The Financial Privacy Rule

The Financial Privacy Rule is another name for the GLBA’s requirement that financial institutions must give customers and consumers the right to opt out, or not allow, a financial institution to share the customer/consumer’s information with nonaffiliated third parties prior to sharing it. (15 U.S.C. § 6802).

What is nonpublic personal information?

NPI is personally identifiable financial information that is not available in public records that (a) a consumer gives to a financial institution (b) for any transaction or service performed for the consumer, or (c) is otherwise obtained by the financial institution in relation to providing the customer with a financial product or service.

NPI includes “lists, descriptions, or grouping of consumers (and publicly available information pertaining to them)” created using nonpublic personal information.

How does the GLBA regulate information sharing?

A financial institution cannot share a consumer’s NPI with a nonaffiliated third party without first notifying the consumer and giving the consumer a chance to opt out of information sharing. The notice must be clear and conspicuous, and the consumer must be given time to review the information and say no to information sharing (15 U.S.C. § 6801).

A financial institution may not share account numbers, access numbers and access codes for credit cards, deposit accounts and the like with third parties “for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.” (15 U.S.C. § 6801) Such information may be shared with a credit reporting agency.

Are there exceptions to the GLBA privacy notice requirements?

Yes. NPI may be shared without a consumer/customer’s permission in certain cases. For example, NPI may be shared if the NPI is provided to a third party to perform services for the financial institution. In that case, the financial institution must inform the consumer about the information-sharing arrangement and that there is a confidentiality agreement protecting the information between the financial institution and the nonaffiliated third party (15 U.S.C. § 6802.)

For a full list of exceptions, review the GLBA, specifically 15 U.S.C. § 6802, and consult with legal counsel.

What is the difference between a customer and a consumer?

A consumer is an individual who receives or has received a financial product or service from a financial institution mainly for personal, family or household purposes. An example is a person who cashes “a check at a check-cashing company,” or a person who makes a wire transfer at a financial institution.

A consumer becomes a customer when there is a continuing customer relationship between a financial institution and the consumer. All customers are consumers. A customer includes a person who opens “a credit card account with a financial institution,” an individual who leases “an automobile from an auto dealer,” or a person who obtains “the services of a tax preparer or investment adviser.”

What are the privacy notice requirements for consumers?

Consumers do not have an on-going relationship with the financial institution. The only time a financial institution must give a consumer a privacy notice is consumer if the financial institution wants to share the consumer’s nonpublic personal information with a nonaffiliated third party. In that case, the financial institution must provide the consumer with a privacy notice with information about how to opt-out from information sharing before the financial institution shares any information. If the consumer does not exercise the opt-out right, the financial institution is free to share the consumer’s nonpublic personal information with nonaffiliated third parties.

What are the privacy notice requirements for customers?

Customers have an on-going relationship with a financial institution. For customers, financial institutions must provide an initial privacy notice at the start of the customer relationship and provide annual privacy notices.

A privacy notice describes the financial institution’s policies and practices for sharing nonpublic personal information with nonaffiliated and affiliated third parties, and includes:

The categories of persons to whom the information is or may be shared with.
The financial institution’s policies and practices for sharing information about customers who stop being customers.
The type(s) of nonpublic personal information that the financial institution collects.
How the institution protects the confidentiality and security of nonpublic personal information.
Any other information required under section 603(d)(2)(A) of the Fair Credit Reporting Act (FCRA).

What is a nonaffiliated third party?

A party that is not related by common ownership or corporate control.

Under the GLBA, financial institutions must give consumers and customers a privacy notice with opt-out rights if they want to share nonpublic personal information with nonaffiliated third parties.

Can a nonaffiliated party that receives information share the information with another nonaffiliated party?

Yes, but only if the financial institution who provided the information to the nonaffiliated third party could have shared the information with the second nonaffiliated third party directly.

Is a model privacy form available and what is safe harbor?

Yes, a model privacy form is available. If an institution uses the model privacy form, the institution “obtains a “safe harbor” and will satisfy the disclosure requirements for notices” (FTC, Federal Regulators Issue Final Model Privacy NoticeForm, published Nov. 19, 2009).

For more context about why and how a model privacy form was developed, see the Supplemental Information section of the Final Model Privacy Form under the Gramm-Leach-Bliley Act Rule. In 2006, the Financial Services Regulatory Relief Act amended the GLBA. The Relief Act amendment directed financial regulatory agencies to collaborate and develop a model privacy notice. In 2009, eight regulatory agencies amended each of their rules to adopt a model privacy form.

Can a financial institution post its annual privacy notice online?

Yes — if the financial institution meets certain requirements, the institution may use an alternative method for delivering annual privacy notices. This alternative method does not apply to financial institutions regulated by the Securities and Exchange Commission, Commodity Futures Trading Commission or Federal Trade Commission.

In general, financial institutions regulated by the Bureau of Consumer Financial Protection may use an alternative delivery method if the financial institution will not share nonpublic personal information in a manner that will trigger GLBA opt-out rights, and if the financial institution uses the model form or model privacy notice (see 76 FR 79025, Dec. 21, 2011).

What is the FAST Act and how does it affect annual privacy notice requirements?

The FAST Act, or Fixing America’s Surface Transportation Act, became law in December 2015. Under the FAST Act’s “Eliminate Privacy Notice Confusion” section (§75001), financial institutions may skip the requirement of providing an annual privacy notice under certain circumstances. In general, a financial institution does not need to send an annual privacy notice if the financial institution shares NPI under limited circumstances and if the financial institution has not changed its privacy policy and practices from that described in the financial institution’s most recent privacy notice.

How is the Fair Credit Reporting Act related to the GLBA?

The Fair Credit Reporting Act is a U.S. federal privacy law that applies to consumer reporting agencies and consumer report information (e.g., information affecting a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living that is used or expected to be used for reasons including assessing credit worthiness). The FCRA gives consumers an opt-out right for information shared with both affiliated and nonaffiliated third parties whereas the GLBA gives consumers an opt-out right for information shared with nonaffiliated third parties only.

Determine whether your financial institution is defined as a consumer reporting agency under the FRCA; if so, privacy requirements for both laws apply.

The Safeguards Rule

What is it?

In 2006, the Financial Services Regulatory Relief Act (Relief Act) amended the GLBA. The Relief Act amendment directed financial regulatory agencies to collaborate and develop a model privacy notice. In 2009, eight regulatory agencies amended each of their rules to adopt a model privacy form.

For more context about why and how a model privacy form was developed, see the Supplemental Information section of the Final Model Privacy Form under the Gramm-Leach-Bliley Act Rule.

Can a financial institution post its annual privacy notice online?

Yes — if the financial institution meets certain requirements, the institution may use an alternative method for delivering annual privacy notices. This alternative method does not apply to financial institutions regulated by the Securities and Exchange Commission, Commodity Futures Trading Commission or Federal Trade Commission.

In general, financial institutions regulated by the Bureau of Consumer Financial Protection may use an alternative delivery method if the financial institution will not share nonpublic personal information in a manner that will trigger GLBA opt-out rights, and if the financial institution uses the model form or model privacy notice (see 76 FR 79025, Dec. 21, 2011).

What is the FAST Act and how does it affect annual privacy notice requirements?

The FAST Act, or Fixing America’s Surface Transportation Act, became law in December 2015. Under the FAST Act’s “Eliminate Privacy Notice Confusion” section (§75001), financial institutions may skip the requirement of providing an annual privacy notice under certain circumstances. In general, a financial institution does not need to send an annual privacy notice if the financial institution shares NPI under limited circumstances and if the financial institution has not changed its privacy policy or practices from that described in the financial institution’s most recent privacy notice.

How is the Fair Credit Reporting Act related to the GLBA?

The Fair Credit Reporting Act is a U.S. federal privacy law that applies to consumer reporting agencies and consumer report information (e.g., information affecting a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living that is used or expected to be used for reasons including assessing credit worthiness). The FCRA gives consumers an opt-out right for information shared with both affiliated and nonaffiliated third parties whereas the GLBA gives consumers an opt-out right for information shared with nonaffiliated third parties only.

If your financial institution is defined as a consumer reporting agency under the FRCA, privacy requirements for both laws apply.

Privacy Protection for Customer Information

What is pretexting and how does the GLBA regulate the fraudulent access of financial information?

Pretexting involves a person making up a story and tricking another person into providing nonpublic information.

Under the GLBA, a person may not obtain or try to obtain customer information about another person “by making a false, fictitious, or fraudulent statement or representation to an officer, employee,” agent, or customer of an institution (15 U.S.C. § 6821). The GLBA also prohibits a person from knowingly using “forged, counterfeit, lost, fraudulently obtained” documents to obtain consumer information (Id.).

Regulatory agencies enforce this regulation against pretexting and fraudulent access of financial information. Individuals who “knowingly and intentionally violate” or “attempt to violate” the regulation may be fined, imprisoned, or both.

Search resources

All IAPP resources

Filter results

Resource type

Subject

Industry

Law and regulation

Domain

The development of user-centered designs for privacy technology

Discussing the Privacy Engineering Master’s curriculum at Carnegie Mellon

In Memoriam: Giovanni Buttarelli, 1957–2019

An overview of the IAPP Privacy Law Specialist designation

How Privacy Tech Is Bought and Deployed Report 2019

An overview of IAPP Live Online Privacy Training

Strategic Privacy by Design

Data integrity as a method for preserving democracy

Benchmarking Metrics and KPIs

UK ICO Elizabeth Denham talks GDPR enforcement priorities, Brexit

Guide to the Gramm-Leach-Bliley Act

The future of digital professions: The Cyber Pro

Brendon Lynch on his Vanguard Award win

IAPP 2017 Leadership Award winner Marc Groman discusses his privacy career

Data Mapping: How to Do It & Why It Matters

Embedding Privacy by Design

Privacy In Art: Orwell's 1984

PIAs and Data Mapping – Operationalizing GDPR and Privacy by Design

Building a Program that Provides Value

How to get hands-on with your data