A deep discovery foundation provides real insight into your data so you can better protect it and maintain full compliance. Some common customer relationships include:GLBA consists of three sections, each establishing a different rule:The Financial Privacy Rule (or just the Privacy Rule) mainly concerns disclosure of practices. To comply with the rule, companies must develop a written information security plan that describes how they protect their data.Some of the protections they need to provide involve:Companies must also secure private information against unauthorized access and track user activity, including any attempts to access protected records.The specific requirements vary depending on the company’s size, complexity, and circumstances, but they’re all designed to ensure that financial institutions address risks to customer information across all areas of their operation, in particular:The Pretexting Prohibition basically amounts to: don’t lie to institutions or customers to obtain information.Pretexting involves collecting information under false pretenses or knowingly convincing customers to divulge information in the context of a made-up story. §§ 6801–6809) A bank must give to a customer, at the time of establishing the customer relationship and annually thereafter, a notice informing the customer of the bank’s privacy policies and practices. Definition: A "customer" is a consumer who has a "customer relationship" with a financial institution. The Notice requirements may vary. B. governs the treatment of nonpublic personal information about consumers by financial institutions. Get unmatched data discovery for PI / PII and sensitive data with BigID’s patented Discovery-in-Depth technology A "customer relationship" is a continuing relationship with a consumer. “Consumer” is a broader category, encompassing customers. (The Safeguards Rule applies to information of any consumers past or present of the financial institution's products or services.) State law can require greater compliance, but not less than what is otherwise required by the GLB. This plan must include: Retail banks, for example, do not tend to buy insurance underwriters, as they seek to engage in a more profitable business of insurance brokerage by selling products of other insurance companies. [I]f GLB was the problem, the crisis would have been expected to have originated in Europe where they never had Glass–Steagall requirements to begin with. Under the GLBA, all customers are consumers, but not all consumers are customers. The law applies to many types of financial institutions. BigID goes beyond that, leveraging patented machine learning technology including NLP and deep learning We automatically classify regulated data — including NPI and PI — to help you enforce its proper handling. “Consumers” vs. “Customers” Under GLBA, “customer” and “consumer” are not used interchangeably. The regulation additionally limits the disclosure of NPI to nonaffiliated third parties.This means that financial institutions must notify customers about their information-sharing practices and inform customers of their right to “opt out” of having their data shared.The Federal Trade Commission (FTC) is the main agency that enforces the GLBA. "Special Rule" for Loans: The customer relationship travels with ownership of the servicing rights.The privacy notice must also explain to the customer the opportunity to 'opt out'. Independent Rep. Congressional voting records on Gramm–Leach–Bliley ActCredit by Banks and Persons Other Than Brokers or Dealers for the Purpose of Purchasing or Carrying Margin Stock (Reg U) For example, (Subtitle A: Disclosure of Nonpublic Personal Information, codified at The Financial Privacy Rule requires financial institutions to provide each consumer with a privacy notice at the time the consumer relationship is established and annually thereafter. The exemption allows for information that is already “collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act.”However, CCPA covers a wider range of information, Financial institutions are also subject to the right of private action that CCPA covers, which is the right of consumers to seek statutory damages in the event of a breach.Ensuring the confidentiality and security of consumers’ data requires building a modern privacy framework that can quickly respond to GLBA, CCPA, and all regulatory requirements that impact financial institutions.Managing, securing, and reporting on data starts with knowing what you have, where it lives, who it belongs to, why you collected it in the first place, and so on.
State laws can require greater compliance, but not less than what’s required by the GLBA.The GLBA protects nonpublic personal information, which is any personally identifiable financial information that is not otherwise publicly available.NPI may include names, addresses, phone numbers, social security numbers, bank and credit card account numbers, credit or debit card purchases, court records from a consumer report, or any other consumer financial information that:NPI does not include information that has been made publicly available or widely distributed in the media or public government records.To determine that a piece of information is not NPI, an organization needs to ensure it’s something that’s made lawfully available to the public generally, and that the individual has not opted to keep the information private, given the choice.Companies can share NPI with affiliated and non-affiliated third parties, provided customers and consumers have been informed according to the provisions of the regulation.The GLBA defines “financial institutions” as companies that are “significantly engaged” in providing financial products or services — such as loans, financial or investment advice, insurance, etc. Title V, Subtitle A of the Gramm-Leach-Bliley Act (“GLBA”) 1 .
GLBA became law in 1999. Distinction between "consumer" and "customer". Move beyond policy and process to data-centric privacy compliance and automation