View source for Definition:Gramm-Leach-Bliley Act (GLBA)

🏛️ '''Gramm-Leach-Bliley Act (GLBA)''' is a landmark United States federal law enacted in 1999 that dismantled Depression-era barriers between banking, securities, and insurance activities, while simultaneously imposing significant [[Definition:Privacy | privacy]] and data-protection obligations on financial institutions — including [[Definition:Insurance carrier | insurance companies]], [[Definition:Insurance agent | agents]], and [[Definition:Insurance broker | brokers]]. For the insurance industry specifically, GLBA reshaped the competitive landscape by permitting banks and financial holding companies to [[Definition:Underwriting | underwrite]] and distribute [[Definition:Insurance product | insurance products]], and it established the foundational framework governing how insurers collect, share, and safeguard consumers' [[Definition:Personally identifiable information (PII) | personally identifiable information]].

📜 The Act operates through three principal pillars relevant to insurers. The Financial Privacy Rule requires carriers and intermediaries to provide clear [[Definition:Disclosure | privacy notices]] explaining what nonpublic personal information they collect and with whom they share it, and to offer consumers an opt-out mechanism for certain third-party disclosures. The Safeguards Rule mandates that every [[Definition:Financial institution | financial institution]] — a category that includes insurers of all sizes — implement a written information-security program with administrative, technical, and physical safeguards proportionate to the sensitivity of the data held. Enforcement against insurance entities falls largely to state [[Definition:Insurance regulator | insurance regulators]] rather than federal agencies, making the [[Definition:National Association of Insurance Commissioners (NAIC) | NAIC]] Insurance Data Security Model Law a key companion regulation that translates GLBA principles into state-level requirements.

🔐 In an era of accelerating [[Definition:Insurtech | insurtech]] innovation and expanding [[Definition:Data analytics | data analytics]] capabilities, GLBA's privacy and safeguard mandates sit at the center of compliance planning for any insurance operation that handles consumer data — from [[Definition:Policy administration system | policy administration]] to [[Definition:Claims management | claims management]] to [[Definition:Telematics | telematics]]-driven pricing. Failure to comply can trigger regulatory action, fines, and reputational damage. As [[Definition:Cyber risk | cyber threats]] intensify and state legislatures layer additional requirements on top of GLBA's baseline, insurers must continuously reassess their data-governance frameworks to remain compliant, making GLBA not a static compliance checkbox but an evolving operational imperative.

'''Related concepts'''
{{Div col|colwidth=20em}}
* [[Definition:Personally identifiable information (PII)]]
* [[Definition:National Association of Insurance Commissioners (NAIC)]]
* [[Definition:Insurance Data Security Model Law]]
* [[Definition:Privacy]]
* [[Definition:Cyber risk]]
* [[Definition:Insurance regulation]]
{{Div col end}}