Financial Information Privacy Act of 1999

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Financial Information Privacy Act of 
1999''.

SEC. 2. DEFINITIONS.

    In this Act--
            (1) the term ``covered person'' means a person that is 
        subject to the jurisdiction of any of the Federal financial 
        regulatory authorities; and
            (2) the term ``Federal financial regulatory authorities'' 
        means--
                    (A) each of the Federal banking agencies, as that 
                term is defined in section 3(z) of the Federal Deposit 
                Insurance Act; and
                    (B) the Securities and Exchange Commission.

SEC. 3. PRIVACY OF CONFIDENTIAL CUSTOMER INFORMATION.

    (a) Rulemaking.--The Federal financial regulatory authorities shall 
jointly issue final rules to protect the privacy of confidential 
customer information relating to the customers of covered persons, not 
later than 270 days after the date of enactment of this Act (and shall 
issue a notice of proposed rulemaking not later than 150 days after the 
date of enactment of this Act), which rules shall--
            (1) define the term ``confidential customer information'' 
        to be personally identifiable data that includes transactions, 
        balances, maturity dates, payouts, and payout dates, of--
                    (A) deposit and trust accounts;
                    (B) certificates of deposit;
                    (C) securities holdings; and
                    (D) insurance policies;
            (2) require that a covered person may not disclose or share 
        any confidential customer information to or with any affiliate 
        or agent of that covered person if the customer to whom the 
        information relates has provided written notice, as described 
        in paragraphs (4) and (5), to the covered person prohibiting 
        such disclosure or sharing--
                    (A) with respect to an individual that became a 
                customer on or after the effective date of such rules, 
                at the time at which the business relationship between 
                the customer and the covered person is initiated and at 
                least annually thereafter; and
                    (B) with respect to an individual that was a 
                customer before the effective date of such rules, at 
                such time thereafter that provides a reasonable and 
                informed opportunity to the customer to prohibit such 
                disclosure or sharing and at least annually thereafter;
            (3) require that a covered person may not disclose or share 
        any confidential customer information to or with any person 
        that is not an affiliate or agent of that covered person unless 
        the covered person has first--
                    (A) given written notice to the customer to whom 
                the information relates, as described in paragraphs (4) 
                and (5); and
                    (B) obtained the informed written or electronic 
                consent of that customer for such disclosures or 
                sharing;
            (4) require that the covered person provide notices and 
        consent acknowledgments to customers, as required by this 
        section, in separate and easily identifiable and 
        distinguishable form;
            (5) require that the covered person provide notice as 
        required by this section to the customer to whom the 
        information relates that describes what specific types of 
        information would be disclosed or shared, and under what 
        general circumstances, to what specific types of businesses or 
        persons, and for what specific types of purposes such 
        information could be disclosed or shared;
            (6) require that the customer to whom the information 
        relates be provided with access to the confidential customer 
        information that could be disclosed or shared so that the 
        information may be reviewed for accuracy and corrected or 
        supplemented;
            (7) require that, before a covered person may use any 
        confidential customer information provided by a third party 
        that engages, directly or indirectly, in activities that are 
        financial in nature, as determined by the Federal financial 
        regulatory authorities, the covered person shall take 
        reasonable steps to assure that procedures that are 
        substantially similar to those described in paragraphs (2) 
        through (6) have been followed by the provider of the 
        information (or an affiliate or agent of that provider); and
            (8) establish a means of examination for compliance and 
        enforcement of such rules and resolving consumer complaints.
    (b) Limitation.--The rules prescribed pursuant to subsection (a) 
may not prohibit the release of confidential customer information--
            (1) that is essential to processing a specific financial 
        transaction that the customer to whom the information relates 
        has authorized;
            (2) to a governmental, regulatory, or self-regulatory 
        authority having jurisdiction over the covered financial entity 
        for examination, compliance, or other authorized purposes;
            (3) to a court of competent jurisdiction;
            (4) to a consumer reporting agency, as defined in section 
        603 of the Fair Credit Reporting Act for inclusion in a 
        consumer report that may be released to a third party only for 
        a purpose permissible under section 604 of that Act; or
            (5) that is not personally identifiable.
    (c) Construction.--Nothing in this section or the rules prescribed 
under this section shall be construed to amend or alter any provision 
of the Fair Credit Reporting Act.

Summary: Financial Information Privacy Act of 1999 - Directs the Federal financial regulatory authorities (banking regulatory agencies and the Securities and Exchange Commission (SEC)) to jointly issue final rules to protect the privacy of confidential information relating to customers of institutions under their respective jurisdictions . Mandates that such rules: (1) prohibit a covered institution from disclosing or sharing confidential customer information with any affiliate or agent if the customer has provided a written notice which forbids such disclosure. (2) prohibit a covered institution from disclosing or sharing confidential customer information with a non-affiliate or non-agent unless the customer has provided written or electronic consent. (3) require the covered institution to disclose to the customer the specific type of information disclosed or shared, under what circumstances, to what specific types of businesses, and for what types of purposes. (4) require customer access to information that could be disclosed so that it may be reviewed for accuracy and supplementation. And (5) establish a compliance and enforcement mechanism that includes consumer complaint resolution. Cites circumstances under which such information may be released.