Gramm-Leach-Bliley Act (GLBA)

The Gramm-Leach-Bliley Act is Public Law 106-102, enacted November 12, 1999. It is an omnibus financial services law: its first title allowed banks, securities firms and insurers to affiliate under common ownership, in part by repealing two sections of the Banking Act of 1933, while its fifth title created federal privacy rules for consumers' financial information. The law is sometimes called the Financial Services Modernization Act, but that name does not appear in it; its short title is the Gramm-Leach-Bliley Act, abbreviated GLBA.

The privacy rules start from a statement of policy that "each financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information" (15 U.S.C. 6801(a)). They then impose two duties that reach consumers directly: a notice explaining the institution's information practices, and a right to opt out of certain disclosures to companies outside its corporate family.

The notice. At the time of establishing a customer relationship, "and not less than annually during the continuation of such relationship," a financial institution must give a clear and conspicuous disclosure of its policies on sharing nonpublic personal information with affiliates and nonaffiliated third parties, on information about former customers, and on protecting the information (15 U.S.C. 6803(a)). Regulation P defines annually as "at least once in any period of 12 consecutive months." An institution may skip the annual notice if it shares information with nonaffiliated parties only under the statute's exceptions and has not changed its practices since the last notice it sent (6803(f)). That is why some customers stop receiving one.

The model form. The agencies developed an optional two-page model notice, now an appendix to Regulation P. It opens with a key frame headed Why?, What? and How?, sets out a table of "Reasons we can share your personal information," and adds a "To limit our sharing" box where an opt-out is available. Using it gives the institution a safe harbor for the notice's content.

The opt-out, and what it does not reach. An institution may not disclose nonpublic personal information to a nonaffiliated third party unless it has told the consumer it may do so and given the consumer a chance, before the disclosure, "to direct that such information not be disclosed" (6802(b)). Several things fall outside that right:

• Affiliates. The Act's opt-out covers nonaffiliated third parties only. Separate Fair Credit Reporting Act rights let you limit some sharing of creditworthiness information among affiliates and the use of shared information by an affiliate to market to you.
• Service providers and joint marketing. An institution may share with a company that performs services for it, including marketing its own products or products offered under a joint agreement with another financial institution, if it discloses this and the company is bound by contract to keep the information confidential (6802(b)(2)).
• The general exceptions. Section 6802(e) allows disclosures needed to process a transaction you requested or service your account, with your consent, to prevent fraud, to a consumer reporting agency under the Fair Credit Reporting Act, in the sale of a business, and to comply with law or legal process.

Two further limits apply regardless of opt-out: an institution may not give your account number to an outside company for telemarketing, direct mail or email marketing (6802(d)), and a company that receives your information may not pass it on to others unless the original institution could have (6802(c)). Under Regulation P an opt-out lasts until you revoke it, and continues to cover information collected during the relationship after the account closes.

Which rule applies. Regulation P covers information about individuals who get financial products or services "primarily for personal, family, or household purposes"; it "does not apply to information about companies or about individuals who obtain financial products or services for business" purposes. It excludes certain motor vehicle dealers and firms under the rulemaking authority of the Securities and Exchange Commission or the Commodity Futures Trading Commission. So a broker-dealer's privacy notice, or that of a registered investment adviser whose registration is with the SEC, comes under the SEC's Regulation S-P instead.

Pretexting. Subtitle B of the same title makes it a violation to obtain, or try to obtain, a customer's information from a financial institution by a false statement to the institution or the customer, or by giving the institution a document the person knows is forged, stolen or fraudulently obtained, and to ask someone else to get the information knowing they will use one of those means.

Data security. The Act also directs regulators to set standards for safeguarding customer information. What happens when those safeguards fail, and who must be notified, is covered on the data breach page.

The notice arrives on a schedule, and the decision it asks for is narrower than the length of the document suggests.

For example: Kenji opens a checking account and a credit card at a bank on March 10.

• At opening, the bank gives him its privacy notice. Its table shows that it shares information with its own affiliates for their everyday business, and that it shares with nonaffiliated companies so they can market to him.
• The opt-out. Because of that second line, the notice includes an opt-out, by phone, online or a mail-in form. Kenji opts out. The bank must honor it "as soon as reasonably practicable," and it stays in effect until he revokes it.
• What continues. The bank still processes his payments through its vendors, reports the card to the credit bureaus and shares with affiliates, because those fall outside the Act's opt-out.
• Later notices. If the bank defines its notice year as the calendar year, it must send his next notice by December 31 of the following year. If it shares only under the statute's exceptions and never changes its practices, it may stop sending annual notices altogether.

Pros

• Requires institutions to explain, in a standardized form, what they collect and share.
• Gives a right to stop many disclosures to outside companies, which lasts until revoked.
• Bars passing account numbers to outside marketers, and makes pretexting for financial information a federal violation.

Cons

• No right under the Act to stop sharing with affiliates, which can be large corporate families.
• The exceptions are broad: service providers, joint marketers, credit bureaus and many others still receive information after an opt-out.
• An institution that shares only under the exceptions may stop sending annual notices, so the absence of a notice does not mean nothing is shared.
• Different agencies' versions of the rule apply to banks, investment firms and others, which makes notices look alike but rest on different regulations.