The Gramm-Leach-Bliley Act (GLBA) and its implementing regulations have undergone significant updates in recent years, with the FTC’s revised Safeguards Rule taking full effect in 2023 and ongoing enforcement activity making compliance more urgent than ever. For financial firms in New York City, Long Island, and Westchester County, understanding the latest GLBA disposal rule updates for financial firms is essential to avoid regulatory action and protect clients’ nonpublic personal information (NPI) through every stage of its lifecycle — including at destruction.
The GLBA’s disposal rule requires that financial institutions properly dispose of customer information derived from consumer reports — and more broadly, the law’s privacy framework requires that NPI be protected from unauthorized access throughout its existence. The 2023 updates to the FTC’s Safeguards Rule significantly strengthened the specific technical requirements for information security programs, including provisions that affect document disposal practices.
What Is the GLBA Disposal Rule?
The GLBA Disposal Rule — formally implemented through the FTC’s Disposal Rule (16 CFR Part 682) — requires financial institutions to take reasonable measures to protect against unauthorized access to or use of customer information in connection with its disposal. The rule specifically addresses the disposal of “consumer report information” — information from credit reports and similar sources — but the broader GLBA privacy framework applies to all forms of customer NPI.
Under the Disposal Rule, financial institutions must:
- Burn, pulverize, or shred paper documents containing consumer report information so that information cannot be read or reconstructed
- Destroy or erase electronic files or media so that information cannot be read or reconstructed
- Hire a document destruction contractor to dispose of material specifically identified as consumer report information, or that contains such information
The rule applies to any firm that obtains consumer reports for a business purpose — including credit checks for loan applications, employment background checks using consumer report data, and similar uses. Our GLBA-compliant shredding services are designed to satisfy the disposal rule for New York financial firms.
2023 FTC Safeguards Rule Updates That Affect Document Disposal
The FTC’s updated Safeguards Rule — effective June 2023 for most covered institutions — significantly expanded the information security requirements for financial institutions subject to GLBA. Several of the updates have direct implications for document disposal practices:
- Qualified individual requirement: Covered institutions must designate a qualified individual to oversee the information security program — including disposal procedures
- Written information security program: The WISP must now specifically address data retention and disposal procedures for customer information in all formats
- Expanded scope: The updated rule expanded coverage to include mortgage brokers, payday lenders, tax preparers, auto dealers, and certain other businesses that weren’t clearly covered before
- Service provider oversight: Institutions must now actively monitor and assess the security practices of service providers, including document destruction vendors
- Annual reporting: The qualified individual must provide an annual written report to the board on the information security program, which would include disposal program performance
Financial institutions in New York should review their disposal procedures and vendor contracts in light of these updates. Contact us to discuss how New York Shredding can help satisfy the updated Safeguards Rule requirements.
Types of Financial Records Subject to GLBA Disposal Requirements
GLBA disposal requirements apply broadly to customer nonpublic personal information — not just information formally designated as “consumer report information.” New York financial firms should treat the following categories of records as subject to the GLBA disposal rule:
- Loan applications, credit reports, and underwriting files
- Customer account statements and financial records
- Social Security numbers, dates of birth, and identification documents
- Income and asset documentation (tax returns, bank statements, pay stubs)
- Insurance applications and claim records
- Trust and estate planning documents containing financial NPI
- Any internal document that references individual customer financial information
When these records are no longer needed for business purposes and retention periods have expired, they must be disposed of through certified shredding — not placed in unsecured trash or recycling. Our shredding services for financial firms cover all paper and electronic formats.
Electronic Media Disposal Under the GLBA Safeguards Rule
The updated GLBA Safeguards Rule explicitly addresses the disposal of electronic media containing customer NPI. Simply deleting files from a computer or wiping a hard drive with standard formatting tools does not satisfy the rule’s requirement to render information unreadable and unrecoverable. Physical destruction of electronic media is the most reliable way to comply.
For electronic media disposal, GLBA-compliant practices include:
- Physical destruction: Shredding or crushing of hard drives, destroying the internal platters
- Degaussing: Use of a strong magnetic field to render magnetic media unreadable (applicable to certain drive types)
- Multi-pass data wiping: Meeting NIST 800-88 standards for media that cannot be physically destroyed (with a Certificate of Destruction documenting the process)
New York Shredding provides certified hard drive and electronic media destruction for financial firms throughout New York City, Long Island, and Westchester. Each destruction event includes a Certificate of Destruction documenting the serial numbers of destroyed devices. Learn about our electronic media destruction process.
GLBA Compliance Checklist for Document Disposal
Use this checklist to assess your financial firm’s document disposal compliance under the updated GLBA Safeguards Rule and Disposal Rule:
- ☐ Written information security program (WISP) includes specific document disposal procedures for all record formats
- ☐ Qualified individual is designated to oversee the information security program, including disposal procedures
- ☐ All paper records containing customer NPI are shredded by a certified shredding company — not placed in unsecured trash or recycling
- ☐ Electronic media is physically destroyed, degaussed, or wiped to NIST standards before disposal
- ☐ A Certificate of Destruction is obtained and retained after each destruction event
- ☐ Document destruction vendor has been assessed and approved under the firm’s third-party service provider management program
- ☐ Locked, secure collection consoles are deployed throughout the office for documents awaiting destruction
- ☐ Employees are trained on GLBA disposal requirements and proper document handling procedures
- ☐ Annual report to the board includes a review of disposal program effectiveness
Visit our service area page to confirm we serve your New York financial firm’s location, and view our pricing for financial institution shredding services.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give financial institutions the proof they need for FTC examinations, NYDFS audits, and any other GLBA compliance review.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your firm on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.