16 C.F.R. § 314.1

Purpose and scope

Read at: eCFRecfr.gov CornellLII GovInfogovinfo.gov CasesGoogle Scholar

(a) Purpose. This part, which implements sections 501 and 505(b)(2) of the Gramm-Leach-Bliley Act, sets forth standards for developing, implementing, and maintaining reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.

(b) Scope. This part applies to the handling of customer information by all financial institutions over which the Federal Trade Commission (“FTC” or “Commission”) has jurisdiction. Namely, this part applies to those “financial institutions” over which the Commission has rulemaking authority pursuant to section 501(b) of the Gramm-Leach-Bliley Act. An entity is a “financial institution” if its business is engaging in an activity that is financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956, 12 U.S.C. 1843(k), which incorporates activities enumerated by the Federal Reserve Board in 12 CFR 225.28 and 225.86. The “financial institutions” subject to the Commission's enforcement authority are those that are not otherwise subject to the enforcement authority of another regulator under section 505 of the Gramm-Leach-Bliley Act, 15 U.S.C. 6805. More specifically, those entities include, but are not limited to, mortgage lenders, “pay day” lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, travel agencies operated in connection with financial services, collection agencies, credit counselors and other financial advisors, tax preparation firms, non-federally insured credit unions, investment advisors that are not required to register with the Securities and Exchange Commission, and entities acting as finders. They are referred to in this part as “You.” This part applies to all customer information in your possession, regardless of whether such information pertains to individuals with whom you have a customer relationship, or pertains to the customers of other financial institutions that have provided such information to you.

[67 FR 36493, May 23, 2002, as amended at 86 FR 70304, Dec. 9, 2021]

Notes of Decisions

Cited in 4 cases (2 in the last 5 years), 2013–2025 · leading case: Wells Fargo Bank, N.A. v. Jenkins, 744 S.E.2d 686 (Ga. 2013).

Sort: Relevance Newest Treatment

Wells Fargo Bank, N.A. v. Jenkins, 744 S.E.2d 686 (Ga. 2013). · cites it 3× “Jenkins points to certain provisions of the Code of Federal Regulations in support of the finding of a duty under 15 USC § 6801 (a), specifically 16 CFR § 314.1 ; however, the regulation was not part of the Court of Appeals analysis or its finding of duty under the GLBA.”

In re Equifax, Inc., 371 F. Supp. 3d 1150 (N.D. Ga. 2019). · cites it 3× “§ 6801 (a), specifically 16 C.F.R. § 314.1 ; however, the regulation was not part of the Court of Appeals analysis or its finding of duty under the GLBA.”

McGoveran v. Amazon Web Servs., Inc. (D. Del. 2023). “16 C.F.R. § 314.1 (a). Its definition of “financial institution” par- allels Regulation P’s special definition discussed above, and it gives the same exam- ples to illustrate that definition.”

Smith v. TransUnion (S.D. Cal. 2025). “) According to 24 16 C.F.R. § 314.1 , those provisions set “forth standards for developing, implementing, and 25 maintaining reasonable administrative, technical, and physical safeguards to protect the 26 security, confidentiality, and integrity of customer information.”

Annotations are extracted automatically from the opinions in the Syfert caselaw corpus and ranked by authority, recency, and treatment. Dots show Syfertize treatment of the citing case itself.