On this page
Financial institution does not mean only a bank
The federal Safeguards Rule expressly includes a business significantly engaged in completing income-tax returns within its financial-institution definition. Its customer-information duties concern the defined nonpublic financial information, including information handled for other financial institutions. Ordinary company size or the label bookkeeping does not answer that scope question.
The programme must fit the firm’s size, complexity, activities and data sensitivity. A qualified individual must oversee it. That person can be supplied by an affiliate or service provider, but the firm retains responsibility; buying tax software does not by itself establish that the programme is in place.
Count the information you maintain, not just this year’s appointments
Fictional example: a practice maintains covered information concerning 800 consumers and assumes it is wholly exempt. The exception for information concerning fewer than 5,000 consumers concerns information maintained, not merely current appointments. It removes only specified formal written-risk-assessment, information-system testing, written incident-plan and annual-report provisions.
The basic risk-based written programme and other applicable safeguards remain. Regular testing or monitoring and service-provider oversight are not all removed just because the more specific testing provision is excepted.
A real historical example: TaxSlayer
In its 2017 final consent order involving TaxSlayer, the FTC required compliance with the privacy and safeguards rules and initial/biennial independent assessments under the order’s specified terms. TaxSlayer neither admitted nor denied the allegations apart from jurisdictional facts.
That is an actual administrative consent outcome, not a finding that every small practice needs that order’s assessments or that any particular software is approved. The current rule supplies this article’s general requirements; the historical case illustrates why the issue reaches tax services.
The 500-consumer report rule is another threshold
A defined notification event involving information of at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery. This concerns unauthorised acquisition of unencrypted customer information; compromised encryption keys and the rule’s unauthorised-access presumption also matter. Knowledge by an employee, officer or agent other than the wrongdoer can count as discovery.
The exception for fewer than 5,000 consumers does not remove this provision. Other incident, state-notice and privacy duties need their own assessment; not every security alert meets this event definition.
Scope
- This is not a complete security implementation or incident-response guide. FTC coverage, maintained consumer counts, notification-event facts and other regulators/state laws remain specific. The 2017 case does not establish later TaxSlayer compliance or present obligations under an unreviewed later record.
Next step
Establish which customer information the practice handles and implement the requirements that actually remain, even if the limited small-firm exception applies.
Sources & review notes
Federal Trade Commission
Passage, dates and research notes
primary · §§314.1–.3; complete 314.4 and 314.6; scoped definitions 314.2
fewer than five thousand consumers
Read scope, tax-preparer example, consumer/customer-information/notification-event definitions and all programme elements/limited small-institution exceptions. In particular, fewer-than-5,000 does not remove the written programme or 314.4(j); 500-consumer notification is a separate threshold. Not a complete security implementation or state-breach analysis.
Federal Trade Commission
Passage, dates and research notes
primary · Complete seven-page Decision and Order; Decision, Parts I–II, VII
neither admits nor denies
Read complete seven-page final order. Issued October 20, 2017; final/effective upon publication as final on the FTC website, which the current case timeline lists November 8, 2017. Consent/no admission except jurisdiction; initial/biennial assessments have their own ten-year terms. No later compliance, new breach, current assessment obligation or collected-money result is asserted.
Federal Trade Commission
Passage, dates and research notes
official-guidance · 2017 final-decision timeline and case description
Decision and Order
Read official case description and full timeline, including final-order announcement dated November 8, 2017. Index corroborates document status; operative terms come from the complete order. Allegations are not treated as admissions or trial findings.
Detailed rule records (1)
Maintain an appropriate written information-security programme, with the applicable 314.4 elements, a qualified individual and retained responsibility even if outsourced. The fewer-than-5,000-consumer exception is limited to 314.4(b)(1),(d)(2),(h),(i). Notify FTC of a defined notification event affecting at least 500 consumers as soon as possible and within 30 days of discovery.
16 CFR Part 314: financial customer-information safeguardsKeep this reading in your learning library.
Progress privacy
Off by default. Without remembering, changes last on this page. If enabled, only public content identifiers and self-reported progress are stored in this browser profile. Anyone using the same profile could see them. No plan inputs or contact details are included. Reset or export in learning settings.
This is a reading aid, not evidence of disclosure delivery, expertise or legal approval.