Understanding GLBA: A Framework for Financial Security

The Gramm-Leach-Bliley Act (GLBA) is a U.S. federal law that requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. For any company that handles financial information, understanding and complying with GLBA is not just a legal requirement but a crucial step in building customer trust. The framework is divided into three main sections.

1. Financial Privacy Rule

The Privacy Rule requires financial institutions to provide customers with a privacy notice at the beginning of the customer relationship and annually thereafter. This notice must explain what information the company collects about the customer, where that information is shared, and how the company protects it. It also gives customers the right to opt-out of some information-sharing practices.

2. Safeguards Rule

The Safeguards Rule is arguably the most critical component from a cybersecurity perspective. It requires financial institutions to develop, implement, and maintain a comprehensive security program to protect the confidentiality and integrity of customer information. This includes designating an employee to coordinate the program, identifying risks, and implementing security controls to address those risks. The Safeguards Rule is broken down into three key categories of safeguards:

• Administrative Safeguards: These are the management-level controls that create a formal security program. This includes designating a security coordinator, conducting risk assessments, and training employees on security best practices.
• Technical Safeguards: These are the technology-based controls used to protect information. Examples include access controls, encryption, intrusion detection systems, and secure disposal of data.
• Physical Safeguards: These controls address the physical security of systems and data. This can include securing physical spaces with locks or alarms and controlling access to data centers and server rooms.

3. Pretexting Provisions

The Pretexting Provisions protect consumers from individuals who obtain their personal financial information under false pretenses (pretexting). These rules make it illegal to impersonate someone else or to misrepresent your identity in order to obtain personal financial information from a financial institution or a consumer.