The Gramm-Leach-Bliley Act is a U.S. federal law created to control how financial institutions deal with a consumer’s non-public personal information (NPI). This is information that a financial institution collects when providing a financial product or service that can identify an individual and that isn’t otherwise publicly available.
- The Privacy Rule, which regulates the collection and use of NPI
- The Safeguards Rule, which requires financial institutions to implement a security program to protect NPI
- Pretexting provisions, which prohibits access to NPI under false pretense
- Ensuring the security and confidentiality of NPI
- Protecting against unauthorized access which could cause substantial harm or inconvenience to any customer
- Protecting against any threats which might affect the security or integrity of NPI
GLBA applies to all businesses, regardless of size, that are “significantly engaged” in providing financial products or services to consumers. This includes many companies not traditionally considered to be a financial institution such as check-cashing businesses, payday lenders, mortgage brokers, nonbank lenders, personal property or real estate appraisers, retailers that issue branded credit cards, professional tax preparers, and courier services. The law also applies to companies like credit reporting agencies and ATM operators that receive information about customers of other financial institutions. GLBA compliance is mandatory. Whether or not a financial institution discloses NPI, there must be a policy in place to protect the information from foreseeable threats in security and data integrity.
GLBA calls for severe civil and criminal penalties for noncompliance, including fines and imprisonment. If a financial institution violates GLBA, the following penalties may be issued:
- The institution will be subject to a civil penalty of not more than $100,000 for each violation.
- Officers and directors of the institution will be subject to, and personally liable for, a civil penalty of not more than $10,000 for each violation.
- The institution and its officers and directors will also be subject to fines in accordance with Title 18 of the United States Code or imprisonment for not more than five years, or both.