And that's why you need to comply with the revised Safeguards Rule.