Certified Banking Data Privacy Law and Regulation - Module 3.pptx

Certified Banking Data Privacy Law and Regulation - Module 3.pptx

1. Data Privacy Law and Regulation Certification Dr. Kevin F. Streff Founder and Managing Partner 1

2. 2 Testified to Congress several times on behalf of banking and cyber Author of Data Privacy textbook Conducted training and education for examiners Done cybersecurity work in almost all states in the U.S. banking system for over 20 years Published in both banking and academic magazines and journals Regular speaker at banking conferences Leading technology, cyber, and privacy educator at Dakota State University and the ASP Academy™ Dr. Kevin Streff

3. Dr. Streff is not an attorney and is not providing legal advice 3

4. Agenda 4

5. Module 3 Gramm-leach-Bliley Act of 1999 5

6. Glass-Steagall of 1933 Legislation that includes four provisions of the United States Banking Act of 1933 separating commercial and investment banking Forced commercial banks to refrain from investment banking activities to protect depositors from potential losses through stock speculation. Glass-Steagall aimed to prevent a repeat of the 1929 stock market crash and the wave of commercial bank failures. Signed into law by President Franklin Delano Roosevelt was part of the New Deal  6

7. Gramm-Leach-Bliley Act of 1999 Repealed Glass-Stegall Increased competition Increased need for information sharing Increased need for security and privacy The eliminated the Glass-Steagall Act's restrictions against affiliations between commercial and investment banks in 1999, which some argue sparked the 2008 financial crisis. 7

8. FFIEC Booklets 8

9. IT Workprograms 9

10. Title V, Subtitle A, of this Act (15 U.S.C. § 6801 et seq.) requires the FTC, along with the Federal banking agencies and other regulators, to issue regulations ensuring that financial institutions protect the privacy of consumers' personal financial information Title V, Subtitle B of Title V (15 U.S.C. § 6821 et seq.) prohibits obtaining customer information of a financial institution by false pretenses. The FTC enforces these provisions with regard to entities not specifically assigned by the provision to the Federal banking agencies or other regulators.  Gramm-Leach-Bliley Act | Federal Trade Commission Federal Trade Commission 10

11. Under the Dodd-Frank Act, this rulemaking authority transferred to the Bureau of Consumer Financial Protection, but the FTC continues to have enforcement authority CFPB 1033 Ruleset under Dodd-Frank is Module 8 of this certification program Consumer Financial Protection Bureau 11

12. The GLBA requires FIs to clearly communicate how sensitive financial data is protected SEC. 501. Safeguards Rule – Develop and operationalize a written information security program SEC. 502. Financial Privacy Rule - Obligations with respect to disclosures of personal information SEC. 503. Disclosure of a Privacy Policy LINK Let’s Review GLBA Together 12

13. Thought of security and privacy as separate and distinct We know today that are overlapping and dependent upon each other Privacy Started with consent and privacy policy Today: Need an Information Privacy Program Security Started with Information Security Program GLBA 13

14. Provide Transparency and Control Over Personal Data Protect CIA of Non-Personal Data and Information Systems 14 Information Privacy Program Information Security Program

15. Commercially Reasonable Security Commercially Reasonable Privacy Provide Transparency and Control Over Personal Data Protect CIA of Non-Personal Data and Information Systems 15 Information Privacy Program Information Security Program

16. The Gramm-Leach-Bliley Act of 1999 laid the foundation for both security and privacy in a financial institution Addressed them individual through the Safeguards rule (security) and Reg P (privacy) 16

17. Dr. Kevin Streff American Security and Privacy, LLC Founder & Managing Partner www.americansecurityandprivacy.com [email protected] 605.270.4427 www.drstreff.com 17 ASP Academy ™