GLBA compliance in plain English for financial firms

What is glba compliance?

The Gramm-Leach-Bliley Act (GLBA) is a federal law that governs how financial institutions handle the private information of their customers. For a small financial firm, glba compliance means being transparent about what data you collect and how you keep it safe. The law is split into two main parts: the Privacy Rule and the Safeguards Rule.

The Privacy Rule is about honesty. You must tell your customers what information you collect, who you share it with, and how you protect it. The Safeguards Rule is about action. It requires you to build a security program that actually keeps that data from falling into the wrong hands. Together, they ensure that consumers can trust the financial system with their most personal details.

The GLBA Privacy Rule: transparency first

Under the Privacy Rule, you must provide a 'Privacy Notice' to your customers. This document must be clear and easy to read. It should explain what information you collect—such as income, credit history, or social security numbers—and who you share it with. Most importantly, you must give customers the right to 'opt-out' of sharing their information with non-affiliated third parties.

• Deliver a privacy notice when a customer relationship is established.
• Provide an updated notice every year if your practices change.
• Clearly explain how a customer can opt-out of data sharing.
• Ensure your notice is available in a way the customer can keep, like a printed letter or a PDF.

The GLBA Safeguards Rule: building your defense

While the Privacy Rule is about what you say, the Safeguards Rule is about what you do. It requires financial institutions to develop a written information security plan. This plan must describe how your firm protects customer information. The plan should be tailored to the size of your firm and the kind of data you handle.

1. Identify the risks to customer information in each area of your operation.
2. Design and implement a safeguard program to manage those risks.
3. Regularly test and monitor the effectiveness of your safeguards.
4. Select service providers that can maintain your security standards and hold them to it via contract.
5. Adjust your program as your business changes or new threats emerge.

Who counts as a 'financial institution'?

The definition of a 'financial institution' under GLBA is broader than many realize. It includes not just banks, but also check-cashing businesses, mortgage brokers, non-bank lenders, personal property appraisers, and even some firms that provide financial or investment advice. If you are 'significantly engaged' in financial activities, you need to look closely at your glba compliance requirements.

Protecting information from 'Pretexting'

GLBA also includes provisions to protect against 'pretexting.' This is when someone tries to get private information by lying about who they are. They might call your office pretending to be a customer or a government official. Your glba compliance program must include training for employees to recognize and stop these social engineering attacks. Verifying the identity of anyone asking for sensitive data is a mandatory part of the job.

The role of the Qualified Individual

Recent updates to the Safeguards Rule require that you appoint a 'Qualified Individual' to oversee your security program. This person is responsible for the overall health of your data protection efforts. They must report to your leadership at least once a year, ensuring that security is a priority for the entire business, not just the IT department.