Who must comply with the Privacy Rule?
A. Any financial institution that provides financial products or services to consumers must comply with the privacy provisions of Subtitle A of TitleV of the Gramm-Leach-Bliley Act (“GLB Act”) (codified at 15 U.S.C. 6801-09) and the Privacy Rule. You have consumers if you provide your financial products or services to individuals, not businesses, to be used primarily for their personal, family, or household purposes. Under the Federal Trade Commission’s Privacy Rule, a financial institution means “any institution the business of which is engaging in financial activities as described in 4(k) of the Bank Holding Company Act of 1956 [12 U.S.C. 1843(k)].” See 16 C.F.R. 313.3(k)(1). (1) Further, you are not a financial institution unless you are significantly engaged in financial activities. Id. Moreover, the Commission’s Rule covers only financial activities as of the date of enactment of the GLB Act. See 16 C.F.R. 18(a)(2). Thus, financial activities added by regulation or order by the Fe
