GLBA Privacy & Safeguards
~10 min read · Apply privacy notices, opt-outs and the Safeguards Rule to borrower data.
GLBA treats borrower financial data as regulated material: the Privacy Rule controls what you share and tell, the Safeguards Rule controls how you protect it, and pretexting is banned outright. For an MLO whose desk is a pile of NPI, this is daily-practice law.
NPI and the Privacy Rule
Nonpublic personal information is any personally identifiable financial information a consumer provides or the institution derives — SSNs, income, balances, credit history, even the fact of being a customer. The Privacy Rule requires an initial privacy notice at the customer relationship's start and annual notices after, describing sharing practices. Consumers get the right to opt out before NPI is shared with nonaffiliated third parties — subject to exceptions for service providers, joint marketing agreements, and processing the consumer's own transaction.
- NPI: essentially everything in a loan file
- Initial + annual privacy notices
- Opt-out before sharing with nonaffiliated third parties
- Exceptions: servicing the transaction, service providers, joint marketing
The Safeguards Rule
Institutions must run a written information security program: a designated coordinator, risk assessment, administrative/technical/physical safeguards, service-provider oversight, and periodic updates. At MLO altitude that means: locked files and clean desks, encrypted devices and email for documents, access limited to need, secure disposal (shredding — FACTA's Disposal Rule overlaps), and immediate reporting of breaches. A loan file in a car trunk or an application emailed unencrypted is a Safeguards failure in miniature.
- Written security program with a named coordinator
- Encrypt, lock, limit access, shred
- Vendors handling NPI must be vetted and bound
Pretexting
GLBA separately criminalizes pretexting — obtaining someone's financial information from an institution by impersonation or false pretenses, and the institutions' duty runs the other way: verify who is asking before disclosing. An MLO fielding a call from a 'spouse' or 'the borrower's attorney' confirms authority before a syllable of file content moves.
Worked example
An MLO's week: (1) a lead-buying company offers to purchase her closed-borrower list; (2) her processor emails full 1003s to an unencrypted personal Gmail 'to work from home'; (3) a caller claiming to be a borrower's wife asks for the payoff figure. Apply GLBA to each.
(1) Selling customer NPI to a nonaffiliated third party is exactly what the opt-out right governs: permitted only if the privacy notice disclosed such sharing and the borrowers were given opt-out opportunity — and the borrowers who opted out are off the list. (2) A Safeguards violation in progress: NPI leaving the controlled environment to an unsecured personal account; the fix is policy plus tooling — encrypted channels, company systems, and access controls. (3) Pretexting defense: verify the caller's identity and authority (callback to the number on file, borrower's written authorization) before disclosing anything — a payoff figure is NPI. Three days, three GLBA pillars: Privacy, Safeguards, pretexting.
Common exam pitfalls
Treating only SSNs as protected.
NPI spans the whole file — income, balances, history, and even customer status itself.
Confusing affiliate sharing with third-party sharing.
The GLBA opt-out governs NONaffiliated third parties; affiliate sharing is governed by FCRA's separate rules.
Helping 'family' callers without verification.
Disclosure to an unverified caller is the pretexting scenario from the institution's side — verify authority first.
Notice it, lock it, never talk to strangers about it.
Recap
- NPI = all personally identifiable financial data in the relationship
- Initial and annual privacy notices; opt-out for nonaffiliated sharing
- Sharing exceptions: transaction processing, service providers, joint marketing
- Safeguards Rule: written program, encryption, access limits, disposal
- Pretexting is a federal crime; verify every requester
- Breaches and sloppy handling are reportable program failures
VIDEO LESSON
Watch this lesson on video — free
Prove it: 10 questions on this topic
Every lesson ends with a ten-question check in the free course — your progress syncs between the web and the EstatePass app.
Studying for the NMLS SAFE MLO exam? Track every lesson free — progress syncs with the app.
Start freeMore in Federal Laws & Regulations
Study smarter in the free dashboard
- Every lesson tracked, synced with the iOS app
- Ten-question checks after each lesson
- Lesson videos, flashcards and mock exams
No credit card required.