The Safeguards Rule of GLBA outlines the data protection and privacy standards, while the FTC’s Privacy of Consumer Financial Information Rule outlines the implementation standards. Compliance with GLBA is overseen by the FTC, federal regulatory authorities, and state oversight agencies.
An organization that is engaged in financial services must provide their clients a written privacy notice, which explicitly states what information is being collected, how it is being shared, and what measures the organization has implemented to safeguard this data. Clients must be presented with this notice before they enter into an agreement with the organization.
Failure to comply with GLBA rules can lead to up to 5 years of imprisonment, organizational fines in the amount of $100,000 for each violation, individual fines in the amount of $10,000 for each violation, or a combination of all penalties.
