Securiti announces a $75M Series C Funding Round

View
Contact Us Schedule a Demo

What is the Gramm-Leach-Bliley Act (GLBA)?

What is the Gramm-Leach-Bliley Act (GLBA)?
By Privacy Research Team
Published on September 3, 2021

The Gramm-Leach-Bliley Act (GLBA) or the Financial Services Modernization Act 1999 is a US Federal sectoral legislation that aims to provide increased protections to the privacy of US residents by requiring financial institutions to safeguard the personal information of their customers and to keep customers informed of where that information is being shared.

There are two important rules in relation to the GLBA which impose important obligations on financial institutions (and other entities) to protect and safeguard the privacy of their customers and consumers, they are:

GLBA Financial Privacy Rule

  • Covered entities must limit when a "Financial Institution" may disclose a consumer's "nonpublic personal information" to nonaffiliated third parties.
  • The GLBA Financial Privacy Rule applies to businesses that are "significantly engaged" in "financial activities" as described in section 4(k) of the Bank Holding Company Act. "Financial Activities" include:
    • Lending, exchanging, transferring, investing for others, or safeguarding money or securities. These activities cover services offered by lenders, check cashers, wire transfer services, and sellers of money orders.
    • Providing financial, investment or economic advisory services. These activities cover services offered by credit counselors, financial planners, tax preparers, accountants, and investment advisors.
    • Brokering loans.
    • Servicing loans.
    • Debt collecting.
    • Providing real estate settlement services.
    • Career counseling (of individuals seeking employment in the financial services industry).
  • The Privacy Rule protects a consumer's "nonpublic personal information" (NPI). NPI is any "personally identifiable financial information" that a financial institution collects about an individual in connection with providing a financial product or service, unless that information is otherwise "publicly available."
  • Obligations for Financial Institutions under the GLBA Financial Privacy Rule are:
    • Notice: Financial institutions must give their customers - and in some cases their consumers - a "clear and conspicuous" written notice describing their privacy policies and practices. When you provide the notice and what you say depends on what you do with the information.
    • Opt-out right: If you share their NPI with nonaffiliated third parties outside of three exceptions, you must give your consumers and customers an "opt-out notice" that clearly and conspicuously describes their right to opt out of the information being shared 30 days before you share their information. An opt-out notice must be delivered with a privacy notice, and it can be part of the privacy notice.
  • If you receive customer NPI from a non-affiliated financial institution, either under an exception or not, you must ensure it is not used or disclosed for purposes which are not in accordance with original purposes -informed to the customer- for which it was collected and disclosed by the financial institution.
  • The GLBA also prohibits financial institutions from sharing account numbers or similar access numbers or codes for marketing purposes. This prohibition applies even when a consumer or customer has not opted-out of the disclosure of NPI concerning her account. The prohibition applies to disclosures of account numbers for an individual's credit card account, deposit account, or "transaction account" to any nonaffiliated third party to use in telemarketing, direct mail marketing, or any other marketing through electronic mail to the consumer. A "transaction account" is any account to which a third party may initiate a charge.

GLBA Safeguards Rule

  • Financial Institutions must protect the private information of customers entrusted in their care
  • “Financial institution” includes many businesses that may not normally describe themselves that way. As per the FTC, the rule applies to all businesses, regardless of size, that are “significantly engaged” in providing financial products or services.
  • Covered entities must implement administrative, technical, or physical safeguards for the use, access, collection, distribution, processing, protection, storage, use, transmission, disposal of, or otherwise handling of customer information.
  • Under the GLBA Safeguards Rule, there must be a written security plan which complements the size and complexity of the covered entity’s business as well as the nature and scope of its activities, and the sensitivity of the customer information it handles.
  • Covered entities are provided flexibility to implement safeguards appropriate to their own circumstances, but each company must:
    • ​​Designate one or more employees to coordinate its information security program;
    • Identify and assess the risks to customer information in each relevant area of the company’s operation, and evaluate the effectiveness of the current safeguards for controlling these risks;
    • Design and implement a safeguards program and regularly monitor and test it;
    • Select service providers that can maintain appropriate safeguards, make sure your contract requires them to maintain safeguards, and oversee their handling of customer information; and
    • Evaluate and adjust the program in light of relevant circumstances, including changes in the firm’s business or operations, or the results of security testing and monitoring.
  • The Safeguards Rule requires companies to assess and address the risks to customer information in all areas of their operation, including three areas that are particularly important to information security:
    • Employee Management and Training;
    • Information Systems; and
    • Detecting and Managing System Failures.
  • Under Section 501(b) of the GLBA and interagency guidance in 2005, when a financial institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the institution determines that misuse has occurred or is reasonably possible, it should notify the affected customer as soon as possible.
  • Under the GLBA Safeguards rule, a financial institution must conduct assessments to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information.
  • A Financial Institution must also 'oversee service providers' by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and requiring by contract that service providers implement and maintain such safeguards.

Obligations under the GLBA

In summary, the GLBA and its associated rules and regulations therefore impose the following responsibilities on financial institutions and other covered entities:

Notice

Right to Opt-out

Purpose limitation

Risk Assessments

Security Safeguards

Data Breach Notifications

Who is protected under the law?

Customers

"Customers" are a subclass of consumers who have a continuing relationship with a financial institution. It's the nature of the relationship - not how long it lasts - that defines whether a person is a customer or a consumer.

Consumers

A "consumer" is someone who obtains or has obtained a financial product or service from a financial institution that is to be used primarily for personal, family, or household purposes, or that person's legal representative. The term "consumer" does not apply to commercial clients, like sole proprietorships.

What type of personal information is protected?

Nonpublic personal information of customers and includes (but is not limited to):

Names

Phone numbers

Addresses

Social Security numbers

Credit and income histories

Credit and bank card account numbers

NPI does not include information that a financial institution or covered entity has a reasonable basis to believe is lawfully made "publicly available." A covered entity must determine whether:

  1. That the information is generally made lawfully available to the public; and
  2. That the individual can stop the information from being made public and has not done so themselves.

Penalties

Gramm-Leach-Bliley Act applies to all penalties for noncompliance, including fines and imprisonment. If a financial institution violates GLBA:

  • The institution will be subject to a civil penalty of not more than $100,000 for each violation;
  • Officers and directors of the institution will be subject to, and personally liable for, a civil penalty of not more than $10,000 for each violation;
  • The institution and its officers and directors will also be subject to fines in accordance with Title 18 of the United States Code or imprisonment for not more than five years, or both.

Key Facts

1

Privacy notices under the GLBA Financial Privacy Rule have specific content requirements as well as methods on how these notices must be provided to customers or consumers.

2

GLBA Financial Privacy Rule provides that consumers and customers who have the right to opt out may do so at any time. Once a financial institution receives an opt-out direction from their existing consumers or customers, they must comply with it as soon as is reasonably possible.

3

Exceptions to honoring opt-out requests in GLBA Financial Privacy Rules are applicable when the information-sharing is necessary for processing or administering a financial transaction requested or authorized by a consumer; or to prevent fraud, respond to judicial process or a subpoena, or comply with federal, state, or local laws; or for certain certain “joint” marketing activities.

4

Under the GLBA Safeguards Rule, Financial Insitutitions and covered entities should know where sensitive customer information is stored and store it securely and also limit access to employees who have a business reason to see it.

5

Under a separate rule, the GLBA Disposal Rule, Financial Institutions and covered entities should dispose of customer information in a secure way.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox

Share

More Stories that May Interest You

Data Access Governance: Balancing Security, Privacy, and Business Needs View More

February 22, 2023

Data Access Governance: Balancing Security, Privacy, and Business Needs

Suppose you own a luxury car. You wouldn’t just give its keys to anyone who asks, right? In fact, you would give your car...

The Definitive Guide – What is First-Party Data? View More

February 20, 2023

What is First-Party Data?

No matter where you are, data is all around you and powers everything you do. Estimates suggest that a whopping 25,000 petabytes of data...

What is Vendor Risk Management (VRM) & How Does it Work? View More

February 6, 2023

What is Vendor Risk Management (VRM) & How Does it Work?

As your business grows, you'll undoubtedly need to outsource some tasks. Every expanding company needs third and even fourth-party suppliers, whether for purchasing supplies...

privacyops blue book

Automating privacy operations across your organization

The multi-disciplinary practice to grow trust-equity of your brand and comply with privacy regulations.

Get the Book

“By leveraging the PrivacyOps constructs from this book across our organization we were able to not only save time and money but also mitigate the risks associated with manual methods of privacy management.”

- Marty Collins, Chief Privacy and Legal Officer, QuinStreet, Inc

At Securiti, our mission is to enable enterprises to safely harness the incredible power of data and the cloud by controlling the complex security, privacy and compliance risks.

Copyright © 2023 Securiti · Sitemap · XML Sitemap

Newsletter

Company

Resources

Terms

Get in touch

[email protected]
3031 Tisch Way Suite 110 Plaza West, San Jose,
CA 95128

Users love Securiti on G2 G2 leader spring 2022 G2 leader summer 2022 G2 leader easiest business 2022 RSAC Leader Forrester Badge Snowflake Partner Badge IAPP Innovation award 2020 Gartner Cool Vendor Award Sinet Innovator Award