II

106TH CONGRESS

1ST SESSION S. 1195

To give customers notice and choice about how their financial institutions

share or sell their personally identifiable sensitive financial information,

and for other purposes.

IN THE SENATE OF THE UNITED STATES

JUNE 9, 1999

Mr. SCHUMER introduced the following bill; which was read twice and referred

to the Committee on Banking, Housing and Urban Affairs

A BILL

To give customers notice and choice about how their financial

institutions share or sell their personally identifiable sensitive financial information, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Financial Information

5 Protection Act of 1999’’.

6 SEC. 2. DEFINITIONS.

7 In this Act—
2

•S 1195 IS

1 (1) the term ‘‘covered person’’ means a person

2 that is subject to the jurisdiction of any of the Fed3 eral financial regulatory authorities; and

4 (2) the term ‘‘Federal financial regulatory au5 thorities’’ means—

6 (A) each of the Federal banking agencies,

7 as that term is defined in section 3(z) of the

8 Federal Deposit Insurance Act; and

9 (B) the Securities and Exchange Commis10 sion.

11 SEC. 3. PRIVACY OF CONFIDENTIAL CUSTOMER INFORMA12 TION.

13 (a) RULEMAKING.—The Federal financial regulatory

14 authorities shall jointly issue final rules to protect the pri15 vacy of confidential customer information relating to the

16 customers of covered persons, not later than 270 days

17 after the date of enactment of this Act (and shall issue

18 a notice of proposed rulemaking not later than 150 days

19 after the date of enactment of this Act), which rules

20 shall—

21 (1) define the term ‘‘confidential customer in22 formation’’ to be personally identifiable data that in23 cludes transactions, balances, maturity dates, pay24 outs, and payout dates, of—

25 (A) deposit and trust accounts;
3

•S 1195 IS

1 (B) certificates of deposit;

2 (C) securities holdings; and

3 (D) insurance policies;

4 (2) require that a covered person may not dis5 close or share any confidential customer information

6 to or with any person that is not an affiliate or

7 agent of that covered person unless the covered per8 son has first—

9 (A) given written notice to the customer to

10 whom the information relates, as described in

11 paragraphs (3) and (4); and

12 (B) obtained the informed written or elec13 tronic consent of that customer for such disclo14 sures or sharing;

15 (3) require that the covered person provide no16 tices and consent acknowledgements to customers,

17 as required by this section, in separate and easily

18 identifiable and distinguishable form;

19 (4) require that the covered person provide no20 tice as required by this section to the customer to

21 whom the information relates that describes what

22 specific types of information would be disclosed or

23 shared, and under what general circumstances, to

24 what specific types of businesses or persons, and for
4

•S 1195 IS

1 what specific types of purposes such information

2 could be disclosed or shared;

3 (5) require that the customer to whom the in4 formation relates be provided with access to the con5 fidential customer information that could be dis6 closed or shared so that the information may be re7 viewed for accuracy and corrected or supplemented;

8 (6) require that, before a covered person may

9 use any confidential customer information provided

10 by a third party that engages, directly or indirectly,

11 in activities that are financial in nature, as deter12 mined by the Federal financial regulatory authori13 ties, the covered person shall take reasonable steps

14 to assure that procedures that are substantially

15 similar to those described in paragraphs (2) through

16 (5) have been followed by the provider of the infor17 mation (or an affiliate or agent of that provider).

18 (b) LIMITATION.—The rules prescribed pursuant to

19 subsection (a) may not prohibit the release of confidential

20 customer information—

21 (1) that is essential to processing a specific fi22 nancial transaction that the customer to whom the

23 information relates has authorized;

24 (2) to a governmental, regulatory, or self-regu25 latory authority having jurisdiction over the covered
5

•S 1195 IS

1 financial entity for examination, compliance, or other

2 authorized purposes;

3 (3) to a court of competent jurisdiction;

4 (4) to a consumer reporting agency, as defined

5 in section 603 of the Fair Credit Reporting Act for

6 inclusion in a consumer report that may be released

7 to a third party only for a purpose permissible under

8 section 604 of that Act; or

9 (5) that is not personally identifiable.

10 (c) CONSTRUCTION.—Nothing in this section or the

11 rules prescribed under this section shall be construed to

12 amend or alter any provisions of the Fair Credit Reporting

13 Act.

Æ