OPINION OF THE COURT
Carolyn E. Demakest, J.In this action alleging, inter alia, breach of fiduciary duties, unfair competition, misappropriation of trade secrets, unlawful use of proprietary and confidential client information, and tortious interference with current and prospective business relations, and seeking damages, injunctive relief, and an accounting, plaintiff Alpha Funding Group, Inc. and third-party defendant Michael Levitis move for an order, pursuant to CPLR 3126, striking the answer of defendants Continental Funding, LLC and Igor Kanfer also known as Gary Kanfer (Igor Kanfer), Eugene Gertskis, Allen Kaplan, Yevgeniy Khodov, Allan Neyman, Milan Schwartz, Arthur Gorenshteyn, Daniel Kanfer, Alexander Kofman, Tair Yakubov, and Alfia Coglitor (the individual defendants) (collectively, defendants) due to their refusal or failure to respond to their discovery demands and interrogatories. Alpha and Levitis seek, in the alternative, an order, pursuant to CPLR 3126, precluding defendants from offering any evidence with respect to liability based upon their refusal or failure to respond to said discovery demands and interrogatories, or an order, pursuant to CPLR 3124 and 3126, compelling defendants to respond in good faith to these discovery demands and interrogatories. Alpha and Levitis further seek an order compelling defendants to produce a privilege log, and an order granting Alpha an extension of the time to file its note of issue. Defendants cross-move, pursuant to CPLR 3103, for a protective order with respect to Alpha and Levitis’ discovery demands and interrogatories.
Alpha is a corporation, formed in 2003, which is engaged in the mortgage brokerage business. It performs brokerage and consulting services for clients seeking financial lending for residential and commercial real estate acquisitions. Levitis is Alpha’s president. Igor Kanfer was a key employee and executive vice-president of Alpha, who allegedly had unrestricted access to Alpha’s proprietary and confidential client information, including the contact and/or key person for each client, the nature and extent of the client’s business activities with Alpha, plans and information in connection with ongoing work for the clients, and information regarding prospective work for the clients. Schwartz, Khodov, Kaplan, Neyman, and Gertskis were *961employed by Alpha as team leaders; Daniel Kanfer, Kofman, Yakubov, and Gorenshteyn were employed by Alpha as loan officers; and Coglitor was employed by Alpha as a loan processor.
Alpha asserts that, on April 28, 2006, Igor Kanfer informed Levitis that he was leaving Alpha to work for Continental, a competitor in the mortgage business, since Continental had offered him a portion of the closing costs as an incentive, a commission structure, and other incentives. Alpha further asserts that Igor Kanfer also informed Levitis that unless Alpha matched Continental’s offer, he and the other individual defendants would leave Alpha to work for Continental. When Alpha declined (on the same date), Igor Kanfer and the other individual defendants left Alpha’s employment. According to Alpha, when the individual defendants departed from Alpha, they copied and removed its proprietary and confidential client information. Alpha claims that the individual defendants have breached their fiduciary duties to it by soliciting its other employees to engage in the same business as it, diverting away its business opportunities, misappropriating its trade secrets and/or proprietary and confidential information regarding its clients (during and subsequent to their employment by it), competing unfairly with it, using its client information in order to develop a competing business (during and subsequent to their employment by it), and soliciting its clients by using its trade secrets and/or proprietary and confidential client information to which they had access solely as a result of their employment by it.
On May 2, 2006, Alpha filed this action against defendants. Alpha’s complaint alleges nine causes of action against defendants, including claims for breach of fiduciary duty, unfair competition, misappropriation of trade secrets and proprietary and confidential client information, and tortious interference with current and prospective business relations. It seeks damages, an accounting, and injunctive relief. On August 11, 2006, defendants interposed an answer to Alpha’s complaint, asserting counterclaims against Alpha, and they commenced a third-party action against Levitis. On September 26, 2006, Levitis served an answer to defendants’ third-party complaint, and Alpha served its reply to defendants’ counterclaims.
On December 8, 2006, Alpha and Levitis served their first set of interrogatories upon the individual defendants, their first set of interrogatories upon Continental, and their first request for the production of documents upon defendants. On March 14, 2007, defendants provided their first responses to Alpha and Le*962vitis’ first request for the production of documents. On March 16, 2007, the individual defendants served their first responses to Alpha’s and Levitis’ first set of interrogatories, and Continental served its first responses to Alpha and Levitis’ first set of interrogatories. By letter dated March 21, 2007, Alpha and Levitis asserted objections to defendants’ responses to document request numbers 2, 3, 4, 6, 7, 15, 16, 27, 29, 30, 38, and 39, and Continental’s responses to interrogatory numbers 7, 8, 13, 14, 15, and 16. Defendants also did not respond to document request number 40, and Alpha and Levitis’ letter noted that defendants provided no information in connection with the closing statements, United States Department of Housing and Urban Development forms (HUD-Is), or other loans documents for the clients at Continental for the time period from January 1, 2006 through December 1, 2006.
On May 21, 2007, Continental served a second set of responses to Alpha and Levitis’ first set of interrogatories, and defendants served second responses to Alpha and Levitis’ first request for the production of documents. Continental, in its second responses to the first set of interrogatories, responded to interrogatory number 7 (by referring to exhibit D in defendants’ second responses to the production of documents) and interrogatory number 8 (by referring to exhibit A in defendants’ first responses to the production of documents). It also responded to interrogatory number 15. Defendants, in their second responses to Alpha and Levitis’ first request for the production of documents, responded to document request number 2 (by referring to exhibit B of their responses to the first set of document requests), and document request numbers 7, 27, 29, and 30 (by referring to exhibit A of their responses to the first set of document requests).
Continental, however, in its second response to the first set of interrogatories, did not provide responses to interrogatory numbers 13, 14, and 16. Interrogatory number 13 demands that Continental identify any former client of Alpha who became a client of Continental, was serviced by Continental, or from which Continental received a fee for providing loan brokerage or lending services from January 2006 to December 2006. Interrogatory number 14 requests that Continental identify any former client of Alpha who contacted Continental or was referred to Continental from January 2006 to December 2006. Interrogatory number 16 demands that Continental identify any former client of Alpha who became a client of Continental from Janu*963ary 2006 to December 2006. Continental, in its second response to Alpha and Levitis’ first set of interrogatories, objected to interrogatory numbers 13, 14, and 16 on the grounds that the information sought is overbroad, unduly burdensome, and not relevant to the subject matter involved in this action and/or is not reasonably calculated to lead to the discovery of admissible evidence. It further objected to these interrogatories on the ground that the information sought contains confidential information.
Defendants, in their second response to Alpha and Levitis’ first request for the production of documents, did not provide the documents requested by document request numbers 3, 4, 6, 15, 16, 38, 39, and 40. Document request numbers 3 and 4 demand any and all employment manuals of Continental from January 1, 2006 to the present, and any and all pamphlets, bulletins, and stationery of Continental from January 1, 2006 to the present. Document request number 6 seeks any and all documents concerning the number of loans that Continental closed each month from January 1, 2006 to December 1, 2006. Document request number 15 demands any and all documents concerning how payments were made to any individual defendant, including copies of all checks paid by Continental to any individual defendant. Document request number 16 requests any and all documents, including, but not limited to, tax returns, general ledgers, accounts payable, and account receivables, of Continental from January 1, 2006 to December 1, 2006. Document request numbers 38 and 39 demand any and all documents of new mortgages at Alpha or refinancing loans, originated, marketed, secured, or closed by defendants, and any and all documents of new mortgages at Alpha concerning all loans, originated, marketed, secured, or closed by defendants, respectively. Document request number 40 seeks any and all documents or loans originated, marketed, secured, and closed by defendants from January 1, 2006 to December 1, 2006.
Defendants, in their second response to Alpha and Levitis’ first request for the production of documents, objected to document request numbers 3, 4, 6, 15, and 16 on the grounds that the information sought is overbroad, unduly burdensome, and not relevant to the subject matter involved in this action, and is not reasonably calculated to lead to the discovery of admissible evidence. They additionally objected to document request numbers 6, 15, and 16 on the ground that the information sought contains confidential information, and, with respect to document request number 16, that the documents contain trade *964secrets. They objected to document request numbers 38 and 39 to the extent that Alpha and Levitis seek documents not in their possession, custody, or control.
Following these responses, Alpha and Levitis brought the instant motion, asserting that defendants’ responses to their demands were inadequate. They argue that the disclosure sought is material and necessary to their claims, and that penalties should be imposed upon defendants for their failure to provide adequate responses to their demands, or, alternatively, that the court should compel defendants to respond to their demands. Defendants, in turn, have brought the cross motion for a protective order, pursuant to CPLR 3103 (a), which permits the court to make a protective order limiting the use of any disclosure device.
In support of their cross motion for a protective order, defendants argue that federal law, namely, the Gramm-Leach-Bliley Act (the GLBA) and the regulations issued thereunder, prohibit them from disclosing the information requested by interrogatory numbers 13, 14, and 16 and document request numbers 6 and 16. The GLBA was enacted to provide procedures for financial institutions
“(1) to insure the security and confidentiality of consumer records and information;
“(2) to protect against any anticipated threats or hazards to the security or integrity of such records; and
“(3) to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer” (15 USC § 6801 [b]).
The GLBA, therefore, requires a financial institution to give its customers notice and an opportunity to opt out of disclosure before releasing any customer’s “nonpublic personal information to a nonaffiliated third party” (15 USC § 6802 [b] [1]). The Federal Trade Commission has promulgated regulations to implement the provisions of the GLBA (16 CFR 313.1-318.18). 16 CFR 313.10 (a) provides that the financial institution may not disclose any nonpublic personal information (see 16 CFR 313.3 [n]) about a consumer to a nonaffiliated third party (see id.) unless it has provided to the consumer an initial notice, an opt-out notice, and has given the consumer a reasonable opportunity to opt out of the disclosure and the consumer does not opt out.
16 CFR 313.1 (b) provides that 16 CFR part 313 applies to “those ‘financial institutions’. . . over which the Federal Trade *965Commission . . . has enforcement authority pursuant to Section 505(a)(7) of the [GLBA],” which includes “mortgage brokers” (see 16 CFR 313.3 [k] [2] [xi]). Thus, Continental qualifies as a “financial institution” under the GLBA. Defendants contend that Alpha and Levitis’ disclosure requests include demands for personal financial information concerning Continental’s clients and/or a list or description of Continental’s clients that are not available to the public and constitute the “nonpublic personal information” of Continental’s customers which the GLBA and its regulations prohibit them from disclosing (see 15 USC § 6809 [4]; 16 CFR 313.3 [o]). They note that a HUD-1 (demanded by Alpha and Levitis) contains the mortgage insurance case name, and the names and addresses of the borrower, seller, and lender, which is nonpublic information (see 16 CFR 313.1, 313.3 [n]). In addition, it is undisputed that Alpha is a “nonaffiliated third party” (16 CFR 313.3 [m] [1]). Continental thus argues that in order to disclose the nonpublic personal information to Alpha, a nonaffiliated third party, sought by Alpha and Levitis’ discovery demands, it would have to obtain the consent of each and every client, a burdensome task, or else it is prohibited, by the GLBA, from disclosing the information demanded. Defendants, therefore, contend that if they were to provide the information demanded by Alpha and Levitis’ disclosure requests, they would violate the GLBA and its regulations.
Insofar as the GLBA requires a financial institution to maintain the confidentiality of customer information, it poses an obvious conflict with the broad scope of discovery contemplated by CPLR 3101. However, the opt-out requirement of the GLBA is subject to express exceptions, set forth in 15 USC § 6802 (e) (8), which permit financial institutions to disclose nonpublic personal customer information to a nonaffiliated entity when necessary to
“comply with Federal, State, or local laws, rules, and other applicable legal requirements; to comply with a properly authorized civil, criminal, or regulatory investigation or subpoena or summons by Federal, State, or local authorities; or to respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.”
16 CFR 313.15 (a) (7) (iii) similarly provides for an exception to *966the opt-out requirement “[t]o respond to judicial process or government regulatory authorities having jurisdiction over [the financial institution] for examination, compliance, or other purposes as authorized by law.”
While no New York court has yet addressed the issue of whether the disclosure of nonpublic personal information to a nonaffiliated third party to comply with civil discovery is permitted by 15 USC § 6802 (e) (8), the courts that have addressed it have concluded that the GLBA should not bar a proper discovery request so long as the disclosure is made subject to an appropriate protective order (see Marks v Global Mtge. Group, Inc., 218 FRD 492, 495-497 [SD W Va 2003]; Ex parte Mutual Sav. Life Ins. Co., 899 So 2d 986, 992-993 [Ala 2004]; Martino v Barnett, 215 W Va 123, 129, 595 SE2d 65, 71 [2004]).* Thus, the opt-out provision does not apply to situations in which disclosure of the confidential information is necessary to “respond to judicial process or government regulatory authorities having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law” (15 USC § 6802 [e] [8]; see also Chao v Community Trust Co., 2005 WL 1084619, *3, 2005 US Dist LEXIS 8409, *7 [ED Pa, May 5, 2005]; Arbor Place, L.P. v Encore Opportunity Fund, LLC, 2002 WL 205681, *4, 2002 Del Ch LEXIS 102, *11 [Jan. 29, 2002]). The court finds the reasoning and holdings of these courts regarding a “judicial process” exception to the GLBA persuasive and compelling. *967Therefore, the court concludes that the GLBA (15 USC § 6802 [e] [8]; 16 CFR 313.15) allows the use of judicial process expressly authorized by statute (i.e., the CPLR) to permit a financial institution, such as Continental, to disclose the nonpublic personal financial information of its customers to comply with a discovery request (see Marks, 218 FRD at 495-497; Martino, 215 W Va at 129, 595 SE2d at 71).
“Furthermore, even if the GLBA included no exception for civil discovery, the mere fact that a statute generally prohibits the disclosure of certain information does not give parties to a civil dispute the right to circumvent the discovery process” (Marks, 218 FRD at 496; see also Laxalt v McClatchy, 809 F2d 885, 889 [DC Cir 1987]; Freeman v Seligson, 405 F2d 1326, 1349 [DC Cir 1968]). “In the absence of a specific prohibition against disclosure' in judicial proceedings, such as Congress set forth in some statutes, clear and strong indication is required before it may be implied that the policy of prohibition is of such force as to dominate the broad objective of doing justice” (Freeman, 405 F2d at 1348). “The GLBA . . . does not clearly prohibit the disclosure of information for discovery purposes; in fact, the [GLBA] permits disclosures made to respond to judicial process” (Marks, 218 FRD at 497). Consequently, the GLBA does not prohibit disclosure herein and the CPLR governs the disclosure of information protected by the GLBA.
Defendants further argue, however, that Continental is contractually bound not to disclose the information demanded since it issues privacy policy notice and authorization release information forms under which, unless the client consents to disclose nonpublic personal information, the information cannot be disclosed. Such argument is unavailing. The privacy policy notice simply sets forth that it is “provided to [the client] pursuant to the [GLBA] and the Federal Trade Commission's] implementation regulation thereunder, 16 CFR Part 313,” and it explains that restriction. Thus, it does not provide for any further contractual restrictions upon disclosure than those provided under the GLBA. In addition, the authorization to release information form does not contractually restrict disclosure, but, instead, merely authorizes “To Whom It May Concern” to release clients’ information to Continental in connection with their loan applications.
Access to the information a party may seek, however, is not without restriction. This court recognizes that “Congress has expressed a strong interest in protecting the privacy of consum*968ers’ financial information” (Marks, 218 FRD at 497). “[T]he judicial process exception to the general privacy purposes of the GLBA does not provide a license to undercut the express interest of Congress in protecting the privacy of consumers’ financial information” (Martino, 215 W Va at 130, 595 SE2d at 72). “[T]he expressed congressional ‘strong interest in protecting the privacy of consumers’ financial information’ has to be weighed by the courts when determining whether to issue protective orders and developing the content of those orders” (Martino, 215 W Va at 130, 595 SE2d at 72, quoting Marks, 218 FRD at 497). As noted above, CPLR 3103 (a) provides that the courts may make protective orders limiting the use of any disclosure device, and the courts must exercise their broad discretion to fashion judicial protective orders and similar safeguards.
Here, the parties have fully discussed the issues regarding the confidential nature of the information to be provided, and they negotiated, over a two-month period, a confidentiality agreement, which the parties’ attorneys have executed. The confidentiality agreement provides, inter alia, that each party may designate as confidential any document or other information pertaining to the financial, banking, tax, and any other records, given during discovery in connection with this action, and it limits the disclosure of these documents or information to the court and certain designated “qualified persons,” which includes the court, counsel and staff employed by counsel, court reporters, and experts. The confidentiality agreement limits the use of such documents or information to purposes of preparing for, and conducting the litigation, and it provides for their return at the conclusion of the litigation. Thus, the confidentiality agreement contains strict limitations and restrictions which sufficiently safeguard that all information provided will be kept secure and confidential.
However, this court’s finding that the GLBA does not preclude disclosure does not permit Alpha and Levitis to obtain discovery which is improper under the CPLR. Thus, the court must review the scope of the discovery sought to determine if it must be limited pursuant to the CPLR’s requirements {see CPLR 3101 [a]). CPLR 3101 (a) sets forth the criterion for disclosure under the CPLR, requiring “full disclosure of all matter material and necessary in the prosecution or defense of an action.” However, requests for disclosure may not be overbroad, burdensome, or lacking in specificity, and they may not seek irrelevant informa*969tion (see Gonzalez v International Bus. Machs. Corp., 236 AD2d 363, 364 [1997]; Holness v Chrysler Corp., 220 AD2d 721, 722 [1995]; Harris v City of New York, 211 AD2d 663, 664-665 [1995]).
With respect to interrogatory numbers 13, 14, and 16, these interrogatories are overbroad in that they demand the names of Continental’s clients which had been former clients of Alpha, regardless of whether they were solicited by Continental or not. Furthermore, these interrogatories are overly burdensome as Continental may not be aware of Alpha’s former clients. The burden is on Alpha and Levitis, who know the names and addresses of the clients that they believe were solicited by defendants, to first identify those clients who had been Alpha’s clients and to then tailor these demands to identify if these named clients had become clients of Continental or were serviced or contacted by Continental. Thus, Continental cannot be required to respond to such overly broad and burdensome interrogatories (see Gonzalez, 236 AD2d at 364).
With respect to document request numbers 3 and 4, Alpha and Levitis have not shown how Continental’s employment manuals, pamphlets, bulletins, and stationery are in any way relevant to Alpha’s claims herein. Therefore, responses to these overbroad and irrelevant requests for disclosure cannot be required (see Jordan v Blue Circle Atl., 296 AD2d 752, 753 [2002]; Saratoga Harness Racing v Roemer, 274 AD2d 887, 889 [2000]).
Document request number 6, rather than being limited to disclosure of the number of loans that Continental closed involving Alpha’s former clients, seeks disclosure of all loans that Continental closed regardless of whether they included former clients of Alpha. It is thus overbroad and palpably improper, and defendants cannot be required to respond thereto (see Bettan v Geico Gen. Ins. Co., 296 AD2d 469, 471 [2002]).
As to document request number 15, which demands any and all documents concerning how payments were made to any individual defendant, including copies of all checks paid by Continental to any individual defendant, the payments made to the individual defendants may be relevant to Alpha’s claim regarding commissions paid to the individual defendants and whether payments were made to them involving Alpha’s former clients. However, such request impermissibly seeks actual copies of checks, rather than being limited to requesting the dates and amounts of payments made. Moreover, such disclosure is not *970properly limited to payments to the individual defendants pertaining to former clients of Alpha who were solicited by Continental. Thus, such request is overbroad, overburdensome, and palpably improper, and defendants cannot be compelled to respond to it (see Bell v Cobble Hill Health Ctr., Inc., 22 AD3d 620, 621 [2005]).
Document request number 16, which seeks disclosure of tax returns and other confidential documents, is palpably improper as tax returns are not discoverable absent a showing of necessity (see Chang v SDI Intl. Inc., 15 AD3d 520, 521 [2005]; Latture v Smith, 304 AD2d 534, 536 [2003]; Saratoga Harness Racing, 274 AD2d at 889; Walter Karl, Inc. v Wood, 161 AD2d 704, 705 [1990]). Alpha and Levitis have not made any showing of how these tax returns and other confidential documents are material and necessary to the claims asserted by Alpha (see Chang, 15 AD3d at 521; Saratoga Harness Racing, 274 AD2d at 889).
With respect to document request numbers 38 and 39, defendants have stated that these documents, which relate to new mortgages or loans at Alpha, are not within their possession, custody, or control, and Alpha and Levitis have not shown otherwise. A party may not be compelled to produce, or sanctioned for failing to produce, information which it does not possess (Romeo v City of New York, 261 AD2d 379, 380 [1999]; Corriel v Volkswagen of Am., 127 AD2d 729, 731 [1987]).
As to document request number 40, which seeks disclosure of any and all documents or loans originated, marketed, secured, and closed by defendants from January 1, 2006 to December 1, 2006, this request is overbroad and overburdensome since it does not limit the request to loans involving those identified clients which Alpha believed had been its clients. Thus, such request is palpably improper (see Gonzalez, 236 AD2d at 364).
A motion to strike a pleading or for an order of preclusion or to compel discovery must be denied where discovery demands are overbroad, burdensome, or lack specificity, or seek irrelevant or confidential information (see Community Dev. Assn. v Warren-Hoffman & Assoc., 4 AD3d 755, 755 [2004]; Brandes v North Shore Univ. Hosp., 1 AD3d 550, 551 [2003]; Latture, 304 AD2d at 536; Gonzalez, 236 AD2d at 364). Under such circumstances, the appropriate remedy is a protective order vacating the improper demands rather than pruning them (see Bell, 22 AD3d at 621; Astudillo v St. Francis-Beacon Extended Care Facility, Inc., 12 AD3d 469, 470 [2004]; Latture, 304 AD2d at 536; *971Bettan, 296 AD2d at 471). Such vacatur, however, should be without prejudice to the service of properly limited discovery requests (see Astudillo, 12 AD3d at 470).
Thus, here, inasmuch as the court finds that the discovery demands were improper, defendants’ responses were adequate, and Alpha and Levitis’ motion to strike defendants’ answer, or for preclusion, or an order compelling them to respond to these demands must be denied (see Brandes, 1 AD3d at 551), Alpha and Levitis’ improper demands must be vacated, and defendants’ cross motion for a protective order must be granted (see Astudillo, 12 AD3d at 470; Bettan, 296 AD2d at 471). Alpha and Levitis’ request for a privilege log, outlining what defendants deem to be privileged, must also be denied as they have shown no basis for such relief.
Accordingly, Alpha and Levitis’ motion to strike defendants’ answer, or, alternatively, for preclusion, or an order compelling disclosure, is denied in its entirety, without prejudice to their serving properly limited discovery requests, if they be so advised, with respect to interrogatory numbers 13, 14, and 16, and document request numbers 6, 15, and 40 within 20 days of service upon them of a copy of this order with notice of entry. The time for Alpha to serve its note of issue is extended to January 18, 2008 to allow for the completion of discovery. Defendants’ cross motion for a protective order with respect to these discovery demands is granted as set forth above.
The Mississippi Supreme Court had reached a contrary conclusion, finding that the exceptions do not permit disclosure in response to a discovery request, but it withdrew its opinion on February 5, 2004 (see Equitable Life Assur. Socy. v Irving, 2003 WL 22098021 [Miss, Sept. 11, 2003]). One federal court found that a financial institution had standing to seek an injunction preventing a state court litigant from disclosing information in violation of the GLBA, but that court’s order was later vacated on jurisdictional grounds (see Union Planters Bank, N.A. v Gavel, 2003 WL 1193671, *2, 2003 US Dist LEXIS 3820, *4 [ED La, Mar. 12, 2003], vacated sub nom. Union Planters Bank, N.A. v Salih, 369 F3d 457 [5th Cir 2004]; see also Union Planters Bank, N.A. v Gavel, 2002 WL 975675, *2, 2002 US Dist LEXIS 8782, *4-5 [ED La, May 9, 2002], reconsideration denied 2002 WL 1379182, 2002 US Dist LEXIS 11969 [ED La, June 25, 2002]). Furthermore, the federal court, in Union Planters Bank (2003 WL 1193671 at *2, 2003 US Dist LEXIS 3820, *4), did not address the express exception of 15 USC § 6802 (e) (8). In Landry v Union Planters Corp. (2003 WL 21355462, *6, 2003 US Dist LEXIS 10553, *20 [ED La, June 6, 2003]), a federal district court found no reason to address the scope of the “legal requirements” or “judicial process” exceptions since it found that the information sought therein did not contain personal identifiers such as account numbers, names, or addresses, and that such “blind data” is not considered “personally identifiable financial information,” and, thus, is not defined as nonpublic information protected by the GLBA.