The subtitle establishes restrictions and requirements relating to a financial institution’s disclosure of nonpublic personal information to nonaffiliated third parties and calls upon federal regulators to promulgate and enforce regulations implementing those provisions. In addition, the federal regulators are to establish standards for safeguarding the security and confidentiality of financial institution customer records and information. Under Subtitle A, a financial institution generally is prohibited from disclosing a consumer’s protected information to nonaffiliated third parties unless the institution provides the consumer with a privacy notice and an opportunity to opt out of such disclosures. A privacy notice must describe the institution’s policies and practices for disclosing nonpublic personal information to nonaffiliated third parties. All of the States Have Taken Action to Implement Subtitle A’s Disclosure-Related Provisions

All of the states and the District of Columbia have by statute, regulation, or insurance bulletin advised the insurance institutions they regulate that the institutions must comply with Subtitle A’s disclosure-related provisions. Although the 1982 Model Act contains additional protections not provided by Subtitle A, a number of the Model Act states modified some of the more protective provisions of their laws to obtain greater consistency with the less restrictive requirements of Subtitle A.
NAIC issued the Model Act in 1982 to address privacy concerns relating to the collection and disclosure of insurance information by insurance institutions, insurance agents, and organizations that assemble and provide information to insurers. Most States Have Not Established Standards for Safeguarding Insurance Customer Information

As of March 1, 2002, only one state—New York—has satisfied the Subtitle A mandate that state insurance authorities establish standards for safeguarding insurance customer records and information. An additional state—California—has proposed regulations containing such standards. In contrast, the federal regulators charged with implementing Subtitle A, with the exception of FTC, issued final standards much earlier. FTC has received comments on proposed standards and is developing final rules.
What GAO Found

Subtitle A of Title V of the Gramm-Leach-Bliley Act (GLBA) of 1999 requires that each financial institution, which is defined to include most insurance providers or companies, has "an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information." This prohibits the disclosure of consumers' nonpublic personal information to any entity that is not an affiliate of, or related by common ownership or control, to the institution unless the consumer is given an opportunity to opt out of such disclosure. Also, financial institutions must provide consumers with privacy notices that explain the institution's policies and practices for disclosure. Subtitle A calls upon federal regulators to (1) issue regulations implementing disclosure-related requirements and (2) establish standards for safeguarding the privacy and integrity of customer information and records. The act also requires state insurance authorities to enforce its provisions by adopting regulations for both information disclosure and information safeguards. As of March 2002, all of the states and the District of Columbia have acted to ensure that insurance companies under their jurisdiction meet Subtitle A's disclosure and notice requirements. In addition, some states have included or retained provisions in their regulations or laws that they believe provide greater protections or more restrictive requirements than those contained in Subtitle A. Only New York has established standards for protecting the security and confidentiality of insurance customer information as of March 2002. Another state, California, has issued proposed regulations establishing such standards. In contrast, as of March 2002, the federal regulators charged with implementing Subtitle A--with the exception of the Federal Trade Commission--have issued their final standards. FTC has received comments on proposed standards and is developing its final rule.