GLB

Question 1

What does GLB mean?

Answer 1

Gramm-Leach-Bliley Act

Question 2

Purpose of GLB?

Answer 2

To protect the privacy of consumer personal information

Question 3

GLB’s regulation?

Answer 3

Regulation P

Question 4

What governs a privacy notices?

Answer 4

Privacy of Consumer Financial Information Rule

(In the GLB Act)

Question 5

Purpose of a privacy notice

Answer 5

A “clear and conspicuous” written notice describing a financial institution’s privacy policies and practices

Question 6

Privacy notice scope

Answer 6

• All consumers must receive a privacy notice if the institution intends to share the consumer’s NPI with non-affiliated third parties; if the institution does not intend to share this information with non-affiliated entities, a privacy notice to consumers is not required
• All customers must be provided with a privacy notice that clearly discloses the institution’s practices for sharing NPI with affiliates and with third parties and specifies what information will be shared and with whom; this notice is due at the time a customer relationship is established
• A financial institution must provide consumers and customers with an opportunity to “opt out” of information sharing with non-affiliates (i.e., direct the institution to refrain from sharing NPI) and instruction on how to do so. A company’s policy should include a convenient method to opt out and a reasonable time to opt out before information is shared.
• In addition to the initial notice, customers must receive an annual privacy notice as long as they are customers; the GLB Act provides that this may be delivered electronically via a webpage, provided that the institution complies with all requirements and restrictions for doing so
• Privacy notices must be delivered in writing by mail, in person, or by posting on the institution’s website, unless the consumer consents to electronic delivery; posting a privacy notice at an office does not satisfy the delivery requirements

Question 7

Privacy notice requirements

Answer 7

A privacy notice must include:

• Categories of NPI collected and disclosed
• Categories of affiliates and non-affiliated third parties to which the information is disclosed
• Categories of information about former customers disclosed and to whom under the joint marketing/service provider exception (with the customer’s permission)
• If NPI is disclosed to non-affiliated third parties, the categories of information disclosed and the categories of third parties to which such information is disclosed
• An explanation of the consumer’s right to opt out of the disclosure of NPI to non-affiliated third parties
• Disclosures required by the Fair Credit Reporting Act
• The policies and practices used to protect the confidentiality and security of NPI

Question 8

What is the Safeguards Rule?

Answer 8

Establishes the document security requirements relating to NPI, as set forth in the GLB Act

Question 9

Safeguard rule requirements

Answer 9

A financial institution must

• Designate one or more employees to oversee the information security program
• Identify and assess the risks to customer information in each relevant area of the company’s operation and evaluate the effectiveness of the current safeguards for controlling these risks
• Design and implement a safeguard program and regularly monitor and test it
• Select appropriate service providers and require them to safeguard consumers’ personal information
• Evaluate and regularly update the program based on changing factors, including changes in the firm’s business arrangements or operations or as a result of its monitoring of the program

Question 10

Telemarketing Sales Rule

Answer 10

Requires telemarketers
* to make specific disclosures of material information
* prohibits misrepresentations
* sets limits on the times telemarketers may call consumers
* prohibits calls to a consumer who has asked not to be called again
* sets payment restrictions for the sale of certain goods and services

Exemptions:
* Political calls, such as those from or on behalf of candidates running for political office
* Charities calling on their own behalf to solicit charitable contributions
* Calls to persons with whom a seller or telemarketer has an established business relationship
* Calls to persons who have provided prior written consent for receipt of telemarketing calls
* “Prior written consent” may include providing an electronic signature on the website of a seller or telemarketer

Question 11

Do-Not-Call Implementation Act

Answer 11

Authorized the creation of the Do-Not-Call Registry and establishment of do-not-call restrictions under the Telemarketing Sales Rule

Question 12

Do-Not-Call Registry

Answer 12

Entities covered under the do-not-call rules (i.e., not exempted from the Telemarketing Sales Rule) may not call a phone number that is listed on the Registry.

Companies are required to update their call lists by reviewing the Registry at least once every 31 days.

Companies must maintainan (*) entity-specific DNC. If a consumer requests that their number be placed on a company-specific list, the company has 30 days in which to do so.

A company that violates the Telemarketing Sales Rule may be fined up to $51,744 per violation, and each phone call is treated as a separate violation.

A company may contact someone on the Registry if it has an established business relationship with the consumer.

An established business relationship is a relationship between a company and a consumer in which the consumer:

• Purchased, rented, or leased goods and/or services from the seller or participated in a financial transaction with the seller within the 18 months preceding a telemarketing call, or
• Made an inquiry into the business of the seller within three months preceding a telemarketing call

Even if a consumer’s phone number is on the Registry, a seller or telemarketer may market to them via the telephone with the clear, conspicuous written consent of the consumer.

It is prohibited for a telemarketer to make solicitation calls outside the hours of 8:00 a.m. and 9:00 p.m. If a telemarketer uses a recorded message, the consumer must be connected with a live sales representative within two seconds of the completion of the consumer’s initial greeting.

Purely informational pre-recorded calls (e.g., a call from an airline, an appointment reminder) are exempt from the Rule. However, if any solicitation is part of the message, such a call would be prohibited unless the consumer has provided permission in advance.

(*) The Entity-Specific Do-Not-Call Provision mandates an internal DNC. Telemarketers must keep and maintain their own DNC list, specific to their organization.

Question 13

Define: DNC

Answer 13

Do-not-call

(AKA The Do-Not-Call List or the Registry)

Question 14

Notice of Right to Financial Privacy and Right to Opt Out of the Sharing of Personal Information

Answer 14

Required by: GLB Act

Due: at time of application