- Emergency Consultation Services
- Risk Management Services
- Who We Are
- Our People
- What We Do
- Why We Are Different
- What’s New
- Where We Are
By: David A. Cole
The U.S. Commodity Futures Trading Commission (Commission) recently issued a Staff Advisory on the recommended best practices for covered financial institutions that must comply with Gramm-Leach-Bliley Act (GLBA) provisions on data security and customer privacy.
Congress enacted the GLBA in 1999 to ensure that financial institutions respect the privacy of their customers and protect the security and confidentiality of nonpublic personal information. Specifically, under the Commission’s regulations, futures commission merchants, commodity trading advisors, commodity pool operators, introducing brokers, retail foreign exchange dealers, swap dealers, and major swap participants (covered entities) “must adopt policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information.” Those policies and procedures must:
According to the Staff Advisory, the recommended best practices include that each covered entity should develop, implement, and maintain a written information security and privacy program that is appropriate to its size and complexity, as well as to the nature and scope of its activities. In addition, the program should require the covered entity to, at a minimum:
These best practices should look familiar to those who already deal with the various state laws that require companies to implement written information security programs, as well as entities that are required to comply with HIPAA. Ultimately, whether a specific law requires it in one form or another, it is a best practice for every entity that maintains personal information, whether it be that of customers, clients, patients, or employees, should implement a data security program and implement a “culture of security” at their workplace.