(a) The Department of Financial Regulation may prescribe by rule the timing and manner of reports by a personal information protection company to the Department.

(b) The Department may adopt rules to govern other aspects of the business of a personal information protection company, including its protection and safeguarding of personal information and its interaction with third parties with respect to personal information it holds. (Added 2017, No. 205 (Adj. Sess.), § 2.)