Financial Institutions
The
GLB Act applies to "financial institutions" - companies
that offer financial products or services to
individuals, like loans, financial or investment advice,
or insurance. The Federal Trade Commission has authority
to enforce the law with respect to "financial
institutions" that are not covered by the federal
banking agencies, the Securities and Exchange
Commission, the Commodity Futures Trading Commission,
and state insurance authorities. Among the institutions
that fall under FTC jurisdiction for purposes of the GLB
Act are non-bank mortgage lenders, loan brokers, some
financial or investment advisers, tax preparers,
providers of real estate settlement services, and debt
collectors. At the same time, the FTC's regulation
applies only to companies that are "significantly
engaged" in such financial activities.
The
law requires that financial institutions protect
information collected about individuals; it does not
apply to information collected in business or commercial
activities.
Consumers and Customers
A
company's obligations under the GLB Act depend on
whether the company has consumers or customers who
obtain its services. A consumer is an
individual who obtains or has obtained a financial
product or service from a financial institution for
personal, family or household reasons. A customer
is a consumer with a continuing relationship with a
financial institution. Generally, if the relationship
between the financial institution and the individual is
significant and/or long-term, the individual is a
customer of the institution. For example, a person who
gets a mortgage from a lender or hires a broker to get a
personal loan is considered a customer of the lender or
the broker, while a person who uses a check-cashing
service is a consumer of that service.
Why
is the difference between consumers and customers so
important? Because only customers are entitled to
receive a financial institution's privacy notice
automatically. Consumers are entitled to receive a
privacy notice from a financial institution only if the
company shares the consumers' information with companies
not affiliated with it, with some exceptions. Customers
must receive a notice every year for as long as the
customer relationship lasts.
The
privacy notice must be given to individual customers or
consumers by mail or in-person delivery; it may not,
say, be posted on a wall. Reasonable ways to deliver a
notice may depend on the type of business the
institution is in: for example, an online lender may
post its notice on its website and require online
consumers to acknowledge receipt as a necessary part of
a loan application.
The Privacy Notice
The
privacy notice must be a clear, conspicuous, and
accurate statement of the company's privacy practices;
it should include what information the company collects
about its consumers and customers, with whom it shares
the information, and how it protects or safeguards the
information. The notice applies to the "nonpublic
personal information" the company gathers and discloses
about its consumers and customers; in practice, that may
be most - or all - of the information a company has
about them. For example, nonpublic personal information
could be information that a consumer or customer puts on
an application; information about the individual from
another source, such as a credit bureau; or information
about transactions between the individual and the
company, such as an account balance. Indeed, even the
fact that an individual is a consumer or customer of a
particular financial institution is nonpublic person
information. But information that the company has reason
to believe is lawfully public - such as mortgage loan
information in a jurisdiction where that information is
publicly recorded - is not restricted by the GLB Act.
Opt-Out Rights
Consumers and customers have the right to opt out of -
or say no to - having their information shared with
certain third parties. The privacy notice must explain
how - and offer a reasonable way - they can do that. For
example, providing a toll-free telephone number or a
detachable form with a pre-printed address is a
reasonable way for consumers or customers to opt out;
requiring someone to write a letter as the only way to
opt out is not.
The
privacy notice also must explain that consumers have a
right to say no to the sharing of certain information -
credit report or application information - with the
financial institution's affiliates. An affiliate is an
entity that controls another company, is controlled by
the company, or is under common control with the
company. Consumers have this right under a different
law, the Fair Credit Reporting Act. The GLB Act does not
give consumers the right to opt out when the financial
institution shares other information with its
affiliates.
The
GLB Act provides no opt-out right in several other
situations: For example, an individual cannot opt out
if:
- a financial institution shares
information with outside companies that provide
essential services like data processing or servicing
accounts;
- the disclosure is legally required;
- a financial institution shares
customer data with outside service providers that
market the financial company's products or services.
Receiving Nonpublic Personal Information
The
GLB Act puts some limits on how anyone that receives
nonpublic personal information from a financial
institution can use or re-disclose the information. Take
the case of a lender that discloses customer information
to a service provider responsible for mailing account
statements, where the consumer has no right to opt out:
The service provider may use the information for limited
purposes - that is, for mailing account statements. It
may not sell the information to other organizations or
use it for marketing.
However, it's a different scenario when a company
receives nonpublic personal information from a financial
institution that provided an opt-out notice -- and the
consumer didn't opt out. In this case, the recipient
steps into the shoes of the disclosing financial
institution, and may use the information for its own
purposes or re-disclose it to a third party, consistent
with the financial institution's privacy notice. That
is, if the privacy notice of the financial institution
allows for disclosure to other unaffiliated financial
institutions - like insurance providers - the recipient
may re-disclose the information to an unaffiliated
insurance provider.
Other Provisions
Other important provisions of the GLB Act also impact
how a company conducts business. For example, financial
institutions are prohibited from disclosing their
customers' account numbers to non-affiliated companies
when it comes to telemarketing, direct mail marketing or
other marketing through e-mail, even if the individuals
have not opted out of sharing the information for
marketing purposes.
Another provision prohibits "pretexting" - the practice
of obtaining customer information from financial
institutions under false pretenses. The FTC has brought
several cases against information brokers who engage in
pretexting.
For More Information
The
FTC is one of eight federal regulatory agencies that has
the authority to enforce the financial privacy law,
along with the state insurance authorities. The federal
banking agencies, the Securities and Exchange Commission
and the Commodity Futures Trading Commission have
jurisdiction over banks, thrifts, credit unions,
brokerage firms and commodity traders.
The
FTC has additional details on the GLB Act, the
Commission's Privacy Rule and a compliance guide for
small business owners at
www.ftc.gov/privacy.
View
Cart
