I realize July 1 has come and gone... but I have a few stragglers that I am working on.

These few service providers that instead of signing the "contract" amendment which covers the objectives of the program ... ensure the security and confidentiality of customer information; protect against any anticipated threats or hazards to the security and integrity of such information; and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer... some have simply re-stated that all information is confidential, they will not disclose or use information, etc... They do not feel it is necessary or just do not want to sign the agreement.

Has anyone else ran into this? Do you send another letter re-stating that yes we are glad you that you hold all information as confidential and that you do not disclose it... but we need to know you meet the objectives, etc... Please sign this agreement!

How about adding an "or else" at the end of your plea?

John has a good point - just take your business to someone else. On the other hand, the document that you want them to sign may be viewed as legally risky and I wonder whether or not a simple commitment: "all information is confidential, will not disclose or used, etc" should be OK, not perfect but serving the purpose.

When GLBA finally came out in all of its glory, I went to work on this immediately. I am fortunate, for the most part everyone understood what we were requesting and were willing to sign our addendum to the contract. However, some well known financial institution service providers would not even acknowledge my attempts. They wouldn't return my calls or respond to my letters. Finally I called our local FDIC examiner and asked him what I should do....he told me to document my attempts and that is really the best I could do.

I think that it is always easy to say, "do it or we are gone.", but in reality that can often times be a very cumbersome process to up and leave a service provider. I'm not yet sure how the examiners are going to view it but I did all I could, except pulling the plug on the service provider.

Keep in mind, there is one additional thing you can do. If you have a service provider that services financial institutions nation wide or for a very large region, there is a chance that your regulator and the FFIEC perform Information Security testing on them anyway. I found that the case with a couple of our larger service providers. Call your regional examination office and ask. You have to provide them with a copy of the agreement between you and the service provider to evidence the relationship. Then they will send you their most recent exam they conducted.
Good luck!

We had that problem and in a couple of isolated cases modified the language to state that they agreed to comply with the information security measures to protect customer information as outlined in Section 301b of GLBA and the Interagency Guidelines Establishing Standards for Safeguarding Customer Information.

They signed it, not realizing that they were signing basically signing what they had refused to sign previously.

Not as specific as we or the attorneys would like, but .....

What really galls me about service providers (and yes, I am one but I sign those agreements) is that they forget that the bank is their customer. When you are having difficulty with service providers, you might firmly but politely (at first, anyway) point this out. If they still refuse, ask for their customer list. Their favorite answer is "no-one else has that problem." This, however, is not true. Everyone else who is on top of things has the same problem you do. Just asking for the list should make a point. Getting it should lead to some real fun. Call other customers and share the pain. Make real use of that bumper sticker "United we stand"! Also let your regulator know you need help from the heavies.

Lucy,
I completely agree with you. I think sometimes companies lose sight of customer service and who their customers are while they are just trying to grow. They need to remember that it was you and me that got them there.

It's the lack of response from the companies that hacks me off. I appreciated those that explained their legal counsel was working on their own form or that it may just take time for the appropriate person/department to sign a form that I may provide to them, but don't ignore your customers. GLBA is not going away, and one of these days it is going to catch up with them by means of loss of customers or if one of the agencies steps in on our behalf. It just makes a difficult situation worse when we don't all work towards the same goals.

Thats my soapbox, everyone have a great day!