Title V of the Gramm-Leach-Bliley Act (Title V. GLB)

Title V, GLB (15 USC 6801 et seq.) is fundamentally different from the RFPA. The RFPA restricts releasing information to the federal government. Title V, GLB restricts releasing certain information about consumers to “nonaffiliated third parties,” which includes almost any entity other than an affiliate of the institution releasing the information.

Title V, GLB became law in November of 1999. It authorizes various federal agencies to issue implementing regulations. Rulemaking authority to implement the GLBA privacy provisions was initially spread among the many agencies. In 2011, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act) transferred GLBA privacy notice rulemaking authority from the Board, NCUA, OCC, OTS, the FDIC, and the FTC (in part) to the Consumer Financial Protection Bureau (the Bureau). The Bureau then restated the implementing regulations in Regulation P, 12 CFR part 1016, in late 2011. The privacy regulations are divided into four parts. The first deals with the notices you are required to provide to consumers. The second concerns the limits on disclosure of information about consumers to third parties. The third deals with exceptions to the requirements and limitations of the first two parts. Finally, the fourth has to do with the relationship between the privacy regulations and other laws—namely, the Fair Credit Reporting Act and state privacy laws. We’ll look at each of these parts separately.

Before we start, however, you should know that the privacy regulations use the words “notice” and “disclosure” in a way that you might find confusing. As used in the privacy regulations, a “notice” is information you must provide to the consumer. A “disclosure” is information about the consumer that you provide to a third party. This might be confusing to you because in other contexts, such as Truth-in-Lending or Truth-in-Savings regulations, a “disclosure” is information you give to the consumer. We will use notice and disclosure in the way the privacy regulations do, but we’ll try to do it in such a way that the terms will not be confusing.

Now we’re ready to look at the four basic parts of the privacy regulations, starting with the notice requirements.