{"page":"/blog/card-networks-glba-coverage","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Reading","What it holds","What it relies on","What it means for a design"],"rows":[["Reading 1: the network as service provider","A network that only processes transactions for issuers and acquirers has no consumer relationship of its own. Its privacy duties come from its contracts with issuers and from the reuse limits that travel with the data.","The definition of consumer in 1016.3(e); 1016.11, 1016.13 and 1016.14","The issuer's contract and the route of disclosure decide what the network may do"],["Reading 2: the network as financial institution","Processing financial data is itself a financial activity, so a network entity can be a financial institution in its own right under the Federal Trade Commission's rules. The Safeguards Rule then applies directly to the customer information it holds, even where notice and opt-out duties do not arise.","The activity-based definition; 16 CFR 314.1(b)","Security duties attach by rule, not only by contract; privacy duties still follow the route"],["A different position","A network that also issues cards through its own bank has consumers and customers of its own for that business.","The definitions of consumer and customer","Issuer rules apply to the issuing business"]],"sourceUrls":[[],[],[]]}