The financial services industry faces a complex and invasive regulatory landscape coupled with increasing consumer focus on the protection of highly sensitive financial and other information. As a result, staying informed and compliant with privacy and cybersecurity rules and regulations is crucial for any entity operating in this industry.

Polsinelli’s experienced team advises on the full range of federal, state, and international privacy laws affecting financial institutions.

Our nationwide team of privacy and cybersecurity attorneys regularly counsels financial institutions of all sizes on proactive compliance, defense of and response to adverse events, and regulatory investigation and enforcement matters. Polsinelli attorneys are experienced in providing guidance to clients across the country and offer practical solutions that can be understood and effectively implemented.

Our attorneys focus on federal and state regulatory matters, including:

  • The Gramm-Leach-Bliley Act (GLBA)
  • The Right to Financial Privacy Act (RFPA)
  • The Fair Credit Reporting Act (FCRA)
  • Comprehensive state privacy laws such as California’s CCPA/CPRA
  • Federal and state data security and data breach laws
  • New York Department of Financial Services Cybersecurity Regulations and similar NAIC regulations.
  • Regulatory and administrative developments among the FDIC, NCUA, FTC, CFPB and other agencies
  • The CAN-SPAM Act
  • New legislative proposals, including proposals that expand privacy regulation for financial institutions at the state and federal level
  • Cross-border issues and requirements of various international regimes
Related Capabilities
Biometric Privacy LawData Breach & Incident ResponseHIPAA/Health Information Privacy & SecurityInformation Security (InfoSec)International PrivacyPrivacy & CybersecurityPrivacy & Cybersecurity CounselingPrivacy LitigationUS State Privacy Laws
Publications
All Publications
National Credit Union Administration Issues New Proposed Rule Requiring 72-Hour Cyber Incident Reporting
On July 27, 2022, the National Credit Union Administration (NCUA) issued a proposed rule requiring federally insured credit unions (FICUs) to notify the NCUA within seventy-two (72) hours of discovering a reportable cyber incident. Summary of the Proposed Rule Under existing federal law (the Interagency Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice), credit unions must notify the appropriate NCUA Regional Director, and, in the case of state-chartered credit unions, their state supervisory authority, as soon as possible when the credit union becomes aware of an incident involving unauthorized access to or use of sensitive member information. If finalized, the new rule will require FICUs to report to the NCUA, as soon as possible and no later than
Read More