Hey, welcome to VoraPrep Audio. Glad you could tune in.
So let’s picture this, because it’s a scenario that comes up all the time on the exam. You’re the new privacy lead at Horizon Bank. Management comes to you with two things on the same day. First, the marketing team wants to share customer account balances with an affiliated company, Horizon Wealth, to sell them investment products. Second, the fraud department flags a bunch of weird account openings that look a lot like identity theft.
They're looking at you. What do you tell them? This is exactly where the test wants to see if you can connect the dots between a few big federal laws: GLBA, FCRA, FACTA, and something called the Red Flags Rule. It feels like a messy alphabet soup, but there’s a really clear logic to it.
Let's start with the big one: the Gramm-Leach-Bliley Act, or GLBA. Think of GLBA as the main rulebook for any business that's a "financial institution." And that term is way broader than you might think. It’s not just banks. It’s mortgage brokers, tax preparers, securities firms, even an auto dealer that gives you a loan. If they’re in the business of finance, GLBA is probably watching them.
And what it’s watching is your Nonpublic Personal Information, or NPI. That’s the sensitive stuff—your account numbers, your transaction history, any personally identifiable financial info they have on you.
GLBA has two main parts you absolutely have to know. The Privacy Rule and the Safeguards Rule.
The Privacy Rule is all about *sharing*. It says a financial institution has to give you a clear, easy-to-read privacy notice. It has to be upfront about what NPI it collects and who it shares it with. You get one when you first become a customer, and then another one every year. And here's the key part: for sharing with certain *non-affiliated* third parties—think of an outside marketing company—they have to give you the right to opt out. To say, "Nope, you can't share my info." So, going back to our Horizon Bank example, if they wanted to sell your data to some random, unaffiliated data broker, they'd have to give you that notice and a chance to opt out. Sharing with an affiliate, like Horizon Wealth, has slightly different rules, but the core idea of transparency through a notice is always there.
Then there’s the Safeguards Rule. This part is about *protecting* the data. It's not enough to just have rules about sharing; you have to actually secure the NPI. The rule requires a written information security program. It needs to have administrative, technical, and physical safeguards. That means things like training employees, using encryption, and locking server room doors. It also says you have to designate a specific person to be in charge of the program, to run risk assessments, and to make sure it’s actually working. It’s the "lock your doors and windows" part of the law.
And there's a quick third piece to GLBA—a rule against "pretexting." That’s just a formal way of saying you can’t lie or use false pretenses to get someone’s financial information from a bank. Pretty straightforward.
Okay, so GLBA covers the information a financial institution collects *on* you. But what about the information collected *about* you to judge your credit? That’s where the Fair Credit Reporting Act, or FCRA, comes in.
FCRA is all about your consumer report. You probably just call it your credit report. This law regulates the big credit bureaus—the Consumer Reporting Agencies, or CRAs, like Experian, Equifax, and TransUnion. FCRA's whole mission is to make sure the information they have on you is accurate and private. It says that your report can only be pulled for a "permissible purpose." So, a bank considering you for a loan? Yes, that’s permissible. An employer running a background check? Yes, permissible. Your curious neighbor? Absolutely not. FCRA also gives you rights, like the right to see what’s in your file and the right to dispute any errors you find.
Now, a few years after FCRA, Congress passed an update called the Fair and Accurate Credit Transactions Act, or FACTA. You can think of FACTA as a set of really important upgrades to FCRA. It gave us a few things we now take for granted.
First, the right to a free credit report from each of the big three agencies once a year. That was FACTA. It also gave us the rule that credit card receipts can't show your full card number—they have to truncate it, showing only the last five digits or so. And it created the Disposal Rule, which says businesses have to securely destroy old consumer reports instead of just tossing them in the trash.
But the biggest thing to come out of FACTA, especially for your exam, is the Red Flags Rule. This is a huge one. It requires financial institutions *and* creditors to create and run an Identity Theft Prevention Program. The goal is to spot "red flags"—those suspicious patterns that might signal identity theft.
So, let's go back to our Horizon Bank problem. The fraud department sees suspicious account openings. That's a classic red flag. Under this rule, the bank *must* have a program in place to detect that activity, and then to respond to it to prevent or mitigate the harm. And notice I said "creditors," too. Just like with GLBA, that term is broad. It can include your utility company or a doctor’s office that lets you pay over time. If they're a creditor, the Red Flags Rule applies.
So, let’s walk through the Horizon Bank problem like you would on exam day.
But now, the fifth and final step: Check for Red Flags Rule compliance. This directly addresses the second part of the problem—the suspicious account openings. As a financial institution, Horizon Bank is required by the Red Flags Rule—which is part of FACTA—to have that Identity Theft Prevention Program. So your advice would be to activate that program immediately to investigate and respond to those suspicious accounts.
See how they all fit together? GLBA for privacy notices and security programs, and the Red Flags Rule for proactively fighting identity theft.
Before we wrap up, a few common traps to watch out for. First, don't confuse NPI under GLBA with, say, Protected Health Information, or PHI, under HIPAA. They're defined differently and governed by totally different laws. Also, remember that 'financial institution' and 'creditor' are incredibly broad terms that go way beyond just banks. And really drill down on the difference between sharing with affiliated versus non-affiliated companies under GLBA—that’s a classic exam distinction.
Let’s try a quick question. A securities firm wants to share its customer investment details—which is NPI—with an *unaffiliated*, third-party marketing company. Under GLBA, what’s their primary obligation before they do that?
The answer is they have to provide a privacy notice and a clear opportunity for customers to opt out of that sharing. That's the core of the GLBA Privacy Rule for non-affiliates.
Here’s one more. An auto loan company notices a pattern of address changes immediately followed by requests for new credit lines. Which law specifically requires them to have a program to deal with these 'red flags'?
That would be FACTA, specifically the Red Flags Rule. It’s the law that mandates the Identity Theft Prevention Program.
These laws are foundational for so many privacy roles, and knowing them cold is a huge advantage. If you want to get more practice with questions like these and reinforce all of these concepts, check out the app. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. You can find it at Vora Prep dot com. It's free to get started and see if it works for you.
So, to recap the big ideas for today. GLBA applies to financial institutions and their handling of NPI, with the Privacy Rule covering sharing and the Safeguards Rule covering security. FCRA governs consumer reports from the big credit bureaus. And FACTA is the important amendment to FCRA that gave us things like free annual credit reports and, most critically, the Red Flags Rule, which requires a proactive plan to fight identity theft.
You've got this. Just keep breaking these complex topics down into simple, real-world pieces. Thanks for listening, and I'll catch you on the next one.