Is your organization one of the 83% that will be out of compliance and exposed to risk?

APFT can assist your company with Gramm- Leach- Bliley Act (GLBA) Consumer Privacy Compliance. We provide complete audits and identify non-compliance risks throughout your organization. Contact Us today.

Overview: The topic of Consumer Privacy Regulations is an extremely hot topic and has increasingly been brought to the forefront as the proliferation of businesses interact via new mediums, including but not limited to, the Internet and e-commerce. With more and more traditional brick-and-mortar businesses, financial institutions, insurance providers, health care organizations, and e-commerce companies collecting, utilizing, and often selling vast amounts of data about "consumers" and "customers", legislators have begun to regulate the use of such data with the goal of protecting consumer privacy. Implementation and compliance of state privacy laws and GLBA will continue to make headlines as the July 1, 2001 compliance deadline quickly approaches.

March 14, 2001 – The OCC announced that Federal banking agencies have stated that any final Fair Credit Reporting Act rule will not require depository institutions to revise Gramm Leach Bliley Act privacy notices prepared in reliance on existing FCRA law and delivered to consumers before next January.http://www.occ.treas.gov/ftp/release/2001-30.txt

March 14, 2001 - The Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System, the Office of the Comptroller of the Currency, and the Office of Thrift Supervision have jointly approved and issued guidelines establishing standards for safeguarding customer information as required by the Gramm-Leach-Bliley Act (GLBA). Press Release: http://www.fdic.gov/news/news/financial/2001/fil0122.html  Guidelines: http://www.fdic.gov/news/news/financial/2001/fil0122a.html 

Privacy regulations will become mainstream for all industries. Businesses will need to ensure that all business policies, practices, and procedures, including their business model, will be in compliance with both state privacy regulations and the GLBA.

Privacy Protections For Information collected by Financial Services

Main Issue: What privacy protections should exist for consumers and customers who divulge certain "nonpublic personal information" to financial service entities, including insurance companies?

IT IS IMPORTANT BECAUSE: Title V of the Gramm-Leach-Bliley (GLB) Act (Public Act 106-102) states that each financial institution (the definition includes insurers) has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of the "nonpublic personal information" of such customers. It is important the regulations for the different financial institutions are uniform so a level playing field for the sale and marketing of all financial services products can be preserved. As part of its obligation to consumers and its customers under Title V, each financial institution must:

Title V requires federal banking regulators and state insurance regulators to finalize the necessary regulations by May 2000, so the law can be implemented by November 2000. The GLB Act also states that any Title V regulations cannot supersede or preempt any state laws that offer greater privacy protection. This has prompted some states to introduce legislation this year that expand privacy definitions to include "publicly available information" such as a consumer's name, address and telephone number. In addition, Members of Congress have introduced legislation to expand the privacy protections beyond those in the GLB Act.

Proposed Legislation to expand the GLBA of Nov 12, 2000:

Uniform Regulations: The regulations should be uniform in their interpretation of such definitions as "nonpublic personal information" and in how specific requirements are to be enforced. While uniformity should be the watchword, slight differences should be duly noted for certain business practices and terminology that are unique to banks, securities firms and insurers.

Initial Notices: Title V requires a financial institution to provide an initial notice of its privacy policy and practices to customers prior to establishing a customer relationship and to consumers at the time of or prior to, providing them with a financial product or service. Regulators should develop specific and practical guidelines for when the privacy notices should be given to customers and consumers. Without such specificity, the administrative costs and burden of complying with this requirement could be enormous.

Manner of Providing Notice: Regulators should provide examples of how privacy notices are given to customers and consumers, but the regulations should allow the financial institutions some flexibility on how to comply with a given provision. Sending a notice to a consumer or customer should suffice as meeting the notice requirement. The regulation should not require that the notice be sent by certified mail or require an acknowledgement from the customer or consumer.

Annual Notice: The law requires privacy notices to be sent to customers at least once annually. Notices should not be provided where the financial institution and customer no longer have a continuing relationship. The regulations should provide specific examples of what constitutes a continuing relationship. Content of Notices: Certain elements are required in the initial and annual privacy notices. They include the categories of "nonpublic personal information" the financial institution collects and discloses; the financial institution's policy for disclosing this information to affiliates and nonaffiliated third parties; and the instructions on how consumers or customers can opt-out of any disclosure to a nonaffiliated third party. Given the short timeline for this regulation, NAMIC believes the regulation should have "model" notices to help insurers comply with the regulation by November 2000.

Opt-Out Provisions: The obligation to provide an opt-out notice applies to all consumers, even if no customer relationship is established and generally applies to all nonpublic personal information, regardless of whether the financial institution collected it before or after the consumer's opt-out direction. This is a particularly onerous requirement, and NAMIC believes the final regulations should limit the opt-out provision to those situations where only a customer relationship is established. The timeframe for a consumer to respond to an opt-out notice should be 30 days.

What has happened so far? Federal banking regulators issued "draft" regulations in January and February and are currently reviewing comments from interested parties, including NAMIC.

The National Association of Insurance Commissioners (NAIC), meanwhile, appointed a committee in December, co-chaired by Commissioners Glenn Pomeroy of North Dakota and Kathleen Sebelius of Kansas, to determine how insurance regulators should address Title V. In January, the committee solicited comments from interested parties on the elements that should be considered in insurance privacy regulation. In March, the NAIC held a public hearing in Chicago where several speakers, including representatives from NAMIC, urged regulators to become more engaged in the federal regulation drafting process and to draft their own privacy regulation that was uniform among states and consistent with federal regulations. At this writing, the committee was still trying to decide whether to pursue its own regulation now, or to wait for the final federal regulations.

One other complication is Sec. 507(b) of Title V. It allows a state to enact a privacy statute that exceeds Title V. At least 20 states, at the urging of their state attorneys general, have introduced legislation this year to broaden the GLB privacy provisions.

As of this writing, it appears that each type of entity, including but not limited to, the Federal Trades Commission, Security Exchange Commission, State governments, FRB, FDIC, OCC, OTS are adopting their own policies and rules: Each organization is in the process of implementing the GLBA with the following regulations:

FDIC FINAL RULING:

FTC FINAL RULING:

FRB, FDIC, OCC, OTS JOINT FINAL RULING:

BANK RULES CHART

LAW FIRM & OTHER REPORTS ON GLBA IMPLEMENTATION:

LLGM contains Executive Summary HIGHLY RECOMMENDED READING
LLGM contains state-by-state proposed legislation HIGHLY RECOMMENDED READING
Schenck, Price, LLP

Additionally, most agencies have a "request for comment" sent out to most banks and financial institutions. Some of these "comment" letters are linked in the charts below:

Laws, Legislation & Regulations on Privacy

Information Resources on Privacy Rules