As online data breaches become more prevalent, it's more important than ever to protect client privacy.

Although recent legislation in the U.S. rolled back online privacy rules for Internet Service Providers (ISPs), and make the rules more lax regarding the collection of consumer data, the tighter cybersecurity requirements imposed by Europe's recently-enacted General Data Protection Regulation (GDPR) will have international repercussions sure to impact the U.S. insurance and finance industry.

Closer to home

The U.S. laws in place for the protection of personal information generally involve one of these four areas:

• Security: Companies aren't allowed to release personal information unless required by law.
• Disclosure: Companies must tell the client/consumer what information they collect and what the company plans to do with that information.
• Breach Disclosure: If there has been a data breach, the company is required to tell the consumer.
• Direct Electronic Marketing: Companies must respect laws around advertisements via fax, email, or phone.

The main legislation that protects consumer information is the Gramm-Leach-Bliley Act, which was passed in 1999 and requires “financial institutions — companies that offer consumers financial products or services like loans, financial or investment advice, or insurance — to explain their information-sharing practices to their customers and to safeguard sensitive data.”