Privacy and Data Security Compliance Flashcards

Under the GLBA, which of the following is considered 'nonpublic personal information' (NPI)?

Answer: Account balances and transaction history provided by the customer

NPI includes any financial information a customer provides to a financial institution, such as account balances and transaction data, that is not publicly available.

A bank's vendor management program should include which of the following to address data security?

Answer: Due diligence on vendor security practices and contractual data protection requirements

Effective vendor management programs include security due diligence and contractual protections requiring vendors to maintain appropriate data security standards.

Under GLBA, which sharing arrangement does NOT require customer opt-out rights?

Answer: Sharing customer data with affiliated companies

Sharing customer information with affiliated companies (companies under common control) does not require an opt-out right under the GLBA Privacy Rule, though customers may be given a limit right.

The principle of 'data minimization' in information security compliance means:

Answer: Collecting and retaining only the personal data necessary for a specific purpose

Data minimization means limiting data collection and retention to only what is necessary for the stated business purpose, reducing exposure risk.

Under the FTC's updated Safeguards Rule, which institutions are subject to the rule?

Answer: Financial institutions not subject to the jurisdiction of another federal regulator (e.g., mortgage brokers, auto dealers, tax preparers)

The FTC Safeguards Rule covers non-bank financial institutions under FTC jurisdiction, such as mortgage brokers, payday lenders, auto dealers, and tax preparers.

When a bank provides customer data to a nonaffiliated third party under an exception to GLBA sharing restrictions, that third party:

Answer: Is restricted in how it may use and redisclose the data

GLBA exceptions allow sharing under certain conditions, but the receiving third party's use and redisclosure of the data is restricted to the purpose of the exception.