GLBA scope + definitions (15 USC 6809 + 15 USC 6827). FINANCIAL INSTITUTION (Sec. 6809(3)): any institution engaged in financial activities described in section 4(k) of the Bank Holding Company Act of 1956 - includes banks + savings associations + credit unions + securities firms + broker-dealers + investment companies + investment advisers + insurance companies + insurance agencies + mortgage brokers + mortgage lenders + check-cashers + money-services businesses + consumer finance companies + collection agencies + tax preparers + non-bank lenders + entities engaged in financial data processing or transmission + any other entity engaged in financial activities. HIGHER EDUCATION institutions participating in Title IV (FSA - Federal Student Aid) are covered as financial institutions for FTC Safeguards Rule purposes. NONPUBLIC PERSONAL INFORMATION (NPI) (Sec. 6809(4)): personally identifiable financial information provided by a consumer to a financial institution + resulting from any transaction or service performed for the consumer + or otherwise obtained by the financial institution; EXCLUDES publicly available information. CUSTOMER (Sec. 6809(11)): a consumer with a continuing relationship with the financial institution under which the institution provides one or more financial products or services - distinct from CONSUMER (one-time/transactional). CUSTOMER INFORMATION OF A FINANCIAL INSTITUTION (Sec. 6827(2)): any information maintained by or for a financial institution which is derived from the relationship + identified with the customer. CONSUMER (Sec. 6809(9)): an individual who obtains or has obtained a financial product or service from the financial institution for personal, family, or household purposes. AFFILIATE (Sec. 6809(6)): any company controlled by or in common control with another. NONAFFILIATED THIRD PARTY (Sec. 6809(5)): any non-affiliate of the financial institution + entity not controlled by + or under common control with + the financial institution.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.