The Gramm-Leach-Bliley Act (GLBA) is a federal law that requires financial institutions to protect the privacy and security of their customers' nonpublic personal information. Found at 15 U.S.C. § 6801 and following, it governs both how institutions share customer data and how they safeguard it.
Because GLBA is federal, it applies to Missouri financial institutions the same way it applies nationwide. It works alongside, and does not replace, Missouri's own data-privacy and breach-notification rules.
How the Gramm-Leach-Bliley Act works
GLBA has two main components. The Financial Privacy Rule requires covered institutions to give customers clear privacy notices describing what nonpublic personal information they collect and how they share it, and to offer customers the right to opt out of certain sharing with nonaffiliated third parties. The Safeguards Rule requires a written information-security program with administrative, technical, and physical safeguards appropriate to the institution's size and the sensitivity of its data.
The term "financial institution" is broad. It covers far more than banks: lenders, mortgage brokers, tax preparers, and many other businesses significantly engaged in financial activities can qualify. The law is enforced by federal regulators, including the Federal Trade Commission (FTC) and the Consumer Financial Protection Bureau (CFPB), rather than through private lawsuits.
Why it matters
For financial institutions, GLBA sets baseline duties that attach automatically once a business is covered. A Missouri lender, broker, or tax preparer must issue compliant privacy notices and build a written security program, or risk regulatory investigation, orders, and penalties.
For customers, GLBA provides transparency about how their financial data is handled and a limited right to control marketing-style sharing with outside companies. It also requires institutions to take concrete steps to keep that data secure, reducing the chance that sensitive financial information is exposed or misused.
Frequently Asked Questions
Is the Gramm-Leach-Bliley Act a Missouri law or a federal law?
GLBA is a federal law, found at 15 U.S.C. § 6801 and following. It applies to Missouri financial institutions because it applies nationwide, and it operates on top of any separate Missouri state-law obligations.
Does GLBA apply to businesses that are not banks?
Yes. GLBA reaches any business significantly engaged in financial activities, including lenders, mortgage brokers, tax preparers, and similar businesses. A company can be a "financial institution" under GLBA without being a bank.
What is the difference between the Privacy Rule and the Safeguards Rule?
The Financial Privacy Rule governs disclosure: it requires privacy notices and gives customers limited opt-out rights over sharing with nonaffiliated third parties. The Safeguards Rule governs protection: it requires a written information-security program with administrative, technical, and physical safeguards.
Legal Disclaimer
This page provides general legal information about Missouri law and is not legal advice. It does not create an attorney-client relationship. Every situation depends on its own facts, deadlines, and documents; consult a qualified Missouri attorney before acting.