Safeguarding Non-bank Consumer Information Act

I 117TH CONGRESS 1ST SESSION H. R. 3910 To amend the Gramm-Leach-Bliley Act to give the Bureau of Consumer Financial Protection rulemaking and enforcement authority over the safe- guards rule with respect to data aggregators and other financial institu- tions, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JUNE 15, 2021 Mr. LYNCH introduced the following bill; which was referred to the Committee on Financial Services A BILL To amend the Gramm-Leach-Bliley Act to give the Bureau of Consumer Financial Protection rulemaking and en- forcement authority over the safeguards rule with respect to data aggregators and other financial institutions, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Safeguarding Non- 4 bank Consumer Information Act’’. 5 VerDate Sep 11 2014 00:51 Jul 02, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H3910.IH H3910 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 3910 IH SEC. 2. APPLICATION OF SAFEGUARDS RULE TO DATA 1 AGGREGATORS. 2 (a) APPLICATION OF SAFEGUARDS RULE.—Section 3 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801) is 4 amended— 5 (1) in the matter preceding paragraph (1), by 6 inserting ‘‘and except as provided in subsection (c)’’ 7 after ‘‘subsection (a)’’; 8 (2) in subsection (b), by striking ‘‘, other than 9 the Bureau of Consumer Financial Protection,’’; and 10 (3) by adding at the end the following new sub- 11 section: 12 ‘‘(c) DATA AGGREGATORS.—The Bureau of Con- 13 sumer Financial Protection shall establish, by rule, appro- 14 priate standards for data aggregators relating to adminis- 15 trative, technical, and physical safeguards to protect 16 records and information as described in paragraphs (1) 17 through (3) of subsection (b).’’. 18 (b) AUTHORITY OF THE BUREAU.—Title V of the 19 Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) is 20 amended— 21 (1) in section 504(a)(1)(A), by striking ‘‘, ex- 22 cept that the Bureau of Consumer Financial Protec- 23 tion shall not have authority to prescribe regulations 24 with respect to the standards under section 501’’; 25 (2) in section 505— 26 VerDate Sep 11 2014 00:51 Jul 02, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3910.IH H3910 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 3910 IH (A) in subsection (a)(8), by striking ‘‘, but 1 not with respect to the standards under section 2 501’’ and inserting ‘‘, including data 3 aggregators’’; 4 (B) in subsection (b)(1), by striking ‘‘, 5 other than the Bureau of Consumer Financial 6 Protection,’’; and 7 (C) in subsection (b)(2), by striking ‘‘and 8 (7)’’ and inserting ‘‘(7), and (8)’’; and 9 (3) in section 508(a), by striking ‘‘and the Fed- 10 eral Trade Commission’’ and inserting ‘‘, the Fed- 11 eral Trade Commission, and the Bureau of Con- 12 sumer Financial Protection’’. 13 (c) DEFINITION.—Section 509 of the Gramm-Leach- 14 Bliley Act (15 U.S.C. 6809) is amended— 15 (1) in paragraph (3)(A), by inserting before the 16 period at the end ‘‘, and includes a data 17 aggregator’’; and 18 (2) by adding at the end the following new 19 paragraph: 20 ‘‘(12) DATA AGGREGATOR.—The term ‘data 21 aggregator’ means a person that collects, maintains, 22 utilizes, distributes, or gives access to individual or 23 VerDate Sep 11 2014 00:51 Jul 02, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3910.IH H3910 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 3910 IH aggregate nonpublic personal information to another 1 financial institution.’’. 2 Æ VerDate Sep 11 2014 00:51 Jul 02, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\H3910.IH H3910 kjohnson on DSK79L0C42PROD with BILLS