GLBA
By Gareth HoyleLast updated How we research
GLBA is the Gramm-Leach-Bliley Act, the federal law that limits how financial institutions share consumers' nonpublic personal information and requires security safeguards.
GLBA is the Gramm-Leach-Bliley Act of 1999, the federal law that governs how financial institutions handle consumers' nonpublic personal information. The FTC describes covered firms as companies offering consumers financial products or services such as loans, financial or investment advice or insurance.
What does GLBA require?
The Privacy Rule requires a notice of information-sharing practices and a right to opt out before nonpublic personal information is shared with certain nonaffiliated third parties. The Safeguards Rule, 16 CFR Part 314, requires an information security program with administrative, technical and physical safeguards. Recipients of the data face limits on reuse and redisclosure.
How does GLBA affect AI data licensing?
GLBA affects AI data licensing because customer records at banks, lenders, insurers and many fintech firms are nonpublic personal information. A license to an AI buyer is a disclosure to a nonaffiliated third party, so it needs the notice and opt-out position checked, or de-identification. Many state privacy and data broker laws exempt GLBA-covered data, which shifts the question to GLBA itself. See our financial services page.
In the UK and EU, financial data is ordinary personal data under GDPR, with sector rules from financial regulators.