Introduction

Data security and privacy in the financial industry is a complex topic impacted by a number of state and federal laws. This chapter will review the landscape with a focus largely on the US regulatory environment. Where appropriate the non-US environment will be covered. A survey of state and federal laws is an ongoing project with evolution of the statutes and their interpretation a basic reality. Two concepts are addressed: data security and privacy. Data security is focused on the need to keep information secure and safeguarded. It addresses the question and methods of how to keep information protected from unauthorized access and misuse. Privacy, in contrast, is a discussion of the rights and limitations associated with the collection, use, maintenance and lifecycle of personal information. Any discussion of privacy needs to address what can be kept from individuals other than the owner and what cannot. Privacy has its roots in the concept of “the right of the individual to be let alone.” Through a long history of cases the US courts have recognized the individual's constitutional right to privacy. While this does not necessarily extend to financial information, starting in the 1970s laws were adopted to protect the privacy of information. Interestingly, the USA takes the approach of specific laws governing specific data questions instead of broad encompassing rules. Typically the USA has addressed concerns through specific laws and regulations. This is in contrast to the EU where a broad directive provides the basis for protection.