Gramm–Leach–Bliley Act

Yeah, it really does.

Because from the corporate side, you have federal privacy laws, specifically the Gramm-Leach-Plyley Act, or GLBA.

This federal act absolutely terrifies banking compliance departments.

Oh, completely.

It is crazy.

To the bank's risk management team and to the client, that paper journal looks like a massive analog data breach waiting to happen.

It is a massive collision of compliance regimes because on the exact opposite side of the federal GLBA, you have state level transparency laws regarding public officers.

If you look at states outside of New York, like Texas or California, notary journals are often considered public records.

Yeah.

And also the Financial Services Modernization Act, which was a year before.

I think that may even be a little bit closer to what we're discussing because, you know, it was a midterm election.

It took 20 years essentially to get this bill passed.

So we do deal with a lot of, I kind of like to break those compliance related questions down into two buckets.

So there's kind of two things that compliance and kind of teams that, you know, privacy teams deal with, right? The first is external factors, which are the alphabet soup of, you know, GDPR, CPRA, GLBA, you know, all that kind of stuff.

And then there is the internal policies, right, that are about, you know, IP protection.

They're about, you know, HR record management, records and retention management, you know, and then there's all sorts of stuff that you have to do there.

Here, what happens instead is you've basically told our platform, Astralis, the laws you care about.

We care about the GDPR, the CCPA, FCRA regulations, GLBA and PCI DSS, let's just say.

And so it has a notion of what you care about.

You've given it past assessments, so it understands how you think about decisions that you make.

And so I share, however, with the administrative assistants that, I mean, meanwhile, this was the outplacing firm that I had used off and on over the years, and after I left one of the major accounting firms for whom I'd done, or for which I'd done mergers and acquisitions, and had some very, very large clients with which I'd been involved in working on mergers on behalf of the accounting firm for these clients.

And this is before the current financial legislation known as Sarbanes-Oxley and even before Gramm-Leach-Bliley legislation.

But I share with them I'm a little embarrassed I'm not sending my resume to potential employers.

I explained to them that morning I'd heard the explosive news Up through Sixth World Trade, I was opposing what they call the Patriot Act because I knew it was all predicated on utter fraud.

My background is I had a startup that I started up that I was a CTO over.

I was an early CISO for a bank and had to build a security program for Gramm-Leach-Bliley from scratch, including audit and DR and the whole nine yards program.

translated that into a Fortune 500 role where I was a chief architect and then a deputy CISO and did a lot of worldwide implementations of security and eventually transitioning that to the cloud and learned a lot of lessons through that.

That all eventually ended me up at AWS where I wanted to be back on the cutting edge.

There are a number of exceptions under this.

The folks that are subject to the Gramm-Leach-Bliley Act, HIPAA, other kind of regulatorily mandated collection requirements, right, are going to be accepted out of this.

It's a very broad scope.

It's broad definitions around who can wind up being defined as a data broker that must register with the state.