GLBA coordination with related US privacy + financial frameworks. (a) FCRA (FAIR CREDIT REPORTING ACT, 15 USC 1681) - regulates consumer-reporting agencies + furnishers of information + users of consumer reports; coordinates with GLBA on information-sharing for credit-decision purposes; Red Flags Rule (16 CFR Part 681) and Disposal Rule (16 CFR Part 682) overlap with Safeguards. (b) ECOA (EQUAL CREDIT OPPORTUNITY ACT, 15 USC 1691) + Regulation B - prohibits credit-decision discrimination; ECOA NPI sharing coordinates with GLBA Section 6802. (c) HIPAA (HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT) Privacy + Security Rules - coordinates with GLBA for entities subject to both (e.g. health-insurance issuers + employee-benefit plans + insurance brokers handling health-related financial info); HIPAA generally provides higher floor than GLBA for protected health information; GLBA preserves stricter state privacy rules. (d) FACTA (FAIR AND ACCURATE CREDIT TRANSACTIONS ACT, 2003) - amends FCRA + Red Flags Rule + Disposal Rule + supplemental to GLBA. (e) STATE PRIVACY LAWS (CCPA + CPRA California + Virginia VCDPA + Colorado CPA + Connecticut CTDPA + Utah UCPA + Florida FDBR + Texas TDPSA + Tennessee TIPA + Oregon OCPA + Montana MCDPA + Iowa IPA + Indiana ICDPA + Delaware DPDPA + New Hampshire NHDPA + New Jersey NJDPA + Maryland MODPA + Minnesota MCDPA + Kentucky KCDPA + Rhode Island RIDTPPA + Washington WDPA): most state DP laws EXEMPT financial institutions subject to GLBA + NPI; but several state laws apply to data NOT covered by GLBA (e.g. employee/HR data); careful scope analysis required. (f) NYCRR 500 - New York DFS state-level GLBA-adjacent cyber rule. (g) DODD-FRANK TITLE X - CFPB authority over non-bank financial institutions. (h) BANK SERVICE COMPANY ACT - service-provider oversight. (i) FCRA + ECOA + UDAAP + CFPB Section 1033 + state UDAP - cross-statute privacy + consumer protection. (j) ELECTRONIC FUND TRANSFER ACT (EFTA) + Regulation E - consumer EFT protections. (k) FAIR DEBT COLLECTION PRACTICES ACT (FDCPA) - debt-collector communications.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.