Reference no: EM133812271

Question

The non-affiliated third party rule fails to adequately protect consumers, as evidenced by recent cases where consumers were still misled about product details. For example, in a case involving a financial advisory service, clients were not informed that their data would be shared with an unrelated marketing company. The lack of transparency has resulted in the unauthorized use of individuals' personal information. This happens because the existing regulation lacks adequate disclosure protections to safeguard consumer interests. As a result, it is unlikely that this rule will hold up under legal scrutiny as a reliable protective measure for disclosure protection.

The case "In re TJX Companies Retail Securities Breach Litigation" pertains to credit card security and the definition of a nonaffiliated third party. In this instance, hackers infiltrated TJX, a retail organization, to obtain personal and financial information from customers. They retrieved credit card transaction data and exploited it for unauthorized purchases, leading to fraudulent transactions. As a result, the banks that issued these cards lost money.

The issuing banks claimed that TJX, was a non-affiliated third party subject to the GLB Act. However, the court disagreed. It noted that customers choose whether to share their personal information with TJX. Only when customers decided to share did the banks pass the information to TJX. Therefore, the court decided that TJX did not get private financial information from the issuing banks. Instead, TJX received the information directly from the customers. Since the banks didn't share customer information with TJX, TJX couldn't be considered a third party under the GLB Act.