GLBA Safeguards Gets A Makeover: Why It Matters For Businesses With Customer Information

In a much-anticipated announcement last week, the FTC amended the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule, and proposed a further amendment requiring certain financial institutions to provide the FTC with notice in the event of certain security events. Although these changes were announced after FTC Commissioner Chopra left the agency to lead the CFPB, he apparently voted prior to leaving to ensure 3/2 approval of the amendments in a Commission that remains divided.

What is GLBA Safeguards?

For nearly 20 years the Safeguards Rule has required financial institutions to develop, implement, and maintain comprehensive information security programs to protect their customers' personal information. Such programs must be appropriate to each entity's "size and complexity, the nature and scope of [its] activities, and the sensitive of the customer information at issue." For a generation, the Rule's requirements have influenced data security standards in other