Note This law applies to U.S. customers only. Customers should rely on appropriate legal counsel and outside auditors for interpretation of the requirements of the act. Suggestions in this document are not to be construed as a substitute for legal advice or a definitive list of all possible legal considerations.
The Gramm-Leach-Bliley Act (GLB) requires financial institutions to disclose privacy policies regarding customer data. This disclosure must describe the ways the institution may use and disclose private information.
Where indicated in their policy, financial institutions must protect the privacy of their customers, including the personal information of the customers. To ensure this protection, the Graham-Leach-Bliley Act mandates that all institutions establish appropriate administrative, technical and physical safeguards.
Messaging data to which the Graham-Leach-Bliley Act might apply includes customer names and telephone numbers, called and calling number data, and abbreviated dial lists.
Use of the following key features can protect customer privacy and demonstrate the company’s compliance with the interagency guidelines supporting the Graham-Leach-Bliley Act.
| Feature | How related to Graham-Leach Bliley Act | Where documented |
|---|---|---|
| Encryption | Transmitted and stored data is protected from unauthorized individuals. | |
| System access control | Access to data is protected from unauthorized personnel. | |
| Authentication | Access to the system is restricted by login/password. | |
| Backup of data | Protection against destruction, loss, or damage of customer information due to potential environmental hazards or technological failures; protected by encryption and key | See |