Implementing the Privacy Initiative for Auto Dealerships

Any financial institution that collects personally identifying information ("PII") is subject to the Gramm Leach Bliley Act ("GLBA"). Compliance is mandatory and there must be a policy in place to protect the information from foreseeable threats in data security and integrity. All companies significantly engaged in activities that are financial in nature are subject to GLBA as well. Businesses should be concerned with two topics arising from the GLBA. One is "Privacy" or "Information Privacy." The other is "Information Safeguards" or the "Safeguards Rule". This program includes policies, references and training to help you understand and put forth good faith compliance against this important regulation.

Implementation Steps in this Guide

1. Review, Edit and Distribute the GLBA Information Privacy, Safeguards and Security Policy

2. Review and Edit the Responding to Information Compromise Guideline

3. Distribute the GLBA Privacy and Safeguards Training

4. Schedule the Safeguards Monitoring Report Form

5. Allow Employees to Start the Information Compromise Report Form

6. Review the related Information Security Initiative

Review, Edit and Distribute the GLBA Information Privacy, Safeguards and Security Policy

The mandate requires you to create a policy for employees to understand and follow the procedures established in your Red Flag Program. Compli provides a starting point for this policy. Find the Identity Theft Red Flag Policy for Employees and follow the instructions inside. Much of the information you need to put in this policy can be taken directly from the Red Flag Program.

Review and edit the policy

1. Click on the Library tab
2. Search for "GLBA Information Privacy, Safeguards and Security Policy" and click on it
3. Click on the Edit button to view the list of versions
4. Click Create Draft to the right of the latest published version
5. Click Edit next to the Draft version that you just created
6. Make desired changes to the policy
7. Click Publish to finish editing the policy

Schedule the activity for distribution

1. Click on the Workspaces tab
2. Click on the Consumer Finance workspace
3. Click on the Privacy initiative
4. Click on the GLBA Information Privacy, Safeguards and Security Policy
5. Click on Groups and assign to the appropriate groups, such as All Employees
6. Click on Schedule and set an annual schedule based on the Hire Date. 
7. Click Save

Review and Edit the Responding to Information Compromise Guideline

1. Click on the Library tab
2. Search for "Responding to Information Compromise" and click on it
3. Click on the Edit button to view the list of versions
4. Click Create Draft to the right of the latest published version
5. Click Edit next to the Draft version that you just created
6. Make desired changes to the guideline
7. Click Publish to finish editing the guideline
8. Click Permissions and assign to the appropriate group(s), such as All Employees

Distribute the GLBA Privacy and Safeguards Training

Schedule the activity for distribution

1. Click on the Workspaces tab
2. Click on the Consumer Finance workspace
3. Click on the Privacy initiative
4. Click on GLBA Privacy and Safeguards Training
5. Click on Groups and assign to the appropriate groups, such as All Employees
6. Click on Schedule and set an annual schedule based on the Hire Date
7. Click Save

Schedule the Safeguards Monitoring Report Form

Use this form to document an employee’s knowledge of the safeguards for which they are responsible or for the area in which they are working during the relevant reporting period. The information provided will help gain a better understanding of the safeguards in place throughout the organization and will help in efforts to continually monitor and improve safeguards related to customer information.

Review the Process Workflow

Set the form routing

1. Click on the Admin tab
2. Click on Workflow/Forms subtab
3. Click on Processes
4. Search for and click on Safeguards Monitoring Report Form
5. Edit the routing rules for each stage by following these suggestions:
   
   

   Stage	Suggested Routing Rule	Description
   IT Section	Subject or Queue	Route to the "Subject" (i.e. the person to whom the system sent this form).  This stage can alternatively be assigned to a queue.
   Compliance Officer Section	Queue	Route to the Compliance Officer Queue, or equivalent.

Schedule the Activity for distribution

1. Click on the Workspaces tab
2. Click on the Consumer Finance workspace
3. Click on the Privacy initiative
4. Click on the Safeguards Monitoring Report Form
5. Click on Groups and assign to the appropriate group(s), such as your IT Director or Privacy Coordinator
6. Click on Schedule and set the appropriate schedule. We suggest a quarterly schedule. Be sure to add a number of days to distribute the form before it is due.
7. Click Save

Allow Employees to Start the Information Compromise Report Form

Use this form so the Company can follow through with an investigation and response if an employee knows, or suspects, that private customer information has been stolen or compromised.

Review the Process Workflow

Set the form routing

1. Click on the Admin tab
2. Click on Workflow/Forms subtab
3. Click on Processes
4. Search for and click on Information Compromise Report Form
5. Edit the routing rules for each stage by following these suggestions:
   
   

   Stage	Suggested Routing Rule	Description
   Employee Section	Subject	Route to the "Subject" (i.e. the person who started the form)
   Compliance Officer Section	Queue	Route to the Compliance Officer Queue, or equivalent.
   CFO Review	Queue or Supervisory Level	Route either to a queue that contains your CFO or up the hierarchy to the CFO if that person is in the management hierarchy.

Set the Activity to be startable by All Employees

1. Click on the Workspaces tab
2. Click on the Consumer Finance workspace
3. Click on the Red Flags initiative
4. Click on the Information Compromise Report Form
5. Click Edit and set the Start Menu Folder to "Report an Incident" or something similar
6. Click Groups and assign "All Employees" (or another set of group as appropriate) within the "In Start Menu" for section. 
7. Click Save

Review the related Information Security Initiative

The best defense against the constantly evolving threat of cyber criminals is an Information Security initiative as part of your workforce compliance program. Your employees provide the best security, or greatest vulnerability, for the private data you are responsible for safeguarding. Every member of your workforce needs to be aligned on the goals of maintaining privacy standards and protocols to protect private information. See the Information Security initiative to learn more.