What is GLBA and how does it impact your business?

GLBA stands for the Gramm-Leach-Bliley Act, a congressional act established in 1999 that removed cumbersome regulations within the financial industry. The purpose of the act was to update and modernize the financial industry. However, it did much more than that. It started a new era of information security and business transparency for customers. In response to GLBA, financial institutions became required to develop information-sharing practices and request their customers to opt in or out of having their non-public information shared with third parties (“The Gramm-Leach-Bliley Act of 1999 (GLBA)”). Fast forward to 2022, GLBA’s jurisdiction has surpassed banks and now includes but is not limited to organizations like educational institutions, travel agencies, and brokerage firms. More recently, new responsibilities have emerged, and the FTC now requires enhanced protection of customer information and everyday business communications including developing and maintaining an information security program (Federal Trade Commission, What does the Safeguards Rule require companies to do?).

From 1999 Until Today

GLBA repealed part of the 1933 Glass-Steagall Act, removing all barriers in the market among banking companies, securities companies, and insurance companies that prohibited any one institution from acting as any combination of an investment bank, a commercial bank, and an insurance company.

Most importantly, GLBA started an era of safeguarding customer non-public information and the development of information-sharing practices. GLBA set the following requirements for all financial institutions to explain their information-sharing practices to their customers and how they safeguard that sensitive data.

In 2003, the Federal Trade Commission (FTC) expanded on the GBLA and established The Safeguards Rule. The rule established standards for safeguarding customer information to ensure those entities covered by the rule maintain protocols to protect the security of customer information. In October 2021, the FTC made updates to those standards and expanded the Safeguards Rule requiring further compliance by financial institutions (“FTC Safeguards Rule: What Your Business Needs to Know”).

What exactly are those safeguards?

The Safeguards Rule requires financial institutions under FTC jurisdiction to develop, implement, and maintain an information security program with administrative, technical, and physical safeguards designed to protect customer information. The “customer information” that financial institutions must safeguard includes the following (“FTC Safeguards Rule: What Your Business Needs to Know”, What does the Safeguards Rule require companies to do?):

• Any record containing nonpublic customer information about a customer of a financial institution, whether in paper, electronic, or other form, that is handled or maintained by or on behalf of you or your affiliates.
• Information about your customers including information and data about customers of other financial institutions that have been shared with you.

Developing and Maintaining Your Own Information Security Program.

The last step to FTC IT compliance is developing, managing, and updating your financial institution’s own Information Security Program.  An Information Security Program means the administrative, technical, or physical safeguards you use to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information (“FTC Safeguards Rule: What Your Business Needs to Know”, Glossary – Information Security Program). These safeguards must be appropriate to your business’s size and complexity, the nature, and scope of your activities, and the sensitivity of any customer information at issue (“FTC Safeguards Rule: What Your Business Needs to Know”, What do the Safeguards Rule require companies to do?).

What does an Information Security Program exactly include?

An Information Security Program includes 9 elements. These 9 elements are imperative to building a foundation for FTC IT compliance and remaining compliant in the future as you can anticipate further updates to the Safeguards Rule. Your financial institution must obtain FTC IT compliance as determined by the new Safeguards Rule update by Dec. 9^th, 2022, to avoid cumbersome financial penalties and potentially federal investigation. Below is a summary of all 9 elements with their appropriate codes from The Safeguards Rule amendments section. For this post, each section has been summarized. Please note that each element is much more detailed in nature and that a detailed provision of each element can be provided to you upon consultation.

(National Archives and Records Administration, § 314.3 Standards for safeguarding customer information.)

This table is a foundation for the requirements needed for you and your associates to ensure the protection of your consumer’s non-public information and maintain effective security of your current information system and your organization’s financial well-being. Please do not hesitate to take the necessary steps to get FTC IT compliant ASAP. We have an effective and convenient way for you to do so. For a limited time, we are offering a complimentary FTC IT Compliance Audit to gauge your current information security system(s) and develop a plan of action for your business to meet each requirement set by the FTC. Please follow the link below and fill out each section required to secure your complimentary FTC IT compliance audit today!

Free FTC GLBA IT Audit

References

• “FTC Safeguards Rule: What Your Business Needs to Know.” Federal Trade Commission, 25 May 2022, www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know#Financial_institution.
• Federal Trade Commission. FTC Strengthens Security Safeguards for Consumer Financial Information Following Widespread Data Breaches. 27 Oct. 2021, www.ftc.gov/news-events/news/press-releases/2021/10/ftc-strengthens-security-safeguards-consumer-financial-information-following-widespread-data.
• “The Gramm-Leach-Bliley Act of 1999 (GLBA).” Investopedia, 19 Feb. 2022, www.investopedia.com/terms/g/glba.asp.
• National Archives and Records Administration. “Part 314 Standards for Safeguarding Customer Information.” Code of Federal Regulations, Title 16, Code of Federal Regulations, 6 Sept. 2022, www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314#314.2.