What is the Gramm-Leach-Bliley Act (GLBA)? - Securiti (2024)

The Gramm-Leach-Bliley Act (GLBA) or the Financial Services Modernization Act 1999 is a US Federal sectoral legislation that aims to provide increased protections to the privacy of US residents by requiring financial institutions to safeguard the personal information of their customers and to keep customers informed of where that information is being shared.

There are two important rules in relation to the GLBA which impose important obligations on financial institutions (and other entities) to protect and safeguard the privacy of their customers and consumers, they are:

• Covered entities must limit when a "Financial Institution" may disclose a consumer's "nonpublic personal information" to nonaffiliated third parties.
• The GLBA Financial Privacy Rule applies to businesses that are "significantly engaged" in "financial activities" as described in section 4(k) of the Bank Holding Company Act. "Financial Activities" include:
  • Lending, exchanging, transferring, investing for others, or safeguarding money or securities. These activities cover services offered by lenders, check cashers, wire transfer services, and sellers of money orders.
  • Providing financial, investment or economic advisory services. These activities cover services offered by credit counselors, financial planners, tax preparers, accountants, and investment advisors.
  • Brokering loans.
  • Servicing loans.
  • Debt collecting.
  • Providing real estate settlement services.
  • Career counseling (of individuals seeking employment in the financial services industry).
• The Privacy Rule protects a consumer's "nonpublic personal information" (NPI). NPI is any "personally identifiable financial information" that a financial institution collects about an individual in connection with providing a financial product or service, unless that information is otherwise "publicly available."
• Obligations for Financial Institutions under the GLBA Financial Privacy Rule are:
  • Notice: Financial institutions must give their customers - and in some cases their consumers - a "clear and conspicuous" written notice describing their privacy policies and practices. When you provide the notice and what you say depends on what you do with the information.
  • Opt-out right: If you share their NPI with nonaffiliated third parties outside of three exceptions, you must give your consumers and customers an "opt-out notice" that clearly and conspicuously describes their right to opt out of the information being shared 30 days before you share their information. An opt-out notice must be delivered with a privacy notice, and it can be part of the privacy notice.
• If you receive customer NPI from a non-affiliated financial institution, either under an exception or not, you must ensure it is not used or disclosed for purposes which are not in accordance with original purposes -informed to the customer- for which it was collected and disclosed by the financial institution.
• The GLBA also prohibits financial institutions from sharing account numbers or similar access numbers or codes for marketing purposes. This prohibition applies even when a consumer or customer has not opted-out of the disclosure of NPI concerning her account. The prohibition applies to disclosures of account numbers for an individual's credit card account, deposit account, or "transaction account" to any nonaffiliated third party to use in telemarketing, direct mail marketing, or any other marketing through electronic mail to the consumer. A "transaction account" is any account to which a third party may initiate a charge.

• Financial Institutions must protect the private information of customers entrusted in their care
• “Financial institution” includes many businesses that may not normally describe themselves that way. As per the FTC, the rule applies to all businesses, regardless of size, that are “significantly engaged” in providing financial products or services.
• Covered entities must implement administrative, technical, or physical safeguards for the use, access, collection, distribution, processing, protection, storage, use, transmission, disposal of, or otherwise handling of customer information.
• Under the GLBA Safeguards Rule, there must be a written security plan which complements the size and complexity of the covered entity’s business as well as the nature and scope of its activities, and the sensitivity of the customer information it handles.
• Covered entities are provided flexibility to implement safeguards appropriate to their own circ*mstances, but each company must:
  • ​​Designate one or more employees to coordinate its information security program;
  • Identify and assess the risks to customer information in each relevant area of the company’s operation, and evaluate the effectiveness of the current safeguards for controlling these risks;
  • Design and implement a safeguards program and regularly monitor and test it;
  • Select service providers that can maintain appropriate safeguards, make sure your contract requires them to maintain safeguards, and oversee their handling of customer information; and
  • Evaluate and adjust the program in light of relevant circ*mstances, including changes in the firm’s business or operations, or the results of security testing and monitoring.
• The Safeguards Rule requires companies to assess and address the risks to customer information in all areas of their operation, including three areas that are particularly important to information security:
  • Employee Management and Training;
  • Information Systems; and
  • Detecting and Managing System Failures.
• Under Section 501(b) of the GLBA and interagency guidance in 2005, when a financial institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the institution determines that misuse has occurred or is reasonably possible, it should notify the affected customer as soon as possible.
• Under the GLBA Safeguards rule, a financial institution must conduct assessments to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information.
• A Financial Institution must also 'oversee service providers' by taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and requiring by contract that service providers implement and maintain such safeguards.

Obligations under the GLBA

In summary, the GLBA and its associated rules and regulations therefore impose the following responsibilities on financial institutions and other covered entities:

What type of personal information is protected?

Nonpublic personal information of customers and includes (but is not limited to):

NPI does not include information that a financial institution or covered entity has a reasonable basis to believe is lawfully made "publicly available." A covered entity must determine whether:

1. That the information is generally made lawfully available to the public; and
2. That the individual can stop the information from being made public and has not done so themselves.

Penalties

GLBA applies to all penalties for noncompliance, including fines and imprisonment. If a financial institution violates GLBA:

• The institution will be subject to a civil penalty of not more than $100,000 for each violation;
• Officers and directors of the institution will be subject to, and personally liable for, a civil penalty of not more than $10,000 for each violation;
• The institution and its officers and directors will also be subject to fines in accordance with Title 18 of the United States Code or imprisonment for not more than five years, or both.

Three key rules of the GLBA include:

1. Privacy Rule: Mandates financial institutions to inform consumers about their information-sharing practices and allow consumers to opt-out of certain information-sharing.
2. Safeguards Rule: Requires financial institutions to implement measures to secure customer information and protect it from unauthorized access.
3. Pretexting Provisions: Prohibits the acquisition of personal financial information under false pretenses.

The main purpose of this act is to establish requirements for financial institutions to safeguard customers' nonpublic personal information and provide transparency about their information-sharing practices.

Three key rules of the GLBA include:

1. Privacy Rule: Ensuring the protection of consumers' personal financial information.
2. Safeguards Rule: Requiring the establishment of security measures to prevent data breaches.
3. Pretexting Provisions: Prohibiting deceptive methods of obtaining personal financial information