Gramm-Leach-Bliley Financial Modernization Act (GLBA)

GLBA stands for the Gramm-Leach-Bliley Act, a U.S. federal law enacted in 1999. Its official title is the “Gramm-Leach-Bliley Financial Modernization Act.” The primary purpose of GLBA is to promote the integration of financial services, such as banking, securities, and insurance, while ensuring the privacy and security of consumers’ nonpublic personal information.

The key provisions of the GLBA include:

1. Privacy Rule: This rule mandates that financial institutions inform their customers about their information-sharing practices and allow customers to opt out of having their non-public personal information shared with certain third parties.

2. Safeguards Rule: The Safeguards Rule obliges financial institutions to develop, implement, and maintain a comprehensive information security program to protect the security and confidentiality of customers’ nonpublic personal information.

3. Pretexting Provisions: The GLBA prohibits individuals from using false pretenses to obtain the personal information of customers from financial institutions.

The GLBA is monitored and enforced by several regulatory agencies, depending on the type of financial institution involved:

1. Federal Trade Commission (FTC): The FTC has primary enforcement authority for financial institutions that are not subject to the oversight of other federal regulators. This includes certain types of financial institutions, such as mortgage lenders, payday lenders, and non-depository lenders.

2. Office of the Comptroller of the Currency (OCC): The OCC oversees and enforces GLBA compliance for national banks and federal savings associations.

3. Federal Reserve System (FRS): The FRS monitors and enforces GLBA compliance for state-chartered banks that are members of the Federal Reserve System.

4. Federal Deposit Insurance Corporation (FDIC): The FDIC is responsible for monitoring and enforcing the GLBA compliance for state-chartered banks that are not members of the Federal Reserve System and state-chartered savings banks.

5. National Credit Union Administration (NCUA): The NCUA oversees and enforces GLBA compliance for credit unions.

6. Securities and Exchange Commission (SEC): The SEC is responsible for regulating and enforcing GLBA compliance for broker-dealers and registered investment advisors.

Financial institutions subject to the GLBA include banks, credit unions, securities firms, insurance companies, and other entities that offer financial products and services to consumers. These institutions must comply with the provisions outlined in the GLBA to protect the privacy and security of their customers’ personal information.

Connect with our Certified Data Privacy Experts to assess your controls and prove your compliance with GLBA. Our engagement options are ideal for organizations of all sizes with and without an experienced in-house IT team. Connect with an expert or schedule a consultation to explore the option that is best for your organization.