UCA Gramm-Leach Bliley Act (GLBA) Safeguards Rule

Transcript:UCA Gramm-Leach Bliley Act (GLBA) Safeguards Rule:
UCA Gramm-Leach Bliley Act (GLBA) Safeguards Rule Compliance Training Effective June 12, 2018 Revised November 7, 2022 Adapted from materials published by the Federal Trade Commission (FTC) and University of Minnesota Training Objectives To provide information to the UCA campus community and customers regarding: What is the Safeguards Rule and why it applies to UCA How the Safeguards Rule differs from FERPA What information is covered by the Safeguards Rule What is required of UCA to comply Examples of safeguards How UCA is complying What is GLBA? GLBA was passed in 1999 and is intended “to protect consumers & customers who obtain ‘financial products or services to be used primarily for personal or other household purposes.’” (Choroszy, “Beyond FERPA”) Through FERPA compliance, UCA is exempt from privacy regulations in GLBA. (16 CFR 313.1(b)) However, compliance with FERPA is not an exemption from the Safeguards Rule; UCA and other colleges and universities are required to comply. (Schneider, “ED Proposes Auditing Safeguards Rule Compliance”) How is GLBA different from FERPA? FERPA relates to students’ educational records, including their right to access and inspect them, what types of records and to whom information can be disclosed, etc. (http://uca.edu/registrar/ferpa/) GLBA Safeguards Rule pertains to nonpublic personal information, which is typically limited to an individual’s financial information obtained in connection with a financial product or service. (FTC, “Financial Institutions and Customer Information”) The University’s efforts should be aimed at ensuring the protection of all student, faculty, staff, and customer private data regardless of the applicable regulation (e.g., FERPA, HIPAA, GLBA). What are the objectives of the Safeguards Rule? Insure the security and confidentiality of customer information Protect against any anticipated threats or hazards to the security or integrity of such information Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. Source: 16 CFR 314.3(b) Why is UCA required to comply? GLBA applies to financial institutions’ protection of customer information; colleges and universities are considered financial institutions under the Safeguards Rule primarily because they offer student loans, though other activities may also be covered (Schneider, “ED Proposes Auditing Safeguards Rule Compliance”) In the Program Participation Agreement (PPA) UCA has with the U.S. Department of Education, UCA agrees to comply with Standards for Safeguarding Customer Information issued by the FTC (specific GLBA provision added in 2015) (U.S. Dept of Education, DCL GEN-16-12, July 1, 2016)