United States
Hong KongGramm-Leach-Bliley privacy rules
The Gramm-Leach-Bliley Act requires a privacy notice at the start of a customer relationship and annually afterwards, an opt-out from sharing with non-affiliated third parties, and safeguards protecting customer information.
Passed in 1999, and the reason every financial institution sends a privacy notice nobody reads.
The notice requirements
An initial privacy notice at the start of the customer relationship, and an annual notice thereafter.
The notice describes what information is collected, who it is shared with and how the customer may limit that sharing.
The opt-out
A customer may opt out of sharing non-public personal information with non-affiliated third parties.
Non-affiliated is the operative word. Sharing with affiliates is treated differently and is not covered by the same opt-out.
It does not cover sharing necessary to service or process the transaction the consumer requested. A lender may send information to a servicer without an opt-out applying, because the customer asked for the loan.
The Safeguards Rule
A written information security program protecting customer information, appropriate to the size and complexity of the institution.
It covers administrative, technical and physical safeguards - which in practice means access controls, encryption, staff training and secure disposal.
What counts as non-public personal information
Personally identifiable financial information a consumer gives to obtain a product, that results from a transaction, or that the institution otherwise obtains.
A social security number, an account balance, the fact somebody applied for a mortgage. Publicly available information is outside it.
How this sits with the other privacy rules
FCRA governs consumer reports. The Do Not Call rules govern telephone solicitation. Gramm-Leach-Bliley governs what an institution does with information it already holds.
Three regimes, three purposes, one exam area.
Common questions
What does the Gramm-Leach-Bliley Act require?
A privacy notice at the start of a customer relationship and annually after, an opt-out from non-affiliate sharing, and safeguards protecting customer information.
Can a customer opt out of all information sharing?
No. The opt-out covers non-affiliated third parties and does not cover sharing needed to service the transaction they requested.
What is the Safeguards Rule?
A requirement for a written information security program with administrative, technical and physical protections.
What is non-public personal information?
Personally identifiable financial information obtained from the consumer, from a transaction, or otherwise. Publicly available information is excluded.
How often is the privacy notice required?
At the start of the relationship and annually afterwards.