Information Security and Privacy Regulations

Customer screening generates a large amount of sensitive personal data. Regulation S-P governs how broker-dealers collect, use, disclose, and protect this nonpublic personal information (NPI).

What Does Regulation S-P Cover?

• Adopted under the Gramm-Leach-Bliley Act (GLBA)
• Applies to broker-dealers, investment companies, and registered investment advisers
• Governs the collection, use, and disclosure of nonpublic personal information (NPI) about consumers
• NPI includes any personally identifiable financial information that is not publicly available (e.g., account numbers, balances, transaction history, SSN)

Think of it this way: NPI is anything a stranger could not find out about you through public records. Your name might be public, but your account balance and trading history are not.

Regulation S-P distinguishes a consumer from a customer. A consumer only obtains a financial product or service without an ongoing relationship, such as a one-time transaction; a customer has a continuing relationship, such as a brokerage account.

A customer always gets the initial and annual notices. A mere consumer gets a notice only before the firm discloses their NPI to a nonaffiliated third party outside the standard exceptions.

What Privacy Notices Must a Firm Deliver?

What Must the Initial Privacy Notice Say?

Must be delivered to customers at the time of establishing the customer relationship. It must describe:

• Categories of NPI the firm collects
• Categories of NPI the firm discloses
• Categories of affiliates and nonaffiliated third parties to whom disclosures are made
• Policies for protecting the confidentiality and security of NPI

Annual Privacy Notice

• Firms must provide an annual privacy notice to customers describing current policies
• Exception: if the firm's privacy policies have not changed and it only shares NPI under the standard exceptions (below), the annual notice requirement is waived

Exam Tip: Gotchas

• The initial privacy notice is due no later than when the customer relationship is established (in practice, at account opening). The rule sets the outer deadline; a firm may deliver it earlier.
• Annual notice is waived if policies have not changed AND the firm only shares under standard exceptions. Both conditions must be met for the waiver to apply.

When Must a Firm Offer an Opt-Out?

Before sharing NPI with nonaffiliated third parties, the firm must:

• Provide an opt-out notice clearly explaining the customer's right to prevent disclosure
• Give the customer a reasonable opportunity to opt out before sharing
• The opt-out must be clear and conspicuous

Exam Tip: Gotchas

• Opt-out applies only to nonaffiliated third parties under Reg S-P. Sharing with affiliates is governed by Regulation S-AM (not S-P) and follows different rules. A customer generally cannot opt out of affiliate sharing under Reg S-P.
• "Clear and conspicuous" is required. Burying the opt-out notice in fine print does not satisfy the requirement.

How Does the Affiliate Marketing Opt-Out Differ?

A customer cannot opt out of a firm sharing NPI with its affiliates under the privacy rule. But a separate affiliate marketing rule (Regulation S-AM) gives the customer a narrower, use-based right: they may stop an affiliate from using that shared information to send them marketing solicitations. The two opt-outs are different:

• Privacy opt-out (Reg S-P): stops the firm from sharing NPI with nonaffiliated third parties. It does not reach affiliate sharing.
• Affiliate marketing opt-out (Reg S-AM): does not stop the sharing, but stops an affiliate from using shared eligibility information to market to the customer.

So a customer receiving solicitations from an affiliate has no right to stop the underlying sharing, but does have a limited right to stop the affiliate from using the information to market to them.

When Can a Firm Share NPI Without an Opt-Out?

Even without customer opt-out consent, firms may share NPI in these situations:

Exam Tip: Gotchas

• Service providers can receive NPI without opt-out, but only with a contractual agreement limiting further use. Without the contract, the exception does not apply.
• Reg S-P vs. Reg S-AM: S-P governs sharing with nonaffiliated third parties; S-AM governs marketing based on affiliate-shared information.

What Must Firms Do to Safeguard and Respond to Breaches?

• Firms must adopt written policies and procedures to safeguard customer records and information
• Must protect against unauthorized access to or use of customer information
• Must protect against anticipated threats to the security or integrity of customer records
• This is sometimes called the Safeguards Rule under GLBA

Breach-response duty: Regulation S-P also requires firms to maintain a written incident-response program and to notify affected customers of a breach involving their sensitive information as soon as practicable, and no later than 30 days after the firm becomes aware of it. This adds a reactive breach-response duty on top of the proactive safeguarding obligation above.

What Should You Check on Exam Day?

• The initial notice is due no later than when the customer relationship is established; the annual notice is waived only when policies are unchanged and the firm shares solely under the standard exceptions
• Opt-out under Regulation S-P reaches only nonaffiliated third parties; sharing with affiliates falls under the separate Regulation S-AM
• Remember the 30-day breach-notification outer deadline is "as soon as practicable," not a target date to wait for