Information Security and Privacy Regulations

Customer screening generates a large amount of sensitive personal data. Regulation S-P governs how broker-dealers collect, use, disclose, and protect this nonpublic personal information (NPI).

What Does Regulation S-P Cover?

• Adopted under the Gramm-Leach-Bliley Act (GLBA)
• Applies to broker-dealers, investment companies, and registered investment advisers
• Does not apply to banks, thrifts, or credit unions; those depository institutions have their own federal banking regulator (the OCC, the Federal Reserve, the FDIC, or the NCUA), which writes a parallel GLBA privacy rule for that institution instead of Regulation S-P
• Governs the collection, use, and disclosure of nonpublic personal information (NPI) about consumers
• NPI includes any personally identifiable financial information that is not publicly available (e.g., account numbers, balances, transaction history, SSN)

Think of it this way: NPI is anything a stranger could not find out about you through public records. Your name might be public, but your account balance and trading history are not.

Regulation S-P distinguishes a consumer from a customer. A consumer only obtains a financial product or service without an ongoing relationship, such as a one-time transaction; a customer has a continuing relationship, such as a brokerage account.

A customer always gets the initial and annual notices. A mere consumer gets a notice only before the firm discloses their NPI to a nonaffiliated third party outside the standard exceptions.

What Privacy Notices Must a Firm Deliver?

What Must the Initial Privacy Notice Say?

Must be delivered to customers at the time of establishing the customer relationship. It must describe:

• Categories of NPI the firm collects
• Categories of NPI the firm discloses
• Categories of affiliates and nonaffiliated third parties to whom disclosures are made
• Policies for protecting the confidentiality and security of NPI

When Must Firms Provide an Annual Privacy Notice?

• Firms must provide an annual privacy notice to customers describing current policies
• Exception: if the firm's privacy policies have not changed and it only shares NPI under the standard exceptions (below), the annual notice requirement is waived

Exam Tip: Gotchas

• The initial privacy notice is due no later than when the customer relationship is established (in practice, at account opening). The rule sets the outer deadline; a firm may deliver it earlier.
• Annual notice is waived if policies have not changed AND the firm only shares under standard exceptions. Both conditions must be met for the waiver to apply.

What Must a Firm Do Before It Starts a New Kind of Sharing?

Before a firm discloses NPI to a new category of nonaffiliated third party, or discloses a new category of NPI, it must first:

• Deliver a revised privacy notice describing the change
• Deliver a new opt-out notice
• Give the customer a reasonable opportunity to opt out

The firm may not begin the new disclosure until it has done all three, unless the new sharing fits one of the standard exceptions below (which do not require opt-out).

This makes the revised-notice duty a before-disclosure requirement, not a cleanup step. A firm that starts sharing under a changed policy without the revised notice is already out of compliance. Each day it keeps sharing without notice and an opt-out chance adds to that violation.

Exam Tip: Gotchas

• A policy change that adds a new sharing category needs a revised notice before the new sharing starts, not an update at the next regular cycle. If a firm already began the new sharing without that notice, sending it right away is how the firm stops an ongoing violation. It is not optional cleanup.
• If a policy change does not add a sharing category that needs a revised notice (the new sharing still fits a standard exception), the firm must still deliver an annual notice within 100 days of the change.

When Must a Firm Offer an Opt-Out?

Before sharing NPI with nonaffiliated third parties, the firm must:

• Provide an opt-out notice clearly explaining the customer's right to prevent disclosure
• Give the customer a reasonable opportunity to opt out before sharing
• The opt-out must be clear and conspicuous

Exam Tip: Gotchas

• The Regulation S-P opt-out covers certain disclosures to nonaffiliated third parties, not every affiliate disclosure. Regulation S-AM separately limits an affiliate's use of shared eligibility information for marketing solicitations and may give the consumer an opt-out right. It does not govern all affiliate sharing.
• "Clear and conspicuous" is required. Burying the opt-out notice in fine print does not satisfy the requirement.

When Can a Firm Share NPI Without an Opt-Out?

Even without customer opt-out consent, firms may share NPI in these situations:

Exam Tip: Gotchas

• Service providers can receive NPI without opt-out, but only with a contractual agreement limiting further use. Without the contract, the exception does not apply.
• Regulation S-P's general opt-out concerns nonaffiliate disclosures; Regulation S-AM addresses marketing that uses certain eligibility information received from an affiliate.

What Must Firms Do to Safeguard and Respond to Breaches?

• Firms must adopt written policies and procedures to safeguard customer records and information
• Must protect against unauthorized access to or use of customer information
• Must protect against anticipated threats to the security or integrity of customer records
• This is sometimes called the Safeguards Rule under GLBA

Breach-response duty: Regulation S-P also requires firms to maintain a written incident-response program and to notify affected customers of a breach involving their sensitive information as soon as practicable, and no later than 30 days after the firm becomes aware of it. This adds a reactive breach-response duty on top of the proactive safeguarding obligation above.

What Should You Check on Exam Day?

• The initial notice is due no later than when the customer relationship is established; the annual notice is waived only when policies are unchanged and the firm shares solely under the standard exceptions
• A new sharing category needs a revised notice and opt-out opportunity before the new sharing starts, not a notice sent whenever convenient afterward
• Regulation S-P's general opt-out covers certain nonaffiliate disclosures. Regulation S-AM separately limits an affiliate's use of shared eligibility information for marketing, subject to exceptions; it does not govern every affiliate disclosure
• Remember the 30-day breach-notification outer deadline is "as soon as practicable," not a target date to wait for