A customer-service escalation raises a GLBA Privacy Requirements question for the file reviewer. What answer should guide the file?

Correct Answer

D) Share borrower information only with proper authority

Why this is correct: The Gramm-Leach-Bliley Act (GLBA) Privacy Rule requires financial institutions to protect consumers' nonpublic personal information (NPI). A fundamental principle is that NPI cannot be shared with third parties unless the institution has provided a privacy notice and, where required, the consumer has not opted out, or another exception applies. The correct answer, "Share borrower information only with proper authority," encapsulates this requirement to have legal authority (like consumer consent or a permissible exception) before sharing. Why the other choices are wrong: The choice "Use an internal exception instead of the required federal disclosure or timing rule" is wrong because internal policies cannot override federal GLBA requirements for providing privacy notices and obtaining opt-outs before sharing. The choice "Apply the anti-steering timing rule even though the file is testing GLBA Privacy Requirements" is wrong because anti-steering rules are part of loan originator compensation under TILA, not related to GLBA privacy. The choice "Rely on oral agreement when the rule requires documented compliance" is wrong because GLBA's privacy notice and opt-out requirements are based on written disclosures; oral agreements do not satisfy the rule. Exam tip: For GLBA, sharing NPI is prohibited unless you have a specific, permissible reason under the law. Always ask: "Do I have proper authority to share this?"