The GLBA Safeguards Rule: Attain Compliance Or Face Hefty Penalties
The Gramm-Leach-Bliley Act (GLBA) is a U.S. federal regulation that seeks to protect consumer financial privacy. GLBA mandates that financial institutions be transparent with their customers about how their data is shared and how sensitive data is kept safe. The GLBA regulation is divided into three sections:
1. The Financial Privacy Rule: Describes how consumer financial information must be collected and stored.
2. The Safeguards Rule: Describes what security programs a financial institution should have to protect sensitive data.
3. The Pretexting Provision: Prohibits the practice of obtaining private information of a customer through deceptive means or fraudulent practices.
Enacted in 1999, GLBA has undergone several revisions over the years, making it a challenge to stay abreast of any updates or deadline extensions.
What Does The Safeguards Rule Entail?
The Safeguards Rule requires that financial institutions (not just banks but also NBFCs like mortgage lenders, payday lenders, financial services, account servicers, wire transferors, collection agencies, investment advisors, etc.) develop, implement and maintain an information security program with proper administrative, technical and physical safeguards to protect customer information.
The goal is to ensure the confidentiality and security of customer information, to protect against anticipated threats to the integrity of that information, and to protect against unauthorized access that can cause any inconvenience to the customer.
The Information Security Program Must Contain Nine Components
The information security program must be written in accordance with the size and complexity of the business, the sensitivity of the information, and the nature or scope of business activities. The Safeguards Rule prescribes nine components that must be included in the information security program:
- Assign a “qualified individual” to implement and oversee the security program.
- Conduct a thorough risk assessment and document the criteria.
- Implement safeguards to control identified risks.
- Regularly monitor and test security defenses.
- Provide security awareness training for employees.
- Monitor and assess the security posture of service providers.
- Update the security program regularly.
- Maintain a well-documented incident response plan.
- Ensure the qualified individual reports to the board.
Recommendations To Help Organizations Comply With The Safeguards Rule
If the GLBA Safeguards Rule is applicable to your organization, here are seven straightforward steps you can take to help your business achieve compliance:
1. Assign security responsibility: Make an employee or a trusted third party accountable for overseeing your information security program. This person must have the required knowledge, experience and authority to manage security measures, conduct assessments, ensure compliance and update the board on the progress of the information security program.
2. Ascertain potential risks: Perform a risk assessment to understand where your crown jewels are, who is managing the data (internally or externally), what risks and vulnerabilities exist, and what security measures or controls are lacking. By thoroughly assessing the current security posture and practices, one can pinpoint areas that need strengthening, thus helping reduce the likelihood of a data breach.
3. Formulate a security plan: Develop a comprehensive plan to safeguard sensitive information. The entire information ecosystem and data life cycle must be understood well, and safeguards—such as access controls, data encryption (at rest and in transit), application security, multifactor authentication, etc.—must be implemented where necessary. Additionally, customer data must be disposed of properly, and businesses must maintain a log of all unauthorized activity.
4. Deliver security training to employees: Organizations must deliver security awareness training to their employees along with regularly scheduled refreshers. The objective of training is to make employees understand the importance of data protection and get them to adhere to the established security procedures. High-risk employees (those who work with sensitive data frequently) should especially receive individualized training.
5. Monitor and update the security program: Monitoring must be continuous and include periodic penetration testing and vulnerability assessments. Security threats are never static; therefore, the security program must also not become static. Whenever there is a change in business operations, emerging threats, and personnel, or whenever there are new insights from risk assessments or circumstances that can cause a material impact on the program, organizations must consider reevaluating their security controls and updating the security program.
6. Develop and document your incident response plan: Every business is required to have a well-documented incident response plan (IRP), including its goals, the internal processes of how the company will respond, designated roles, responsibilities, and levels of decision-making authority; a communication process for sharing information inside and outside the company. The IRP must also be updated based on learnings from ongoing incidents.
7. Ensure reporting requirements are implemented: In May 2024, the FTC announced another amendment to the GLBA Safeguards Rule that imposes data breach reporting requirements on financial entities. This new law requires that financial institutions notify the FTC as soon as possible or no later than 30 days after discovery of a security breach that involves at least 500 consumers. Make sure that your organization has clear processes in place for timely reporting.
Avoid Penalties For Noncompliance
Noncompliance with GLBA can lead to serious repercussions for both companies and their directors. Financial institutions may be fined up to $100,000 for each violation, while directors could face fines of up to $10,000 per violation and a potential five-year imprisonment. Additionally, civil lawsuits and damage to reputation may result in lost business and a decline in customer trust.
