6701(g)). 6801-6809, 6821-6827, Competition and Consumer Protection Guidance Documents, An Inquiry into Cloud Computing Business Practices: The Federal Trade Commission is seeking public comments. When it comes to the Privacy Rule, the GLBA makes a distinction between different types of people a company interacts with. Institutions should coordinate with their leadership and appropriate staff to implement the requirements in the Final Rule by June 9. 0000007438 00000 n Consumer Financial Protection Before sharing sensitive information, make sure youre on a federal government site. 1844) is amended by striking subsection (g). WebGramm-Leach-Bliley Act Tags: Consumer Protection Mission Consumer Protection Law Pub. 106-102, 113 Stat. VIII. Privacy GLBA - Federal Deposit Insurance Corporation A BILL TO BE ENTITLED AN ACT BE IT ENACTED BY THE is amended by striking section 45. Financial Services Modernization Act of 1999 3106(c)) is amended by striking paragraph (3). 6801 <> It is the responsibility of the organization to enforce the compliance recommendations at their discretion.". L. 111203 inserted ,other than the Bureau of Consumer Financial Protection, after section 6805(a) of this title in introductory provisions. An insured depository institution may not be or become an affiliate of any broker or dealer, any investment adviser, any investment company, or any other person engaged principally in the issue, flotation, underwriting, public sale, or distribution at wholesale or retail or through syndicate participation of stocks, bonds, debentures, notes, or other securities. 2'4R!`Y# !;_V.|r,/u;^Iq8yB^ug! The Graham-Leach-Bailey Act (GLBA) is a 1999 law that allowed financial services companies to offer both commercial and investment banking, something that had Sometimes they are a way of recognizing or honoring the sponsor or creator of a particular law (as with the 'Taft-Hartley Act'). Subject to a determination under subparagraph (B), the Comptroller of the Currency may extend the 2-year period referred to in subparagraph (A) above from time to time as to any particular national bank for not more than 6 months at a time, if, in the judgment of the Comptroller, such an extension would not be detrimental to the public interest, but no such extensions shall in the aggregate exceed 1 year. to the extent that a later date is specified in the rules prescribed under section 504; and, In furtherance of the policy in subsection (a), each agency or authority described in, This subtitle [subtitle A (501510) of title V of. WebThe Gramm-Leach-Bliley Act requires financial institutions companies that offer consumers financial products or services like loans, financial or investment advice, or insurance to 0000005185 00000 n The changes to the Safeguards Rule are effective June 9, 2023. H.R.2714 - 118th Congress (2023-2024): To repeal certain Your note is for you and will not be shared with anyone. Pub. <> 1338. The site is secure. (Of course, this isn't always the case; some legislation deals with a fairly narrow range of related concerns.). endobj Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances thatit knows or has reason to know mayhave a material impact the information security program (16 C.F.R. The Safeguards Rule took effect ABOUT THE GLB ACT The Gramm-Leach-Bliley Act was enacted on November 12, 1999. Limitation on agency interpretation or judicial construction. Section 5 of the Bank Holding Company Act of 1956 (12 U.S.C. WebGLB. 314.4(c)). The reasoning of the Supreme Court of the United States in the case referred to in paragraph (1) with respect to sections 20 and 32 of the Banking Act of 1933 (as in effect prior to the date of the enactment of the Gramm-Leach-Bliley Act) shall continue to apply to subsection (bb) of section 18 of the Federal Deposit Insurance Act (as added by subsection (a) of this section) except to the extent the scope and application of such subsection as enacted exceed the scope and application of such sections 20 and 32. Pub. on this bill on a six-point scale from strongly oppose to strongly support. Repeal of provision relating to foreign banks filing as financial holding companies. GRAMMLEACHBLILEY ACT - Congress (1971)) with regard to the permissible activities of banks and securities firms, except to the extent expressly prescribed otherwise by this section. Pretexting is form of social engineering in which an attacker tries to convince a victim to give up valuable information or access to a service or system. WebThe Security Guidelines implement section 501 (b) of the Gramm-Leach-Bliley Act (GLB Act) 4 and section 216 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act). An official website of the United States government. HTQj@}Ygv5/"M";eag|BG y ^#XmRdPRj"\mc@FRDq+7{ER6{,_{kDF0Z"nd/b>oOc%"!a(N9!`bH.^"3=TgoNqe#k# ^TW=\wR}B >r? WebV, Gramm-Leach-Bliley Act (15 U.S.C. However, individuals have the right to choose whether the information is disclosed under the Act. 314.4(e)). GLBA explained: Definition, requirements, and compliance Guide to the Gramm The law requires Financial institutions covered by the Gramm-Leach-Bliley Act must tell their customers about their information-sharing practices and explain to customers their right to "opt out" if they don't want their information shared with certain third parties. Responsible individuals at those institutionsgenerally company officers or members of the board of directorscan be personally fined up to $10,000 for each violation, Those individuals may also be sentenced to up to 5 years in prison. Deep Odyssey, a company that offers these services, puts it this way in their disclaimer: "The completion of a GLBA Audit does not ensure GLBA compliance. "[B&9y>2A}N"c`:s5IL[P=XR4xu w="(.lU[_ 3[aT!x,HfWZI_>2pq9:Nj!l Parts 160 and 164, established under the Health Insurance Wall between commercial banks and securities activities reestablished. The Gramm-Leach-Bliley Act (GLBA), signed into law last November, authorized the certification of financial holding companies, the structure that looks to be the main vehicle for linking commercial banks with securities firms, insurance firms, and merchant banking. The process of incorporating a newly-passed piece of legislation into the Code is known as "classification" -- essentially a process of deciding where in the logical organization of the Code the various parts of the particular law belong. 7 0 obj Webwashington state law library; town center east, building 3 243 israel road se tumwater, wa 98501 (360) 357-2136; mail: p.o. WebThe Gramm Leach Bliley Act (GLBA) is a law that applies to financial institutions and includes privacy and information security provisions that are designed to protect consumer financial Below we provide additional information about the updated requirements and definitions in the GLBA Safeguards Rule. Nor will a full-text search of the Code necessarily reveal where all the pieces have been scattered. Webwashington state law library; town center east, building 3 243 israel road se tumwater, wa 98501 (360) 357-2136; mail: p.o. 314.4(c)(1) through (8). 0000004180 00000 n To repeal certain provisions of the Gramm-Leach-Bliley Act and revive the separation between commercial banking and the securities business, in the manner provided in the Banking Act of 1933, the so-called Glass-Steagall Act, and for other purposes. 314.4(h)). And as we said before, a particular law might be narrow in focus, making it both simple and sensible to move it wholesale into a particular slot in the Code. by redesignating clauses (ii) and (iv) as clauses (i) and (ii), respectively. or securities. In Dear Colleague LettersGEN-15-18andGEN-16-12, we reminded institutions about the longstanding requirements of GLBA and notified them of our intention to begin enforcing the legal requirements of GLBA through annual compliance audits. Hackers/journalists/researchers: See these open data sources. The GLBA is also known as the Financial Services Modernization Act of 1999. Are you up on what the revised Rule requires? Prohibition on officers, directors and employees of securities firms service on boards of depository institutions. Gramm-Leach-Bliley Act The Gramm Leach Bliley Act (GLB or GLBA) was enacted in 1999. Find legal resources and guidance to understand your business responsibilities and comply with the law. Laws acquire popular names as they make their way through Congress. In addition to reforming the financial services industry, the Act addressed concerns relating to consumer financial privacy. Gramm-Leach-Bliley Act An Act to Enhance Competition in the Financial Services Industry by Providing a Prudential Framework for the Affiliation of Banks, Securities Firms, Insurance Companies, and Other Financial Service Providers, and for Other Purposes Public Law 106-102, 106th Congress, S. 900 NOTE: 113 Stat. We are excited to now be on Mastodon, a social network developed by and for its users. On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations (Final Rule) to amend the Standards for Safeguarding Customer Information Gramm-Leach-Bliley Act Gramm The list of businesses that fall under this heading is broad, and includes debt collectors, real estate appraisers, automobile dealers, and even higher education institutions, which maintain bursar accounts for students and administer student loans. Hopefully our description of the GLBA's broad reach makes it clear why the Department of Education is involved in enforcing a financial service law. This is part of a new project to develop better tools for bringing real-time legislative data into the classroom. Download PDF. Gramm-Leach-Bliley Act (GLB Act) | EDUCAUSE WebId., adding 15 U.S.C. Ms. Kaptur (for herself, Ms. Norton, Ms. Omar, Ms. Pingree, Ms. Wild, Ms. Tlaib, Mr. Pocan, and Mrs. Watson Coleman) introduced the following bill; which was referred to the Committee on Financial Services. 1843(c)(8)) is amended by striking the day before the date of the enactment of the Gramm-Leach-Bliley Act and inserting January 1, 1970. We enforce federal competition and consumer protection laws that prevent anticompetitive, deceptive, and unfair business practices. 2 0 obj Join GovTrack.uss Inner Circle With a Yearly Membership, In retaliation for prosecutor Alvin Bragg indicting Trump, ALVIN Act would ban federal funds for, On March 29, Arizona Republican Andy Biggs introduced a (possible record) 521 bills in one day, No More Political Prosecutions Act would give presidents like Trump option to move their legal. Gramm The Comptroller of the Currency, after opportunity for hearing, may terminate, at any time, the authority conferred by the preceding subparagraph to continue any affiliation subject to such subparagraph until the end of the period referred to in such subparagraph if the Comptroller determines, having due regard for the purposes of this Act, that such action is necessary to prevent undue concentration of resources, decreased or unfair competition, conflicts of interest, or unsound banking practices and is in the public interest. Section 8(c) of the International Banking Act of 1978 (12 U.S.C. Are you up on what the revised Rule requires? 1445, provided that: to insure the security and confidentiality of customer records and information; to protect against any anticipated threats or hazards to the security or integrity of such records; and. Final Model Privacy Form Under the Gramm-Leach-Bliley Act The Gramm-Leach-Bliley Act (GLB Act or GLBA) is also known as the Financial Modernization Act of 1999. The Department will issue guidance on NIST 800-171 compliance in a future Electronic Announcement, but again encourages institutions to begin incorporating the information security controls required under NIST 800-171 into the written information security program required under GLBA as soon as possible. And starting in 2019 well be tracking Congresss oversight investigations of the executive branch. Regulatory Agency. 1338. box 40751 olympia wa 98504-0751 Subject to a determination under subparagraph (B), the Board of Governors of the Federal Reserve System may extend the 2-year period referred to in subparagraph (A) above from time to time as to any particular bank holding company for not more than 6 months at a time, if, in the judgment of the Board, such an extension would not be detrimental to the public interest, but no such extensions shall in the aggregate exceed 1 year. We enforce federal competition and consumer protection laws that prevent anticompetitive, deceptive, and unfair business practices. Subtitle A also requires the FTC and other agencies to issue regulations for the safeguarding of personal financial information; this authority did not transfer. The Department intends to work with all institutions to improve their information security posture, including those that may not have yet implemented the Safeguards Rule requirements. Well be in touch. The Infosec Institute outlines ten top-level steps your infosec or IT organization needs to take in order to be GLBA compliant: A risk assessment is an important part of the threat modeling process that many infosec teams do as a matter of course. Please sign up for our advisory group to be a part of making GovTrack a better tool for what you do. Youve cast your vote. The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely. All customers are consumers, but not all consumers are customers; customers are those consumers whose relationship with an institution are longer-lasting and more intimate. On December 18, 2020 we issued an Electronic Announcement encouraging institutions to review and adopt NIST 800171 as a security standard to support continuing obligations under GLBA. Text If organizations don't feel that they are up to the task of assessing their own preparedness and compliance, or if they want an honest assessment from an outsider, they can pay a third-party organization to audit their compliance. Section 3(a)(4)(B) of the Securities Exchange Act of 1934 (15 U.S.C. Sponsor: Summary of H.R.2714 - 118th Congress (2023-2024): To repeal certain provisions of the Gramm-Leach-Bliley Act and revive the separation between commercial banking and the securities business, in the manner provided in the Banking Act of 1933, the so-called "Glass-Steagall Act", and for other purposes. The .gov means its official. GrammLeachBliley Act Text WebThis paper examines the impact of Gramm-Leach-Bliley Act across three main sectors of the financial services industry: commercial banks, insurance companies, and brokerage firms, taking account of the wealth effect associated with the announcement. This process will be necessary for each IP address you wish to access the site from, requests are valid for approximately one quarter (three months) after which the process may need to be repeated. 0000001610 00000 n WebSec. Text Text It's also worth noting that, from the GLBA's perspective, part of safeguarding data involves having business continuity and disaster recovery plans in place, in case some catastrophic breach or data loss occurs that will affect your customers. "6hfeLT*RWCW\O^ ~UTdhD/~p(&uJUCPu~}12k$kKq!/ uC}$Bw5C|W?3pK%>S@aMiVe+JS\5vP tVZ_XOh%$ HX6fZE,)HYPo6|QZBJ%0LNNJP$@z7E+F+#}S`2?1$T&M_f ~H?Ld:92#h-2ipM#7$2`1U;V]Gobek~C&/w|udk7a+!H` Apr 25, 2023. Memo from Chair Lina M. Khan to commission staff and commissioners regarding the vision and priorities for the FTC. <> The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely. 0000003542 00000 n The Gramm-Leach-Bliley Act (GLB Act) of 1999 sought to provide new rules for financial privacy. Find legal resources and guidance to understand your business responsibilities and comply with the law. 1841) is amended by striking subsection (p). BpcUNy!6g82ja3u|jMM#GHR! 6821 et seq.) 0JjvQ R For instance, someone might call up your bank, armed with a few pieces of information about you like your address or social security number, and try to bluff them into giving them more information, or even access to your account. If youve visited a bill page on GovTrack.us recently, you may have noticed a new study guide tab located just below the bill title. Institutions or servicers provide a financial service when they, among other things, administer or aid in the administration of the Title IV programs; make institutional loans, including income share agreements; or certify or service a private education loan on behalf of a student. The table of sections for chapter one of title LXII of the Revised Statutes of the United States is amended by striking the item relating to section 5136A. 1787, codified at 15 U.S.C. The Financial Privacy Rule (generally just shortened to the Privacy Rule) is relatively straightforward. 1844(c)) is amended. 24, as amended by section 16 of the Banking Act of 1933 and subsequent amendments) and section 21 of the Banking Act of 1933 (12 U.S.C. You'll find three types of link associated with each popular name (though each law may not have all three types). WebGrammLeachBliley Act (GLBA), Regulation R, and Retail Nondeposit Investment Sales The Gramm-Leach-Bliley Act sets forth certain exceptions for banks from the broker-dealer registration requirements of the Securities and Exchange Act of 1934. Sometimes these names say something about the substance of the law (as with the '2002 Winter Olympic Commemorative Coin Act'). Notwithstanding the limitation of the January 1, 1970, approval deadline in subsection (c)(8), the Board may determine an activity to be so closely related to banking as to be a proper incident thereto for purposes of such subsection, subject to the requirements of this subsection and such terms and conditions as the Board may require. The Act also limits the sharing of account number information for marketing purposes. Learn more about your rights as a consumer and how to spot and avoid scams. prohibits obtaining customer information of a financial institution by false pretenses. For instance, there's no specific GLBA password requirements; instead, GLBA-covered institutions are expected to follow contemporary best practices for authenticating access to personal data, which in practice today would include an appropriate password regime. to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer. L. No. Learn more about your rights as a consumer and how to spot and avoid scams. Anyone who obtains financial products or services from a company is dubbed a consumer, but consumers who maintain a continuing relationship with that institution are customers. Text The .gov means its official. Finally, acts may be referred to by a different name, or may have been renamed, the links will take you to the appropriate listing in the table. The first is that it explicitly makes it illegal to use pretexting to try to gain access to the information about victims held by a financial institution covered by the Act. 0000007555 00000 n 30 Minute Mortgage, Inc., Gregory P. Roth, and Peter W. Stolz, Garrett, Paula L. d/b/a Discreet Data Systems, Guzzetta, Victor L., d/b/a Smart Data Systems, Information Search, Inc., and David J. Kacala (District of Maryland, Northern Division). 314.4(b)). No determination of the Board under paragraph (1) may take effect before the end of the 180-day period beginning on the date by which notice of the determination has been submitted to both Houses of the Congress together with a detailed explanation of the activities to which the determination relates and the basis for the determination, unless before the end of such period, such activities have been approved by an Act of Congress. To repeal certain provisions of the Gramm-Leach-Bliley Act and revive the separation between commercial banking and the securities business, in the manner provided in the Banking Act of 1933, the so-called Glass-Steagall Act, and for other purposes. Were looking for feedback from educators about how GovTrack can be used and improved for your classroom. SM_Y9d1`uwUN:t m^3_ . While all elements of the Safeguards Rule are vital to protecting the security of customer information, an institution or servicer may significantly reduce the risk of a security breach, and the resulting harm and inconvenience to its customers, by encrypting customer information while it is in transit outside its systems or stored on its system and by implementing multi-factor authentication for anyone accessing customer information on its systems. endobj 32k!6=uHSj\-1UIC]Li5]|:suWR+R4;<0{PC\ZW]dt T|Q}!s\7BRmgCJI$X=r+FetvXT.26T ) 2wJ~j^5}7=(E 0gZ%A6d;bn@ i, )Pn\|-b>T,9:4 (iF]v';#?o6**O bh*0He [WEn s)xsTW?%iF!$*gE}+3iC/h()X&/23dusoe _~?fup}1\xGl ba7#&a 22=b-;`$&4?m #c$Wv(9y^/UR|P{Of'`N&;z TBGWbKw9DCvT] Gramm-Leach-Bliley Act Gramm-Leach <>/ExtGState<>>> Pub. 78c(a)(5)(C)) is amended. 0000001588 00000 n 0000030139 00000 n As you might expect, data privacy requirements are stricter for customers. The U.S. Senate On the other hand, legislation often contains bundles of topically unrelated provisions that collectively respond to a particular public need or problem. Therefore, an institution that does not provide for the security of the information it needs to continue its operations would not be administratively capable. See also infra discussion at section II.A. Franchisee Conversations with Chair Khan and Cmr. !`MBq!O!Xe=xB7p4IjPw 0jb7cZ5>$. 24a) is amended to read as follows: In the case of a national bank which, pursuant to the amendments made by paragraph (1), is no longer authorized to control or be affiliated with a financial subsidiary as of the date of the enactment of this Act, such affiliation shall be terminated as soon as practicable and in any event no later than the end of the 2-year period beginning on such date of enactment. II. REVISED THROUGH SEPTEMBER 30, 2004 Rapp, James J., and Regana L. Rapp d/b/a Touch Tone Information, Inc. NovaStar Financial, Inc. and NovaStar Mortgage Inc. 16 CFR Part 314: Standards for Safeguarding Customer Information (Supplemental Notice of Proposed Rulemaking), 16 CFR Part 314: Standards for Safeguarding Customer Information (Final Rule), 16 CFR Part 313: Privacy of Consumer Financial Information Rule under the Gramm-Leach-Bliley Act, Ascension Data & Analytics, LLC; Analysis To Aid Public Comment, Agency Information Collection Activities; Submission for OMB Review; Comment Request (Privacy Rule), Agency Information Collection Activities; Proposed Collection; Comment Request (Privacy Rule), Postponement of Public Workshop Related to Proposed Changes to the Safeguards Rule, DealerBuilt/LightYear Dealer Technologies; Analysis To Aid Public Comment, 16 CFR Part 314: Standards for Safeguarding Customer Information; Extension of Deadline for Submission of Public Comments, Privacy of Customer Financial Information-Security; Advance Notice Of Proposed Rulemaking And Request For Comment, Final Model Privacy Form Under the Gramm-Leach-Bliley Act - 16 CFR Part 313, Standards for Safeguarding Customer Information; Final Rule - 16 CFR Part 314, Privacy of Consumer Financial Information; Final Rule - 16 CFR Part 313, Privacy of Consumer Financial Information; Proposed Rule - 16 CFR Part 313, Keynote Remarks of Commissioner Christine S. Wilson at the Privacy + Security Academy, Opening Remarks of Chairman Joseph Simons at FTC Equifax Press Conference, Opening Remarks of Commissioner Terrell McSweeny. Would you like to join our advisory group to work with us on the future of GovTrack? The changes to the Safeguards Rule expand on the minimum information security requirements that should already be in place at participating institutions and their third-party servicers. Please note that compliance with the GLBA requirements is not the same as compliance with NIST 800-171. 1 This guide was prepared by the staff of the U.S. Securities and Exchange Commission as a "small entity compliance guide" under Section 212 of the Small Business Regulatory Enforcement Fairness Act of 1996, as amended. ]JX9&TN:pP2U:'%#yqQ_ ,0C5)4KzOD^W [~A5R&16 uveAgH)djZ^rM_8#!yVxW5B$} W(hgV9&O|"jJBk=DP N?nxs!]I)$y@qK endstream endobj 122 0 obj << /Filter [ /ASCII85Decode /FlateDecode ] /Length 312 /Subtype /Type1C >> stream On the other hand, government agencies can and do include GLBA compliance criteria in their audits of institutions covered by the Act. Short title. ACT Definition, examples and prevention, business continuity and disaster recovery, The 10 most powerful cybersecurity companies, 7 hot cybersecurity trends (and 2 going cold), The Apache Log4j vulnerabilities: A timeline, Using the NIST Cybersecurity Framework to address organizational risk, 11 penetration testing tools the pros use, Designate employees to coordinate an infosec program, Identify risks to customer information across your company and assess the effectiveness of your current safeguards, Design, implement, monitor, and test an overarching safeguard program, Select service providers that are able to meet the requirements of the GLBA, and write that into your contract with them, Continually evaluate your program as circumstances and the threat landscape change, Understand the regulations and how they apply to you, Conduct a risk assessment (more on which in a moment), Ensure that effective controls are in place to mitigate risks, Make sure your service providers are GLBA-compliant, Confirm that you're meeting Privacy Rule requirements, Update your disaster recovery and business continuity plans, Prepare a written information security plan (WISP) a formal document of this type is a GLBA requirement, Report to the board the GLBA requires those responsible for inforsec make an annual report to an organizations managing board on GLBA compliance.