source:
  type: regulation
  id: glba-safeguards-16cfr-314.2
  authority: 16 CFR §314.2 — Definitions (FTC GLBA Safeguards Rule)
  description: '16 CFR §314.2 defines the operational terms of the FTC Safeguards

    Rule — including customer information, multi-factor authentication,

    notification event, security event, and service provider.

    '
obligations:
- id: glba-safeguards-16cfr-314.2-a
  canonical_id: glba-safeguards-16cfr-314.2-a
  section: 16 CFR §314.2(a)
  description: '(a): (a) Authorized user means any employee, contractor, agent, customer , or other person
    that is authorized to access any of your information systems or data.'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (a) Authorized user means any employee, contractor, agent, customer , or other person
      that is authorized to access any of your information systems or data.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-b
  canonical_id: glba-safeguards-16cfr-314.2-b
  section: 16 CFR §314.2(b)
  description: '(b): (b) (1) Consumer means an individual who obtains or has obtained a financial product
    or service from you that is to be used primarily for personal, family, or household purposes, or that
    individual''s legal representative. (2) For example:'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(b) (1) Consumer means an individual who obtains or has obtained a financial product
      or service from you that is to be used primarily for personal, family, or household purposes, or
      that individual''s legal representative. (2) For example:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) An individual who applies to you for credit for personal, family, or household
    purposes is a consumer of a financial service , regardless of whether the credit is extended. (ii)
    An individual who provides nonpublic personal information to you in order to obtain a determination
    about whether he o…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (i) An individual who applies to you for credit for personal, family, or household
      purposes is a consumer of a financial service , regardless of whether the credit is extended. (ii)
      An individual who provides nonpublic personal information to you in order to obtain a determination
      about whether he or she may qualify for a loan to be used primarily for personal, family, or household
      purposes is a consumer of a financial service , regardless of whether the loan is extended. (iii)
      An individual who provides nonpublic personal information to you in connection with obtaining or
      seeking to obtain financial, investment, or economic advisory services is a consumer, regardless
      of whether you establish a continuing advisory relationship. (iv) If you hold ownership or servicing
      rights to an individual's loan that is used primarily for personal, family, or household purposes,
      the individual is your consumer, even if you hold those rights in conjunction with one or more other
      institutions. (The individual is also a consumer with respect to the other financial institutions
      involved.) An individual who has a loan in which you have ownership or servicing rights is your
      consumer, even if you , or another institution with those rights, hire an agent to collect on the
      loan.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-v
  canonical_id: glba-safeguards-16cfr-314.2-v
  section: 16 CFR §314.2(v)
  description: '(v): (v) An individual who is a consumer of another financial institution is not your
    consumer solely because you act as agent for, or provide processing or other services to, that financial
    institution . (vi) An individual is not your consumer solely because he or she has designated you
    as trustee for a…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (v) An individual who is a consumer of another financial institution is not your
      consumer solely because you act as agent for, or provide processing or other services to, that financial
      institution . (vi) An individual is not your consumer solely because he or she has designated you
      as trustee for a trust. (vii) An individual is not your consumer solely because he or she is a beneficiary
      of a trust for which you are a trustee. (viii) An individual is not your consumer solely because
      he or she is a participant or a beneficiary of an employee benefit plan that you sponsor or for
      which you act as a trustee or fiduciary.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-c
  canonical_id: glba-safeguards-16cfr-314.2-c
  section: 16 CFR §314.2(c)
  description: '(c): (c) Customer means a consumer who has a customer relationship with you .'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (c) Customer means a consumer who has a customer relationship with you .
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-d
  canonical_id: glba-safeguards-16cfr-314.2-d
  section: 16 CFR §314.2(d)
  description: '(d): (d) Customer information means any record containing nonpublic personal information
    about a customer of a financial institution , whether in paper, electronic, or other form, that is
    handled or maintained by or on behalf of you or your affiliates.'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (d) Customer information means any record containing nonpublic personal information
      about a customer of a financial institution , whether in paper, electronic, or other form, that
      is handled or maintained by or on behalf of you or your affiliates.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-e
  canonical_id: glba-safeguards-16cfr-314.2-e
  section: 16 CFR §314.2(e)
  description: '(e): (e) (1) Customer relationship means a continuing relationship between a consumer
    and you under which you provide one or more financial products or services to the consumer that are
    to be used primarily for personal, family, or household purposes. (2) For example:'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(e) (1) Customer relationship means a continuing relationship between a consumer
      and you under which you provide one or more financial products or services to the consumer that
      are to be used primarily for personal, family, or household purposes. (2) For example:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Continuing relationship. A consumer has a continuing relationship with you if
    the consumer: (A) Has a credit or investment account with you ; (B) Obtains a loan from you ; (C)
    Purchases an insurance product from you ; (D) Holds an investment product through you , such as when
    you act as a custod…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(i) Continuing relationship. A consumer has a continuing relationship with you if
      the consumer: (A) Has a credit or investment account with you ; (B) Obtains a loan from you ; (C)
      Purchases an insurance product from you ; (D) Holds an investment product through you , such as
      when you act as a custodian for securities or for assets in an Individual Retirement Arrangement;
      (E) Enters into an agreement or understanding with you whereby you undertake to arrange or broker
      a home mortgage loan, or credit to purchase a vehicle, for the consumer; (F) Enters into a lease
      of personal property on a non-operating basis with you ; (G) Obtains financial, investment, or economic
      advisory services from you for a fee; (H) Becomes your client for the purpose of obtaining tax preparation
      or credit counseling services from you ; (I) Obtains career counseling while seeking employment
      with a financial institution or the finance, accounting, or audit department of any company (or
      while employed by such a financial institution or department of any company); (J) Is obligated on
      an account that you purchase from another financial institution , regardless of whether the account
      is in default when purchased, unless you do not locate the consumer or attempt to collect any amount
      from the consumer on the account; (K) Obtains real estate settlement services from you ; or (L)
      Has a loan for which you own the servicing rights. (ii) No continuing relationship. A consumer does
      not, however, have a continuing relationship with you if: (A) The consumer obtains a financial product
      or service from you only in isolated transactions, such as using your ATM to withdraw cash from
      an account at another financial institution ; purchasing a money order from you ; cashing a check
      with you ; or making a wire transfer through you ; (B) You sell the consumer''s loan and do not
      retain the rights to service that loan; (C) You sell the consumer airline tickets, travel insurance,
      or traveler''s checks in isolated transactions; (D) The consumer obtains one-time personal or real
      property appraisal services from you ; or (E) The consumer purchases checks for a personal checking
      account from you .'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-f
  canonical_id: glba-safeguards-16cfr-314.2-f
  section: 16 CFR §314.2(f)
  description: '(f): (f) Encryption means the transformation of data into a form that results in a low
    probability of assigning meaning without the use of a protective process or key, consistent with current
    cryptographic standards and accompanied by appropriate safeguards for cryptographic key material.'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (f) Encryption means the transformation of data into a form that results in a low
      probability of assigning meaning without the use of a protective process or key, consistent with
      current cryptographic standards and accompanied by appropriate safeguards for cryptographic key
      material.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-g
  canonical_id: glba-safeguards-16cfr-314.2-g
  section: 16 CFR §314.2(g)
  description: '(g): (g) (1) Financial product or service means any product or service that a financial
    holding company could offer by engaging in a financial activity under section 4(k) of the Bank Holding
    Company Act of 1956 ( 12 U.S.C. 1843(k) ). (2) Financial service includes your evaluation or brokerage
    of informat…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (g) (1) Financial product or service means any product or service that a financial
      holding company could offer by engaging in a financial activity under section 4(k) of the Bank Holding
      Company Act of 1956 ( 12 U.S.C. 1843(k) ). (2) Financial service includes your evaluation or brokerage
      of information that you collect in connection with a request or an application from a consumer for
      a financial product or service.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-h
  canonical_id: glba-safeguards-16cfr-314.2-h
  section: 16 CFR §314.2(h)
  description: '(h): (h) (1) Financial institution means any institution the business of which is engaging
    in an activity that is financial in nature or incidental to such financial activities as described
    in section 4(k) of the Bank Holding Company Act of 1956 , 12 U.S.C. 1843(k) . An institution that
    is significantly …'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(h) (1) Financial institution means any institution the business of which is engaging
      in an activity that is financial in nature or incidental to such financial activities as described
      in section 4(k) of the Bank Holding Company Act of 1956 , 12 U.S.C. 1843(k) . An institution that
      is significantly engaged in financial activities, or significantly engaged in activities incidental
      to such financial activities, is a financial institution . (2) Examples of financial institutions
      are as follows:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) A retailer that extends credit by issuing its own credit card directly to consumers
    is a financial institution because extending credit is a financial activity listed in 12 CFR 225.28
    (b)(1) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act of 1956 ( 12 U.S.C. 1843(k)(4)(F)
    ),…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (i) A retailer that extends credit by issuing its own credit card directly to consumers
      is a financial institution because extending credit is a financial activity listed in 12 CFR 225.28
      (b)(1) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act of 1956 ( 12 U.S.C.
      1843(k)(4)(F) ), and issuing that extension of credit through a proprietary credit card demonstrates
      that a retailer is significantly engaged in extending credit. (ii) An automobile dealership that,
      as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days
      is a financial institution with respect to its leasing business because leasing personal property
      on a nonoperating basis where the initial term of the lease is at least 90 days is a financial activity
      listed in 12 CFR 225.28 (b)(3) and referenced in section 4(k)(4)(F) of the Bank Holding Company
      Act, 12 U.S.C. 1843(k)(4)(F) . (iii) A personal property or real estate appraiser is a financial
      institution because real and personal property appraisal is a financial activity listed in 12 CFR
      225.28 (b)(2)(i) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C.
      1843(k)(4)(F) . (iv) A career counselor that specializes in providing career counseling services
      to individuals currently employed by or recently displaced from a financial organization, individuals
      who are seeking employment with a financial organization, or individuals who are currently employed
      by or seeking placement with the finance, accounting or audit departments of any company is a financial
      institution because such career counseling activities are financial activities listed in 12 CFR
      225.28 (b)(9)(iii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C.
      1843(k)(4)(F) .
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-v
  canonical_id: glba-safeguards-16cfr-314.2-v
  section: 16 CFR §314.2(v)
  description: '(v): (v) A business that prints and sells checks for consumers, either as its sole business
    or as one of its product lines, is a financial institution because printing and selling checks is
    a financial activity that is listed in 12 CFR 225.28 (b)(10)(ii) and referenced in section 4(k)(4)(F)
    of the Bank H…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (v) A business that prints and sells checks for consumers, either as its sole business
      or as one of its product lines, is a financial institution because printing and selling checks is
      a financial activity that is listed in 12 CFR 225.28 (b)(10)(ii) and referenced in section 4(k)(4)(F)
      of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F) . (vi) A business that regularly wires
      money to and from consumers is a financial institution because transferring money is a financial
      activity referenced in section 4(k)(4)(A) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(A)
      , and regularly providing that service demonstrates that the business is significantly engaged in
      that activity. (vii) A check cashing business is a financial institution because cashing a check
      is exchanging money, which is a financial activity listed in section 4(k)(4)(A) of the Bank Holding
      Company Act, 12 U.S.C. 1843(k)(4)(A) . (viii) An accountant or other tax preparation service that
      is in the business of completing income tax returns is a financial institution because tax preparation
      services is a financial activity listed in 12 CFR 225.28 (b)(6)(vi) and referenced in section 4(k)(4)(G)
      of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G) . (ix) A business that operates a travel
      agency in connection with financial services is a financial institution because operating a travel
      agency in connection with financial services is a financial activity listed in 12 CFR 225.86 (b)(2)
      and referenced in section 4(k)(4)(G) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(G) .
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-x
  canonical_id: glba-safeguards-16cfr-314.2-x
  section: 16 CFR §314.2(x)
  description: '(x): (x) An entity that provides real estate settlement services is a financial institution
    because providing real estate settlement services is a financial activity listed in 12 CFR 225.28
    (b)(2)(viii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F)
    . (xi) A…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(x) An entity that provides real estate settlement services is a financial institution
      because providing real estate settlement services is a financial activity listed in 12 CFR 225.28
      (b)(2)(viii) and referenced in section 4(k)(4)(F) of the Bank Holding Company Act, 12 U.S.C. 1843(k)(4)(F)
      . (xi) A mortgage broker is a financial institution because brokering loans is a financial activity
      listed in 12 CFR 225.28 (b)(1) and referenced in section 4(k)(4)(F) of the Bank Holding Company
      Act, 12 U.S.C. 1843(k)(4)(F) . (xii) An investment advisory company and a credit counseling service
      are each financial institutions because providing financial and investment advisory services are
      financial activities referenced in section 4(k)(4)(C) of the Bank Holding Company Act, 12 U.S.C.
      1843(k)(4)(C) . (xiii) A company acting as a finder in bringing together one or more buyers and
      sellers of any product or service for transactions that the parties themselves negotiate and consummate
      is a financial institution because acting as a finder is an activity that is financial in nature
      or incidental to a financial activity listed in 12 CFR 225.86 (d)(1). (3) Financial institution
      does not include:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Any person or entity with respect to any financial activity that is subject to
    the jurisdiction of the Commodity Futures Trading Commission under the Commodity Exchange Act ( 7
    U.S.C. 1 et seq. ); (ii) The Federal Agricultural Mortgage Corporation or any entity chartered and
    operating under the …'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(i) Any person or entity with respect to any financial activity that is subject
      to the jurisdiction of the Commodity Futures Trading Commission under the Commodity Exchange Act
      ( 7 U.S.C. 1 et seq. ); (ii) The Federal Agricultural Mortgage Corporation or any entity chartered
      and operating under the Farm Credit Act of 1971 ( 12 U.S.C. 2001 et seq. ); (iii) Institutions chartered
      by Congress specifically to engage in securitizations, secondary market sales (including sales of
      servicing rights) or similar transactions related to a transaction of a consumer, as long as such
      institutions do not sell or transfer nonpublic personal information to a nonaffiliated third party
      other than as permitted by §§ 313.14 and 313.15; or (iv) Entities that engage in financial activities
      but that are not significantly engaged in those financial activities, and entities that engage in
      activities incidental to financial activities but that are not significantly engaged in activities
      incidental to financial activities. (4) Examples of entities that are not significantly engaged
      in financial activities are as follows:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) A retailer is not a financial institution if its only means of extending credit
    are occasional “lay away” and deferred payment plans or accepting payment by means of credit cards
    issued by others. (ii) A retailer is not a financial institution merely because it accepts payment
    in the form of cas…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (i) A retailer is not a financial institution if its only means of extending credit
      are occasional “lay away” and deferred payment plans or accepting payment by means of credit cards
      issued by others. (ii) A retailer is not a financial institution merely because it accepts payment
      in the form of cash, checks, or credit cards that it did not issue. (iii) A merchant is not a financial
      institution merely because it allows an individual to “run a tab.” (iv) A grocery store is not a
      financial institution merely because it allows individuals to whom it sells groceries to cash a
      check, or write a check for a higher amount than the grocery purchase and obtain cash in return.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Information security program means the administrative, technical, or physical
    safeguards you use to access, collect, distribute, process, protect, store, use, transmit, dispose
    of, or otherwise handle customer information .'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (i) Information security program means the administrative, technical, or physical
      safeguards you use to access, collect, distribute, process, protect, store, use, transmit, dispose
      of, or otherwise handle customer information .
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-j
  canonical_id: glba-safeguards-16cfr-314.2-j
  section: 16 CFR §314.2(j)
  description: '(j): (j) Information system means a discrete set of electronic information resources organized
    for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic
    information containing customer information or connected to a system containing customer information
    , as we…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (j) Information system means a discrete set of electronic information resources organized
      for the collection, processing, maintenance, use, sharing, dissemination or disposition of electronic
      information containing customer information or connected to a system containing customer information
      , as well as any specialized system such as industrial/process controls systems, telephone switching
      and private branch exchange systems, and environmental controls systems that contains customer information
      or that is connected to a system that contains customer information .
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-k
  canonical_id: glba-safeguards-16cfr-314.2-k
  section: 16 CFR §314.2(k)
  description: '(k): (k) Multi-factor authentication means authentication through verification of at least
    two of the following types of authentication factors: (1) Knowledge factors, such as a password; (2)
    Possession factors, such as a token; or (3) Inherence factors, such as biometric characteristics.'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(k) Multi-factor authentication means authentication through verification of at
      least two of the following types of authentication factors: (1) Knowledge factors, such as a password;
      (2) Possession factors, such as a token; or (3) Inherence factors, such as biometric characteristics.'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-l
  canonical_id: glba-safeguards-16cfr-314.2-l
  section: 16 CFR §314.2(l)
  description: '(l): (l) (1) Nonpublic personal information means:'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(l) (1) Nonpublic personal information means:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Personally identifiable financial information; and (ii) Any list, description,
    or other grouping of consumers (and publicly available information pertaining to them) that is derived
    using any personally identifiable financial information that is not publicly available. (2) Nonpublic
    personal inf…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(i) Personally identifiable financial information; and (ii) Any list, description,
      or other grouping of consumers (and publicly available information pertaining to them) that is derived
      using any personally identifiable financial information that is not publicly available. (2) Nonpublic
      personal information does not include:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Publicly available information, except as included on a list described in paragraph
    (l)(1)(ii) of this section; or (ii) Any list, description, or other grouping of consumers (and publicly
    available information pertaining to them) that is derived without using any personally identifiable
    financia…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(i) Publicly available information, except as included on a list described in paragraph
      (l)(1)(ii) of this section; or (ii) Any list, description, or other grouping of consumers (and publicly
      available information pertaining to them) that is derived without using any personally identifiable
      financial information that is not publicly available. (3) For example:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Nonpublic personal information includes any list of individuals'' names and street
    addresses that is derived in whole or in part using personally identifiable financial information
    (that is not publicly available), such as account numbers. (ii) Nonpublic personal information does
    not include any …'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (i) Nonpublic personal information includes any list of individuals' names and street
      addresses that is derived in whole or in part using personally identifiable financial information
      (that is not publicly available), such as account numbers. (ii) Nonpublic personal information does
      not include any list of individuals' names and addresses that contains only publicly available information,
      is not derived, in whole or in part, using personally identifiable financial information that is
      not publicly available, and is not disclosed in a manner that indicates that any of the individuals
      on the list is a consumer of a financial institution .
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-m
  canonical_id: glba-safeguards-16cfr-314.2-m
  section: 16 CFR §314.2(m)
  description: '(m): (m) Notification event means acquisition of unencrypted customer information without
    the authorization of the individual to which the information pertains. Customer information is considered
    unencrypted for this purpose if the encryption key was accessed by an unauthorized person. Unauthorized
    acqui…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (m) Notification event means acquisition of unencrypted customer information without
      the authorization of the individual to which the information pertains. Customer information is considered
      unencrypted for this purpose if the encryption key was accessed by an unauthorized person. Unauthorized
      acquisition will be presumed to include unauthorized access to unencrypted customer information
      unless you have reliable evidence showing that there has not been, or could not reasonably have
      been, unauthorized acquisition of such information.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-n
  canonical_id: glba-safeguards-16cfr-314.2-n
  section: 16 CFR §314.2(n)
  description: '(n): (n) Penetration testing means a test methodology in which assessors attempt to circumvent
    or defeat the security features of an information system by attempting penetration of databases or
    controls from outside or inside your information systems.'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (n) Penetration testing means a test methodology in which assessors attempt to circumvent
      or defeat the security features of an information system by attempting penetration of databases
      or controls from outside or inside your information systems.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-o
  canonical_id: glba-safeguards-16cfr-314.2-o
  section: 16 CFR §314.2(o)
  description: '(o): (o) (1) Personally identifiable financial information means any information:'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(o) (1) Personally identifiable financial information means any information:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) A consumer provides to you to obtain a financial product or service from you
    ; (ii) About a consumer resulting from any transaction involving a financial product or service between
    you and a consumer; or (iii) You otherwise obtain about a consumer in connection with providing a
    financial product…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(i) A consumer provides to you to obtain a financial product or service from you
      ; (ii) About a consumer resulting from any transaction involving a financial product or service
      between you and a consumer; or (iii) You otherwise obtain about a consumer in connection with providing
      a financial product or service to that consumer. (2) For example:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Information included. Personally identifiable financial information includes:
    (A) Information a consumer provides to you on an application to obtain a loan, credit card, or other
    financial product or service; (B) Account balance information, payment history, overdraft history,
    and credit or debi…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(i) Information included. Personally identifiable financial information includes:
      (A) Information a consumer provides to you on an application to obtain a loan, credit card, or other
      financial product or service; (B) Account balance information, payment history, overdraft history,
      and credit or debit card purchase information; (C) The fact that an individual is or has been one
      of your customers or has obtained a financial product or service from you ; (D) Any information
      about your consumer if it is disclosed in a manner that indicates that the individual is or has
      been your consumer; (E) Any information that a consumer provides to you or that you or your agent
      otherwise obtain in connection with collecting on, or servicing, a credit account; (F) Any information
      you collect through an internet “cookie” (an information collecting device from a web server); and
      (G) Information from a consumer report. (ii) Information not included. Personally identifiable financial
      information does not include: (A) A list of names and addresses of customers of an entity that is
      not a financial institution ; and (B) Information that does not identify a consumer, such as aggregate
      information or blind data that does not contain personal identifiers such as account numbers, names,
      or addresses.'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-p
  canonical_id: glba-safeguards-16cfr-314.2-p
  section: 16 CFR §314.2(p)
  description: '(p): (p) (1) Publicly available information means any information that you have a reasonable
    basis to believe is lawfully made available to the general public from:'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(p) (1) Publicly available information means any information that you have a reasonable
      basis to believe is lawfully made available to the general public from:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Federal, State, or local government records ; (ii) Widely distributed media ;
    or (iii) Disclosures to the general public that are required to be made by Federal, State, or local
    law. (2) You have a reasonable basis to believe that information is lawfully made available to the
    general public if y…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(i) Federal, State, or local government records ; (ii) Widely distributed media
      ; or (iii) Disclosures to the general public that are required to be made by Federal, State, or
      local law. (2) You have a reasonable basis to believe that information is lawfully made available
      to the general public if you have taken steps to determine:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) That the information is of the type that is available to the general public;
    and (ii) Whether an individual can direct that the information not be made available to the general
    public and, if so, that your consumer has not done so. (3) For example:'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: '(i) That the information is of the type that is available to the general public;
      and (ii) Whether an individual can direct that the information not be made available to the general
      public and, if so, that your consumer has not done so. (3) For example:'
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-i
  canonical_id: glba-safeguards-16cfr-314.2-i
  section: 16 CFR §314.2(i)
  description: '(i): (i) Government records. Publicly available information in government records includes
    information in government real estate records and security interest filings. (ii) Widely distributed
    media. Publicly available information from widely distributed media includes information from a telephone
    book, a…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (i) Government records. Publicly available information in government records includes
      information in government real estate records and security interest filings. (ii) Widely distributed
      media. Publicly available information from widely distributed media includes information from a
      telephone book, a television or radio program, a newspaper, or a website that is available to the
      general public on an unrestricted basis. A website is not restricted merely because an internet
      service provider or a site operator requires a fee or a password, so long as access is available
      to the general public. (iii) Reasonable basis. (A) You have a reasonable basis to believe that mortgage
      information is lawfully made available to the general public if you have determined that the information
      is of the type included on the public record in the jurisdiction where the mortgage would be recorded.
      (B) You have a reasonable basis to believe that an individual's telephone number is lawfully made
      available to the general public if you have located the telephone number in the telephone book or
      the consumer has informed you that the telephone number is not unlisted.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-q
  canonical_id: glba-safeguards-16cfr-314.2-q
  section: 16 CFR §314.2(q)
  description: '(q): (q) Security event means an event resulting in unauthorized access to, or disruption
    or misuse of, an information system, information stored on such information system, or customer information
    held in physical form.'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (q) Security event means an event resulting in unauthorized access to, or disruption
      or misuse of, an information system, information stored on such information system, or customer
      information held in physical form.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-r
  canonical_id: glba-safeguards-16cfr-314.2-r
  section: 16 CFR §314.2(r)
  description: '(r): (r) Service provider means any person or entity that receives, maintains, processes,
    or otherwise is permitted access to customer information through its provision of services directly
    to a financial institution that is subject to this part.'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (r) Service provider means any person or entity that receives, maintains, processes,
      or otherwise is permitted access to customer information through its provision of services directly
      to a financial institution that is subject to this part.
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
- id: glba-safeguards-16cfr-314.2-s
  canonical_id: glba-safeguards-16cfr-314.2-s
  section: 16 CFR §314.2(s)
  description: '(s): (s) You includes each “financial institution” (but excludes any “other person”) over
    which the Commission has enforcement jurisdiction pursuant to section 505(a)(7) of the Gramm-Leach-Bliley
    Act . [ 86 FR 70304 , Dec. 9, 2021, as amended at 88 FR 77508 , Nov. 13, 2023] Bank Holding Company
    Act of 19…'
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.2(d)
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.2
    snapshot_id: 19d2e2a5f95bc74c
    fetched_at: '2026-05-24T00:44:09Z'
    content_hash: sha256:2bee5a7ad65ad81928bb173849f6e69175dcd02e6f2bfe9cc30a01ac1111b5c8
    paragraph_quote: (s) You includes each “financial institution” (but excludes any “other person”) over
      which the Commission has enforcement jurisdiction pursuant to section 505(a)(7) of the Gramm-Leach-Bliley
      Act . [ 86 FR 70304 , Dec. 9, 2021, as amended at 88 FR 77508 , Nov. 13, 2023] Bank Holding Company
      Act of 1956 Commodity Exchange Act Farm Credit Act of 1971 Gramm-Leach-Bliley Act CFR Toolbox Law
      about... Articles from Wex Table of Popular Names Parallel Table of Authorities Accessibility About
      LII Contact us Advertise here Help Terms of use Privacy
    drafter_attestation: Verbatim subsection of 16 CFR §314.2 from Cornell LII snapshot 19d2e2a5f95bc74c;
      body isolated between nav and notes; substring-verified.
  judgment: false
