kpayne on DSK54DXVN1OFR with $$_JOB

AUTHENTICATE~ U.S. GOVERNMENT . 

INFORMATION 

GPO 

EXHIBIT B

Case 1:19-mi-99999-UNA Document 2361-5 Filed 07/22/19 Page 1 of 2 

Federal Trade Commission § 314.3 

(ii) If it shares with nonaffiliated third parties, state, as applicable: ‘‘Nonaffiliates we 

share with can include [list categories of companies such as mortgage companies, insurance 

companies, direct marketing companies, and

nonprofit organizations].’’ 

(3) Joint Marketing. As required by § 313.13 

of this part, where [joint marketing] appears, 

the financial institution must: 

(i) If it does not engage in joint marketing, 

state: ‘‘[name of financial institution] doesn’t 

jointly market’’; or 

(ii) If it shares personal information for 

joint marketing, state, as applicable: ‘‘Our 

joint marketing partners include [list categories 

of companies such as credit card companies].’’ 

(c) General instructions for the ‘‘Other important information’’ box. This box is optional. 

The space provided for information in this 

box is not limited. Only the following types 

of information can appear in this box. 

(1) State and/or international privacy law 

information; and/or 

(2) Acknowledgment of receipt form. 

[74 FR 62966, Dec. 1, 2009] 

PART 314—STANDARDS FOR SAFEGUARDING CUSTOMER INFORMATION 

Sec. 

314.1 Purpose and scope. 

314.2 Definitions. 

314.3 Standards for safeguarding customer 

information. 

314.4 Elements. 

314.5 Effective date. 

AUTHORITY: 15 U.S.C. 6801(b), 6805(b)(2). 

SOURCE: 67 FR 36493, May 23, 2002, unless 

otherwise noted. 

§ 314.1 Purpose and scope. 

(a) Purpose. This part, which implements sections 501 and 505(b)(2) of the 

Gramm-Leach-Bliley Act, sets forth

standards for developing, implementing, and maintaining reasonable 

administrative, technical, and physical 

safeguards to protect the security, confidentiality, and integrity of customer 

information. 

(b) Scope. This part applies to the

handling of customer information by 

all financial institutions over which

the Federal Trade Commission (‘‘FTC’’ 

or ‘‘Commission’’) has jurisdiction.

This part refers to such entities as

‘‘you.’’ This part applies to all customer information in your possession, 

regardless of whether such information 

pertains to individuals with whom you 

have a customer relationship, or pertains to the customers of other financial institutions that have provided 

such information to you. 

§ 314.2 Definitions. 

(a) In general. Except as modified by 

this part or unless the context otherwise requires, the terms used in this 

part have the same meaning as set 

forth in the Commission’s rule governing the Privacy of Consumer Financial Information, 16 CFR part 313. 

(b) Customer information means any 

record containing nonpublic personal 

information as defined in 16 CFR 

313.3(n), about a customer of a financial 

institution, whether in paper, electronic, or other form, that is handled 

or maintained by or on behalf of you or 

your affiliates. 

(c) Information security program means 

the administrative, technical, or physical safeguards you use to access, collect, distribute, process, protect, store, 

use, transmit, dispose of, or otherwise 

handle customer information. 

(d) Service provider means any person 

or entity that receives, maintains, 

processes, or otherwise is permitted access to customer information through 

its provision of services directly to a financial institution that is subject to 

this part. 

§ 314.3 Standards for safeguarding

customer information. 

(a) Information security program. You 

shall develop, implement, and maintain a comprehensive information security program that is written in one 

or more readily accessible parts and 

contains administrative, technical, and 

physical safeguards that are appropriate to your size and complexity, the 

nature and scope of your activities, and 

the sensitivity of any customer information at issue. Such safeguards shall 

include the elements set forth in § 314.4 

and shall be reasonably designed to 

achieve the objectives of this part, as 

set forth in paragraph (b) of this section. 

(b) Objectives. The objectives of section 501(b) of the Act, and of this part, 

are to: 

(1) Insure the security and confidentiality of customer information; 

433 

kpayne on DSK54DXVN1OFR with $$_JOB

EXHIBIT B

Case 1:19-mi-99999-UNA Document 2361-5 Filed 07/22/19 Page 2 of 2 

§ 314.4 16 CFR Ch. I (1–1–18 Edition) 

(2) Protect against any anticipated 

threats or hazards to the security or 

integrity of such information; and 

(3) Protect against unauthorized access to or use of such information that 

could result in substantial harm or inconvenience to any customer. 

§ 314.4 Elements. 

In order to develop, implement, and 

maintain your information security 

program, you shall: 

(a) Designate an employee or employees to coordinate your information security program. 

(b) Identify reasonably foreseeable 

internal and external risks to the security, confidentiality, and integrity of 

customer information that could result 

in the unauthorized disclosure, misuse, 

alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards 

in place to control these risks. At a 

minimum, such a risk assessment 

should include consideration of risks in 

each relevant area of your operations, 

including: 

(1) Employee training and management; 

(2) Information systems, including 

network and software design, as well as 

information processing, storage, transmission and disposal; and 

(3) Detecting, preventing and responding to attacks, intrusions, or 

other systems failures. 

(c) Design and implement information safeguards to control the risks 

you identify through risk assessment, 

and regularly test or otherwise monitor the effectiveness of the safeguards’ 

key controls, systems, and procedures. 

(d) Oversee service providers, by: 

(1) Taking reasonable steps to select 

and retain service providers that are 

capable of maintaining appropriate 

safeguards for the customer information at issue; and 

(2) Requiring your service providers 

by contract to implement and maintain such safeguards. 

(e) Evaluate and adjust your information security program in light of the 

results of the testing and monitoring 

required by paragraph (c) of this section; any material changes to your operations or business arrangements; or 

any other circumstances that you 

know or have reason to know may have 

a material impact on your information 

security program. 

§ 314.5 Effective date. 

(a) Each financial institution subject 

to the Commission’s jurisdiction must 

implement an information security 

program pursuant to this part no later 

than May 23, 2003. 

(b) Two-year grandfathering of service contracts. Until May 24, 2004, a contract you have entered into with a nonaffiliated third party to perform services for you or functions on your behalf 

satisfies the provisions of § 314.4(d), 

even if the contract does not include a 

requirement that the service provider 

maintain appropriate safeguards, as 

long as you entered into the contract 

not later than June 24, 2002. 

PART 315—CONTACT LENS RULE 

Sec. 

315.1 Scope of regulations in this part. 

315.2 Definitions. 

315.3 Availability of contact lens prescriptions to patients. 

315.4 Limits on requiring immediate payment. 

315.5 Prescriber verification. 

315.6 Expiration of contact lens prescriptions. 

315.7 Content of advertisements and other 

representations. 

315.8 Prohibition of certain waivers. 

315.9 Enforcement. 

315.10 Severability. 

315.11 Effect on state and local laws. 

AUTHORITY: Pub. L. 108–164, secs. 1–12; 117 

Stat. 2024 (15 U.S.C. 7601–7610). 

SOURCE: 69 FR 40508, July 2, 2004, unless 

otherwise noted. 

§ 315.1 Scope of regulations in this 

part. 

This part, which shall be called the 

‘‘Contact Lens Rule,’’ implements the 

Fairness to Contact Lens Consumers 

Act, codified at 15 U.S.C. 7601–7610, 

which requires that rules be issued to 

address the release, verification, and 

sale of contact lens prescriptions. This 

part specifically governs contact lens 

prescriptions and related issues. Part 

456 of Title 16 governs the availability 

of eyeglass prescriptions and related 

issues (the Ophthalmic Practice Rules 

(Eyeglass Rule)). 

434