Bank data & compliance
Gramm-Leach-Bliley Act: Definition & Example
Also called: GLBA
What Is the Gramm-Leach-Bliley Act?
The Gramm-Leach-Bliley Act (GLBA) is a 1999 federal law that requires financial institutions to explain how they share customers’ nonpublic personal information and to safeguard that information.
What does Gramm-Leach-Bliley Act mean?
GLBA has three main parts relevant to privacy: the Financial Privacy Rule, which requires privacy notices and, in many cases, a chance to opt out of sharing with unaffiliated third parties; the Safeguards Rule, which requires a written information security program; and pretexting provisions that prohibit obtaining customer information under false pretenses.
"Financial institution" is defined broadly and can include lenders, mortgage brokers, tax preparers, some data aggregators, and other companies significantly engaged in financial activities.
The FTC’s updated Safeguards Rule requires covered companies to designate a qualified individual to run the security program, perform risk assessments, use encryption and multi-factor authentication, and report certain security events.
Gramm-Leach-Bliley Act example
A small mortgage broker keeps borrower tax returns and bank statements. To comply with the GLBA Safeguards Rule, the broker names a security lead, encrypts stored files, requires multi-factor authentication for staff, and sends borrowers a privacy notice explaining how their information is shared.
Related terms
- Fair Credit Reporting ActThe Fair Credit Reporting Act (FCRA) is a federal law that regulates how consumer reporting agencies collect and share consumer information and how others use consumer reports.
- Section 1033Section 1033 of the Dodd-Frank Act gives consumers a right to access their own financial account data. The CFPB’s rule implementing it sets requirements for sharing that data with authorized third parties.
- Consumer-Permissioned DataConsumer-permissioned data is financial information a consumer actively authorizes a third party to access, such as bank transactions shared through an open banking connection.
- KYCKYC (Know Your Customer) is the process financial institutions use to verify a customer’s identity and understand the nature of the relationship, to prevent fraud, money laundering, and terrorist financing.
