CIPP Financial Privacy (GLBA, FCRA, and FACTA) 1 ā Questions and Answers
Question 1: Under the Gramm-Leach-Bliley Act (GLBA), what must financial institutions provide to customers at the time of establishing a customer relationship?
- A data retention schedule
- An initial privacy notice (Correct answer)
- A data breach notification
- A written consent form for all data sharing
Correct answer: An initial privacy notice
GLBA requires financial institutions to deliver an initial privacy notice to customers at the time the customer relationship is established.
Question 2: Which of the following is excluded from the definition of 'nonpublic personal information' (NPI) under GLBA?
- Social Security numbers
- Account balances
- Publicly available information from government records (Correct answer)
- Transaction histories
Correct answer: Publicly available information from government records
GLBA explicitly excludes publicly available information from government records from the definition of NPI, since it is already accessible to the general public.
Question 3: Which federal agency has primary enforcement authority over national banks under GLBA's privacy provisions?
- Federal Trade Commission (FTC)
- Office of the Comptroller of the Currency (OCC) (Correct answer)
- Consumer Financial Protection Bureau (CFPB)
- Securities and Exchange Commission (SEC)
Correct answer: Office of the Comptroller of the Currency (OCC)
The OCC has primary supervisory and enforcement authority over national banks, including compliance with GLBA privacy requirements.
Question 4: The GLBA opt-out right allows consumers to prevent a financial institution from sharing their NPI with which type of party?
- Affiliates under a common ownership structure
- Unaffiliated third parties not covered by a statutory exception (Correct answer)
- Government agencies requesting information
- Credit bureaus compiling consumer reports
Correct answer: Unaffiliated third parties not covered by a statutory exception
The GLBA opt-out right specifically enables consumers to restrict sharing of NPI with unaffiliated third parties that do not fall under statutory exceptions such as the joint marketing agreement exception.
Question 5: Which GLBA exception permits financial institutions to share NPI with unaffiliated third parties without offering consumers an opt-out right?
- General marketing exception
- Joint marketing agreement exception (Correct answer)
- Customer analytics exception
- Promotional partners exception
Correct answer: Joint marketing agreement exception
The joint marketing agreement exception allows sharing NPI with unaffiliated companies for joint product or service marketing purposes without triggering the opt-out requirement.
Question 6: The GLBA Safeguards Rule primarily requires financial institutions to:
- Encrypt all data at rest using AES-256
- Develop, implement, and maintain a comprehensive information security program (Correct answer)
- Report security incidents to the FTC within 72 hours
- Conduct annual penetration testing by certified third parties
Correct answer: Develop, implement, and maintain a comprehensive information security program
The Safeguards Rule mandates that financial institutions establish and maintain a written comprehensive information security program appropriate to the size and complexity of the institution.
Question 7: Under GLBA, which entities qualify as 'financial institutions' subject to its privacy provisions?
- Only federally chartered banks and credit unions
- Only entities registered with the SEC
- Businesses significantly engaged in financial activities (Correct answer)
- Only publicly traded financial companies
Correct answer: Businesses significantly engaged in financial activities
GLBA defines financial institutions broadly to include any business significantly engaged in financial activities, encompassing banks, mortgage lenders, insurers, investment advisors, and similar entities.
CIPP Financial Privacy (GLBA, FCRA, and FACTA) 1
Under the Gramm-Leach-Bliley Act (GLBA), what must financial institutions provide to customers at the time of establishing a customer relationship?