Information Security and Privacy Regulations

What this video covers

• What nonpublic personal information (NPI) actually covers under Regulation S-P, and why public records like a customer's name fall outside the rule
• When the initial privacy notice must be delivered (at account opening, not during prospecting), and the four categories it must describe
• The two conditions that must BOTH be met for the annual privacy notice requirement to be waived
• Opt-out notice mechanics for sharing NPI with nonaffiliated third parties, including the clear and conspicuous standard
• The Reg S-P vs. Regulation S-AM distinction: S-P stops outsiders from getting data, S-AM stops affiliates from using shared data to market to the customer
• The four exceptions that allow sharing NPI without opt-out (service providers, joint marketing, processing transactions, legal/regulatory), and the written-contract trap on the service provider exception
• The Safeguards Rule under GLBA: written policies, protecting against unauthorized access, and guarding against anticipated threats