Data Privacy Act of 2023

IB Union Calendar No. 673 118TH CONGRESS 2D SESSION H. R. 1165 [Report No. 118–822] To amend the Gramm-Leach-Bliley Act to modernize the protection of the nonpublic personal information of individuals with whom financial institu- tions have customer or consumer relationship, and for other purposes. IN THE HOUSE OF REPRESENTATIVES FEBRUARY 24, 2023 Mr. MCHENRY introduced the following bill; which was referred to the Committee on Financial Services DECEMBER 5, 2024 Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed [Strike out all after the enacting clause and insert the part printed in italic] [For text of introduced bill, see copy of bill as introduced on February 24, 2023] VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6652 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 2 •HR 1165 RH A BILL To amend the Gramm-Leach-Bliley Act to modernize the protection of the nonpublic personal information of indi- viduals with whom financial institutions have customer or consumer relationship, and for other purposes. VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6652 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 3 •HR 1165 RH Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 3 (a) SHORT TITLE.—This Act may be cited as the 4 ‘‘Data Privacy Act of 2023’’. 5 (b) TABLE OF CONTENTS.—The table of contents for 6 this Act is as follows: 7 Sec. 1. Short title; table of contents. Sec. 2. Protection of nonpublic personal information. Sec. 3. Obligations with respect to the collection and disclosure of nonpublic per- sonal information. Sec. 4. Disclosure of institution privacy policy. Sec. 5. Rulemaking. Sec. 6. Relation to State laws. Sec. 7. Obligations with respect to access and deletion of nonpublic personal in- formation. Sec. 8. Obligations with respect to the international sharing of nonpublic per- sonal information. Sec. 9. Definitions. Sec. 10. Repeal of expired provisions. Sec. 11. GAO Report. Sec. 12. Sense of Congress. Sec. 13. Effective date. SEC. 2. PROTECTION OF NONPUBLIC PERSONAL INFORMA- 8 TION. 9 Section 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 10 6801) is amended— 11 (1) in subsection (a)— 12 (A) by striking ‘‘of its customers’’ and in- 13 serting ‘‘of individuals with whom such financial 14 institution has a customer or consumer relation- 15 ship’’; and 16 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 4 •HR 1165 RH (B) by striking ‘‘those customers’ nonpublic 1 personal information’’ and inserting ‘‘those indi- 2 vidual’s nonpublic personal information’’; and 3 (2) by adding at the end the following: 4 ‘‘(c) USE OF NONPUBLIC PERSONAL INFORMATION.— 5 Unless otherwise permitted under section 502(e), it shall be 6 unlawful for a financial institution to willfully use non- 7 public personal information without the consent of an indi- 8 vidual with whom the financial institution has a customer 9 or consumer relationship.’’. 10 SEC. 3. OBLIGATIONS WITH RESPECT TO THE COLLECTION 11 AND DISCLOSURE OF NONPUBLIC PERSONAL 12 INFORMATION. 13 (a) IN GENERAL.—Section 502 of the Gramm-Leach- 14 Bliley Act (15 U.S.C. 6802) is amended— 15 (1) in the heading, by striking ‘‘DISCLOSURES 16 OF’’ and inserting ‘‘THE COLLECTION AND DIS- 17 CLOSURE OF NONPUBLIC’’; 18 (2) in subsection (a)— 19 (A) by inserting before ‘‘disclose’’ the fol- 20 lowing: ‘‘collect nonpublic personal information 21 from an individual with whom such financial 22 institution has a customer or consumer relation- 23 ship or’’; and 24 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 5 •HR 1165 RH (B) by striking ‘‘has provided to the con- 1 sumer’’ and inserting ‘‘has provided to such in- 2 dividual’’; and 3 (3) in subsection (b), by amending paragraph 4 (1) to read as follows: 5 ‘‘(1) IN GENERAL.—A financial institution may 6 not collect nonpublic personal information from an 7 individual with whom such financial institution has 8 a customer or consumer relationship or disclose non- 9 public personal information to a nonaffiliated third 10 party unless the individual with whom such financial 11 institution has a consumer or customer relationship 12 is given the opportunity, before the time that such in- 13 formation is initially collected or disclosed, to direct 14 that such information not be collected or disclosed to 15 such third party.’’; 16 (4) in subsection (d)— 17 (A) by striking ‘‘of a consumer’’ and insert- 18 ing ‘‘of an individual with whom such financial 19 institution has a customer or consumer relation- 20 ship’’; and 21 (B) by striking ‘‘telemarketing, direct mail 22 marketing, or other marketing through electronic 23 mail to the consumer’’ and inserting ‘‘marketing 24 to the individual with whom such financial in- 25 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 6 •HR 1165 RH stitution has a customer or consumer relation- 1 ship, regardless of medium’’; 2 (5) in subsection (e)— 3 (A) in the heading, by striking ‘‘GENERAL’’; 4 (B) by striking ‘‘Subsections (a) and (b) 5 shall not prohibit the disclosure of nonpublic 6 personal information’’ and inserting ‘‘The gen- 7 eral collection and disclosure procedures provided 8 in subsections (a) and (b) shall not prohibit or 9 otherwise limit the collection or disclosure of 10 nonpublic personal information’’; 11 (C) by striking paragraphs (1) and (2) and 12 inserting the following: 13 ‘‘(1) if the collection or disclosure is— 14 ‘‘(A) necessary to effect, administer, or en- 15 force a transaction requested or authorized by the 16 individual with whom the financial institution 17 has a customer or consumer relationship; 18 ‘‘(B) in connection with servicing or proc- 19 essing a financial product or service requested or 20 authorized by the individual with whom the fi- 21 nancial institution has a customer or consumer 22 relationship; 23 ‘‘(C) with the consent or at the direction of 24 the individual with whom the financial institu- 25 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 7 •HR 1165 RH tion has a customer or consumer relationship, 1 and the financial institution obtains, from such 2 individual, evidence of such individual’s author- 3 ization for such collection or disclosure; or 4 ‘‘(D) in connection with— 5 ‘‘(i) maintaining or servicing the ac- 6 count, with such financial institution or 7 with another entity as part of a private 8 label or co-brand credit card program or an 9 extension of credit on behalf of such entity, 10 of an individual with whom such financial 11 institution or entity has a customer or con- 12 sumer relationship; or 13 ‘‘(ii) a proposed or actual 14 securitization, secondary market sale (in- 15 cluding sales of servicing rights), or similar 16 transaction related to an account or a 17 transaction of the individual which whom 18 such entity or financial institution has a 19 customer or consumer relationship; or 20 ‘‘(2) to a nonaffiliated third party to perform 21 services for, or functions on behalf of, the financial in- 22 stitution, including marketing of the financial insti- 23 tution’s own products or services, or financial prod- 24 ucts or services offered pursuant to joint agreements 25 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 8 •HR 1165 RH between two or more financial institutions that com- 1 ply with the requirements imposed by the regulations 2 prescribed under section 504, if the financial institu- 3 tion fully discloses the providing of such information 4 and enters into a contractual agreement with the 5 third party that requires the third party to maintain 6 the confidentiality of such information;’’; 7 (D) in paragraph (3)— 8 (i) in subparagraph (A)— 9 (I) by striking ‘‘or security’’ and 10 inserting ‘‘, security, or integrity’’; 11 (II) by striking ‘‘pertaining to the 12 consumer’’ and inserting ‘‘pertaining 13 to the individual with whom the finan- 14 cial institution has a customer or con- 15 sumer relationship’’; 16 (III) by inserting before the semi- 17 colon the following: ‘‘, as well as the 18 systems, processes, and services that 19 handle such records’’; 20 (ii) in subparagraph (B), by inserting 21 after ‘‘fraud,’’ the following: ‘‘identity 22 theft,’’; 23 (iii) in subparagraph (C), by striking 24 ‘‘for resolving customer disputes or inquir- 25 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 9 •HR 1165 RH ies’’ and inserting ‘‘for resolving disputes or 1 inquires relating to individuals with whom 2 the financial institution has a customer or 3 consumer relationship’’; 4 (iv) in subparagraph (D), by striking 5 ‘‘relating to the consumer’’ and inserting 6 ‘‘relating to the individual with whom the 7 financial institution has a customer or con- 8 sumer relationship’’; and 9 (v) in subparagraph (E), by striking 10 ‘‘behalf of the consumer’’ and inserting ‘‘be- 11 half of the individual with whom the finan- 12 cial institution has a customer or consumer 13 relationship’’; and 14 (E) in paragraph (7)— 15 (i) by striking ‘‘or exchange’’ and in- 16 serting ‘‘exchange, or similar transaction’’; 17 (ii) by striking ‘‘consumers of such 18 business or unit’’ and inserting ‘‘individ- 19 uals with whom such business or unit have 20 a customer or consumer relationship’’; and 21 (iii) by inserting ‘‘collection or’’ before 22 ‘‘disclosure’’; 23 (6) by adding at the end the following: 24 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 10 •HR 1165 RH ‘‘(f) NOTIFICATION TO NONAFFILIATES WHEN SHAR- 1 ING IS TERMINATED.— 2 ‘‘(1) IN GENERAL.—If a financial institution is 3 required to terminate sharing nonpublic personal in- 4 formation, of an individual with whom such financial 5 institution has a customer or consumer relationship, 6 with a nonaffiliated third party— 7 ‘‘(A) the financial institution shall notify 8 the nonaffiliated third party that the sharing has 9 been terminated and that such nonaffiliated 10 third party may not share any nonpublic infor- 11 mation of the individual already received from 12 the financial institution; and 13 ‘‘(B) upon receipt of a notice described 14 under subparagraph (A), the nonaffiliated third 15 party may not share any nonpublic information 16 of such individual already received from the fi- 17 nancial institution. 18 ‘‘(2) RULEMAKING.—The agencies referred to in 19 section 504 shall issue rules to establish the require- 20 ments for notices under paragraph (1), including the 21 form of such notices, taking into account any privacy 22 risks posed by such notices. 23 ‘‘(g) REQUIREMENTS WITH RESPECT TO THE COLLEC- 24 TION OF ACCOUNT CREDENTIALS.—A financial institution 25 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 11 •HR 1165 RH may not collect from an individual with whom such finan- 1 cial institution has a customer or consumer relationship ac- 2 count credentials such individual uses to access an account 3 at a nonaffiliated third party that is a financial institution 4 unless, prior to collecting the account credentials— 5 ‘‘(1) the financial institution clearly and con- 6 spicuously discloses to the individual, in a form per- 7 mitted by the regulations prescribed under section 8 504— 9 ‘‘(A) that the financial institution is col- 10 lecting such account credentials; 11 ‘‘(B) how such credentials will be used by 12 the financial institution; and 13 ‘‘(C) whether such credentials may be dis- 14 closed to a nonaffiliated third party; and 15 ‘‘(2) such individual is given an opportunity to 16 direct that such credentials not be collected or to di- 17 rect that such credentials not be disclosed to any non- 18 affiliated third party.’’. 19 (b) CONFORMING AMENDMENT.—Section 509(3)(D) of 20 the Gramm-Leach-Bliley Act (15 U.S.C. 6809(3)(D)) is 21 amended by striking ‘‘section 502(e)(1)(C)’’ and inserting 22 ‘‘section 502(e)(1)(D)(ii)’’. 23 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 12 •HR 1165 RH SEC. 4. DISCLOSURE OF INSTITUTION PRIVACY POLICY. 1 Section 503 of the Gramm-Leach-Bliley Act (15 U.S.C. 2 6803) is amended— 3 (1) in subsection (a)— 4 (A) by striking ‘‘customer relationship with 5 a consumer’’ and inserting ‘‘customer or con- 6 sumer relationship’’; 7 (B) by striking ‘‘clear and conspicuous dis- 8 closure to such consumer’’ and inserting ‘‘clear 9 and conspicuous disclosure to such individual 10 with whom such financial institution has a cus- 11 tomer or consumer relationship’’; 12 (C) by redesignating paragraphs (1), (2), 13 and (3) as paragraphs (2), (3), and (4), respec- 14 tively; 15 (D) by inserting before paragraph (2), as so 16 redesignated, the following: 17 ‘‘(1) collecting nonpublic personal information;’’; 18 (E) in paragraph (3), as so redesignated, by 19 striking ‘‘have ceased to be customers of’’ and in- 20 serting ‘‘have ceased to have a customer or con- 21 sumer relationship with’’; and 22 (F) in paragraph (4), as so redesignated, by 23 striking ‘‘personal information of consumers’’ 24 and inserting ‘‘personal information of individ- 25 VerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165 ssavage on LAPJG3WLY3PROD with BILLS 13 •HR 1165 RH uals with whom such financial institution has a 1 customer or consumer relationship’’; 2 (2) by redesignating subsections (b) through (f) 3 as subsections (c) through (g), respectively; 4 (3) by inserting after subsection (a) the fol- 5 lowing: 6 ‘‘(b) DISCLOSURE UPON REQUEST.—Upon the request 7 of an individual with whom a financial institution has a 8 customer or consumer relationship, a financial institution 9 shall provide such individual with a copy of the disclosures 10 required by subsection (a) in writing or in electronic or 11 other form as permitted by the regulations [Text truncated for display. Full text available on Congress.gov.]