To amend the Gramm-Leach-Bliley Act to establish procedures for disclosures by financial institutions of nonpublic personal information, and for other purposes.

I 117TH CONGRESS 1ST SESSION H. R. 3911 To amend the Gramm-Leach-Bliley Act to establish procedures for disclosures by financial institutions of nonpublic personal information, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JUNE 15, 2021 Mr. LYNCH introduced the following bill; which was referred to the Committee on Financial Services A BILL To amend the Gramm-Leach-Bliley Act to establish proce- dures for disclosures by financial institutions of non- public personal information, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. DATA BREACHES. 3 (a) IN GENERAL.—Title V of the Gramm-Leach-Bli- 4 ley Act (15 U.S.C. 6801 et seq.) is amended by inserting 5 after section 502 the following: 6 ‘‘SEC. 502A. DATA BREACHES. 7 ‘‘(a) IN GENERAL.—A financial institution shall sub- 8 mit to the Director of the Bureau of Consumer Financial 9 VerDate Sep 11 2014 00:51 Jul 02, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H3911.IH H3911 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 3911 IH Protection a report if the financial institution discloses 1 nonpublic personal information of a consumer in violation 2 of this subtitle. Such report shall— 3 ‘‘(1) be submitted not later than 72 hours after 4 the financial institution discovers such violation; 5 ‘‘(2) identify the name and contact information 6 of an individual who can provide more information 7 to the Bureau about the violation; 8 ‘‘(3) describe the nature of the violation, includ- 9 ing (if possible) the categories and approximate 10 number of consumers affected and the categories 11 and approximate number of records of nonpublic 12 personal information affected; 13 ‘‘(4) describe the likely consequences of the vio- 14 lation; and 15 ‘‘(5) describe the measures taken or proposed 16 to be taken by the financial institution to address 17 the violation, including, where appropriate, measures 18 to mitigate its possible adverse effects. 19 ‘‘(b) BUREAU DETERMINATION.— 20 ‘‘(1) IN GENERAL.—Upon receipt of a report 21 under subsection (a), the Director of the Bureau of 22 Consumer Financial Protection shall assess whether 23 any violation described in such report poses a high 24 risk of harm to consumers affected by such a viola- 25 VerDate Sep 11 2014 00:51 Jul 02, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H3911.IH H3911 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 3911 IH tion, and if so, require the financial institution to 1 disclose the violation to such consumers. 2 ‘‘(2) REQUIREMENTS.—The disclosure required 3 under paragraph (1) shall— 4 ‘‘(A) describe the nature of the violation, 5 including (if possible) the categories and ap- 6 proximate number of consumers affected and 7 the categories and approximate number of 8 records of nonpublic personal information af- 9 fected; 10 ‘‘(B) identify the name and contact infor- 11 mation of an individual who can provide more 12 information to consumers about the violation; 13 ‘‘(C) describe the likely consequences of 14 the of the violation; and 15 ‘‘(D) describe of the measures taken or 16 proposed to be taken by the financial institution 17 to address the violation, including, where appro- 18 priate, measures to mitigate its possible adverse 19 effects. 20 ‘‘(3) DISCLOSURE NOT REQUIRED.—A financial 21 institution is not required to disclose a violation 22 under paragraph (1) if— 23 ‘‘(A) the financial institution has imple- 24 mented appropriate measures to ensure that the 25 VerDate Sep 11 2014 00:51 Jul 02, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H3911.IH H3911 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 3911 IH the nonpublic personal information affected by 1 the violation would not be usable by a third 2 party; and 3 ‘‘(B) the Director of the Bureau of Con- 4 sumer Financial Protection has determined that 5 the financial institution has taken action to pre- 6 vent harm to consumers as a result of the viola- 7 tion. 8 ‘‘(c) RULEMAKING.—Not later than the end of the 9 1-year period beginning on the date of enactment of this 10 section, the Director of the Bureau of Consumer Financial 11 Protection and the Federal agencies described under sec- 12 tion 505(a) shall, jointly, issue rules to carry out this sec- 13 tion.’’. 14 Æ VerDate Sep 11 2014 00:51 Jul 02, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\H3911.IH H3911 kjohnson on DSK79L0C42PROD with BILLS