Home > Business and Policy Areas > Risk Management > Risk Management News

Clarification on Applicability of FTC Safeguarding Rules

April 10, 2003

Beginning May 23, colleges and universities must comply with provisions of the Gramm-Leach-Bliley (GLB) Act that relate to the safeguarding of personal and financial data, in accordance with final regulations promulgated by the Federal Trade Commission (FTC) last year (see “NACUBO Advisory Report 2003-01”).

Colleges and universities will be deemed to be in compliance with FTC privacy rules that also stem from the GLB Act—if they comply with the Family Educational Rights and Privacy Act. The safeguarding rules are separate from the privacy rules, which were issued in May of 2000.

In recent weeks, a misinterpretation of FTC rules by staff at the Department of Education and others has led to a considerable amount of confusion at institutions, evidenced by a flurry of questions to NACUBO about the applicability of the rules to colleges and universities.

FTC counsel confirmed to NACUBO staff that the safeguarding rules do indeed apply to higher education institutions.

Colleges and universities developing or combining existing policies to comply with the new rules are encouraged to share them with NACUBO, in order that model policies and plans may be posted on the Web site for members to share.

The NACUBO staff contact is Mary Bachinger, senior policy analyst. She may be reached at (202) 861-2581 or mary.bachinger@nacubo.org.