What is the Gramm-Leach-Bliley Act (GLBA)?

• Covered entities must limit when a "Financial Institution" may disclose a consumer's "nonpublic personal information" to nonaffiliated third parties.
• The GLBA Financial Privacy Rule applies to businesses that are "significantly engaged" in "financial activities" as described in section 4(k) of the Bank Holding Company Act. "Financial Activities" include:
  • Lending, exchanging, transferring, investing for others, or safeguarding money or securities. These activities cover services offered by lenders, check cashers, wire transfer services, and sellers of money orders.
  • Providing financial, investment or economic advisory services. These activities cover services offered by credit counselors, financial planners, tax preparers, accountants, and investment advisors.
  • Brokering loans.
  • Servicing loans.
  • Debt collecting.
  • Providing real estate settlement services.
  • Career counseling (of individuals seeking employment in the financial services industry).
• The Privacy Rule protects a consumer's "nonpublic personal information" (NPI). NPI is any "personally identifiable financial information" that a financial institution collects about an individual in connection with providing a financial product or service, unless that information is otherwise "publicly available."
• Obligations for Financial Institutions under the GLBA Financial Privacy Rule are:
  • Notice: Financial institutions must give their customers - and in some cases their consumers - a "clear and conspicuous" written notice describing their privacy policies and practices. When you provide the notice and what you say depends on what you do with the information.
  • Opt-out right: If you share their NPI with nonaffiliated third parties outside of three exceptions, you must give your consumers and customers an "opt-out notice" that clearly and conspicuously describes their right to opt out of the information being shared 30 days before you share their information. An opt-out notice must be delivered with a privacy notice, and it can be part of the privacy notice.
• If you receive customer NPI from a non-affiliated financial institution, either under an exception or not, you must ensure it is not used or disclosed for purposes which are not in accordance with original purposes -informed to the customer- for which it was collected and disclosed by the financial institution.
• The GLBA also prohibits financial institutions from sharing account numbers or similar access numbers or codes for marketing purposes. This prohibition applies even when a consumer or customer has not opted-out of the disclosure of NPI concerning her account. The prohibition applies to disclosures of account numbers for an individual's credit card account, deposit account, or "transaction account" to any nonaffiliated third party to use in telemarketing, direct mail marketing, or any other marketing through electronic mail to the consumer. A "transaction account" is any account to which a third party may initiate a charge.

• Financial Institutions must protect the private information of customers entrusted in their care
• “Financial institution” includes many businesses that may not normally describe themselves that way. As per the FTC, the rule applies to all businesses, regardless of size, that are “significantly engaged” in providing financial products or services.
• Covered entities must implement administrative, technical, or physical safeguards for the use, access, collection, distribution, processing, protection, storage, use, transmission, disposal of, or otherwise handling of customer information.
• Under the GLBA Safeguards Rule, there must be a written security plan which complements the size and complexity of the covered entity’s business as well as the nature and scope of its activities, and the sensitivity of the customer information it handles.
• Covered entities are provided flexibility to implement safeguards appropriate to their own circumstances, but each company must:
  • ​​Designate one or more employees to coordinate its information security program;
  • Identify and assess the risks to customer information in each relevant area of the company’s operation, and evaluate the effectiveness of the current safeguards for controlling these risks;
  • Design and implement a safeguards program and regularly monitor and test it;
  • Select service providers that can maintain appropriate safeguards, make sure your contract requires them to maintain safeguards, and oversee their handling of customer information; and
  • Evaluate and adjust the program in light of relevant circumstances, including changes in the firm’s business or operations, or the results of security testing and monitoring.
• The Safeguards Rule requires companies to assess and address the risks to customer information in all areas of their operation, including three areas that are particularly important to information security:
  • Employee Management and Training;
  • Information Systems; and
  • Detecting and Managing System Failures.
• Under Section 501(b) of the GLBA and interagency guidance in 2005, when a financial institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the institution determines that misuse has occurred or is reasonably possible, it should notify the affected customer as soon as possible.
• Under the GLBA Safeguards rule, a financial institution must conduct assessments to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information.
• A Financial Institution must also 'oversee service providers' by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and requiring by contract that service providers implement and maintain such safeguards.

Frequently Asked Questions (FAQs)

What is the purpose of the GLBA?

The purpose of the Gramm-Leach-Bliley Act (GLBA) is to enhance the privacy and security of consumers' personal financial information. It mandates financial institutions to protect the confidentiality of this information and provides guidelines for sharing it with nonaffiliated third parties.

Which are three key rules of the GLBA?

Three key rules of the GLBA include:

1. Privacy Rule: Mandates financial institutions to inform consumers about their information-sharing practices and allow consumers to opt-out of certain information sharing.
2. Safeguards Rule: Requires financial institutions to implement measures to secure customer information and protect it from unauthorized access.
3. Pretexting Provisions: Prohibits the acquisition of personal financial information under false pretenses.

What is the difference between GDPR and GLBA?

General Data Protection Regulation (GDPR) is a comprehensive data protection regulation in the European Union, focusing on the rights and protection of personal data for EU residents. Gramm-Leach-Bliley Act (GLBA) is a U.S. law specifically targeting the privacy of consumers' financial information held by financial institutions.

What is the GLBA also known as?

The GLBA is also known as the Gramm-Leach-Bliley Financial Services Modernization Act.

What is the main purpose of the Gramm-Leach-Bliley Act?

The main purpose of the Gramm-Leach-Bliley Act (GLBA) is to establish requirements for financial institutions to safeguard customers' nonpublic personal information and provide transparency about their information-sharing practices.

Which are three key rules of the GLBA?

Three key rules of the GLBA include:

1. Privacy Rule: Ensuring the protection of consumers' personal financial information.
2. Safeguards Rule: Requiring the establishment of security measures to prevent data breaches.
3. Pretexting Provisions: Prohibiting deceptive methods of obtaining personal financial information.

What is the Gramm-Leach-Bliley Financial Protection Act?

The Gramm-Leach-Bliley Financial Protection Act, also known as the GLBA, is a federal law in the United States that regulates the privacy and security of consumers' personal financial information held by financial institutions.

What is an example of the Gramm-Leach-Bliley Act?

An example of the Gramm-Leach-Bliley Act (GLBA) in action is when a bank informs its customers about its privacy practices, provides them the option to opt-out of certain information sharing, and implements security measures to protect their financial data from unauthorized access or data breaches.