I 

118TH CONGRESS 

1ST SESSION H. R. 1165 

To amend the Gramm-Leach-Bliley Act to modernize the protection of the 

nonpublic personal information of individuals with whom financial institutions have customer or consumer relationship, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 24, 2023 

Mr. MCHENRY introduced the following bill; which was referred to the 

Committee on Financial Services 

A BILL 

To amend the Gramm-Leach-Bliley Act to modernize the 

protection of the nonpublic personal information of individuals with whom financial institutions have customer 

or consumer relationship, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Data Privacy Act of 2023’’. 

6 (b) TABLE OF CONTENTS.—The table of contents for 

7 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Protection of nonpublic personal information. 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•HR 1165 IH

Sec. 3. Obligations with respect to the collection and disclosure of nonpublic 

personal information. 

Sec. 4. Disclosure of institution privacy policy. 

Sec. 5. Rulemaking. 

Sec. 6. Relation to State laws. 

Sec. 7. Definitions. 

Sec. 8. Obligations with respect to access and deletion of nonpublic personal information. 

Sec. 9. Obligations with respect to the international sharing of nonpublic personal information. 

Sec. 10. Repeal of expired provisions. 

Sec. 11. GAO Report. 

Sec. 12. Sense of Congress. 

Sec. 13. Effective date. 

1 SEC. 2. PROTECTION OF NONPUBLIC PERSONAL INFORMA2 TION. 

3 Section 501 of the Gramm-Leach-Bliley Act (15 

4 U.S.C. 6801) is amended— 

5 (1) in subsection (a)— 

6 (A) by striking ‘‘of its customers’’ and in7 serting ‘‘of individuals with whom such finan8 cial institution has a customer or consumer re9 lationship’’; and 

10 (B) by striking ‘‘those customers’ non11 public personal information’’ and inserting 

12 ‘‘those individual’s nonpublic personal informa13 tion’’; and 

14 (2) by adding at the end the following: 

15 ‘‘(c) USE OF NONPUBLIC PERSONAL INFORMA16 TION.—It shall be unlawful for a financial institution to 

17 willfully use nonpublic personal information without the 

18 consent of an individual with whom the financial institu19 tion has a customer or consumer relationship.’’. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•HR 1165 IH

1 SEC. 3. OBLIGATIONS WITH RESPECT TO THE COLLECTION 

2 AND DISCLOSURE OF NONPUBLIC PERSONAL 

3 INFORMATION. 

4 (a) IN GENERAL.—Section 502 of the Gramm-Leach5 Bliley Act (15 U.S.C. 6802) is amended— 

6 (1) in the heading, by striking ‘‘DISCLOSURES

7 OF’’ and inserting ‘‘THE COLLECTION AND DIS8 CLOSURE OF NONPUBLIC’’; 

9 (2) in subsection (a)— 

10 (A) by inserting before ‘‘disclose’’ the fol11 lowing: ‘‘collect nonpublic personal information 

12 from an individual with whom such financial in13 stitution has a customer or consumer relation14 ship or’’; and 

15 (B) by striking ‘‘has provided to the con16 sumer’’ and inserting ‘‘has provided to such in17 dividual’’; and 

18 (3) in subsection (b), by amending paragraph 

19 (1) to read as follows: 

20 ‘‘(1) IN GENERAL.—A financial institution may 

21 not collect nonpublic personal information from an 

22 individual with whom such financial institution has 

23 a customer or consumer relationship or disclose non24 public personal information to a nonaffiliated third 

25 party unless the individual with whom such financial 

26 institution has a consumer or customer relationship 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•HR 1165 IH

1 is given the opportunity, before the time that such 

2 information is initially collected or disclosed, to di3 rect that such information not be collected or dis4 closed to such third party.’’; 

5 (4) in subsection (d)— 

6 (A) by striking ‘‘of a consumer’’ and in7 serting ‘‘of an individual with whom such finan8 cial institution has a customer or consumer re9 lationship’’; and 

10 (B) by striking ‘‘telemarketing, direct mail 

11 marketing, or other marketing through elec12 tronic mail to the consumer’’ and inserting 

13 ‘‘marketing to the individual with whom such fi14 nancial institution has a customer or consumer 

15 relationship, regardless of medium’’; 

16 (5) in subsection (e)— 

17 (A) by striking ‘‘(e) GENERAL EXCEP18 TIONS.—’’ and all that follows through the end 

19 of paragraph (2) and inserting the following: 

20 ‘‘(e) EXCEPTIONS.—The general collection and dis21 closure procedures provided in subsections (a) and (b) 

22 shall not prohibit or otherwise limit the collection or dis23 closure of nonpublic personal information— 

24 ‘‘(1) if the collection or disclosure is— 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•HR 1165 IH

1 ‘‘(A) necessary to effect, administer, or en2 force a transaction requested or authorized by 

3 the individual with whom the financial institu4 tion has a customer or consumer relationship; 

5 ‘‘(B) in connection with servicing or proc6 essing a financial product or service requested 

7 or authorized by the individual with whom the 

8 financial institution has a customer or con9 sumer relationship; 

10 ‘‘(C) with the consent or at the direction of 

11 the individual with whom the financial institu12 tion has a customer or consumer relationship, 

13 and the financial institution obtains, from such 

14 individual, evidence of such individual’s author15 ization for such collection or disclosure; or 

16 ‘‘(D) in connection with— 

17 ‘‘(i) maintaining or servicing the ac18 count, with such financial institution or 

19 with another entity as part of a private 

20 label or co-brand credit card program or 

21 an extension of credit on behalf of such en22 tity, of an individual with whom such fi23 nancial institution or entity has a customer 

24 or consumer relationship; 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•HR 1165 IH

1 ‘‘(ii) a proposed or actual 

2 securitization, secondary market sale (in3 cluding sales of servicing rights), or similar 

4 transaction related to an account or a 

5 transaction of the individual which whom 

6 such entity or financial institution has a 

7 customer or consumer relationship; or 

8 ‘‘(2) to a nonaffiliated third party to perform 

9 services for, or functions on behalf of, the financial 

10 institution, including marketing of the financial in11 stitution’s own products or services, or financial 

12 products or services offered pursuant to joint agree13 ments between two or more financial institutions 

14 that comply with the requirements imposed by the 

15 regulations prescribed under section 504, if the fi16 nancial institution fully discloses the providing of 

17 such information and enters into a contractual 

18 agreement with the third party that requires the 

19 third party to maintain the confidentiality of such 

20 information;’’; 

21 (B) in paragraph (3)— 

22 (i) in subparagraph (A)— 

23 (I) by striking ‘‘or security’’ and 

24 inserting ‘‘security, or integrity’’; 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•HR 1165 IH

1 (II) by striking ‘‘pertaining to 

2 the consumer’’ and inserting ‘‘per3 taining to the individual with whom 

4 the financial institution has a cus5 tomer or consumer relationship’’; 

6 (III) by inserting before the 

7 semicolon the following: ‘‘, as well as 

8 the systems, processes, and services 

9 that handle such records’’; 

10 (ii) in subparagraph (B), by inserting 

11 after ‘‘fraud,’’ the following: ‘‘identity 

12 theft,’’; 

13 (iii) in subparagraph (C), by striking 

14 ‘‘for resolving customer disputes or inquir15 ies’’ and inserting ‘‘for resolving disputes 

16 or inquires relating to individuals with 

17 whom the financial institution has a cus18 tomer or consumer relationship’’; 

19 (iv) in subparagraph (D), by striking 

20 ‘‘relating to the consumer’’ and inserting 

21 ‘‘relating to the individual with whom the 

22 financial institution has a customer or con23 sumer relationship’’; and 

24 (v) in subparagraph (E), by striking 

25 ‘‘behalf of the consumer’’ and inserting 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•HR 1165 IH

1 ‘‘behalf of the individual with whom the fi2 nancial institution has a customer or con3 sumer relationship’’; and 

4 (C) in paragraph (7)— 

5 (i) by striking ‘‘or exchange’’ and in6 serting ‘‘exchange, or similar transaction’’; 

7 (ii) by striking ‘‘consumers of such 

8 business or unit’’ and inserting ‘‘individ9 uals with whom such business or unit have 

10 a customer or consumer relationship’’; and 

11 (iii) by inserting ‘‘collection or’’ before 

12 ‘‘disclosure’’; 

13 (6) by adding at the end the following: 

14 ‘‘(f) NOTIFICATION TO NONAFFILIATES WHEN

15 SHARING IS TERMINATED.— 

16 ‘‘(1) IN GENERAL.—If a financial institution is 

17 required to terminate sharing nonpublic personal in18 formation, of an individual with whom such financial 

19 institution has a customer or consumer relationship, 

20 with a nonaffiliated third party— 

21 ‘‘(A) the financial institution shall notify 

22 the nonaffiliated third party that the sharing 

23 has been terminated and that such nonaffiliated 

24 third party may not share any nonpublic inforVerDate Sep 11 2014 22:48 Feb 24, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H1165.IH H1165

pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•HR 1165 IH

1 mation of the individual already received from 

2 the financial institution; and 

3 ‘‘(B) upon receipt of a notice described 

4 under subparagraph (A), the nonaffiliated third 

5 party may not share any nonpublic information 

6 of such individual already received from the fi7 nancial institution. 

8 ‘‘(2) RULEMAKING.—The agencies referred to 

9 in section 504 shall issue rules to establish the re10 quirements for notices under paragraph (1), includ11 ing the form of such notices, taking into account any 

12 privacy risks posed by such notices. 

13 ‘‘(g) REQUIREMENTS WITH RESPECT TO THE COL14 LECTION OF CONSUMER ACCOUNT CREDENTIALS.—A fi15 nancial institution may not collect from an individual with 

16 whom such financial institution has a customer or con17 sumer relationship account credentials such individual 

18 uses to access an account at a nonaffiliated third party 

19 that is a financial institution unless, prior to collecting the 

20 consumer account credentials— 

21 ‘‘(1) the financial institution clearly and con22 spicuously discloses to the consumer, in a form per23 mitted by the regulations prescribed under section 

24 504— 


pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•HR 1165 IH

1 ‘‘(A) that the financial institution is col2 lecting such account credentials; 

3 ‘‘(B) how such credentials will be used by 

4 the financial institution; and 

5 ‘‘(C) whether such credentials may be dis6 closed to a nonaffiliated third party; and 

7 ‘‘(2) such individual is given an opportunity to 

8 direct that such credentials not be collected or to di9 rect that such credentials not be disclosed to any 

10 nonaffiliated third party.’’. 

11 (b) CONFORMING AMENDMENT.—Section 509(3)(D) 

12 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809(3)(D)) 

13 is amended by striking ‘‘section 502(e)(1)(C)’’ and insert14 ing ‘‘section 502(e)(1)(D)(ii)’’. 

15 SEC. 4. DISCLOSURE OF INSTITUTION PRIVACY POLICY. 

16 Section 503 of the Gramm-Leach-Bliley Act (15 

17 U.S.C. 6803) is amended— 

18 (1) in subsection (a)— 

19 (A) by striking ‘‘customer relationship with 

20 a consumer’’ and inserting ‘‘customer or con21 sumer relationship’’; 

22 (B) by striking ‘‘clear and conspicuous dis23 closure to such consumer’’ and inserting ‘‘clear 

24 and conspicuous disclosure to such individual 


pbinns on DSKJLVW7X2PROD with $$_JOB
11 

•HR 1165 IH

1 with whom such financial institution has a cus2 tomer or consumer relationship’’; 

3 (C) by redesignating paragraphs (1), (2), 

4 and (3) as paragraphs (2), (3), and (4), respec5 tively; 

6 (D) by inserting before paragraph (2), as 

7 so redesignated, the following: 

8 ‘‘(1) collecting nonpublic personal informa9 tion;’’; 

10 (E) in paragraph (3), as so redesignated, 

11 by striking ‘‘have ceased to be customers of’’ 

12 and inserting ‘‘have ceased to have a customer 

13 or consumer relationship with’’; and 

14 (F) in paragraph (4), as so redesignated, 

15 by striking ‘‘personal information of con16 sumers’’ and inserting ‘‘personal information of 

17 individuals with whom such financial institution 

18 has a customer or consumer relationship’’; 

19 (2) by redesignating subsections (b) through (f) 

20 as subsections (c) through (g), respectively; 

21 (3) in paragraph (3), as so redesignated, by 

22 striking ‘‘ceased to be customers of the financial in23 stitution’’ and inserting ‘‘ceased to have a customer 

24 or consumer relationship with the financial institu25 tion’’; and 


pbinns on DSKJLVW7X2PROD with $$_JOB
12 

•HR 1165 IH

1 (4) in paragraph (4), as so redesignated, by 

2 striking ‘‘nonpublic personal information of con3 sumers’’ and inserting ‘‘nonpublic personal informa4 tion of individual with whom the financial institution 

5 has a customer or consumer relationship’’. 

6 (5) by inserting after subsection (a) the fol7 lowing: 

8 ‘‘(b) DISCLOSURE UPON REQUEST.—Upon the re9 quest of an individual with whom a financial institution 

10 has a customer or consumer relationship, a financial insti11 tution shall provide such individual with a copy of the dis12 closures required by subsection (a) in writing or in elec13 tronic or other form as permitted by the regulations pre14 scribed under section 504.’’; and 

15 (6) in subsection (d), as so redesignated— 

16 (A) in paragraph (1)— 

17 (i) by inserting ‘‘collecting or’’ before 

18 ‘‘disclosing nonpublic’’; and 

19 (ii) by striking subparagraph (B) and 

20 inserting the following: 

21 ‘‘(B) the purpose for which the financial 

22 institution collects the nonpublic personal infor23 mation of individuals with whom the financial 

24 institution has a customer or consumer rela25 tionship, as well as how the data will be used;’’; 


pbinns on DSKJLVW7X2PROD with $$_JOB
13 

•HR 1165 IH

1 (B) in paragraph (2), by inserting before 

2 the semicolon the following: ‘‘, provided in a 

3 manner that provides individuals with whom the 

4 financial institution has a customer or con5 sumer relationship a meaningful understanding 

6 of the information that is collected’’; 

7 (C) in paragraph (3), by striking ‘‘and’’ at 

8 the end; 

9 (D) in paragraph (4), by striking the pe10 riod at the end and inserting a semicolon; and 

11 (E) by adding at the end the following: 

12 ‘‘(5) if the financial institution collects non13 public personal information for any purpose other 

14 than to provide a specific product or service such an 

15 individual is seeking— 

16 ‘‘(A) a description of such information; 

17 ‘‘(B) the purpose for which such informa18 tion is collected; and 

19 ‘‘(C) the right of such individual to opt out 

20 of having such nonpublic personal information 

21 collected or disclosed to a nonaffiliated third 

22 party, and the manner in which such individual 

23 may make such opt out election; 

24 ‘‘(6) the data retention policies of the financial 

25 institution, including the period of time for which 


pbinns on DSKJLVW7X2PROD with $$_JOB
14 

•HR 1165 IH

1 the institution retains the nonpublic personal infor2 mation relating to such individual; 

3 ‘‘(7) the right of such individual to direct the 

4 financial institution to terminate the sharing of non5 public personal information with a nonaffiliated 

6 third party, and the manner in which such individual 

7 may make such direction; 

8 ‘‘(8) the right of such individual to request that 

9 the financial institution provide the individual with 

10 a list of all nonpublic personal information relating 

11 to the individual held by the financial institution, 

12 and the manner in which the individual may make 

13 such request; and 

14 ‘‘(9) the right of such individual to direct the 

15 financial institution to delete nonpublic personal in16 formation of the individual held by the financial in17 stitution (subject to the exceptions provided under 

18 section 502A(b)(3)), and the manner in which the 

19 individual may make such direction.’’; 

20 (7) in subsection (f), as so redesignated— 

21 (A) in paragraph 2(A), by striking ‘‘to con22 sumers’’ and inserting ‘‘to individuals with 

23 whom a financial institution has a customer or 

24 consumer relationship’’; and 


pbinns on DSKJLVW7X2PROD with $$_JOB
15 

•HR 1165 IH

1 (B) in paragraph 2(C), by striking ‘‘enable 

2 consumers’’ and inserting ‘‘enable individuals 

3 with whom a financial institution has a cus4 tomer or consumer relationship’’; and 

5 (8) in subsection (g), as so redesignated, by 

6 striking ‘‘sent to consumers’’ and inserting ‘‘sent to 

7 individuals with whom a financial institution has a 

8 customer or consumer relationship’’. 

9 SEC. 5. RULEMAKING. 

10 Section 504 of the Gramm-Leach-Bliley Act (15 

11 U.S.C. 6804) is amended— 

12 (1) in subsection (a)(1)— 

13 (A) by striking subparagraph (D) and in14 serting the following: 

15 ‘‘(D) INSURANCE.— 

16 ‘‘(i) IN GENERAL.—With respect to 

17 any person engaged in providing insurance, 

18 the applicable State insurance authority of 

19 the State in which the person is domiciled 

20 shall issue regulations as may be necessary 

21 to carry out the purposes of this subtitle, 

22 subject to section 505(c). 

23 ‘‘(ii) LIMITATION.—Regulations 

24 issued by a State insurance authority 

25 under this subparagraph may be no more 


pbinns on DSKJLVW7X2PROD with $$_JOB
16 

•HR 1165 IH

1 restrictive for a person engaged in pro2 viding insurance than those regulations 

3 issued by the agencies coordinating for 

4 consistency and comparability under para5 graph (2).’’; and 

6 (2) by adding at the end the following: 

7 ‘‘(c) CONSIDERATION OF COMPLIANCE COSTS.— 

8 When prescribing rules under this subtitle, agencies shall 

9 take into account the compliance cost such rules will im10 pose on small institutions.’’. 

11 SEC. 6. RELATION TO STATE LAWS. 

12 Section 507 of the Gramm-Leach-Bliley Act (15 

13 U.S.C. 6807) is amended to read as follows: 

14 ‘‘SEC. 507. RELATION TO STATE LAWS. 

15 ‘‘This subtitle and the amendments made by this sub16 title supersede any statute or rule of a State or political 

17 subdivision thereof that regulates the obligations of a fi18 nancial institution with respect to— 

19 ‘‘(1) the collection or disclosure of personal in20 formation; 

21 ‘‘(2) the disclosure of the financial institution’s 

22 privacy policy or information about the financial in23 stitution’s privacy policies and practices; 


pbinns on DSKJLVW7X2PROD with $$_JOB
17 

•HR 1165 IH

1 ‘‘(3) the access to, deletion of, or other indi2 vidual privacy rights with respect to personal infor3 mation; or 

4 ‘‘(4) the international sharing of personal infor5 mation.’’. 

6 SEC. 7. DEFINITIONS. 

7 Section 509 of the Gramm-Leach-Bliley Act (15 

8 U.S.C. 6809) is amended— 

9 (1) in paragraph (3)(A), by inserting before the 

10 period at the end the following: ‘‘and includes a data 

11 aggregator’’; 

12 (2) in paragraph (4), by striking ‘‘personally 

13 identifiable financial information’’ and inserting ‘‘in14 formation that identifies, relates to, describes, is rea15 sonably capable of being associated with, or could 

16 reasonably be linked, directly or indirectly, with a 

17 particular individual and is’’; 

18 (3) in paragraph (7), by inserting ‘‘collection 

19 or’’ before ‘‘disclosure’’ each place such term ap20 pears; 

21 (4) by striking paragraph (9); 

22 (5) by amending paragraph (11) to read as fol23 lows: 

24 ‘‘(11) CUSTOMER OR CONSUMER RELATION25 SHIP.— 


pbinns on DSKJLVW7X2PROD with $$_JOB
18 

•HR 1165 IH

1 ‘‘(A) IN GENERAL.—The term ‘customer 

2 or consumer relationship’ means a customer re3 lationship or a consumer relationship. 

4 ‘‘(B) CUSTOMER RELATIONSHIP.—The 

5 term ‘customer relationship’ shall have the 

6 meaning given the term in rules issued pursu7 ant to section 504. 

8 ‘‘(C) CONSUMER RELATIONSHIP.—The 

9 term ‘consumer relationship’ shall have the 

10 meaning given the term in rules issued pursu11 ant to section 504 and such meaning shall— 

12 ‘‘(i) include situations in which a fi13 nancial institution obtains nonpublic infor14 mation from an individual with whom the 

15 financial institution does not have a cus16 tomer relationship; and 

17 ‘‘(ii) deem a financial institution to no 

18 longer to be in a consumer relationship 

19 with an individual at such time as the fi20 nancial institution no longer collects, con21 trols, possesses, transmits, or maintains 

22 any nonpublic personal information of such 

23 individual. 

24 ‘‘(D) TREATMENT OF CERTAIN TRANS25 ACTIONS.—When the terms ‘customer relationVerDate Sep 11 2014 22:48 Feb 24, 2023 Jkt 039200 PO 00000 Frm 00018 Fmt 6652 Sfmt 6201 E:\BILLS\H1165.IH H1165

pbinns on DSKJLVW7X2PROD with $$_JOB
19 

•HR 1165 IH

1 ship’ and ‘consumer relationship’are defined by 

2 rule, it shall be specified that the following 

3 transactions do not, by themselves, establish a 

4 consumer relationship or a consumer relation5 ship: 

6 ‘‘(i) The use of an automated teller 

7 machine. 

8 ‘‘(ii) The use of a credit card or debit 

9 card to make a purchase. 

10 ‘‘(iii) Such other similar transactions 

11 as the agencies determine appropriate.’’; 

12 and 

13 (6) by adding at the end the following: 

14 ‘‘(12) ACCOUNT CREDENTIALS.—The term ‘ac15 count credentials’ means nonpublic information that 

16 an individual with whom a financial institution has 

17 a customer or consumer relationship uses to access 

18 an account of the individual at such financial insti19 tution, including a username, password, or an an20 swer to a security question. 

21 ‘‘(13) DATA AGGREGATOR.—The term ‘data 

22 aggregator’— 

23 ‘‘(A) means any person that operates a 

24 commercial business or enterprise for the busi25 ness purpose of accessing, aggregating, colVerDate Sep 11 2014 22:48 Feb 24, 2023 Jkt 039200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6201 E:\BILLS\H1165.IH H1165

pbinns on DSKJLVW7X2PROD with $$_JOB
20 

•HR 1165 IH

1 lecting, selling, or sharing nonpublic personal 

2 information about financial accounts or trans3 actions, relating to an individual; and 

4 ‘‘(B) does not include— 

5 ‘‘(i) a service provider acting at the 

6 express instruction of a financial institu7 tion, that accesses, aggregates, collects, or 

8 shares nonpublic personal information 

9 about an individual with whom such finan10 cial institution has a customer or consumer 

11 relationship in accordance with paragraphs 

12 (1), (2), (3)(A), (3)(B), (3)(C), (3)(D), or 

13 (6) of section 502(2); or 

14 ‘‘(ii) an attorney or accountant acting 

15 on behalf of an individual with whom such 

16 attorney or accountant has a customer or 

17 consumer relationship, in accordance with 

18 section 502(e)(3)(E). 

19 ‘‘(14) PERSON ENGAGED IN PROVIDING INSUR20 ANCE.—The term ‘person engaged in providing in21 surance’ means a person that engages in the ‘busi22 ness of insurance’, as that term is defined in section 

23 1002 of the Dodd-Frank Wall Street Reform and 

24 Consumer Protection Act (12 U.S.C. 5481).’’. 


pbinns on DSKJLVW7X2PROD with $$_JOB
21 

•HR 1165 IH

1 SEC. 8. OBLIGATIONS WITH RESPECT TO ACCESS AND DE2 LETION OF NONPUBLIC PERSONAL INFORMA3 TION. 

4 (a) IN GENERAL.—Title V of the Gramm-Leach-Bli5 ley Act (15 U.S.C. 6801 et seq.) is amended by inserting 

6 after section 502 the following: 

7 ‘‘SEC. 502A. OBLIGATIONS WITH RESPECT TO ACCESS AND 

8 DELETION OF NONPUBLIC PERSONAL INFOR9 MATION. 

10 ‘‘(a) ACCESS TO INFORMATION.— 

11 ‘‘(1) IN GENERAL.—Upon an authorized re12 quest from an individual with whom a financial in13 stitution has a customer or consumer relationship, a 

14 financial institution shall disclose— 

15 ‘‘(A) any nonpublic personal information 

16 relating to such individual held by the financial 

17 institution; 

18 ‘‘(B) the list of categories of nonaffiliated 

19 third parties with whom the financial institution 

20 shares nonpublic personal information relating 

21 to such individual; and 

22 ‘‘(C) the list of categories of nonaffiliated 

23 third parties from whom the financial institu24 tion has received nonpublic personal informa25 tion relating to such individual. 


pbinns on DSKJLVW7X2PROD with $$_JOB
22 

•HR 1165 IH

1 ‘‘(2) FORMAT.—Disclosures described under 

2 paragraph (1) shall be in a structured, commonly 

3 used, and machine-readable format. 

4 ‘‘(3) EXCEPTION.—For purposes of subpara5 graphs (B) and (C) of paragraph (1), a financial in6 stitution is not required to disclose a nonaffiliated 

7 third party with whom the financial institution 

8 shares or receives nonpublic personal information re9 lating to such individual pursuant to an exception 

10 described under any of paragraphs (3) through (8) 

11 of section 502(e). 

12 ‘‘(b) DELETION OF INFORMATION.— 

13 ‘‘(1) IN GENERAL.—Upon an authorized re14 quest from an individual with whom a financial in15 stitution has a customer or consumer relationship, a 

16 financial institution shall delete any nonpublic per17 sonal information relating to such individual held by 

18 the financial institution. 

19 ‘‘(2) CERTAIN INACTIVE ACCOUNTS.—If such 

20 individual has not used a product or service provided 

21 by a financial institution for 1 year, the financial in22 stitution shall— 

23 ‘‘(A) notify such individual that such indi24 vidual has the right to request the deletion of 

25 any nonpublic personal information relating to 


pbinns on DSKJLVW7X2PROD with $$_JOB
23 

•HR 1165 IH

1 such individual held by the financial institution, 

2 and provide such individual with clear instruc3 tions on how to make such request; and 

4 ‘‘(B) for each additional 1-year period with 

5 respect to which such person continues to not 

6 use a product or service of the financial institu7 tion, resend the notice described under subpara8 graph (A). 

9 ‘‘(3) EXCEPTION.— 

10 ‘‘(A) IN GENERAL.—This subsection shall 

11 not require a financial institution to delete non12 public personal information if— 

13 ‘‘(i) the financial institution is other14 wise required by law to retain the non15 public personal information; 

16 ‘‘(ii) the nonpublic personal informa17 tion may be necessary to respond to a dis18 pute under the Fair Credit Reporting Act; 

19 or 

20 ‘‘(iii) the nonpublic personal informa21 tion may be necessary to retain for a pur22 pose described in an exception under sec23 tion 502(e). 

24 ‘‘(B) LIMITATION ON RETAINED NON25 PUBLIC PERSONAL INFORMATION.—With reVerDate Sep 11 2014 22:48 Feb 24, 2023 Jkt 039200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6201 E:\BILLS\H1165.IH H1165

pbinns on DSKJLVW7X2PROD with $$_JOB
24 

•HR 1165 IH

1 spect to nonpublic personal information that a 

2 financial institution would be required to delete 

3 under this subsection but for the application of 

4 this paragraph, the financial institution may 

5 only use such nonpublic personal information 

6 for the applicable purpose described under sub7 paragraph (A). 

8 ‘‘(c) TIMING.—A financial institution that receives an 

9 authorized request, under this section, from an individual 

10 with whom such financial institution has a customer or 

11 consumer relationship, shall respond within 45 business 

12 days. 

13 ‘‘(d) RULEMAKING.—Not later than the end of the 

14 1-year period beginning on the date of enactment of this 

15 section, each agency or authority described in section 504 

16 shall issue rules to carry out this section with respect to 

17 the financial institutions subject to its jurisdiction.’’. 

18 (b) CLERICAL AMENDMENT.—The table of contents 

19 in section 1(b) of the Gramm-Leach-Bliley Act is amended 

20 by inserting after the item relating to section 502 the fol21 lowing: 

‘‘Sec. 502A. Obligations with respect to access and deletion of nonpublic personal information.’’. 


pbinns on DSKJLVW7X2PROD with $$_JOB
25 

•HR 1165 IH

1 SEC. 9. OBLIGATIONS WITH RESPECT TO THE INTER2 NATIONAL SHARING OF NONPUBLIC PER3 SONAL INFORMATION. 

4 (a) IN GENERAL.—Title V of the Gramm-Leach-Bli5 ley Act (15 U.S.C. 6801 et seq.), as amended by section 

6 10, is further amended by inserting after section 502A 

7 the following: 

8 ‘‘SEC. 502B. OBLIGATIONS WITH RESPECT TO THE INTER9 NATIONAL SHARING OF NONPUBLIC PER10 SONAL INFORMATION. 

11 ‘‘(a) IN GENERAL.—A financial institution may not 

12 share with a foreign government nonpublic personal infor13 mation relating to an individual with whom such financial 

14 institution has a customer or consumer relationship. 

15 ‘‘(b) LAW ENFORCEMENT EXCEPTION.—Subsection 

16 (a) shall not apply to the sharing of the nonpublic personal 

17 information relating to such an individual with a foreign 

18 government authority if such sharing is— 

19 ‘‘(1) done for legitimate law enforcement pur20 poses; or 

21 ‘‘(2) to a foreign government authority having 

22 jurisdiction over the financial institution for exam23 ination, compliance, or other purposes as authorized 

24 by law.’’. 

25 (b) CLERICAL AMENDMENT.—The table of contents 

26 in section 1(b) of the Gramm-Leach-Bliley Act, as amendVerDate Sep 11 2014 22:48 Feb 24, 2023 Jkt 039200 PO 00000 Frm 00025 Fmt 6652 Sfmt 6201 E:\BILLS\H1165.IH H1165

pbinns on DSKJLVW7X2PROD with $$_JOB
26 

•HR 1165 IH

1 ed by section 10, is further amended by inserting after 

2 the item relating to section 502A the following: 

‘‘Sec. 502B. Obligations with respect to the international sharing of nonpublic 

personal information’’. 

3 SEC. 10. REPEAL OF EXPIRED PROVISIONS. 

4 The Gramm-Leach-Bliley Act is amended— 

5 (1) by striking section 508 (15 U.S.C. 6808); 

6 and 

7 (2) in the table of contents in section 1(b), by 

8 striking the item relating to section 508. 

9 SEC. 11. GAO REPORT. 

10 The Comptroller General of the United States shall, 

11 not later than 1 year after the date of the enactment of 

12 this Act, submit to the Congress a report that assesses— 

13 (1) whether the safeguard standards promul14 gated pursuant to section 501 of the Gramm-Leach15 Bliley Act, including but not limited to protecting 

16 against unauthorized disclosure, are effective in pro17 tecting individuals with whom financial institutions 

18 have a customer or consumer relationship; and 

19 (2) whether the enforcement regime with re20 spect to those standards are effective in protecting 

21 customers and consumers, and whether additional 

22 remedies are necessary. 


pbinns on DSKJLVW7X2PROD with $$_JOB
27 

•HR 1165 IH

1 SEC. 12. SENSE OF CONGRESS. 

2 It is the sense of the Congress that the Federal agen3 cies implementing the Gramm-Leach-Bliley Act should im4 plement such Act, to the extent possible, in a technology5 agnostic manner so as to ensure it can adapt to different 

6 business models and technologies. 

7 SEC. 13. EFFECTIVE DATE. 

8 The amendments made by this Act shall take effect 

9 on the date that is the earlier of— 

10 (1) the date that is one year after the date on 

11 which all rulemaking required under this Act is com12 plete; or 

13 (2) the date that is 2 years after the date of the 

14 enactment of this Act. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB