The regulations under 16 CFR Part 314, published in May 2002 (May 23 Federal Register, p. 346484), stem from the Gramm-Leach-Bliley Act (the GLB Act or the Act) which was enacted in 2000 to repeal Depression-era restrictions prohibiting banks from engaging in “risky” financial practices under the Glass-Steagall Act.

The law mandates extensive new privacy protections for consumers. The GLB Act requires financial institutions to take steps to ensure the security and confidentiality of customer records, such as names, addresses, phone numbers, bank and credit card account numbers, income and credit card account numbers, income and credit histories, and Social Security numbers.

Colleges and universities are deemed to be in compliance with the privacy provisions of the GLB Act if they are in compliance with the Family Educational Rights and Privacy Act (FERPA). However, higher education institutions are subject to the provisions of the Act related to the administrative, technical and physical safeguarding of customer information.

How does GLB differ from FERPA? Both the GLB Act and FERPA have specific requirements regarding privacy of customer financial information. The difference however, is that the GLB Act has requirements pertaining to the actual administrative, technical and physical safeguarding of the customer financial information.

The Gramm-Leach-Bliley Act (GLB), the Family Educational Rights and Privacy Act (FERPA) and other applicable federal and state laws require the academy to protect the privacy of certain personal health information, financial records, educational records and personal customer information. It is the intent of the academy to comply with all applicable provisions of these laws.

Employees shall abide by and follow all Academy Policies, Procedures and workplace rules regarding the safeguarding of such information and shall take all necessary and required measures to otherwise protect private information created, collected, maintained, transmitted or stored by or for the Academy.

Individuals who believe their privacy rights have been violated may file a complaint with the Campus Director in person or at jarrell@ssag.edu.

The Gramm-Leach-Bliley Act (Public Law 106-102) provides consumers the right to the protection of their nonpublic Personally Identifiable Information (PII) and requires financial institutions possessing such information about consumers to publish a privacy policy.

General Privacy Policy

SSAG carefully protects all nonpublic personal information in our possession regarding students and their families. The academy will not release nonpublic, private, personal, or financial information about our students or applicants to any third party, except as specifically provided in this policy. The academy will release certain nonpublic personal information to federal and state agencies, government contractors, student loan providers/servicers, and other parties as necessary for the administration of the federal student aid programs, for enforcement purposes, for litigation, and for use in connection with audits or other investigations. Disclosure is permitted to law enforcement or emergency services agencies in the performance of their duties or when student safety or health may be in jeopardy. The academy will not sell or otherwise make available personal information for marketing purposes to any third party at any time.

Protection of Personally Identifiable Information

The academy employs office procedures and password-protected computer systems to ensure the security of paper and electronic records. The academy does not disclose specifics of its internal security procedures to students or the public to protect the effectiveness of those procedures.

Access to social security numbers and other Personally Identifiable Information (PII) is strictly limited to those academy officials with a need-to-know. Each employee is responsible for enforcement of this policy regarding the information within his/her office. The Campus Director will be responsible for overall control of information release and will resolve any disagreements and make final decisions as necessary in accordance with this Policy.

The academy computer information systems are an important asset that is critical to providing an effective and comprehensive learning environment, openly communicating ideas, providing outstanding community service, and supporting the academy’s operations. This information includes sensitive and personal student, faculty, and staff data as well as the academy’s operational data. To maintain effectiveness and protect individuals, the academy’s information assets must be protected from misuse, unavailability, destruction, and unauthorized disclosure or modification. The leadership of academy is committed to protecting the value of the academy’s information assets. The academy’s Third-party IT Company is charged with establishing and maintaining a program that preserves the confidentiality, integrity, and availability of information and information systems. This responsibility is addressed by:

• Continually assessing risks and defining appropriate protection strategies
• Complying with applicable legal and regulatory requirements
• Protecting the reputation, image and competitive advantage of the academy
• Supporting the academy’s strategic mission and goals
• Maintaining partnership with administrative units, faculty, and staff to ensure a collaborative approach to information security

Our third-party IT company deals with numerous threats and challenges including data loss or theft, malicious software (e.g., viruses, worms, Trojan horses), identity theft, social engineering, phishing scams, and risks associated with new technologies. Security measures also must be implemented to comply with several laws and regulations that address student information (FERPA), financial information, individuals’ privacy data and individuals’ health information. The third-party IT company offers a wide range of products and services to address information security risks and requirements. These offerings are designed to balance strategic, tactical, and operational needs, and they include the following specific products and services:

• Security policies, procedures, standards, and methodologies
• Security awareness and training
• Legal and regulatory compliance
• Security strategy, architecture, and technologies (including technologies to protect against malicious software)
• Technical system configurations and vulnerability management
• Response to information security incidents or breaches
• Security requirements for software development and acquisition
• Disaster recovery and continuity planning

Any suspected information security breach or issue should be reported immediately to the academy’s Campus Director.

The Family Educational Rights and Privacy Act (FERPA) affords eligible students certain rights with respect to their education records. (An “eligible student” under FERPA is a student who is 18 years of age or older or who attends a postsecondary institution at any age.) These rights include:

1. The right to inspect and review the student’s education records within 45 days after the day the Summit Salon Academy – Gainesville receives a request for access. A student should submit to the Campus Director, a written request that identifies the record(s) the student wishes to inspect. The Campus Director will plan for access and notify the student of the time and place where the records may be inspected. If the records are not maintained by the school official to whom the request was submitted, that official shall advise the student of the correct official to whom the request should be addressed.
2. The right to request the amendment of the student’s education records that the student believes is inaccurate, misleading, or otherwise in violation of the student’s privacy rights under FERPA.A student who wishes to ask the school to amend a record should write the school official responsible for the record, clearly identify the part of the record the student wants changed and specify why it should be changed.If the academy decides not to amend the record as requested, the academy will notify the student in writing of the decision and the student’s right to a hearing re­garding the request for amendment. Additional information regarding the hearing procedures will be provided to the student when notified of the right to a hearing.
3. The right to provide written consent before the academy discloses personally identifiable information (PII) from the student’s education records, except to the extent that FERPA authorizes disclosure without consent.The academy discloses education records without a student’s prior written consent under the FERPA exception for disclosure to school officials with legitimate educational interests. A school official is typically including a person employed by the academy in an administrative, supervisory, academic, research, or support staff position (including law enforcement unit personnel and health staff); a person serving on the board of trustees; or a student serving on an official committee, such as a disciplinary or grievance committee. A school official also may include a volunteer or contractor outside of the academy who performs an institutional service of function for which the school would otherwise use its own employees and who is under the direct control of the school with respect to the use and maintenance of PII from education records, such as an attorney, auditor, or collection agent or a student volunteering to assist another school official in performing his or her tasks. A school official typically has a legitimate educational interest if the official needs to review an education record to fulfill his or her professional responsibilities for the academy.
4. The right to file a complaint with the U.S. Department of Education concerning alleged failures by the academy to comply with the requirements of FERPA. The name and address of the office that administers FERPA is:

• Family Policy Compliance Office
• U.S. Department of Education
• 400 Maryland Avenue, SW
• Washington, DC 20202

1. FERPA permits the disclosure of PII from students’ education records, without consent of the student, if the disclosure meets certain conditions found in § 99.31 of the FERPA regulations. Except for disclosures to school officials, disclosures related to some judicial orders or lawfully issued subpoenas, disclosures of directory information, and disclosures to the student, § 99.32 of FERPA regulations requires the institution to record the disclosure. Eligible students have a right to inspect and review the record of disclosures. A postsecondary institution may disclose PII from the education records without obtaining prior written consent of the student —
   • To other school officials, including teachers, within the academy whom the school has determined to have legitimate educational interests. This includes contractors, consultants, volunteers, or other parties to whom the academy has outsourced institutional services or functions, provided that the conditions listed in § 99.31(a)(1)(i)(B)(1) – (a)(1)(i)(B)(3) are met. (§ 99.31(a)(1)) To authorized representatives of the U. S. Comptroller General, the U.S. Attorney General, the U.S. Secretary of Education, or State and local educational authorities, such as a State postsecondary authority that is responsible for supervising the university’s State-supported education programs. Disclosures under this provision may be made, subject to the requirements of §99.35, in connection with an audit or evaluation of Federal- or State-supported education programs, or for the enforcement of or compliance with Federal legal requirements that relate to those programs. These entities may make further disclosures of PII to outside entities that are designated by them as their authorized representatives to conduct any audit, evaluation, or enforcement or compliance activity on their behalf. (§§ 99.31(a)(3) and 99.35)
   • In connection with financial aid for which the student has applied or which the student has received, if the information is necessary to determine eligibility for the aid, determine the amount of the aid, determine the conditions of the aid, or enforce the terms and conditions of the aid. (§ 99.31(a)(4))
   • To organizations conducting studies for, or on behalf of, the school, to: (a) develop, validate, or administer predictive tests; (b) administer student aid programs; or (c) improve instruction. (§ 99.31(a)(6))
   • To accrediting organizations to carry out their accrediting functions. (§ 99.31(a)(7))
   • To comply with a judicial order or lawfully issued subpoena. (§ 99.31(a)(9))
   • To appropriate officials in connection with a health or safety emergency, subject to § 99.36. (§ 99.31(a)(10))
   • To a victim of an alleged perpetrator of a crime of violence or a non-forcible sex offense, subject to the requirements of § 99.39. The disclosure may only include the results of the disciplinary proceeding with respect to that alleged crime or offense, regardless of the finding. (§ 99.31(a)(13))
   • To the public, the results of a disciplinary proceeding, subject to the requirements of § 99.39, if the school determines the student is an alleged perpetrator of a crime of violence or non-forcible sex offense and the student has committed a violation of the school’s rules or policies with respect to the allegation made against him or her. (§ 99.31(a)(14))