What is the Gramm-Leach-Bliley Act (GLBA)?

The Gramm-Leach-Bliley Act (GLBA) or the Financial Services Modernization Act 1999 is a US Federal sectoral legislation that aims to provide increased protections to the privacy of US residents by requiring financial institutions to safeguard the personal information of their customers and to keep customers informed of where that information is being shared.

There are two important rules in relation to the GLBA which impose important obligations on financial institutions (and other entities) to protect and safeguard the privacy of their customers and consumers, they are:

• Covered entities must limit when a "Financial Institution" may disclose a consumer's "nonpublic personal information" to nonaffiliated third parties.
• The GLBA Financial Privacy Rule applies to businesses that are "significantly engaged" in "financial activities" as described in section 4(k) of the Bank Holding Company Act. "Financial Activities" include:
  • Lending, exchanging, transferring, investing for others, or safeguarding money or securities. These activities cover services offered by lenders, check cashers, wire transfer services, and sellers of money orders.
  • Providing financial, investment or economic advisory services. These activities cover services offered by credit counselors, financial planners, tax preparers, accountants, and investment advisors.
  • Brokering loans.
  • Servicing loans.
  • Debt collecting.
  • Providing real estate settlement services.
  • Career counseling (of individuals seeking employment in the financial services industry).
• The Privacy Rule protects a consumer's "nonpublic personal information" (NPI). NPI is any "personally identifiable financial information" that a financial institution collects about an individual in connection with providing a financial product or service, unless that information is otherwise "publicly available."
• Obligations for Financial Institutions under the GLBA Financial Privacy Rule are:
  • Notice: Financial institutions must give their customers - and in some cases their consumers - a "clear and conspicuous" written notice describing their privacy policies and practices. When you provide the notice and what you say depends on what you do with the information.
  • Opt-out right: If you share their NPI with nonaffiliated third parties outside of three exceptions, you must give your consumers and customers an "opt-out notice" that clearly and conspicuously describes their right to opt out of the information being shared 30 days before you share their information. An opt-out notice must be delivered with a privacy notice, and it can be part of the privacy notice.
• If you receive customer NPI from a non-affiliated financial institution, either under an exception or not, you must ensure it is not used or disclosed for purposes which are not in accordance with original purposes -informed to the customer- for which it was collected and disclosed by the financial institution.
• The GLBA also prohibits financial institutions from sharing account numbers or similar access numbers or codes for marketing purposes. This prohibition applies even when a consumer or customer has not opted-out of the disclosure of NPI concerning her account. The prohibition applies to disclosures of account numbers for an individual's credit card account, deposit account, or "transaction account" to any nonaffiliated third party to use in telemarketing, direct mail marketing, or any other marketing through electronic mail to the consumer. A "transaction account" is any account to which a third party may initiate a charge.

• Financial Institutions must protect the private information of customers entrusted in their care
• “Financial institution” includes many businesses that may not normally describe themselves that way. As per the FTC, the rule applies to all businesses, regardless of size, that are “significantly engaged” in providing financial products or services.
• Covered entities must implement administrative, technical, or physical safeguards for the use, access, collection, distribution, processing, protection, storage, use, transmission, disposal of, or otherwise handling of customer information.
• Under the GLBA Safeguards Rule, there must be a written security plan which complements the size and complexity of the covered entity’s business as well as the nature and scope of its activities, and the sensitivity of the customer information it handles.
• Covered entities are provided flexibility to implement safeguards appropriate to their own circumstances, but each company must:
  • ​​Designate one or more employees to coordinate its information security program;
  • Identify and assess the risks to customer information in each relevant area of the company’s operation, and evaluate the effectiveness of the current safeguards for controlling these risks;
  • Design and implement a safeguards program and regularly monitor and test it;
  • Select service providers that can maintain appropriate safeguards, make sure your contract requires them to maintain safeguards, and oversee their handling of customer information; and
  • Evaluate and adjust the program in light of relevant circumstances, including changes in the firm’s business or operations, or the results of security testing and monitoring.
• The Safeguards Rule requires companies to assess and address the risks to customer information in all areas of their operation, including three areas that are particularly important to information security:
  • Employee Management and Training;
  • Information Systems; and
  • Detecting and Managing System Failures.
• Under Section 501(b) of the GLBA and interagency guidance in 2005, when a financial institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the institution determines that misuse has occurred or is reasonably possible, it should notify the affected customer as soon as possible.
• Under the GLBA Safeguards rule, a financial institution must conduct assessments to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information.
• A Financial Institution must also 'oversee service providers' by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and requiring by contract that service providers implement and maintain such safeguards.