Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

James Sherer Teaches, Speaks on Panel at IAPP Global Privacy Summit 2025

Alexander Reid Explains Steps Needed for Harvard to Lose Tax-Exempt Status

Efforts to Expand Mini-WARN Acts’ Requirements Underscore the Importance of Knowing State-Level, Post-Sale Obligations Relating to a Plant Closing or a Mass Layoff

BakerHostetler Named a Top-Performing Lobbying Firm for Seventh Consecutive Year

On Tuesday, March 25, members of BakerHostetler’s Digital Assets and Data Management (DADM) Practice Group served up a flavorful presentation, “Cooking Up Compliance: Navigating the Alphabet Soup of Financial Privacy,” as part of DADM’s ongoing webinar series, The Privacy Strategist. Presenters <a href="https://www.bakerlaw.com/professionals/jonathan-a-forman/" target="_blank" rel="noreferrer noopener">Jonno Forman</a> (New York), <a href="https://www.bakerlaw.com/professionals/justin-t-yedor/" target="_blank" rel="noreferrer noopener">Justin Yedor</a> (Los Angeles) and <a href="https://www.bakerlaw.com/professionals/whitney-q-schneider-white/" target="_blank" rel="noreferrer noopener">Whitney Schneider-White</a> (Washington, D.C.) gave attendees a peek inside the kitchen to see what goes into a financial privacy compliance program under the Gramm-Leach-Bliley Act (GLBA) and the patchwork of state and federal financial privacy regulations.

core/paragraph

Much of the discussion focused on the GLBA, covering both the Privacy Rule and the Safeguards Rule. Like a health inspection sticker in a restaurant’s front window, a GLBA privacy notice must provide clear and conspicuous disclosures about a financial institution’s practices relating to nonpublic personal information (NPI). While chefs can certainly create their own privacy notices, it is important to follow the recipe set by the federal functional regulators (e.g., the Office of the Comptroller of Currency (OCC), the Federal Trade Commission (FTC), the Securities and Exchange Commission (SEC)), which all provide model template notices that provide a safe harbor for compliance with the Privacy Rule’s notice requirements. The Safeguards Rule, meanwhile, outlines requirements for proper information security hygiene. Although the various safeguards regulations implemented by the various federal functional regulators differ on the margins, common components include, among other things, regular risk assessments; a written information security program (WISP) that tailors safeguards to the financial institution’s size and complexity; security controls that implement administrative, technical and physical protections to ensure the security, confidentiality and integrity of NPI; a robust incident response program; and the training of employees.

Financial institutions should also be sure to address local flavors under laws like the California Financial Privacy Act (CalFIPA) and Vermont Regulation S-2001-01, which provide consumers in certain states with additional notice and consent rights. The menu may also include state comprehensive consumer privacy laws — such as the California Consumer Privacy Act (CCPA), the Oregon Consumer Privacy Act (OCPA) and the Minnesota Consumer Data Privacy Act (MNCDPA) — that exempt NPI but do not wholly exempt financial institutions.

In sum, the webinar was a gourmet discussion that provided a taste of many aspects of financial privacy compliance. Adhering to these rules continues to be a secret ingredient to help your compliance kitchen avoid ending up on the regulatory chopping block.

Related Services

Featured Insights