GLBA

The Gramm-Leach-Bliley Act governs how financial institutions protect and share consumers' personal financial information. In practice it works through two rules: the Privacy Rule, on privacy notices and the right to opt out of certain sharing, and the Safeguards Rule, which requires a written information security program.

"Financial institution" reaches far beyond banks: mortgage brokers, lenders, tax preparers, car dealers that arrange financing and many others are covered, and for them the FTC's rules apply.

• Financial institutions: businesses significantly engaged in financial activities, such as lending, brokering, advising, insuring or collecting debt.
• Banks and credit unions follow their banking regulators' versions of the rules; most non-bank financial companies follow the FTC's.
• It covers nonpublic personal information about consumers and customers who obtain financial products or services for personal, family or household purposes.

Consumers get a privacy notice explaining what the institution collects and shares, and can opt out of sharing their nonpublic personal information with nonaffiliated third parties, subject to exceptions (Privacy Rule, Regulation P).

Aplicada pela FTC, pelo Escritório de Proteção Financeira do Consumidor e pelos reguladores bancários, por meio de ordens, programas de conformidade e, dependendo do regulador e da violação, penalidades civis. Obter informações de clientes sob falsos pretextos é crime federal.

1. Confirm you are a financial institution and which regulator's rules apply to you.
2. Name a qualified individual to run the information security program.
3. Run a written risk assessment and build the controls in 16 CFR 314.4 on it.
4. Turn on multi-factor authentication and encryption for customer information.
5. Oversee service providers by contract and periodic assessment.
6. Prepare to notify the FTC of qualifying security events within 30 days.
7. Check your privacy notice and opt-out process under the Privacy Rule.