(a) The Department of Financial Regulation may prescribe by rule the timing and manner of reports by a personal information protection company to the Department.
(b) The Department may adopt rules to govern other aspects of the business of a personal information protection company, including its protection and safeguarding of personal information and its interaction with third parties with respect to personal information it holds.
