Gramm-Leach-Bliley Act — Privacy Protections
Gramm-Leach-Bliley Act of 1999, Title V — Privacy (15 U.S.C. § 6801 et seq.), Regulation P (12 CFR Part 1016)
Overview
The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act, requires financial institutions — including mortgage lenders and servicers — to protect the privacy of consumers' nonpublic personal information (NPI). GLBA has three key requirements: (1) the Privacy Rule — financial institutions must provide annual privacy notices to customers explaining what information they collect, how they share it, and how to opt out of information sharing with non-affiliated third parties, (2) the Safeguards Rule — institutions must maintain reasonable administrative, technical, and physical safeguards to protect customer information, and (3) the Pretexting Protection — prohibits the use of false pretenses (pretexting) to obtain customer financial information. GLBA violations can be enforced by the CFPB and state attorneys general.
Enacted: 1999 (Regulation P, 12 CFR Part 1016)
Enforcing Agency: Consumer Financial Protection Bureau (CFPB) and Federal Trade Commission (FTC)
Key Provisions
Privacy Notice Requirement (§ 6803)
Financial institutions must provide clear and conspicuous notice to customers describing their privacy policies and practices: (1) what information they collect, (2) what information they share and with whom, (3) the customer's right to opt out of information sharing with non-affiliated third parties (the 'opt-out notice'), and (4) the institution's policies for protecting confidentiality and security of customer information. Annual notices are required.
Safeguards Rule (§ 6801(b) and 16 CFR Part 314)
Financial institutions must develop, implement, and maintain a comprehensive written information security program that contains administrative, technical, and physical safeguards appropriate to the institution's size, complexity, and scope of activities. The program must: designate a coordinator, identify reasonably foreseeable risks, assess current safeguards, implement and test safeguards, and oversee service providers.
Pretexting Protection (§ 6821)
It is unlawful to obtain or attempt to obtain customer information from a financial institution by making false, fictitious, or fraudulent statements or representations (pretexting). It is also unlawful to request another person to obtain customer information through pretexting. This protects against identity theft and unauthorized information gathering.
How This Law Protects Homeowners
GLBA protects homeowners' financial privacy. Mortgage lenders and servicers cannot: (1) share your nonpublic personal information with non-affiliated third parties without providing an opt-out right, (2) fail to maintain reasonable safeguards to protect your loan file, personal data, and financial information, or (3) obtain your information through false pretenses. In foreclosure practice: if your servicer shared your loan information (delinquency, modification application, financial hardship details) with third-party vendors, debt buyers, or data aggregators without providing the opt-out notice, this may be a GLBA violation.
Why This Matters in a Foreclosure
GLBA's relevance to foreclosure is limited but real: (1) if the servicer shares your loan information with third-party vendors (property inspection companies, BPO agents, field services) without adequate safeguards, this is a GLBA compliance issue, (2) if a debt collector or foreclosure mill obtained your financial information through false pretenses — a GLBA violation and possible defense, (3) in a forensic loan audit, review the servicer's information handling — were privacy notices provided? Were safeguards adequate? GLBA violations, while not typically a direct defense to foreclosure, can support counterclaims and regulatory complaints.
Common Violations
- •Failing to provide annual privacy notices to mortgage customers
- •Sharing nonpublic personal information with non-affiliated third parties without providing an opt-out right
- •Failing to maintain reasonable security safeguards for customer information
- •Obtaining customer information through false pretenses (pretexting)
- •Failing to oversee service providers' information security practices
Available Remedies
- •CFPB enforcement action (civil penalties, injunctive relief)
- •State attorney general enforcement
- •No explicit private right of action for damages under GLBA (most circuits hold GLBA does NOT create a private right of action)
- •State unfair and deceptive practices laws (UDAP statutes) can incorporate GLBA standards and provide private remedies
Recent Developments
The CFPB issued an updated Safeguards Rule (effective December 9, 2022) requiring financial institutions to: designate a qualified individual to oversee the information security program, conduct risk assessments, implement access controls and encryption, conduct penetration testing and vulnerability assessments, and report to the board of directors. The FTC has increased enforcement of the Safeguards Rule, particularly against smaller mortgage lenders and servicers with inadequate security practices.
Frequently Asked Questions
Can I sue my servicer directly under GLBA for sharing my loan information?+
Probably not directly under GLBA. Most courts have held that GLBA does NOT create a private right of action — meaning you cannot sue for damages under GLBA itself. However, you can: (1) file a complaint with the CFPB, (2) file a complaint with the FTC, (3) assert GLBA violations as a state UDAP (unfair and deceptive acts) claim — most state UDAP laws incorporate GLBA standards and DO provide a private right of action, (4) assert invasion of privacy and related tort claims under state law.
Related Federal Laws
Related Services
Know Your Rights. Defend Your Home.
Federal law gives you powerful protections — but you have to use them. Free, confidential case review.
Available Monday–Friday · 10:00 AM – 6:00 PM Pacific
Get Your Free Full Case Review
Tell us about your situation — our senior legal team will review every detail and contact you within 24 hours with a tailored plan. No obligation. 100% confidential.
Submit Your Information
Tell us about your situation in complete confidence.
Case Analysis
Our legal team reviews your documents and foreclosure status.
Receive Your Strategy
We outline your best options and recommended path forward.
We Get to Work
Your dedicated team begins protecting your home and rights.