November 28, 2014

Advertisement

November 26, 2014

November 25, 2014

Best Practices For Gramm-Leach-Bliley Compliance Re: Data Security and Customer Privacy

The U.S. Commodity Futures Trading Commission (Commission) issued a Staff Advisory on best practices for financial institutions that must comply with Gramm-Leach-Bliley Act (GLBA) provisions on data security and customer privacy.

CTFC Commodity Futures Trading CommissionGLBA was enacted to ensure that financial institutions respect the privacy of their customers and protect the security and confidentiality of nonpublic personal information.  Specifically, under the Commission’s regulations, futures commission merchants, commodity trading advisors, commodity pool operators, introducing brokers, retail foreign exchange dealers, swap dealers, and major swap participants (covered entities) “must adopt polices and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information.”  Those policies and procedures must:

  1. Insure the security and confidentiality of customer records and information;
  2. Protect against any anticipated threats or hazards to the security or integrity of such records; and
  3. Protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

The recommended best practices include:

  • Designating a specific employee with privacy and security management oversight responsibilities;
  • Identifying, in writing, all reasonably foreseeable internal and external risks to security, confidentiality, and integrity of personal information and systems processing personal information;
  • Designing and implement safeguards, in writing, to control the identified risks;
  • Training staff to implement the program;
  • Regularly testing and monitoring the safeguards;
  • Implementing third party service provider agreements which specify that the third party is maintaining appropriate safeguards;
  • Regularly evaluating and adjusting the program; and
  • Designing and implementing policies and procedures to respond to incidents involving unauthorized access, disclosure, or use of personal information.

The best practices should look familiar to those who are familiar with the various state laws which require companies to implement written information security programs, as well as entities which are required to comply with HIPAA’s requirements.  Ultimately, every entity who maintains personal information, whether that of customers, clients, patients, or employees, should consider implementing a program to safeguard such information. 

Jackson Lewis P.C. © 2014

TRENDING LEGAL ANALYSIS


About this Author

Jason C. Gavejian, Employment Litigation Attorney, Jackson Lewis Law Firm
Shareholder

Jason C. Gavejian is a Shareholder in the Morristown office of Jackson Lewis P.C. Mr. Gavejian represents management exclusively in all aspects of employment litigation, including restrictive covenants, class-actions, harassment, retaliation, discrimination and wage and hour claims. Mr. Gavejian regularly represents employers in federal and state courts and administrative agencies, including the Equal Employment Opportunity Commission, the New Jersey Division of Civil Rights, and the New Jersey Department of Labor. Additionally, Mr. Gavejian is a member of the firm’s ...

(973) 538-6890