IB 

Union Calendar No. 673 

118TH CONGRESS 

2D SESSION H. R. 1165 

[Report No. 118–822] 

To amend the Gramm-Leach-Bliley Act to modernize the protection of the 

nonpublic personal information of individuals with whom financial institutions have customer or consumer relationship, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 24, 2023 

Mr. MCHENRY introduced the following bill; which was referred to the 

Committee on Financial Services 

DECEMBER 5, 2024 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on February 24, 2023] 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•HR 1165 RH

A BILL 

To amend the Gramm-Leach-Bliley Act to modernize the 

protection of the nonpublic personal information of individuals with whom financial institutions have customer 

or consumer relationship, and for other purposes. 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•HR 1165 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Data Privacy Act of 2023’’. 

6 (b) TABLE OF CONTENTS.—The table of contents for 

7 this Act is as follows: 

Sec. 1. Short title; table of contents. 

Sec. 2. Protection of nonpublic personal information. 

Sec. 3. Obligations with respect to the collection and disclosure of nonpublic personal information. 

Sec. 4. Disclosure of institution privacy policy. 

Sec. 5. Rulemaking. 

Sec. 6. Relation to State laws. 

Sec. 7. Obligations with respect to access and deletion of nonpublic personal information. 

Sec. 8. Obligations with respect to the international sharing of nonpublic personal information. 

Sec. 9. Definitions. 

Sec. 10. Repeal of expired provisions. 

Sec. 11. GAO Report. 

Sec. 12. Sense of Congress. 

Sec. 13. Effective date. 

8 SEC. 2. PROTECTION OF NONPUBLIC PERSONAL INFORMA9 TION. 

10 Section 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 

11 6801) is amended— 

12 (1) in subsection (a)— 

13 (A) by striking ‘‘of its customers’’ and in14 serting ‘‘of individuals with whom such financial 

15 institution has a customer or consumer relation16 ship’’; and 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•HR 1165 RH

1 (B) by striking ‘‘those customers’ nonpublic 

2 personal information’’ and inserting ‘‘those indi3 vidual’s nonpublic personal information’’; and 

4 (2) by adding at the end the following: 

5 ‘‘(c) USE OF NONPUBLIC PERSONAL INFORMATION.— 

6 Unless otherwise permitted under section 502(e), it shall be 

7 unlawful for a financial institution to willfully use non8 public personal information without the consent of an indi9 vidual with whom the financial institution has a customer 

10 or consumer relationship.’’. 

11 SEC. 3. OBLIGATIONS WITH RESPECT TO THE COLLECTION 

12 AND DISCLOSURE OF NONPUBLIC PERSONAL 

13 INFORMATION. 

14 (a) IN GENERAL.—Section 502 of the Gramm-Leach15 Bliley Act (15 U.S.C. 6802) is amended— 

16 (1) in the heading, by striking ‘‘DISCLOSURES

17 OF’’ and inserting ‘‘THE COLLECTION AND DIS18 CLOSURE OF NONPUBLIC’’; 

19 (2) in subsection (a)— 

20 (A) by inserting before ‘‘disclose’’ the fol21 lowing: ‘‘collect nonpublic personal information 

22 from an individual with whom such financial 

23 institution has a customer or consumer relation24 ship or’’; and 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•HR 1165 RH

1 (B) by striking ‘‘has provided to the con2 sumer’’ and inserting ‘‘has provided to such in3 dividual’’; and 

4 (3) in subsection (b), by amending paragraph 

5 (1) to read as follows: 

6 ‘‘(1) IN GENERAL.—A financial institution may 

7 not collect nonpublic personal information from an 

8 individual with whom such financial institution has 

9 a customer or consumer relationship or disclose non10 public personal information to a nonaffiliated third 

11 party unless the individual with whom such financial 

12 institution has a consumer or customer relationship 

13 is given the opportunity, before the time that such in14 formation is initially collected or disclosed, to direct 

15 that such information not be collected or disclosed to 

16 such third party.’’; 

17 (4) in subsection (d)— 

18 (A) by striking ‘‘of a consumer’’ and insert19 ing ‘‘of an individual with whom such financial 

20 institution has a customer or consumer relation21 ship’’; and 

22 (B) by striking ‘‘telemarketing, direct mail 

23 marketing, or other marketing through electronic 

24 mail to the consumer’’ and inserting ‘‘marketing 

25 to the individual with whom such financial inVerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165

ssavage on LAPJG3WLY3PROD with BILLS
6 

•HR 1165 RH

1 stitution has a customer or consumer relation2 ship, regardless of medium’’; 

3 (5) in subsection (e)— 

4 (A) in the heading, by striking ‘‘GENERAL’’; 

5 (B) by striking ‘‘Subsections (a) and (b) 

6 shall not prohibit the disclosure of nonpublic 

7 personal information’’ and inserting ‘‘The gen8 eral collection and disclosure procedures provided 

9 in subsections (a) and (b) shall not prohibit or 

10 otherwise limit the collection or disclosure of 

11 nonpublic personal information’’; 

12 (C) by striking paragraphs (1) and (2) and 

13 inserting the following: 

14 ‘‘(1) if the collection or disclosure is— 

15 ‘‘(A) necessary to effect, administer, or en16 force a transaction requested or authorized by the 

17 individual with whom the financial institution 

18 has a customer or consumer relationship; 

19 ‘‘(B) in connection with servicing or proc20 essing a financial product or service requested or 

21 authorized by the individual with whom the fi22 nancial institution has a customer or consumer 

23 relationship; 

24 ‘‘(C) with the consent or at the direction of 

25 the individual with whom the financial instituVerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165

ssavage on LAPJG3WLY3PROD with BILLS
7 

•HR 1165 RH

1 tion has a customer or consumer relationship, 

2 and the financial institution obtains, from such 

3 individual, evidence of such individual’s author4 ization for such collection or disclosure; or 

5 ‘‘(D) in connection with— 

6 ‘‘(i) maintaining or servicing the ac7 count, with such financial institution or 

8 with another entity as part of a private 

9 label or co-brand credit card program or an 

10 extension of credit on behalf of such entity, 

11 of an individual with whom such financial 

12 institution or entity has a customer or con13 sumer relationship; or 

14 ‘‘(ii) a proposed or actual 

15 securitization, secondary market sale (in16 cluding sales of servicing rights), or similar 

17 transaction related to an account or a 

18 transaction of the individual which whom 

19 such entity or financial institution has a 

20 customer or consumer relationship; or 

21 ‘‘(2) to a nonaffiliated third party to perform 

22 services for, or functions on behalf of, the financial in23 stitution, including marketing of the financial insti24 tution’s own products or services, or financial prod25 ucts or services offered pursuant to joint agreements 


ssavage on LAPJG3WLY3PROD with BILLS
8 

•HR 1165 RH

1 between two or more financial institutions that com2 ply with the requirements imposed by the regulations 

3 prescribed under section 504, if the financial institu4 tion fully discloses the providing of such information 

5 and enters into a contractual agreement with the 

6 third party that requires the third party to maintain 

7 the confidentiality of such information;’’; 

8 (D) in paragraph (3)— 

9 (i) in subparagraph (A)— 

10 (I) by striking ‘‘or security’’ and 

11 inserting ‘‘, security, or integrity’’; 

12 (II) by striking ‘‘pertaining to the 

13 consumer’’ and inserting ‘‘pertaining 

14 to the individual with whom the finan15 cial institution has a customer or con16 sumer relationship’’; 

17 (III) by inserting before the semi18 colon the following: ‘‘, as well as the 

19 systems, processes, and services that 

20 handle such records’’; 

21 (ii) in subparagraph (B), by inserting 

22 after ‘‘fraud,’’ the following: ‘‘identity 

23 theft,’’; 

24 (iii) in subparagraph (C), by striking 

25 ‘‘for resolving customer disputes or inquirVerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165

ssavage on LAPJG3WLY3PROD with BILLS
9 

•HR 1165 RH

1 ies’’ and inserting ‘‘for resolving disputes or 

2 inquires relating to individuals with whom 

3 the financial institution has a customer or 

4 consumer relationship’’; 

5 (iv) in subparagraph (D), by striking 

6 ‘‘relating to the consumer’’ and inserting 

7 ‘‘relating to the individual with whom the 

8 financial institution has a customer or con9 sumer relationship’’; and 

10 (v) in subparagraph (E), by striking 

11 ‘‘behalf of the consumer’’ and inserting ‘‘be12 half of the individual with whom the finan13 cial institution has a customer or consumer 

14 relationship’’; and 

15 (E) in paragraph (7)— 

16 (i) by striking ‘‘or exchange’’ and in17 serting ‘‘exchange, or similar transaction’’; 

18 (ii) by striking ‘‘consumers of such 

19 business or unit’’ and inserting ‘‘individ20 uals with whom such business or unit have 

21 a customer or consumer relationship’’; and 

22 (iii) by inserting ‘‘collection or’’ before 

23 ‘‘disclosure’’; 

24 (6) by adding at the end the following: 


ssavage on LAPJG3WLY3PROD with BILLS
10 

•HR 1165 RH

1 ‘‘(f) NOTIFICATION TO NONAFFILIATES WHEN SHAR2 ING IS TERMINATED.— 

3 ‘‘(1) IN GENERAL.—If a financial institution is 

4 required to terminate sharing nonpublic personal in5 formation, of an individual with whom such financial 

6 institution has a customer or consumer relationship, 

7 with a nonaffiliated third party— 

8 ‘‘(A) the financial institution shall notify 

9 the nonaffiliated third party that the sharing has 

10 been terminated and that such nonaffiliated 

11 third party may not share any nonpublic infor12 mation of the individual already received from 

13 the financial institution; and 

14 ‘‘(B) upon receipt of a notice described 

15 under subparagraph (A), the nonaffiliated third 

16 party may not share any nonpublic information 

17 of such individual already received from the fi18 nancial institution. 

19 ‘‘(2) RULEMAKING.—The agencies referred to in 

20 section 504 shall issue rules to establish the require21 ments for notices under paragraph (1), including the 

22 form of such notices, taking into account any privacy 

23 risks posed by such notices. 

24 ‘‘(g) REQUIREMENTS WITH RESPECT TO THE COLLEC25 TION OF ACCOUNT CREDENTIALS.—A financial institution 


ssavage on LAPJG3WLY3PROD with BILLS
11 

•HR 1165 RH

1 may not collect from an individual with whom such finan2 cial institution has a customer or consumer relationship ac3 count credentials such individual uses to access an account 

4 at a nonaffiliated third party that is a financial institution 

5 unless, prior to collecting the account credentials— 

6 ‘‘(1) the financial institution clearly and con7 spicuously discloses to the individual, in a form per8 mitted by the regulations prescribed under section 

9 504— 

10 ‘‘(A) that the financial institution is col11 lecting such account credentials; 

12 ‘‘(B) how such credentials will be used by 

13 the financial institution; and 

14 ‘‘(C) whether such credentials may be dis15 closed to a nonaffiliated third party; and 

16 ‘‘(2) such individual is given an opportunity to 

17 direct that such credentials not be collected or to di18 rect that such credentials not be disclosed to any non19 affiliated third party.’’. 

20 (b) CONFORMING AMENDMENT.—Section 509(3)(D) of 

21 the Gramm-Leach-Bliley Act (15 U.S.C. 6809(3)(D)) is 

22 amended by striking ‘‘section 502(e)(1)(C)’’ and inserting 

23 ‘‘section 502(e)(1)(D)(ii)’’. 


ssavage on LAPJG3WLY3PROD with BILLS
12 

•HR 1165 RH

1 SEC. 4. DISCLOSURE OF INSTITUTION PRIVACY POLICY. 

2 Section 503 of the Gramm-Leach-Bliley Act (15 U.S.C. 

3 6803) is amended— 

4 (1) in subsection (a)— 

5 (A) by striking ‘‘customer relationship with 

6 a consumer’’ and inserting ‘‘customer or con7 sumer relationship’’; 

8 (B) by striking ‘‘clear and conspicuous dis9 closure to such consumer’’ and inserting ‘‘clear 

10 and conspicuous disclosure to such individual 

11 with whom such financial institution has a cus12 tomer or consumer relationship’’; 

13 (C) by redesignating paragraphs (1), (2), 

14 and (3) as paragraphs (2), (3), and (4), respec15 tively; 

16 (D) by inserting before paragraph (2), as so 

17 redesignated, the following: 

18 ‘‘(1) collecting nonpublic personal information;’’; 

19 (E) in paragraph (3), as so redesignated, by 

20 striking ‘‘have ceased to be customers of’’ and in21 serting ‘‘have ceased to have a customer or con22 sumer relationship with’’; and 

23 (F) in paragraph (4), as so redesignated, by 

24 striking ‘‘personal information of consumers’’ 

25 and inserting ‘‘personal information of individVerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165

ssavage on LAPJG3WLY3PROD with BILLS
13 

•HR 1165 RH

1 uals with whom such financial institution has a 

2 customer or consumer relationship’’; 

3 (2) by redesignating subsections (b) through (f) 

4 as subsections (c) through (g), respectively; 

5 (3) by inserting after subsection (a) the fol6 lowing: 

7 ‘‘(b) DISCLOSURE UPON REQUEST.—Upon the request 

8 of an individual with whom a financial institution has a 

9 customer or consumer relationship, a financial institution 

10 shall provide such individual with a copy of the disclosures 

11 required by subsection (a) in writing or in electronic or 

12 other form as permitted by the regulations prescribed under 

13 section 504.’’; and 

14 (4) in subsection (d), as so redesignated— 

15 (A) in paragraph (1)— 

16 (i) by inserting ‘‘collecting or’’ before 

17 ‘‘disclosing nonpublic’’; and 

18 (ii) by striking subparagraph (B) and 

19 inserting the following: 

20 ‘‘(B) the purpose for which the financial in21 stitution collects the nonpublic personal informa22 tion of individuals with whom the financial in23 stitution has a customer or consumer relation24 ship, as well as how the information will be 

25 used;’’; 


ssavage on LAPJG3WLY3PROD with BILLS
14 

•HR 1165 RH

1 (B) in paragraph (2), by inserting before 

2 the semicolon the following: ‘‘, provided in a 

3 manner that provides individuals with whom the 

4 financial institution has a customer or consumer 

5 relationship a meaningful understanding of the 

6 information that is collected’’; 

7 (C) in paragraph (3), by striking ‘‘and’’ at 

8 the end; 

9 (D) in paragraph (4), by striking the pe10 riod at the end and inserting a semicolon; and 

11 (E) by adding at the end the following: 

12 ‘‘(5) if the financial institution collects non13 public personal information for any purpose other 

14 than to provide a specific product or service such an 

15 individual is seeking— 

16 ‘‘(A) a description of such information; 

17 ‘‘(B) the purpose for which such informa18 tion is collected; and 

19 ‘‘(C) the right of such individual to opt out 

20 of having such nonpublic personal information 

21 collected or disclosed to a nonaffiliated third 

22 party, and the manner in which such individual 

23 may make such opt out election; 

24 ‘‘(6) the data retention policies of the financial 

25 institution, including— 


ssavage on LAPJG3WLY3PROD with BILLS
15 

•HR 1165 RH

1 ‘‘(A) the period of time for which the finan2 cial institution retains the nonpublic personal 

3 information relating to such individual; or 

4 ‘‘(B) the criteria used by the financial insti5 tution to determine the period of time for which 

6 such information is retained; 

7 ‘‘(7) the right of such individual to direct the fi8 nancial institution to terminate the sharing of non9 public personal information with a nonaffiliated 

10 third party, and the manner in which such indi11 vidual may make such direction; 

12 ‘‘(8) the right of such individual to request that 

13 the financial institution provide the individual with 

14 a list of all nonpublic personal information relating 

15 to the individual held by the financial institution, 

16 and the manner in which the individual may make 

17 such request; and 

18 ‘‘(9) the right of such individual to direct the fi19 nancial institution to delete nonpublic personal infor20 mation of the individual held by the financial institu21 tion (subject to the exceptions provided under section 

22 502A(b)(3)), and the manner in which the individual 

23 may make such direction.’’; 

24 (5) in subsection (f), as so redesignated— 


ssavage on LAPJG3WLY3PROD with BILLS
16 

•HR 1165 RH

1 (A) in paragraph (2)(A), by striking ‘‘to 

2 consumers’’ and inserting ‘‘to individuals with 

3 whom a financial institution has a customer or 

4 consumer relationship’’; and 

5 (B) in paragraph (2)(C), by striking ‘‘en6 able consumers’’ and inserting ‘‘enable individ7 uals with whom a financial institution has a 

8 customer or consumer relationship’’; and 

9 (6) in subsection (g), as so redesignated, by strik10 ing ‘‘sent to consumers’’ and inserting ‘‘sent to indi11 viduals with whom a financial institution has a cus12 tomer or consumer relationship’’. 

13 SEC. 5. RULEMAKING. 

14 Section 504 of the Gramm-Leach-Bliley Act (15 U.S.C. 

15 6804) is amended— 

16 (1) in subsection (a)(1)— 

17 (A) by striking subparagraph (D) and in18 serting the following: 

19 ‘‘(D) INSURANCE.— 

20 ‘‘(i) IN GENERAL.—With respect to any 

21 person engaged in providing insurance, the 

22 applicable State insurance authority of the 

23 State in which the person is domiciled shall 

24 issue regulations as may be necessary to 


ssavage on LAPJG3WLY3PROD with BILLS
17 

•HR 1165 RH

1 carry out the purposes of this subtitle, sub2 ject to section 505(c). 

3 ‘‘(ii) LIMITATION.—Regulations issued 

4 by a State insurance authority under this 

5 subparagraph may be no more restrictive 

6 for a person engaged in providing insurance 

7 than those regulations issued by the agencies 

8 coordinating for consistency and com9 parability under paragraph (2).’’; and 

10 (2) by adding at the end the following: 

11 ‘‘(c) CONSIDERATION OF COMPLIANCE COSTS.—When 

12 prescribing rules under this subtitle, agencies shall take into 

13 account the compliance cost such rules will impose on small 

14 institutions.’’. 

15 SEC. 6. RELATION TO STATE LAWS. 

16 Section 507 of the Gramm-Leach-Bliley Act (15 U.S.C. 

17 6807) is amended to read as follows: 

18 ‘‘SEC. 507. RELATION TO STATE LAWS. 

19 ‘‘This subtitle and the amendments made by this sub20 title supersede any statute or rule of a State or political 

21 subdivision thereof that regulates the obligations of a finan22 cial institution with respect to— 

23 ‘‘(1) the collection or disclosure of personal infor24 mation; 


ssavage on LAPJG3WLY3PROD with BILLS
18 

•HR 1165 RH

1 ‘‘(2) the disclosure of the financial institution’s 

2 privacy policy or information about the financial in3 stitution’s privacy policies and practices; 

4 ‘‘(3) the access to, deletion of, or other individual 

5 privacy rights with respect to personal information; 

6 or 

7 ‘‘(4) the international sharing of personal infor8 mation.’’. 

9 SEC. 7. OBLIGATIONS WITH RESPECT TO ACCESS AND DE10 LETION OF NONPUBLIC PERSONAL INFORMA11 TION. 

12 (a) IN GENERAL.—Title V of the Gramm-Leach-Bliley 

13 Act (15 U.S.C. 6801 et seq.) is amended by inserting after 

14 section 502 the following: 

15 ‘‘SEC. 502A. OBLIGATIONS WITH RESPECT TO ACCESS AND 

16 DELETION OF NONPUBLIC PERSONAL INFOR17 MATION. 

18 ‘‘(a) ACCESS TO INFORMATION.— 

19 ‘‘(1) IN GENERAL.—Upon an authorized request 

20 from an individual with whom a financial institu21 tion has a customer or consumer relationship, a fi22 nancial institution shall disclose— 

23 ‘‘(A) any nonpublic personal information 

24 relating to such individual held by the financial 

25 institution; 


ssavage on LAPJG3WLY3PROD with BILLS
19 

•HR 1165 RH

1 ‘‘(B) the list of categories of nonaffiliated 

2 third parties with whom the financial institu3 tion shares nonpublic personal information re4 lating to such individual; and 

5 ‘‘(C) the list of categories of nonaffiliated 

6 third parties from whom the financial institu7 tion has received nonpublic personal information 

8 relating to such individual. 

9 ‘‘(2) FORMAT.—Disclosures described under 

10 paragraph (1) shall be in a structured, commonly 

11 used, and machine-readable format. 

12 ‘‘(3) EXCEPTION.—For purposes of subpara13 graphs (B) and (C) of paragraph (1), a financial in14 stitution is not required to disclose a nonaffiliated 

15 third party with whom the financial institution 

16 shares or receives nonpublic personal information re17 lating to such individual pursuant to an exception 

18 described under any of paragraphs (3) through (8) of 

19 section 502(e). 

20 ‘‘(b) DELETION OF INFORMATION.— 

21 ‘‘(1) IN GENERAL.—Upon an authorized request 

22 from an individual with whom a financial institu23 tion has a customer or consumer relationship, a fi24 nancial institution shall delete any nonpublic perVerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165

ssavage on LAPJG3WLY3PROD with BILLS
20 

•HR 1165 RH

1 sonal information relating to such individual held by 

2 the financial institution. 

3 ‘‘(2) CERTAIN INACTIVE ACCOUNTS.—If such in4 dividual has not used a product or service provided 

5 by a financial institution for 1 year, the financial in6 stitution shall— 

7 ‘‘(A) notify such individual that such indi8 vidual has the right to request the deletion of any 

9 nonpublic personal information relating to such 

10 individual held by the financial institution, and 

11 provide such individual with clear instructions 

12 on how to make such request; and 

13 ‘‘(B) for each additional 1-year period with 

14 respect to which such person continues to not use 

15 a product or service of the financial institution, 

16 resend the notice described under subparagraph 

17 (A). 

18 ‘‘(3) EXCEPTION.— 

19 ‘‘(A) IN GENERAL.—This subsection shall 

20 not require a financial institution to delete non21 public personal information if— 

22 ‘‘(i) the financial institution is other23 wise required by law to retain the non24 public personal information; 


ssavage on LAPJG3WLY3PROD with BILLS
21 

•HR 1165 RH

1 ‘‘(ii) the nonpublic personal informa2 tion may be necessary to respond to a dis3 pute under the Fair Credit Reporting Act; 

4 or 

5 ‘‘(iii) the nonpublic personal informa6 tion may be necessary to retain for a pur7 pose described in an exception under section 

8 502(e). 

9 ‘‘(B) LIMITATION ON RETAINED NONPUBLIC

10 PERSONAL INFORMATION.—With respect to non11 public personal information that a financial in12 stitution would be required to delete under this 

13 subsection but for the application of this para14 graph, the financial institution may only use 

15 such nonpublic personal information for the ap16 plicable purpose described under subparagraph 

17 (A). 

18 ‘‘(c) TIMING.—A financial institution that receives an 

19 authorized request, under this section, from an individual 

20 with whom such financial institution has a customer or 

21 consumer relationship, shall respond within 45 business 

22 days. 

23 ‘‘(d) RULEMAKING.—Not later than the end of the 1- 

24 year period beginning on the date of enactment of this sec25 tion, each agency or authority described in section 504 shall 


ssavage on LAPJG3WLY3PROD with BILLS
22 

•HR 1165 RH

1 issue rules to carry out this section with respect to the fi2 nancial institutions subject to its jurisdiction.’’. 

3 (b) CLERICAL AMENDMENT.—The table of contents in 

4 section 1(b) of the Gramm-Leach-Bliley Act is amended by 

5 inserting after the item relating to section 502 the following: 

‘‘Sec. 502A. Obligations with respect to access and deletion of nonpublic personal 

information.’’. 

6 SEC. 8. OBLIGATIONS WITH RESPECT TO THE INTER7 NATIONAL SHARING OF NONPUBLIC PER8 SONAL INFORMATION. 

9 (a) IN GENERAL.—Title V of the Gramm-Leach-Bliley 

10 Act (15 U.S.C. 6801 et seq.), as amended by section 10, 

11 is further amended by inserting after section 502A the fol12 lowing: 

13 ‘‘SEC. 502B. OBLIGATIONS WITH RESPECT TO THE INTER14 NATIONAL SHARING OF NONPUBLIC PER15 SONAL INFORMATION. 

16 ‘‘(a) IN GENERAL.—A financial institution may not 

17 share with a foreign government nonpublic personal infor18 mation relating to an individual with whom such financial 

19 institution has a customer or consumer relationship. 

20 ‘‘(b) LAW ENFORCEMENT EXCEPTION.—Subsection (a) 

21 shall not apply to the sharing of the nonpublic personal 

22 information relating to such an individual with a foreign 

23 government authority if such sharing is— 


ssavage on LAPJG3WLY3PROD with BILLS
23 

•HR 1165 RH

1 ‘‘(1) done for legitimate law enforcement pur2 poses; or 

3 ‘‘(2) to a foreign government authority having 

4 jurisdiction over the financial institution for exam5 ination, compliance, or other purposes as authorized 

6 by law.’’. 

7 (b) CLERICAL AMENDMENT.—The table of contents in 

8 section 1(b) of the Gramm-Leach-Bliley Act, as amended 

9 by section 10, is further amended by inserting after the item 

10 relating to section 502A the following: 

‘‘Sec. 502B. Obligations with respect to the international sharing of nonpublic 

personal information’’. 

11 SEC. 9. DEFINITIONS. 

12 Section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 

13 6809) is amended— 

14 (1) in paragraph (3)(A), by inserting before the 

15 period at the end the following: ‘‘and includes a data 

16 aggregator’’; 

17 (2) in paragraph (4), by striking ‘‘personally 

18 identifiable financial information’’ and inserting ‘‘in19 formation that identifies, relates to, describes, is rea20 sonably capable of being associated with, or could rea21 sonably be linked, directly or indirectly, with a par22 ticular individual and is’’; 

23 (3) in paragraph (7), by inserting ‘‘collection 

24 or’’ before ‘‘disclosure’’ each place such term appears; 


ssavage on LAPJG3WLY3PROD with BILLS
24 

•HR 1165 RH

1 (4) by striking paragraph (9); 

2 (5) by amending paragraph (11) to read as fol3 lows: 

4 ‘‘(11) CUSTOMER OR CONSUMER RELATION5 SHIP.— 

6 ‘‘(A) IN GENERAL.—The term ‘customer or 

7 consumer relationship’ means a customer rela8 tionship or a consumer relationship. 

9 ‘‘(B) CUSTOMER RELATIONSHIP.—The term 

10 ‘customer relationship’ shall have the meaning 

11 given the term in rules issued pursuant to sec12 tion 504. 

13 ‘‘(C) CONSUMER RELATIONSHIP.—The term 

14 ‘consumer relationship’ shall have the meaning 

15 given the term in rules issued pursuant to sec16 tion 504 and such meaning shall— 

17 ‘‘(i) include situations in which a fi18 nancial institution obtains nonpublic infor19 mation from an individual with whom the 

20 financial institution does not have a cus21 tomer relationship; and 

22 ‘‘(ii) deem a financial institution to no 

23 longer to be in a consumer relationship 

24 with an individual at such time as the fi25 nancial institution no longer collects, conVerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00024 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165

ssavage on LAPJG3WLY3PROD with BILLS
25 

•HR 1165 RH

1 trols, possesses, transmits, or maintains any 

2 nonpublic personal information of such in3 dividual. 

4 ‘‘(D) TREATMENT OF CERTAIN TRANS5 ACTIONS.—When the terms ‘customer relation6 ship’ and ‘consumer relationship’ are defined by 

7 rule, it shall be specified that the following trans8 actions do not, by themselves, establish a con9 sumer relationship or a consumer relationship: 

10 ‘‘(i) The use of an automated teller 

11 machine. 

12 ‘‘(ii) The use of a credit card or debit 

13 card to make a purchase. 

14 ‘‘(iii) Such other similar transactions 

15 as the agencies determine appropriate.’’; 

16 and 

17 (6) by adding at the end the following: 

18 ‘‘(12) ACCOUNT CREDENTIALS.—The term ‘ac19 count credentials’ means nonpublic personal informa20 tion that an individual with whom a financial insti21 tution has a customer or consumer relationship uses 

22 to access an account of the individual at such finan23 cial institution, including a username, password, or 

24 an answer to a security question. 


ssavage on LAPJG3WLY3PROD with BILLS
26 

•HR 1165 RH

1 ‘‘(13) DATA AGGREGATOR.—The term ‘data 

2 aggregator’— 

3 ‘‘(A) means any person that operates a 

4 commercial business or enterprise for the busi5 ness purpose of accessing, aggregating, collecting, 

6 selling, or sharing nonpublic personal informa7 tion about financial accounts or transactions re8 lating to an individual; and 

9 ‘‘(B) does not include— 

10 ‘‘(i) a service provider acting at the ex11 press instruction of a financial institution 

12 that accesses, aggregates, collects, or shares 

13 nonpublic personal information about an 

14 individual with whom such financial insti15 tution has a customer or consumer relation16 ship in accordance with paragraphs (1), 

17 (2), (3)(A), (3)(B), (3)(C), (3)(D), or (6) of 

18 section 502(e); or 

19 ‘‘(ii) an attorney or accountant acting 

20 on behalf of an individual with whom such 

21 attorney or accountant has a customer or 

22 consumer relationship, in accordance with 

23 section 502(e)(3)(E). 

24 ‘‘(14) PERSON ENGAGED IN PROVIDING INSUR25 ANCE.—The term ‘person engaged in providing insurVerDate Sep 11 2014 01:27 Dec 06, 2024 Jkt 059200 PO 00000 Frm 00026 Fmt 6652 Sfmt 6203 E:\BILLS\H1165.RH H1165

ssavage on LAPJG3WLY3PROD with BILLS
27 

•HR 1165 RH

1 ance’ means a person that engages in the business of 

2 insurance, as that term is defined in section 1002 of 

3 the Dodd-Frank Wall Street Reform and Consumer 

4 Protection Act (12 U.S.C. 5481).’’. 

5 SEC. 10. REPEAL OF EXPIRED PROVISIONS. 

6 The Gramm-Leach-Bliley Act is amended— 

7 (1) by striking section 508 (15 U.S.C. 6808); 

8 and 

9 (2) in the table of contents in section 1(b), by 

10 striking the item relating to section 508. 

11 SEC. 11. GAO REPORT. 

12 (a) IN GENERAL.—The Comptroller General of the 

13 United States shall, not later than 1 year after the date 

14 of the enactment of this Act, submit to the Congress a report 

15 that assesses— 

16 (1) whether the safeguard standards promulgated 

17 pursuant to section 501 of the Gramm-Leach-Bliley 

18 Act, including protecting against unauthorized disclo19 sure, are effective in protecting individuals with 

20 whom financial institutions have a customer or con21 sumer relationship; and 

22 (2) whether the enforcement regime with respect 

23 to those standards are effective in protecting cus24 tomers and consumers, and whether additional rem25 edies are necessary. 


ssavage on LAPJG3WLY3PROD with BILLS
28 

•HR 1165 RH

1 (b) DEFINITIONS.—In this section, the terms ‘‘cus2 tomer or consumer relationship’’ and ‘‘financial institu3 tion’’ have the meaning given those terms, respectively, 

4 under section 509 of the Gramm-Leach-Bliley Act (15 

5 U.S.C. 6809), as amended by section 9. 

6 SEC. 12. SENSE OF CONGRESS. 

7 It is the sense of the Congress that the Federal agencies 

8 implementing the Gramm-Leach-Bliley Act should imple9 ment such Act, to the extent possible, in a technology-agnos10 tic manner so as to ensure it can adapt to different business 

11 models and technologies. 

12 SEC. 13. EFFECTIVE DATE. 

13 The amendments made by this Act shall take effect on 

14 the date that is the earlier of— 

15 (1) the date that is one year after the date on 

16 which all rulemaking required under this Act is com17 plete; or 

18 (2) the date that is 2 years after the date of the 

19 enactment of this Act. 


ssavage on LAPJG3WLY3PROD with BILLS

ssavage on LAPJG3WLY3PROD with BILLS
Union Calendar No. 673 

118TH CONGRESS 

2D SESSION H. R. 1165 

[Report No. 118–822] 

A BILL 

To amend the Gramm-Leach-Bliley Act to modship, and for other purposes. institutions have customer or consumer relation- information of individuals with whom financial ernize the protection of the nonpublic personal 

DECEMBER 5, 2024 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


ssavage on LAPJG3WLY3PROD with BILLS