Innocent Mall Shoppers, You're Off the Hook: Federal Agencies Release Model GLBA Privacy Notice Form

Posted on November 20, 2009 by Brendon Tavelli

On November 17, 2009, eight federal regulatory agencies released their final model privacy notice form that is intended to make it easier for consumers to understand how financial institutions collect and share information about them. The model privacy notice form, which features a version that offers consumers an opt-out and one with no opt-out, represents the culmination of extensive research and testing by the various agencies, which included a nationwide mall-intercept study (see our previous post here), and their analysis of public comments on the model form first proposed on March 29, 2007. The agencies’ efforts in this regard were spurned by the Financial Services Regulatory Relief Act of 2006, which amended the Gramm-Leach-Bliley Act (“GLBA”) and called upon the federal financial services agencies to jointly propose a succinct and comprehensible format for GLBA privacy notices.

Continue Reading...
Tags: , , , , , ,

Massachusetts Finally Finalizes Data Security Regulations - We Think

Posted on November 2, 2009 by Kristen J. Mathews

In response to feedback received at a public hearing held in September, the Massachusetts Office of Consumer Affairs and Business Regulation has released what it purports to be final regulations under Massachusetts' "Act Relative to Security Freezes and Notification of Data Breaches," which was enacted in Jul 2007.  

Regulation 201 CMR 17.00 ("Standards For The Protection of Personal Information of Residents of  the Commonweath") was previoulsly amended in August in response to industry backlash. 

This week's final amendments make very few changes to the regulations that were released in August:

  • The regulations apply to persons who "store" personal information in addition to those who receive, maintain, process, or otherwise have access to personal information
  • Service Providers include persons who "store" personal information through their provision of services directly to a person that is subject to the regulations (in addition to those who receive, maintain, process, or otherwise are permitted access to personal information)
  • The express carve-out of the U.S. Postal Service from the definition of "Service Providers" has been removed
  • The amendments clarify that Service Provider agreements that are entered into before March 1, 2010 do not have to be amended to comply with the regulations until March 1, 2012.

The March 1, 2010 effective date of the regulations has not changed.

 

Tags: