8. Financial Privacy

Question 1

What are the Regulations related to FCRA?

Answer 1

FCRA regulates consumer reporting agencies (CRAs).
• CRAs compile or evaluate personal information to furnish consumer reports to third parties for a fee.
• A “consumer report” is any communication by a CRA, related to an individual, which is used to establish that individual’s eligibility for credit, insurance, employment, etc.
• An “investigative consumer report” gives information about a one’s character, reputation, mode of living, etc. and is obtained through a personal interview.
• FCRA limits the use of medical information obtained from a CRA. If needed for employment purposes, written consent is needed, and medical information
must be relevant.

Question 2

What are the Provisions related to FCRA?

Answer 2

FCRA mandates accurate and relevant data collection and provides privacy rights in consumer reports.
• Consumers have the ability to access and correct their information
• Limits use of consumer reports to “permissible purposes”

Question 3

What are the Enforcements related to FCRA?

Answer 3

The FTC, the Consumer Financial Protection Bureau (or CFPB), and state attorneys general enforce the FCRA through:
• Dispute resolution
• Private right of action
• Government actions

Question 4

What are the key concepts of FACTA?

Answer 4

1. the truncation of credit and debit card numbers
2. affording consumers the right to an explanation of their credit scores,
3. right to a free annual credit report
4. requiring regulators to implement the Disposal Rule and the Red Flags Rule

Question 5

What is the disposal rule under FACTA?

Answer 5

Applies to: Individuals or entities that use consumer reports for business purposes; e.g., consumer reporting agencies, lenders, employers, insurers, landlords, car dealers, attorneys, debt collectors, government agencies

Requirement: Dispose of consumer information in a way that prevents unauthorized access and misuse of the data

Violations: Civil liability as well as federal and state enforcement actions

Question 6

What is the Red Flag Rule under FACTA?

Answer 6

requires certain financial entities to develop and implement written identity theft detection programs that can identify and respond to “red flags” that signal identity theft.

Applies to: Financial institutions, such as banks, savings and loan associations, credit unions and creditors

Requirements: Develop a set of rules to mandate the detection, prevention and mitigation of identity theft

Question 7

What are the three key concepts of the GLBA Privacy rule?

Answer 7

1. Privacy Notice- initial and annual
2. Information Sharing- opt-out and 30 processing
3. Compliance

Question 8

What are the Three levels of security for GLBA safeguard rule?

Answer 8

1. Administrative security: Program definition, management of workforce risks, employee training, vendor oversight
2. Technical security: Computer systems, networks and applications, access controls and encryption
3. Physical security: Facilities, environmental safeguards, business continuity, disaster recovery

Question 9

What are the Three items on program design for GLBA safeguards rule?

Answer 9

1. Ensure the security and confidentiality of customer information
2. Protect against any anticipated threats or hazards to information
3. Protect against unauthorized access to or use of information that could result in substantial harm or inconvenience to customers

Question 10

What are the Four program implementations for GLBA safeguards rule?

Answer 10

1. Designate an employee to coordinate safeguards
2. Identify and assess risks and evaluate the effectiveness of the safeguards
3. Design, implement and monitor a safeguard program
4. Select and provide oversight of appropriate service providers