Privacy and Data Security Compliance Flashcards

Under the Gramm-Leach-Bliley Act's Safeguards Rule, financial institutions are required to:

Answer: Develop, implement, and maintain a comprehensive information security program

The GLBA Safeguards Rule requires financial institutions to have a written comprehensive information security program protecting customer financial information.

The FTC's Safeguards Rule (updated 2023) requires covered financial institutions to designate:

Answer: A qualified individual to oversee the information security program

The updated FTC Safeguards Rule requires covered institutions to designate a qualified individual (e.g., CISO) to oversee the information security program.

Under the GLBA Privacy Rule, a financial institution must provide customers the right to opt out of:

Answer: Sharing nonpublic personal information with nonaffiliated third parties

The GLBA Privacy Rule gives customers the right to opt out of sharing their nonpublic personal information with unaffiliated third parties.

Under the Bank Service Company Act, when a bank contracts with a third party for services, the bank's compliance obligations:

Answer: Remain with the bank; it cannot outsource its compliance responsibilities

Banks cannot outsource their compliance responsibilities; they remain responsible for compliance even when services are performed by third-party vendors.

A notification to customers affected by a data breach is required under:

Answer: A combination of federal agency guidance and state data breach notification laws

Data breach notifications are governed by both federal agency guidance (OCC, FDIC, Federal Reserve) and state-level data breach notification statutes.

Which section of the GLBA covers the financial privacy provisions and requires initial and annual privacy notices?

Answer: Title V (Privacy of Consumer Financial Information)

Title V of the GLBA contains the privacy provisions requiring financial institutions to provide privacy notices and honor opt-out rights.