The U.S. Commodity Futures Trading Commission (Commission) issued a Staff Advisory on best practices for financial institutions that must comply with Gramm-Leach-Bliley Act (GLBA) provisions on data security and customer privacy.

GLBA was enacted to ensure that financial institutions respect the privacy of their customers and protect the security and confidentiality of nonpublic personal information.  Specifically, under the Commission’s regulations, futures commission merchants, commodity trading advisors, commodity pool operators, introducing brokers, retail foreign exchange dealers, swap dealers, and major swap participants (covered entities) “must adopt polices and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information.”  Those policies and procedures must:

1. Insure the security and confidentiality of customer records and information;
2. Protect against any anticipated threats or hazards to the security or integrity of such records; and
3. Protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

The recommended best practices include:

• Designating a specific employee with privacy and security management oversight responsibilities;
• Identifying, in writing, all reasonably foreseeable internal and external risks to security, confidentiality, and integrity of personal information and systems processing personal information;
• Designing and implement safeguards, in writing, to control the identified risks;
• Training staff to implement the program;
• Regularly testing and monitoring the safeguards;
• Implementing third party service provider agreements which specify that the third party is maintaining appropriate safeguards;
• Regularly evaluating and adjusting the program; and
• Designing and implementing policies and procedures to respond to incidents involving unauthorized access, disclosure, or use of personal information.

The best practices should look familiar to those who are familiar with the various state laws which require companies to implement written information security programs, as well as entities which are required to comply with HIPAA’s requirements.  Ultimately, every entity who maintains personal information, whether that of customers, clients, patients, or employees, should consider implementing a program to safeguard such information.