Safeguarding customer information gramm leach bliley act compliance
1 / 44

Safeguarding Customer Information Gramm-Leach-Bliley Act Compliance - PowerPoint PPT Presentation

  • Updated On :

Safeguarding Customer Information Gramm-Leach-Bliley Act Compliance. Ellen Harris-Small Terry Wooding. Why was GLBA enacted?.

Related searches for Safeguarding Customer Information Gramm-Leach-Bliley Act Compliance

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Safeguarding Customer Information Gramm-Leach-Bliley Act Compliance' - sarai

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Safeguarding customer information gramm leach bliley act compliance
Safeguarding Customer InformationGramm-Leach-Bliley Act Compliance

Ellen Harris-Small

Terry Wooding

Why was glba enacted
Why was GLBA enacted?

Section 501 of the Gramm-Leach-Bliley Act requires Financial Institutions to establish standards relating to administrative, technical and physical information safeguards to protect customer records and information.

Safeguard objectives
Safeguard Objectives:

  • Ensure security and confidentially of customer records and information.

  • Protect against any anticipated threats or hazards to the security of the records.

  • Protect against unauthorized access or use of records or information which could result in harm or inconvenience to customer.

Information security plan
Information Security Plan

  • Written to insure security and confidentiality of non-public customer financial information (NPI).

  • Protect against any anticipated threats and hazards.

  • Protect against unauthorized access or use.

Non public customer information npi
Non-public customer information(NPI)

  • Credit card numbers

  • Social Security numbers

  • Drivers license numbers

  • Student loan data

  • Income information

  • Credit histories

  • Customer files with NPI

  • NPI Consumer information

  • Bank Account data

Financial institutions
Financial Institutions

Including Colleges and Universities must ensure that their security programs provide adequate protection to customer information

in whatever format –

electronic or hardcopy.

Ftc ruling
FTC Ruling

consumer’s information is not a privacy issue but is one of security.

Compliance with FERPA does not exempt colleges and universities from GLBA safeguarding regulations.

Ferpa vs glba

  • The Family Education Rights and Privacy Act addresses the privacy of student information.

  • Gramm- Leach-Bliley Act addresses the security of customer records and information.

Rutgers university
Rutgers University

  • Has established a committee to insure compliance.

  • Committee meets regularly to review and insure compliance with the act.

  • Performs risk assessment and regular testing.

  • Oversees service providers and contracts.

  • Trains staff to maintain security and confidentially.

Statistics on Identity Theft in New Jersey

4802 Complaints / year

  • 1. Credit Card Fraud 2,350 -- 49%

  • 2. Phone or Utilities Fraud 867--18%

  • 3. Bank Fraud 669 --14%

  • 4. Government Documents/Benefits Fraud 396 --8%

  • 5. Loan Fraud 356 --7%

  • 6. Employment-Related Fraud 260 -- 5%

  • 7. Attempted Identity Theft 477 --10%

  • 8. Other 710 -- 15%

What is identity theft
What is Identity Theft?

  • Under ID Theft Act, identity theft is defined very broadly as:

    knowingly using, without authority, a means of identification of another person to commit any unlawful activity.

    (unlawful activity: a violation of Federal law, or a felony under State or local law).

Identity theft
Identity Theft

When someone steals your identity, they are usually using your credit to obtain goods and services for themselves that “you” will have to pay for.

How does an identity thief get your information
How Does an Identity Thief Get Your Information?

  • Stealing files from places where you work, go to school, shop, get medical services, bank, etc.

  • Stealing your wallet or purse.

  • Stealing information from your home or car.

  • Stealing from your mailbox or from mail in transit.

  • Sending a bogus email or calling with a false promise or fraudulent purpose.

    - For example: pretending to be from a bank,

    creating a false website, pretending to be

    a real company, fake auditing letters.

From: PNC Bank

Sent: May 17, 2004 6:31 PM

To: [email protected]

Subject: To All PNC bank users

Dear PNC user,

During our regular update and verification of the user data, you

must confirm your credit card details.

Please confirm you information by clicking link below. pncfeatures/cardmember access.shtml

2004 PNC Bank

How does an identity thief use your information
How Does an Identity Thief Use Your Information?

  • Obtains Credit Cards in your name or

    makes charges on your existing accounts (42%).

  • Obtains Wireless or telephone equipment or services in your name (20%).

  • Forges checks, makes unauthorized EFTs, or open bank accounts in your name (13%).

  • Works in your name (9%).

  • Obtains personal, student, car and mortgage loans, or cashes convenience checks in your name (7%).

  • Other uses: obtains drivers license in your name.

Victims of identity theft
Victims of Identity Theft

  • If your identity is stolen, do the following immediately:

    • Contact the fraud department of the three major credit bureaus (Equifax, Experian, Trans Union).

    • Contact your creditors and check your accounts.

    • File a police report.

      - File a complaint with the FTC.


  • Take back control of your identity:

    • Close any fraudulent accounts.

    • Put passwords on your accounts.

    • Change old passwords and create new PIN codes.


  • Protect yourself

  • Protect others

  • Guard against fraud:

    • Sign cards as soon as they arrive.

    • Keep records of account numbers and phone numbers.

    • Keep an eye on your card during transactions. Also be aware of who is around you, is anyone else listening?

    • Check your credit report and credit card monthly statements.

Annual credit bureau report
Annual credit bureau report

  • New Jersey residents are entitled to one free annual credit report.

  • If you are denied credit, you are allowed to request one free copy of your credit report.

  • Check your report for accurate information, open accounts, balance information, loan information, etc.

Credit bureau links
Credit Bureau Links

  • Equifax –

    • To order a report, 1-800-685-1111

    • To report fraud, 1-800-525-6285

  • Experian –

    • To order a report, 1-888-397-3742

    • To report fraud, 1-888-397-3742

      Trans Union –

    • To order a report, 1-800-916-8800

    • To report fraud, 1-800-680-7289

You may be a victim if
You may be a victim if:

  • You are denied credit.

  • You stop getting mail.

  • You start getting collection calls/mail.

  • You start getting new bills for accounts you do not have or services you did not authorize.

  • Your bank account balances drops.


  • Time

  • Money

  • Credit rating

  • Reputation

Good practices
Good Practices

  • Photocopy the contents of your wallet/purse.

  • Photocopy your passport (keep a copy at home and one with you when you travel).

  • Empty your wallet/purse of non-essential identifiers.

  • Do not use any information provided by the people who may be trying to scam you look it up yourself.

  • Shred documents before you depose of them.

Glba requires us to protect consumers from substantial harm or inconvenience
GLBA requires ustoPROTECT CONSUMERS from substantial harm or inconvenience.

What can we do to guard npi
What can we do to guard NPI?

  • Keep confidential information private.

  • Use care when asking or giving SSN.

  • Use secure disposal methods.

  • Protect the privacy of data transmissions.

  • Improve procedures.

Actions to prevent others from becoming victims
Actions to prevent Others from becoming Victims

  • Determine what information you need.

  • Provide a secure workplace.

  • Always ask for a student’s ID or debtors account number.

  • Keep prying eyes away from customer’s information.

  • Don’t expose NPI information to the outside world.

Actions to prevent others from becoming victims1
Actions to prevent Others from becoming Victims

  • Take care when you provide employee’s or customers’ personal information to others.

  • Know & explain how you handle personal information.

  • Ask for written permission prior to sharing personal information.

  • Report problems or concerns to managers or supervisors.

Remember to always maintain confidentiality, security and integrity :


  • unauthorized disclosure

  • removing information from your office

  • sharing information

  • tossing information in the trash

  • down loading or e-mailing information.

General privacy
General Privacy integrity :

  • Do not provide correcting information for account verification questions.

  • Be suspicious.

  • Be paranoid.

  • Don’t be afraid to say no when asked for information that is not required to conduct the current business transaction.

Rutgers university assets
Rutgers University Assets integrity :

Are customer

information and records assets?

Safeguarding information
Safeguarding Information integrity :

  • Information takes many forms.

  • Information is stored in various ways.

  • Data assets have unique risks.

Safeguarding information1
Safeguarding Information integrity :

Your Role:

  • Ensure Physical Security.

  • Select and Protect hard to guess passwords.

  • Avoid email traps and disclosures.

  • Back up files.

  • Log off your computer when not in use.

  • Do not open emails with attachments from unknown sources.

  • Obliterate data before giving up your computer.

  • Recognize social engineering tactics.

Safeguarding information2
Safeguarding Information integrity :

Your role as a user….

What else can you do?

Check your work area
Check your work area! integrity :

  • Do you leave NPI reports on your desk?

  • Is NPI stored in unlocked file cabinets?

  • Keep computer disks secure.

  • Do not save NPI on your computer C drive.

Safeguarding information3
Safeguarding Information integrity :

Your role….

The University has many policies and procedures to help you, learn them.

University regulations guidelines related to safeguarding
University Regulations & Guidelines related to Safeguarding integrity :

Standards for University Operations Handbook

  • Confidentiality

  • Accounting for Financial Resources

  • Acceptable Use of Network &Computing Resources:

    • Agreement for Accessing Information

    • Acceptable Use Policy

    • Guidelines for Interpretation of Acceptable Use

    • Acceptable Use Supplement

    • Basics

Potential damages to rutgers
Potential Damages to Rutgers integrity :

  • Reputation

  • Violation of federal and state laws

  • Fines

  • Reparation costs

  • Recovery costs

  • Increased prevention costs

    Georgia Tech accidental release of credit card to the internet cost them over $1,000,000.

Management s expectations
Management’s Expectations integrity :

“Rutgers places a high level of trust in you, its faculty and staff, and requires that University assets under your control be protected and properly safeguarded from loss and misuse.”

Joanne G. Jackson

Senior V.P.

October 24, 2001

Expectations integrity :

  • All RU employees are responsible for securing and caring for University property, resources and other assets.

  • RU relies on the attention and cooperation of every member of the community to prevent, detect and report the misuse of university assets.

Prevention integrity :

  • Protect yourself

  • Protect others