Data Privacy Act of 2023
A BILL
To amend the Gramm-Leach-Bliley Act to modernize the protection of the nonpublic personal information of individuals with whom financial institutions have customer or consumer relationship, and for other purposes.
Sec. 2 Protection of nonpublic personal information
Section 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801) is amended—
in subsection (a)—
by striking “of its customers” and inserting “of individuals with whom such financial institution has a customer or consumer relationship”; and
by striking “those customers' nonpublic personal information” and inserting “those individual’s nonpublic personal information”; and
by adding at the end the following:
“(c) Use of nonpublic personal information—Unless otherwise permitted under section 502(e), it shall be unlawful for a financial institution to willfully use nonpublic personal information without the consent of an individual with whom the financial institution has a customer or consumer relationship.”
Sec. 3 Obligations with respect to the collection and disclosure of nonpublic personal information
in the heading, by striking “DISCLOSURES OF” and inserting “THE COLLECTION AND DISCLOSURE OF NONPUBLIC”;
in subsection (a)—
by inserting before “disclose” the following: “collect nonpublic personal information from an individual with whom such financial institution has a customer or consumer relationship or”; and
by striking “has provided to the consumer” and inserting “has provided to such individual”; and
in subsection (b), by amending paragraph (1) to read as follows:
“(1) In general—A financial institution may not collect nonpublic personal information from an individual with whom such financial institution has a customer or consumer relationship or disclose nonpublic personal information to a nonaffiliated third party unless the individual with whom such financial institution has a consumer or customer relationship is given the opportunity, before the time that such information is initially collected or disclosed, to direct that such information not be collected or disclosed to such third party.”
in subsection (d)—
by striking “of a consumer” and inserting “of an individual with whom such financial institution has a customer or consumer relationship”; and
by striking “telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer” and inserting “marketing to the individual with whom such financial institution has a customer or consumer relationship, regardless of medium”;
in subsection (e)—
in the heading, by striking “General”;
by striking “Subsections (a) and (b) shall not prohibit the disclosure of nonpublic personal information” and inserting “The general collection and disclosure procedures provided in subsections (a) and (b) shall not prohibit or otherwise limit the collection or disclosure of nonpublic personal information”;
by striking paragraphs (1) and (2) and inserting the following:
“(1) if the collection or disclosure is—
“(A) necessary to effect, administer, or enforce a transaction requested or authorized by the individual with whom the financial institution has a customer or consumer relationship;
“(B) in connection with servicing or processing a financial product or service requested or authorized by the individual with whom the financial institution has a customer or consumer relationship;
“(C) with the consent or at the direction of the individual with whom the financial institution has a customer or consumer relationship, and the financial institution obtains, from such individual, evidence of such individual’s authorization for such collection or disclosure; or
“(D) in connection with—
“(i) maintaining or servicing the account, with such financial institution or with another entity as part of a private label or co-brand credit card program or an extension of credit on behalf of such entity, of an individual with whom such financial institution or entity has a customer or consumer relationship; or
“(ii) a proposed or actual securitization, secondary market sale (including sales of servicing rights), or similar transaction related to an account or a transaction of the individual which whom such entity or financial institution has a customer or consumer relationship; or
“(2) to a nonaffiliated third party to perform services for, or functions on behalf of, the financial institution, including marketing of the financial institution's own products or services, or financial products or services offered pursuant to joint agreements between two or more financial institutions that comply with the requirements imposed by the regulations prescribed under section 504, if the financial institution fully discloses the providing of such information and enters into a contractual agreement with the third party that requires the third party to maintain the confidentiality of such information;”
in paragraph (3)—
in subparagraph (A)—
by striking “or security ” and inserting “, security, or integrity”;
by striking “pertaining to the consumer” and inserting “pertaining to the individual with whom the financial institution has a customer or consumer relationship”;
by inserting before the semicolon the following: “, as well as the systems, processes, and services that handle such records”;
in subparagraph (B), by inserting after “fraud,” the following: “identity theft,”;
in subparagraph (C), by striking “for resolving customer disputes or inquiries” and inserting “for resolving disputes or inquires relating to individuals with whom the financial institution has a customer or consumer relationship”;
in subparagraph (D), by striking “relating to the consumer” and inserting “relating to the individual with whom the financial institution has a customer or consumer relationship”; and
in subparagraph (E), by striking “behalf of the consumer” and inserting “behalf of the individual with whom the financial institution has a customer or consumer relationship”; and
in paragraph (7)—
by striking “or exchange” and inserting “exchange, or similar transaction”;
by striking “consumers of such business or unit” and inserting “individuals with whom such business or unit have a customer or consumer relationship”; and
by inserting “collection or” before “disclosure”;
by adding at the end the following:
“(f) Notification to nonaffiliates when sharing is terminated
“(1) In general—If a financial institution is required to terminate sharing nonpublic personal information, of an individual with whom such financial institution has a customer or consumer relationship, with a nonaffiliated third party—
“(A) the financial institution shall notify the nonaffiliated third party that the sharing has been terminated and that such nonaffiliated third party may not share any nonpublic information of the individual already received from the financial institution; and
“(B) upon receipt of a notice described under subparagraph (A), the nonaffiliated third party may not share any nonpublic information of such individual already received from the financial institution.
“(2) Rulemaking—The agencies referred to in section 504 shall issue rules to establish the requirements for notices under paragraph (1), including the form of such notices, taking into account any privacy risks posed by such notices.
“(g) Requirements with respect to the collection of account credentials—A financial institution may not collect from an individual with whom such financial institution has a customer or consumer relationship account credentials such individual uses to access an account at a nonaffiliated third party that is a financial institution unless, prior to collecting the account credentials—
“(1) the financial institution clearly and conspicuously discloses to the individual, in a form permitted by the regulations prescribed under section 504—
“(A) that the financial institution is collecting such account credentials;
“(B) how such credentials will be used by the financial institution; and
“(C) whether such credentials may be disclosed to a nonaffiliated third party; and
“(2) such individual is given an opportunity to direct that such credentials not be collected or to direct that such credentials not be disclosed to any nonaffiliated third party.”
Conforming amendment— Section 509(3)(D) of the Gramm-Leach-Bliley Act (15 U.S.C. 6809(3)(D)) is amended by striking “section 502(e)(1)(C)” and inserting “section 502(e)(1)(D)(ii)”.
Sec. 4 Disclosure of institution privacy policy
Section 503 of the Gramm-Leach-Bliley Act (15 U.S.C. 6803) is amended—
in subsection (a)—
by striking “customer relationship with a consumer” and inserting “customer or consumer relationship”;
by striking “clear and conspicuous disclosure to such consumer” and inserting “clear and conspicuous disclosure to such individual with whom such financial institution has a customer or consumer relationship”;
by redesignating paragraphs (1), (2), and (3) as paragraphs (2), (3), and (4), respectively;
by inserting before paragraph (2), as so redesignated, the following:
“(1) collecting nonpublic personal information;”
in paragraph (3), as so redesignated, by striking “have ceased to be customers of” and inserting “have ceased to have a customer or consumer relationship with”; and
in paragraph (4), as so redesignated, by striking “personal information of consumers” and inserting “personal information of individuals with whom such financial institution has a customer or consumer relationship”;
by redesignating subsections (b) through (f) as subsections (c) through (g), respectively;
by inserting after subsection (a) the following:
“(b) Disclosure upon request—Upon the request of an individual with whom a financial institution has a customer or consumer relationship, a financial institution shall provide such individual with a copy of the disclosures required by subsection (a) in writing or in electronic or other form as permitted by the regulations prescribed under section 504.”
in subsection (d), as so redesignated—
in paragraph (1)—
by inserting “collecting or” before “disclosing nonpublic”; and
by striking subparagraph (B) and inserting the following:
“(B) the purpose for which the financial institution collects the nonpublic personal information of individuals with whom the financial institution has a customer or consumer relationship, as well as how the information will be used;”
in paragraph (2), by inserting before the semicolon the following: “, provided in a manner that provides individuals with whom the financial institution has a customer or consumer relationship a meaningful understanding of the information that is collected”;
in paragraph (3), by striking “and” at the end;
in paragraph (4), by striking the period at the end and inserting a semicolon; and
by adding at the end the following:
“(5) if the financial institution collects nonpublic personal information for any purpose other than to provide a specific product or service such an individual is seeking—
“(A) a description of such information;
“(B) the purpose for which such information is collected; and
“(C) the right of such individual to opt out of having such nonpublic personal information collected or disclosed to a nonaffiliated third party, and the manner in which such individual may make such opt out election;
“(6) the data retention policies of the financial institution, including—
“(A) the period of time for which the financial institution retains the nonpublic personal information relating to such individual; or
“(B) the criteria used by the financial institution to determine the period of time for which such information is retained;
“(7) the right of such individual to direct the financial institution to terminate the sharing of nonpublic personal information with a nonaffiliated third party, and the manner in which such individual may make such direction;
“(8) the right of such individual to request that the financial institution provide the individual with a list of all nonpublic personal information relating to the individual held by the financial institution, and the manner in which the individual may make such request; and
“(9) the right of such individual to direct the financial institution to delete nonpublic personal information of the individual held by the financial institution (subject to the exceptions provided under section 502A(b)(3)), and the manner in which the individual may make such direction.”
in subsection (f), as so redesignated—
in paragraph (2)(A), by striking “to consumers” and inserting “to individuals with whom a financial institution has a customer or consumer relationship”; and
in paragraph (2)(C), by striking “enable consumers” and inserting “enable individuals with whom a financial institution has a customer or consumer relationship”; and
in subsection (g), as so redesignated, by striking “sent to consumers” and inserting “sent to individuals with whom a financial institution has a customer or consumer relationship”.
Sec. 5 Rulemaking
Section 504 of the Gramm-Leach-Bliley Act (15 U.S.C. 6804) is amended—
in subsection (a)(1)—
by striking subparagraph (D) and inserting the following:
“(D) Insurance
“(i) In general—With respect to any person engaged in providing insurance, the applicable State insurance authority of the State in which the person is domiciled shall issue regulations as may be necessary to carry out the purposes of this subtitle, subject to section 505(c).
“(ii) Limitation—Regulations issued by a State insurance authority under this subparagraph may be no more restrictive for a person engaged in providing insurance than those regulations issued by the agencies coordinating for consistency and comparability under paragraph (2).”
by adding at the end the following:
“(c) Consideration of compliance costs—When prescribing rules under this subtitle, agencies shall take into account the compliance cost such rules will impose on small institutions.”
Sec. 6 Relation to State laws
Section 507 of the Gramm-Leach-Bliley Act (15 U.S.C. 6807) is amended to read as follows:
“507. Relation to State laws
“This subtitle and the amendments made by this subtitle supersede any statute or rule of a State or political subdivision thereof that regulates the obligations of a financial institution with respect to—
“(1) the collection or disclosure of personal information;
“(2) the disclosure of the financial institution’s privacy policy or information about the financial institution’s privacy policies and practices;
“(3) the access to, deletion of, or other individual privacy rights with respect to personal information; or
“(4) the international sharing of personal information.”
Sec. 7 Obligations with respect to access and deletion of nonpublic personal information
In general— Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) is amended by inserting after section 502 the following:
“502A. Obligations with respect to access and deletion of nonpublic personal information
“(a) Access to information
“(1) In general—Upon an authorized request from an individual with whom a financial institution has a customer or consumer relationship, a financial institution shall disclose—
“(A) any nonpublic personal information relating to such individual held by the financial institution;
“(B) the list of categories of nonaffiliated third parties with whom the financial institution shares nonpublic personal information relating to such individual; and
“(C) the list of categories of nonaffiliated third parties from whom the financial institution has received nonpublic personal information relating to such individual.
“(2) Format—Disclosures described under paragraph (1) shall be in a structured, commonly used, and machine-readable format.
“(3) Exception—For purposes of subparagraphs (B) and (C) of paragraph (1), a financial institution is not required to disclose a nonaffiliated third party with whom the financial institution shares or receives nonpublic personal information relating to such individual pursuant to an exception described under any of paragraphs (3) through (8) of section 502(e).
“(b) Deletion of information
“(1) In general—Upon an authorized request from an individual with whom a financial institution has a customer or consumer relationship, a financial institution shall delete any nonpublic personal information relating to such individual held by the financial institution.
“(2) Certain inactive accounts—If such individual has not used a product or service provided by a financial institution for 1 year, the financial institution shall—
“(A) notify such individual that such individual has the right to request the deletion of any nonpublic personal information relating to such individual held by the financial institution, and provide such individual with clear instructions on how to make such request; and
“(B) for each additional 1-year period with respect to which such person continues to not use a product or service of the financial institution, resend the notice described under subparagraph (A).
“(3) Exception
“(A) In general—This subsection shall not require a financial institution to delete nonpublic personal information if—
“(i) the financial institution is otherwise required by law to retain the nonpublic personal information;
“(ii) the nonpublic personal information may be necessary to respond to a dispute under the Fair Credit Reporting Act; or
“(iii) the nonpublic personal information may be necessary to retain for a purpose described in an exception under section 502(e).
“(B) Limitation on retained nonpublic personal information—With respect to nonpublic personal information that a financial institution would be required to delete under this subsection but for the application of this paragraph, the financial institution may only use such nonpublic personal information for the applicable purpose described under subparagraph (A).
“(c) Timing—A financial institution that receives an authorized request, under this section, from an individual with whom such financial institution has a customer or consumer relationship, shall respond within 45 business days.
“(d) Rulemaking—Not later than the end of the 1-year period beginning on the date of enactment of this section, each agency or authority described in section 504 shall issue rules to carry out this section with respect to the financial institutions subject to its jurisdiction.”
Clerical amendment— The table of contents in section 1(b) of the Gramm-Leach-Bliley Act is amended by inserting after the item relating to section 502 the following:
Sec. 8 Obligations with respect to the international sharing of nonpublic personal information
In general— Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.), as amended by section 10, is further amended by inserting after section 502A the following:
“502B. Obligations with respect to the international sharing of nonpublic personal information
“(a) In general—A financial institution may not share with a foreign government nonpublic personal information relating to an individual with whom such financial institution has a customer or consumer relationship.
“(b) Law enforcement exception—Subsection (a) shall not apply to the sharing of the nonpublic personal information relating to such an individual with a foreign government authority if such sharing is—
“(1) done for legitimate law enforcement purposes; or
“(2) to a foreign government authority having jurisdiction over the financial institution for examination, compliance, or other purposes as authorized by law.”
Clerical amendment— The table of contents in section 1(b) of the Gramm-Leach-Bliley Act, as amended by section 10, is further amended by inserting after the item relating to section 502A the following:
Sec. 9 Definitions
Section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809) is amended—
in paragraph (3)(A), by inserting before the period at the end the following: “and includes a data aggregator”;
in paragraph (4), by striking “personally identifiable financial information” and inserting “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual and is”;
in paragraph (7), by inserting “collection or” before “disclosure” each place such term appears;
by striking paragraph (9);
by amending paragraph (11) to read as follows:
“(11) Customer or consumer relationship
“(A) In general—The term “customer or consumer relationship” means a customer relationship or a consumer relationship.
“(B) Customer relationship—The term “customer relationship” shall have the meaning given the term in rules issued pursuant to section 504.
“(C) Consumer Relationship—The term “consumer relationship” shall have the meaning given the term in rules issued pursuant to section 504 and such meaning shall—
“(i) include situations in which a financial institution obtains nonpublic information from an individual with whom the financial institution does not have a customer relationship; and
“(ii) deem a financial institution to no longer to be in a consumer relationship with an individual at such time as the financial institution no longer collects, controls, possesses, transmits, or maintains any nonpublic personal information of such individual.
“(D) Treatment of certain transactions—When the terms “customer relationship” and “consumer relationship” are defined by rule, it shall be specified that the following transactions do not, by themselves, establish a consumer relationship or a consumer relationship:
“(i) The use of an automated teller machine.
“(ii) The use of a credit card or debit card to make a purchase.
“(iii) Such other similar transactions as the agencies determine appropriate.”
by adding at the end the following:
“(12) Account credentials—The term “account credentials” means nonpublic personal information that an individual with whom a financial institution has a customer or consumer relationship uses to access an account of the individual at such financial institution, including a username, password, or an answer to a security question.
“(13) Data aggregator—The term “data aggregator”—
“(A) means any person that operates a commercial business or enterprise for the business purpose of accessing, aggregating, collecting, selling, or sharing nonpublic personal information about financial accounts or transactions relating to an individual; and
“(B) does not include—
“(i) a service provider acting at the express instruction of a financial institution that accesses, aggregates, collects, or shares nonpublic personal information about an individual with whom such financial institution has a customer or consumer relationship in accordance with paragraphs (1), (2), (3)(A), (3)(B), (3)(C), (3)(D), or (6) of section 502(e); or
“(ii) an attorney or accountant acting on behalf of an individual with whom such attorney or accountant has a customer or consumer relationship, in accordance with section 502(e)(3)(E).
“(14) Person engaged in providing insurance—The term “person engaged in providing insurance” means a person that engages in the business of insurance, as that term is defined in section 1002 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (12 U.S.C. 5481).”
Sec. 10 Repeal of expired provisions
The Gramm-Leach-Bliley Act is amended—
by striking section 508 (15 U.S.C. 6808); and
in the table of contents in section 1(b), by striking the item relating to section 508.
Sec. 11 GAO report
In general— The Comptroller General of the United States shall, not later than 1 year after the date of the enactment of this Act, submit to the Congress a report that assesses—
whether the safeguard standards promulgated pursuant to section 501 of the Gramm-Leach-Bliley Act, including protecting against unauthorized disclosure, are effective in protecting individuals with whom financial institutions have a customer or consumer relationship; and
whether the enforcement regime with respect to those standards are effective in protecting customers and consumers, and whether additional remedies are necessary.
Definitions— In this section, the terms “customer or consumer relationship” and “financial institution” have the meaning given those terms, respectively, under section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809), as amended by section 9.
Sec. 12 Sense of Congress
It is the sense of the Congress that the Federal agencies implementing the Gramm-Leach-Bliley Act should implement such Act, to the extent possible, in a technology-agnostic manner so as to ensure it can adapt to different business models and technologies.