"GLBA's vague wording raised questions among other kinds of companies that collect consumers' private financial data, including credit card information, about the proper procedures they ought to implement to secure that data." . . . .