# Are card networks covered by GLBA, and what does that mean for their advertising data?

## Where readings differ

| Reading | What it holds | What it relies on | What it means for a design |
|---|---|---|---|
| Reading 1: the network as service provider | A network that only processes transactions for issuers and acquirers has no consumer relationship of its own. Its privacy duties come from its contracts with issuers and from the reuse limits that travel with the data. | The definition of consumer in 1016.3(e); 1016.11, 1016.13 and 1016.14 | The issuer's contract and the route of disclosure decide what the network may do |
| Reading 2: the network as financial institution | Processing financial data is itself a financial activity, so a network entity can be a financial institution in its own right under the Federal Trade Commission's rules. The Safeguards Rule then applies directly to the customer information it holds, even where notice and opt-out duties do not arise. | The activity-based definition; 16 CFR 314.1(b) | Security duties attach by rule, not only by contract; privacy duties still follow the route |
| A different position | A network that also issues cards through its own bank has consumers and customers of its own for that business. | The definitions of consumer and customer | Issuer rules apply to the issuing business |

**Where the readings collide.** The same group can house transaction processing, an issuing bank and a media product in different entities. Counsel can examine which of them held the data and who decided to reuse it. The labels aggregated and anonymized also depend on which fields leave and what a recipient can match.

## Questions to take to your counsel

1. Which entity is our counterparty, and is it a financial institution under GLBA for this activity?
2. Under which Regulation P route did the data reach the network, and what reuse does that route allow?
3. What does our contract say about the network's own use of transaction data?
4. What standard does "aggregated" or "anonymized" meet, and who tested it?
5. Which state privacy laws apply to data outside the GLBA exemption?
6. Which security rule applies to each party: the Safeguards Rule, banking-agency guidelines, payment-card standards, or several?

[Read the full checkpoint](https://adsovereign.com/blog/card-networks-glba-coverage) · [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/)