The reasoning of the Supreme Court of the United States in the case referred to in paragraph (1) with respect to sections 20 and 32 of the Banking Act of 1933 (as in effect prior to the date of the enactment of the Gramm-Leach-Bliley Act) shall continue to apply to subsection (bb) of section 18 of the Federal Deposit Insurance Act (as added by subsection (a) of this section) except to the extent the scope and application of such subsection as enacted exceed the scope and application of such sections 20 and 32. Subsection (a) of section 206 of the Gramm-Leach-Bliley Act (15 U.S.C. Section 8(c) of the International Banking Act of 1978 (12 U.S.C. Gramm Also, Sections 131-133 of the Act (15 U.S.C. Because you are a member of panel, your positions on legislation and notes below will be shared with the panel administrators. But the framers of the law correctly foresaw that by loosening existing banking regulations, they were opening the door to the creation of huge, sprawling firms offering an array of services ranging from checking accounts to high-end investmentsand that these companies would have access to huge amounts of customer information. 314.4(c)). Section 4 of the Bank Holding Company Act of 1956 (12 U.S.C. 0000007171 00000 n 0000007438 00000 n 78c note) is amended. Under the Standards of Administrative Capability at 34 C.F.R. Learn more about your rights as a consumer and how to spot and avoid scams. Federal government websites often end in .gov or .mil. CSO |. Pub. trailer << /Size 134 /Info 110 0 R /Encrypt 114 0 R /Root 113 0 R /Prev 102438 /ID[<5846b0805e7089b473388c4c36e8c2e1>] >> startxref 0 %%EOF 113 0 obj << /Type /Catalog /Pages 98 0 R /Metadata 111 0 R /JT 109 0 R >> endobj 114 0 obj << /Filter /Standard /R 2 /O (~}!P RZW#YvN.\n) /U (MvY_E^PJ.+w) /P -12 /V 1 /Length 40 >> endobj 132 0 obj << /S 437 /T 505 /Filter /FlateDecode /Length 133 0 R >> stream Subsection (j) of section 4 of the Bank Holding Company Act of 1956 (12 U.S.C. ), was designed to regulate the disclosure and protection of nonpublic personal information (NPI) collected by a financial institution from an individual in order to obtain a financial product or service from the institution for personal, family, or The text of the bill below is as of Apr 19, 2023 (Introduced). <>/ExtGState<>>> GrammLeachBliley Act Text Prohibition on officers, directors and employees of securities firms service on boards of depository institutions. Title V, subtitle A, of this Act (15 U.S.C. 314.4(b)). 1338. 314.4(a)). ); (3)AAa covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 C.F.R. Section 728 of the Regulatory Relief Act directs the agencies named in Section 504(a)(1) of the GLB Act, 15 U.S.C. Part 314. WebText for S.900 - 106th Congress (1999-2000): Gramm-Leach-Bliley Act. S. 1179. to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer. An insured depository institution may not be or become an affiliate of any broker or dealer, any investment adviser, any investment company, or any other person engaged principally in the issue, flotation, underwriting, public sale, or distribution at wholesale or retail or through syndicate participation of stocks, bonds, debentures, notes, or other securities. Slaughter, FTC Safeguards Rule: What Your Business Needs to Know, FTC's Privacy Rule and Auto Dealers: FAQs, How To Comply with the Privacy of Consumer Financial Information Rule of the Gramm-Leach-Bliley Act, Compliance deadline for certain revised FTC Safeguards Rule provisions extended to June 2023, New publication offers guidance on revised FTC Safeguards Rule, Updating you on FTC privacy and data security initiatives, Corporate boards: Dont underestimate your role in data security oversight, Application of Title V, Subtitle A, of the G-L-B Act, and of the Commission's Privacy Rule, to Attorneys At Law, Ascension Data & Analytics, LLC, In the Matter of, LightYear Dealer Technologies, LLC, In the Matter of, FTC v. Global Mortgage Funding, Inc., et al., SACV 02-1026 DOC, __________________, a minor, also known as _______________, by his parent ____________, Fajilan and Associates, Inc., also d/b/a Statewide Credit Services, In the Matter of, James B. Nutter & Company, a corporation, in the Matter of, Premier Capital Lending, Inc., et al., In the Matter of, American United Mortgage Company., United States of America (for the FTC), Nations Title Agency, Inc., Nations Holding Company, and Christopher M. The distinguishing feature of this kind of attack is that the scam artists comes up with a storyor pretextin order to fool the victim. Amendment by Pub. This Act may be cited as the Return to Prudent Banking Act of 2023. As the name suggests, the purpose of the Federal Trade Commissions Standards for Safeguarding Customer Information the Safeguards Rule, for short is to ensure that entities covered by the Rule maintain safeguards to protect the security of customer information. Contributing writer, For example, consumers who aren't customers are only entitled to privacy and opt-out notices if an institution makes specific plans to share those consumers' data with third parties; customers have these rights as soon as they establish a customer relationship. WebGramm-Leach-Bliley Act Tags: Consumer Protection Mission Consumer Protection Law Pub. Before the GLBA, these kinds of scams could only be prosecuted under other laws about fraud or false pretenses that didn't always exactly match up with attackers' specific techniques. e,B endstream endobj 125 0 obj << /Type /Font /Subtype /Type1 /FirstChar 32 /LastChar 248 /Widths [ 250 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 551 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 500 551 ] /Encoding 123 0 R /BaseFont /OPPKBP+BGsddV01 /FontDescriptor 126 0 R /ToUnicode 124 0 R >> endobj 126 0 obj << /Type /FontDescriptor /Ascent 724 /CapHeight 806 /Descent 8 /Flags 6 /FontBBox [ 0 -111 518 733 ] /FontName /OPPKBP+BGsddV01 /ItalicAngle 0 /StemV 42 /XHeight 725 /StemH 54 /CharSet (EcekzW^H~{) /FontFile3 122 0 R >> endobj 127 0 obj << /Type /ExtGState /SA false /SM 0.02 /OP false /BG 131 0 R /UCR 128 0 R /TR /Identity >> endobj 128 0 obj << /FunctionType 0 /Domain [ 0 1 ] /Range [ -1 1 ] /BitsPerSample 16 /Size [ 256 ] /Length 670 /Filter [ /ASCII85Decode /FlateDecode ] >> stream 1445, provided that: to insure the security and confidentiality of customer records and information; to protect against any anticipated threats or hazards to the security or integrity of such records; and. 314.4(h)). WebThe Gramm Leach Bliley Act (GLBA) is a comprehensive, federal US law enacted to control the way financial institutions handle customers personal information. To repeal certain provisions of the Gramm-Leach-Bliley Act and revive the separation between commercial banking and the securities business, in the manner provided in the Banking Act of 1933, the so-called Glass-Steagall Act, and for other purposes. endobj Gramm-Leach-Bliley Act rZ The current information security requirements that institutions must meet are the GLBA Safeguards Rule requirements at 16 C.F.R. Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. An institutions or servicers written information security program must include the following nine elements included in the FTCs regulations: Element 1: Designates a qualified individual responsible for overseeing and implementing the institutions or servicers information security program and enforcing the information security program (16 C.F.R. Act 2. 1. We hope to make GovTrack more useful to policy professionals like you. Consumer Financial Protection 1843(j)) is amended to read as follows: Approval for certain post-1970 subsection (c)(8) activities. Repeal of Gramm-Leach-Bliley Act provisions. Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. The Comptroller of the Currency, after opportunity for hearing, may terminate, at any time, the authority conferred by the preceding subparagraph to continue any affiliation subject to such subparagraph until the end of the period referred to in such subparagraph if the Comptroller determines, having due regard for the purposes of this Act, that such action is necessary to prevent undue concentration of resources, decreased or unfair competition, conflicts of interest, or unsound banking practices and is in the public interest. 12 new state privacy and security laws explained: Is your business ready? Please help us make GovTrack better address the needs of educators by joining our advisory group. GRAMMLEACHBLILEY ACT - Congress The Act also limits the sharing of account number information for marketing purposes. Youre more than a vote, so support GovTrack today with a tip of any amount: Or keep using GovTrack for free! On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations (Final Rule) to amend the Standards for Safeguarding Customer Information (Safeguards Rule), an important component of the Gramm-Leach-Bliley Acts (GLBA) requirements for protecting the privacy and personal information of consumers. Gramm-Leach-Bliley Act It is the policy of the Congress that each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers nonpublic personal information. 15 U.S. Code 6801 - Protection of nonpublic personal The Safeguard Rule requires that any institutions covered by the GLBA protect, via administrative, technical, and physical means, the confidentiality, integrity, and security of any nonpublic personal information that institution retains. Sometimes they are a way of recognizing or honoring the sponsor or creator of a particular law (as with the 'Taft-Hartley Act'). 8 0 obj 106102, 113 Stat. See also infra discussion at section II.A. Subject to a determination under subparagraph (B), the Board of Governors of the Federal Reserve System may extend the 2-year period referred to in subparagraph (A) above from time to time as to any particular bank holding company for not more than 6 months at a time, if, in the judgment of the Board, such an extension would not be detrimental to the public interest, but no such extensions shall in the aggregate exceed 1 year. 7 0 obj If organizations don't feel that they are up to the task of assessing their own preparedness and compliance, or if they want an honest assessment from an outsider, they can pay a third-party organization to audit their compliance. The Gramm Leach Bliley Act (GLB or GLBA) was enacted in 1999. The Department intends to work with all institutions to improve their information security posture, including those that may not have yet implemented the Safeguards Rule requirements. 106-102, 113 Stat. 41 note; 12 U.S.C. Pub. In Dear CPA LetterCPA-19-01, the Office of Inspector General (OIG) explained the audit procedures for auditors to determine whether institutions were complying with GLBA. Privacy of Consumer Financial Information Rule Under the Gramm-Leach-Bliley Act A Rule by the Federal Trade Commission on 12/09/2021 Document Details Printed L. 111203, set out as a note under section 552a of Title 5, Government Organization and Employees. endobj 1843(c)(8)) is amended to read as follows: (8) shares of any company the activities of which had been determined by the Board by regulation or order under this Our Table of Popular Names is organized alphabetically by popular name. "[B&9y>2A}N"c`:s5IL[P=XR4xu w="(.lU[_ 3[aT!x,HfWZI_>2pq9:Nj!l WebAct of 1956 (12 U.S.C. 0000001610 00000 n GLBA explained: Definition, requirements, and compliance Sun Spectrum Communications Organization, Inc., et al. Subject to a determination under subparagraph (B), an appropriate Federal banking agency may extend the 2-year period referred to in subparagraph (A) from time to time as to any particular insured depository institution for not more than 6 months at a time, if, in the judgment of the agency, such an extension would not be detrimental to the public interest, but no such extensions shall in the aggregate exceed 1 year. 1787, codified at 15 U.S.C. In Dear Colleague LettersGEN-15-18andGEN-16-12, we reminded institutions about the longstanding requirements of GLBA and notified them of our intention to begin enforcing the legal requirements of GLBA through annual compliance audits. (1971)) with regard to the permissible activities of banks and securities firms, except to the extent expressly prescribed otherwise by this section. Privacy of Consumer Financial Summary of H.R.2714 - 118th Congress (2023-2024): To repeal certain provisions of the Gramm-Leach-Bliley Act and revive the separation between commercial banking and the securities business, in the manner provided in the Banking Act of 1933, the so-called "Glass-Steagall Act", and for other purposes. Are you up on what the revised Rule requires? We work to advance government policies that protect consumers and promote competition. 6801-6809, 6821-6827, Competition and Consumer Protection Guidance Documents, An Inquiry into Cloud Computing Business Practices: The Federal Trade Commission is seeking public comments. Title V boldly introduces the topic of Privacy and the Disclosure of Nonpublic Personal Information. This process will be necessary for each IP address you wish to access the site from, requests are valid for approximately one quarter (three months) after which the process may need to be repeated. If youve visited a bill page on GovTrack.us recently, you may have noticed a new study guide tab located just below the bill title. >vz6 by striking paragraph (6) and all that follows through the end of such subsection. GLBA related findings will have the same effect on an institutions participation in the Title IV programs as any other determination of non-compliance. 1831w). The law requires Part 314. SM_Y9d1`uwUN:t m^3_ . WebThe Gramm Leach Bliley Act (GLBA) is a law that applies to financial institutions and includes privacy and information security provisions that are designed to protect consumer financial 78c(a)(4)(B)) is amended, by striking clauses (i), (iii), (v), (vii), (x), and (xi); and. It is the responsibility of the organization to enforce the compliance recommendations at their discretion.". by redesignating paragraph (5) as paragraph (3). Subtitle B of title I of the Gramm-Leach-Bliley Act is amended by striking section 114 (12 U.S.C. IN THE HOUSE OF REPRESENTATIVES April 19, 2023 For instance, large educational institutions now have their GLBA compliance reviewed as part of their annual federal compliance audits that they must submit to the Department of Education. Provision allowing for exceptions after report to the Congress. Learn more about your rights as a consumer and how to spot and avoid scams. When it comes to data security and privacy compliance requirements under the GLBA, there are three main sets of regulationseach called a Rule in regulation-speakthat IT needs to worry about: the Financial Privacy Rule, the Safeguard Rule, and the Pretexting Rule. Gramm-Leach-Bliley Act (GLB Act) | EDUCAUSE Were looking for feedback from educators about how GovTrack can be used and improved for your classroom. 1 0 obj Parts 160 and 164, established under the Health Insurance WebThe Security Guidelines implement section 501 (b) of the Gramm-Leach-Bliley Act (GLB Act) 4 and section 216 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act). endobj 314.4(g)). Section 6801 et seq. Copyright 2023 IDG Communications, Inc. CSO provides news, analysis and research on security and risk management, Security and privacy laws, regulations, and compliance: The complete guide. These notices must describe the privacy practices of financial institutions, including whether and how they share customers nonpublic personal information. Institutions and servicers also sign the Student Aid Internet Gateway (SAIG) Enrollment Agreement, which states that they will ensure that all Federal Student Aid applicant information is protected from access by, or disclosure to, unauthorized personnel, and that they are aware of and will comply with all of the requirements to protect and secure data obtained from the Departments systems for the purposes of administering the Title IV programs. Pub. Lina M. Khan was sworn in as Chair of the Federal Trade Commission on June 15, 2021. Are you up on what the revised Rule requires? However, individuals have the right to choose whether the information is disclosed under the Act. Abstract. Text Short title. 1338, codified in relevant part primarily at 15 U.S.C. 0000008401 00000 n Each institution that participates in the Title IV programs has agreed in its Program Participation Agreement (PPA) to comply with the GLBA Safeguards Rule under 16 C.F.R. H.R.2714 - 118th Congress (2023-2024): To repeal certain provisions of the Gramm-Leach-Bliley Act and revive the separation between commercial banking and the securities business, in the manner provided in the Banking Act of 1933, the so-called "Glass-Steagall Act", and for other purposes. !`MBq!O!Xe=xB7p4IjPw 0jb7cZ5>$. Parts 160 and 164, established under the Health Insurance 378) is amended by adding at the end the following new subsection: For purposes of this section, the term business of receiving deposits includes the establishment and maintenance of any transaction account (as defined in section 19(b)(1)(C) of the Federal Reserve Act). Therefore, an institution that does not provide for the security of the information it needs to continue its operations would not be administratively capable. 3106(c)) is amended by striking paragraph (3). Subject to a determination under subparagraph (B), the Comptroller of the Currency may extend the 2-year period referred to in subparagraph (A) above from time to time as to any particular national bank for not more than 6 months at a time, if, in the judgment of the Comptroller, such an extension would not be detrimental to the public interest, but no such extensions shall in the aggregate exceed 1 year. q(4cY7-;xb/8" ^k 8F|$@OH4hd{}Qw2TPnvL@D\}/x(`{#AzlV}r8#$3Xlyh?/mulVHqXsBl6'O U)@P3h^IdIZVvs?L7\a H==ta<1A>OQ2fGR`?`'q_ a)0Y}XdMO}4]?q@2UtrQhp box 40751 olympia wa 98504-0751 0000003542 00000 n endobj the purposes of this Act and the Gramm-Leach-Bliley Act, the following activities as, and the extent to which such activities are, financial in nature or incidental to a financial activity: (A) Lending, exchanging, transferring, investing for. Due to aggressive automated scraping of FederalRegister.gov and eCFR.gov, programmatic access to these sites is limited to access to our extensive developer APIs. The Federal Deposit Insurance Act (12 U.S.C. ); (3)AAa covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 C.F.R. -rKER ANQ?H_aij#]Fv'E7#_#V~Fk Jn%ENi?Px&deTCQu)7n-FuzdWo/@;5F[L{v=IMbIJ Josh Fruhlinger is a writer and editor who lives in Los Angeles. This is information that a financial institution collects when providing a financial product or service that can identify an individual and that isnt otherwise publicly available. Copyright 2020 IDG Communications, Inc. The Gramm-Leach-Bliley Act (G-L-B) versus Best Practices in Network Security. Section 6801 et seq. WebGrammLeachBliley Act (GLBA), Regulation R, and Retail Nondeposit Investment Sales The Gramm-Leach-Bliley Act sets forth certain exceptions for banks from the broker-dealer registration requirements of the Securities and Exchange Act of 1934. WebV, Gramm-Leach-Bliley Act (15 U.S.C. Institutions or servicers provide a financial service when they, among other things, administer or aid in the administration of the Title IV programs; make institutional loans, including income share agreements; or certify or service a private education loan on behalf of a student. The GLBA has important implications for pretexting in a couple different respects. The site is secure. You can also find guidance regarding GLBA as well as other cybersecurity resources on the FSA Partner Connect Cybersecurity page. Each report submitted to the Congress under subsection (a) shall contain a detailed description of the basis for the determination or extension. Gramm-Leach-Bliley Act | Federal Trade Commission If you have questions about the Departments enforcement of the GLBA, please contact the Cybersecurity Team at [email protected]. One, a reference to a Public Law number, is a link to the bill as it was originally passed by Congress, and will take you to the LRC THOMAS legislative system, or GPO FDSYS site. Subject to a determination under subparagraph (B), any individual described in subparagraph (A) who, as of the date of the enactment of the Return to Prudent Banking Act of 2023, is serving as an officer, director, employee, or other institution-affiliated party of any insured depository institution shall terminate such service as soon as practicable after such date of enactment and no later than the end of the 60-day period beginning on such date. An official website of the United States government. Statement Regarding the Termination of CalPortland Companys Attempted Acquisition of Assets Owned by Rival Cement Producer Martin Marietta Materials, Inc. Is Franchising Fair? by redesignating clauses (ii), (iv), (vi), (viii), and (ix) as clauses (i), (ii), (iii), (iv), and (v), respectively. We are excited to now be on Mastodon, a social network developed by and for its users. Statement Regarding the Termination of CalPortland Companys Attempted Acquisition of Assets Owned by Rival Cement Producer Martin Marietta Materials, Inc. Is Franchising Fair? Section 21 of the Banking Act of 1933 (12 U.S.C. Help us develop the tools to bring real-time legislative data into the classroom. Sponsored item title goes here as designed, The security laws, regulations and guidelines directory, What is pretexting? Updates to the Gramm-Leach-Bliley Act Cybersecurity Requirements, (GENERAL-23-09) The regulations required all covered businesses to be in full compliance by July 1, 2001. L. 111203 inserted ,other than the Bureau of Consumer Financial Protection, after section 6805(a) of this title in introductory provisions. Hackers/journalists/researchers: See these open data sources. Anyone who obtains financial products or services from a company is dubbed a consumer, but consumers who maintain a continuing relationship with that institution are customers. Find legal resources and guidance to understand your business responsibilities and comply with the law. The .gov means its official. The process of incorporating a newly-passed piece of legislation into the Code is known as "classification" -- essentially a process of deciding where in the logical organization of the Code the various parts of the particular law belong. 3 0 obj Repeated non-compliance by an institution or a servicer may result in an administrative action taken by the Department, which could impact the institutions or servicers participation in the Title IV programs. Privacy pros zero in on Title V, Subtitle A of the GLBA (15 U.S.C. 1338, enacted November 12, 1999) is an act of the On the other hand, government agencies can and do include GLBA compliance criteria in their audits of institutions covered by the Act. Any GLBA findings identified through a compliance audit, or any other means, after the effective date will be resolved by the Department during the evaluation of the institutions or servicers information security safeguards required under GLBA as part of the Departments final determination of an institutions administrative capability. 1828b, 1849) clarify the application of the FTC Act and other FTC statutes to subsidiaries and other affiliates of depository institutions, and provide for certain interagency information sharing. 9 0 obj Gramm The Gramm-Leach-Bliley Act of 1999 (GLBA) was a bi-partisan regulation under President Bill Clinton, passed by Congress on November 12, 1999. Gramm-Leach-Bliley Act (Privacy of Consumer Financial Information) Introduction . Spot the latest COVID scams, get compliance guidance, and stay up to date on FTC actions during the pandemic. At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. It may seem a bit strange at first that a financial services law has such a profound impact on IT and data security. The Gramm-Leach-Bliley Act is a U.S. federal law created to control how financial institutions deal with a consumers non-public personal information (NPI). Gramm Leach Bliley Act - Louisiana State University Shreveport Gramm-Leach-Bliley Act | Federal Trade Commission This is part of a new project to develop better tools for bringing real-time legislative data into the classroom. 1. Check out their Cybersecurity Assessment Tool, which can help you identify specific areas in which your organization may not be aligned with the GLBA's requirements. Note that while the following provides a summary of the requirements, your best source of information is the text of theSafeguards Ruleitself and GLBA guidance provided by the FTC. 1811 et seq.) Gramm \ This is, obviously, a very broad mandate, though the good news is that it's obviously also a set of best practices that any organization that retains personal data ought to be following anyway; it's also broadly similar to regulatory mandates imposed on other industries like health care, so companies covered by multiple sets of regulations shouldn't have to duplicate work. Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any student (16 C.F.R. Nor will a full-text search of the Code necessarily reveal where all the pieces have been scattered. The U.S. Senate By joining our advisory group, you can help us make GovTrack more useful and engaging to young voters like you. Memo from Chair Lina M. Khan to commission staff and commissioners regarding the vision and priorities for the FTC. Sometimes these names say something about the substance of the law (as with the '2002 Winter Olympic Commemorative Coin Act'). Before sharing sensitive information, make sure youre on a federal government site. You are encouraged to reuse any material on this site. Data breaches (a) While many of these rules represent best IT practices, the legal stakes of noncompliance are high, with big fines and even potential jail time looming for those who fall short.