Suppose you are the treasurer of a student club and you store records of club members’ payments in a database.

In the past, members have disputed payment amounts;

therefore, when you receive a payment, you scan an image of the check or credit card invoice and store the scanned image in a database.

One day, you are using your computer in a local wireless coffee shop and a malicious student breaks into your computer over the wireless network and steals the club database. You know nothing about this until the next day, when a club member complains that a popular student Web site has published the names, bank names, and bank account numbers for everyone who has given you a check.
What liability do you have in this matter? Could you be classified as a financial institution because you are taking students’ money? (You can find the GLB at http://
business.ftc.gov/privacy-and-security/gramm-leach-blileyact.) If so, what liability do you have? If not, do you have any other liability? Does the coffee shop have a liability?