US Congress Report Examines Data Privacy and Cybersecurity Regulations

The report highlights that most of the legislative and regulatory data privacy framework established for banks and credit unions is constructed from a patchwork of cybersecurity provisions. Similarly, the implementation of cybersecurity supervisory programs among financial institution regulators is fragmented and potential risks to the financial system have emerged as new technologies evolve. The report focuses on the cybersecurity regulatory framework among the federal banking regulators—the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (FED), the National Credit Union Administration (NCUA), and the Consumer Financial Protection Bureau (CFPB). Together, these agencies are responsible for implementing and ensuring compliance with banking laws.

The report findings show that cybersecurity threats pose operational, reputational, and systemic risks, which are a major concern for banks and banking regulators. Banking regulators implement the cybersecurity legislative framework through rulemaking and then supervise institutions to ensure that banks are following regulations. The findings reveal that no single law provides a framework for regulating cybersecurity in the United States. Instead, multiple laws require financial regulators to establish cybersecurity standards for financial institutions and provide regulators the authority to ensure compliance with such standards. The Gramm-Leach-Bliley Act of 1999 (GLBA) is the most comprehensive law which directs financial regulators to implement disclosure requirements and mandate security measures to safeguard private information. Other laws—such as the Sarbanes-Oxley Act of 2002, Fair and Accurate Credit Transactions Act (FACT Act), Bank Protection Act, and Bank Service Company Act of 1962—complete the general legislative framework for cybersecurity.

The report also identifies several policy issues that address regulator concern over the patchwork nature of regulatory standards for consumer privacy and security. The policy issues relate to how new technologies that facilitate financial data-sharing should be treated under the existing cybersecurity framework. Another issue relates to how and whether the data privacy protections that exist for data-sharing should also apply to data collection. The Data Privacy Act of 2023 (H.R. 1165), which the House Financial Services Committee ordered to be reported as amended in February 2023, examines several of these issues. Moreover, the report notes that technology partnerships, particularly at smaller banks, with institutions such as cloud management companies, have led to new cybersecurity risks to the banking system. This has raised concerns among policymakers about the capacity of the existing framework to address new risks. To that end, the report notes that, considering the financial stability, concentration, and systemic risks stemming from the increasing bank reliance on cloud services, the scope of bank supervision may expand to cloud service providers. This may lead to technical resource mismatches, and regulators, like banks, may find themselves with a shortage of cloud skills necessary to examine cloud service providers. These service providers may also not be familiar with or amenable to audits or bank-like examinations. It is also expected that banks may adopt multi-cloud strategies—contracts with multiple cloud service providers—to avoid lock-in risk. In addition to increasing costs, this introduces potentially two or more providers in the form of cloud service providers, and banks must manage these relationships effectively to ensure cybersecurity.

Related Link: Report (PDF)