GLB Act

Gramm-Leach-Bliley Act of 1999 (GLB Act)

The Financial Modernization Act of 1999, also known as the Gramm-Leach-Bliley Act (GLB Act), includes privacy provisions to protect consumer information held by financial institutions. In 2003, the Federal Trade Commission (FTC) confirmed that higher education institutions are considered financial institutions under this federal law. The Safeguards Rule of the GLB Act requires financial institutions to have a security plan to protect confidentiality and integrity of personal information. Privacy notices explaining an institution's information-sharing practices must also be provided.

As of May 23, 2003, colleges and universities must be in compliance with provisions of the GLB Act that relate to the Safeguards Rule. Colleges and universities that already comply with the Family Educational Rights and Privacy Act (FERPA) will be deemed to be in compliance with FTC privacy rules under the GLB Act.

EDUCAUSE has identified links concerning the GLB Act that may be useful to the higher education community. Many of these links have been contributed by EDUCAUSE members. If you would like to include additional resources on this page, send the information to contribute@educause.edu

Federal Government Resources

Gramm-Leach-Bliley Act of 1999 (GLB Act) Public Law 106-102, passed by the 106th Congress.

16 CFR Part 314: Standards for Safeguarding Customer Information; Final Rule Published in May 2002, the regulations under 16 CFR Part Part 314 stem from the GLB Act and mandate extensive new privacy protections for consumers. Since colleges and universities participate in financial activities, such as making federal Perkins Loans, FTC regulations consider higher education institutions to be financial institutions for the purposes of the GLB Act. An FTC News Release from May 17, 2002.

Financial Privacy: The Gramm-Leach Bliley Act The FTC is educating consumers and businesses about the importance of personal information privacy, including the security of personal information. Under the GLB Act, the FTC has implemented rules concerning financial privacy notices and the administrative, technical, and physical safeguarding of personal information.

FTC Brief: Financial Privacy Requirements This page offers a brief review of the basic financial privacy requirements of the GLB Act.

FTC Guide: Safeguards Rule Compliance This document describes how to comply with the Safeguards Rule of the GLB Act. Topics covered include: "Who Must Comply," "How to Comply," and "Securing Information."

FTC Information Security This Web site was created by the FTC for consumers and businesses as a source of information about computer security and safeguarding personal information.

Information Regarding the Gramm-Leach-Bliley Act of 1999 This web site, hosted by the U.S. Senate Committee on Banking, Housing, and Urban Affairs, provides a conference report and text of the bill, summary of provisions, statements, and press releases.

Association and Non-governmental Organization Resources

EPIC (Electronic Privacy Information Center) GLB Resource Page

National Association of College and University Business Officers (NACUBO) GLB Act Resource Page

Training

GLB Act Safeguards Rule Training (by the FTC)

Universities and the GLB Act

Catholic University of America, Office of the General Counsel

Florida State University, Finance Administration Policies & Procedures

Georgetown University, Policies & Procedures

University of Arizona Information Security & Privacy

University of Kansas Medical Center, GLB Act Security Program

University of Maryland-Baltimore, Information Technology Privacy Policy

University of Pittsburgh, Customer Information Security Plan

University of Virginia, Financial & Administrative Policies & Procedures