{ "body_html": "

Consumer Privacy and Information Security

\n

Customer data has three tiers. Restricted data — government IDs, SSNs, check images, transaction records, SAR/CTR workpapers — must be encrypted. Only you and designated personnel may access it. Confidential data — customer names, contact info, risk ratings, cashing history — is limited to staff with a documented need to know. Internal data uses standard employee access controls.

\n

Access management:

\n
    \n
  1. Assign access based on each employee's role and operational need. Prohibit shared credentials.
    2. \n
  2. Revoke access within 24 hours of termination or role change.
    3. \n
\n

Privacy notices:

\n
    \n
  1. Provide each customer an initial privacy notice at their first transaction.
    2. \n
  2. Provide annual notices to all customers. The notice must identify: categories of nonpublic personal information collected; parties it may be shared with; and opt-out rights.
    3. \n
  3. Honor opt-out requests within 30 days.
    4. \n
\n

Ongoing security:

\n
    \n
  1. Review access logs for all systems holding customer or compliance data monthly. Investigate anomalies.
    2. \n
  2. Apply antivirus, firewall, and patch management to all systems processing nonpublic personal information.
    3. \n
  3. Apply critical security patches within 72 hours of release.
    4. \n
  4. Review the information security program annually and after any material change in operations or systems.
    5. \n
\n

Security incidents:

\n
    \n
  1. Immediately assess scope and isolate affected systems.
    2. \n
  2. Engage legal counsel within 24 hours.
    3. \n
  3. If the incident affects 500 or more Florida residents, notify the Florida Department of Legal Affairs within 30 days of breach determination.
    4. \n
  4. Send written notice to affected individuals within the statutory deadline.
    5. \n
  5. Document all response actions and remediation steps. Retain for five years.
    6. \n
  6. If the breach involved exploitation of customer accounts to facilitate financial crime, file a SAR.
    7. \n
\n

Vendors:

\n
    \n
  1. Before sharing nonpublic personal information with any service provider, execute a written data security agreement requiring safeguards consistent with federal requirements.
    2. \n
  2. Do not share check images with third parties except as required by law or under a qualifying data security agreement.
    3. \n
  3. Review vendor security controls annually and at each contract renewal. Replace vendors that cannot demonstrate adequate controls.
    4. \n
\n

Record disposal:

\n
    \n
  1. When retention periods expire, destroy nonpublic personal information so it cannot be reconstructed.
    2. \n
  2. Cross-cut shred paper. Electronically wipe or physically destroy digital media using a certified process.
    3. \n
  3. Log and verify each disposal.
    4. \n
", "narration_text": "Customer data has three tiers. Restricted data — government IDs, SSNs, check images, transaction records, SAR/CTR workpapers — must be encrypted. Only you and designated personnel may access it. Confidential data — customer names, contact info, risk ratings, cashing history — is limited to staff with a documented need to know. Internal data uses standard employee access controls.\r\n\r\nAccess management:\r\nAssign access based on each employee's role and operational need. Prohibit shared credentials.\r\nRevoke access within 24 hours of termination or role change.\r\n\r\nPrivacy notices:\r\nProvide each customer an initial privacy notice at their first transaction.\r\nProvide annual notices to all customers. The notice must identify: categories of nonpublic personal information collected; parties it may be shared with; and opt-out rights.\r\nHonor opt-out requests within 30 days.\r\n\r\nOngoing security:\r\nReview access logs for all systems holding customer or compliance data monthly. Investigate anomalies.\r\nApply antivirus, firewall, and patch management to all systems processing nonpublic personal information.\r\nApply critical security patches within 72 hours of release.\r\nReview the information security program annually and after any material change in operations or systems.\r\n\r\nSecurity incidents:\r\nImmediately assess scope and isolate affected systems.\r\nEngage legal counsel within 24 hours.\r\nIf the incident affects 500 or more Florida residents, notify the Florida Department of Legal Affairs within 30 days of breach determination.\r\nSend written notice to affected individuals within the statutory deadline.\r\nDocument all response actions and remediation steps. Retain for five years.\r\nIf the breach involved exploitation of customer accounts to facilitate financial crime, file a SAR.\r\n\r\nVendors:\r\nBefore sharing nonpublic personal information with any service provider, execute a written data security agreement requiring safeguards consistent with federal requirements.\r\nDo not share check images with third parties except as required by law or under a qualifying data security agreement.\r\nReview vendor security controls annually and at each contract renewal. Replace vendors that cannot demonstrate adequate controls.\r\n\r\nRecord disposal:\r\nWhen retention periods expire, destroy nonpublic personal information so it cannot be reconstructed.\r\nCross-cut shred paper. Electronically wipe or physically destroy digital media using a certified process.\r\nLog and verify each disposal." }