GLBA

Who it applies to

Financial institutions, broadly defined to include banks, lenders, brokers, insurers and many non-bank businesses offering financial products or services.

Key requirements

• Financial Privacy Rule: privacy notices and opt-out rights for certain sharing with non-affiliated third parties.
• Safeguards Rule: a written information security program with a designated qualified individual.
• Risk assessment, access controls, encryption, multi-factor authentication and monitoring under the FTC Safeguards Rule.
• Oversight of service providers.
• Pretexting protections against obtaining customer information under false pretences.

Breach and incident notification

Under the FTC Safeguards Rule, a notification event involving unencrypted information of at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery. Banking regulators have their own incident notification rules.

Penalties

Enforced by the FTC and banking regulators through civil penalties and orders; amounts depend on the regulator and the violation.

Go deeper