September 18, 2019

September 18, 2019

Subscribe to Latest Legal News and Analysis

September 17, 2019

Subscribe to Latest Legal News and Analysis

September 16, 2019

Subscribe to Latest Legal News and Analysis

Best Practices For Gramm-Leach-Bliley Compliance Re: Data Security and Customer Privacy

The U.S. Commodity Futures Trading Commission (Commission) issued a Staff Advisory on best practices for financial institutions that must comply with Gramm-Leach-Bliley Act (GLBA) provisions on data security and customer privacy.

CTFC Commodity Futures Trading CommissionGLBA was enacted to ensure that financial institutions respect the privacy of their customers and protect the security and confidentiality of nonpublic personal information.  Specifically, under the Commission’s regulations, futures commission merchants, commodity trading advisors, commodity pool operators, introducing brokers, retail foreign exchange dealers, swap dealers, and major swap participants (covered entities) “must adopt polices and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information.”  Those policies and procedures must:

  1. Insure the security and confidentiality of customer records and information;
  2. Protect against any anticipated threats or hazards to the security or integrity of such records; and
  3. Protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

The recommended best practices include:

  • Designating a specific employee with privacy and security management oversight responsibilities;
  • Identifying, in writing, all reasonably foreseeable internal and external risks to security, confidentiality, and integrity of personal information and systems processing personal information;
  • Designing and implement safeguards, in writing, to control the identified risks;
  • Training staff to implement the program;
  • Regularly testing and monitoring the safeguards;
  • Implementing third party service provider agreements which specify that the third party is maintaining appropriate safeguards;
  • Regularly evaluating and adjusting the program; and
  • Designing and implementing policies and procedures to respond to incidents involving unauthorized access, disclosure, or use of personal information.

The best practices should look familiar to those who are familiar with the various state laws which require companies to implement written information security programs, as well as entities which are required to comply with HIPAA’s requirements.  Ultimately, every entity who maintains personal information, whether that of customers, clients, patients, or employees, should consider implementing a program to safeguard such information. 

Jackson Lewis P.C. © 2019


About this Author

Jason C. Gavejian, Employment Attorney, Jackson Lewis, Principal, Restrictive Covenants Lawyer

Jason C. Gavejian is a Principal in the Morristown, New Jersey, office of Jackson Lewis P.C. and a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.

Mr. Gavejian represents management exclusively in all aspects of employment litigation, including restrictive covenants, class-actions, harassment, retaliation, discrimination and wage and hour claims in both federal and state courts. Additionally, Mr. Gavejian regularly appears before administrative agencies,...

(973) 538-6890