GFI Securities agrees to pay $4.3 million for violating privacy