I

106TH CONGRESS

1ST SESSION H. R. 1929

To amend the Federal Deposit Insurance Act to control the disclosure by

financial institutions of personal financial information of customers of

the institutions, and for other purposes.

IN THE HOUSE OF REPRESENTATIVES

MAY 25, 1999

Mr. INSLEE (for himself, Mr. CAPUANO, Mr. FILNER, Mr. HINCHEY, Mr.

HOEFFEL, Mr. KANJORSKI, Ms. LEE, Mr. MCDERMOTT, Ms. RIVERS,

Mr. SANDERS, Ms. SCHAKOWSKY, and Mr. STARK) introduced the following bill; which was referred to the Committee on Banking and Financial Services

A BILL

To amend the Federal Deposit Insurance Act to control

the disclosure by financial institutions of personal financial information of customers of the institutions, and

for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Banking Privacy Act

5 of 1999’’.
2

•HR 1929 IH

1 SEC. 2. PERSONAL INFORMATION SHARING.

2 (a) DEPOSITORY INSTITUTIONS AND SUBSIDIARIES

3 OF DEPOSITORY INSTITUTIONS.—Section 18 of the Fed4 eral Deposit Insurance Act (12 U.S.C. 1828) is amended

5 by adding at the end the following new subsection:

6 ‘‘(t) PERSONAL INFORMATION SHARING REQUIRE7 MENTS.—

8 ‘‘(1) INFORMATION SHARING PROHIBITED IF

9 CUSTOMER OPTS OUT.—Notwithstanding any other

10 provision of law and except as permitted under para11 graph (5), an insured depository institution and a

12 subsidiary of a depository institution may not dis13 close or transfer customer information relating to

14 any customer to any other person, including an affil15 iate of the depository institution, unless—

16 ‘‘(A) the customer to whom such informa17 tion relates has been provided with notice in ac18 cordance with paragraph (2); and

19 ‘‘(B) the customer has not provided a writ20 ten directive (including a transmission by e21 mail, facsimile, or other form of electronic com22 munication) to the insured depository institu23 tion or subsidiary, at any time before the close

24 of business on the 6th business day before such

25 disclosure or transfer, that such information

26 shall not be disclosed or transferred, except
3

•HR 1929 IH

1 when specifically authorized by the customer in

2 connection with and pertaining to a specific

3 transaction with the depository institution or

4 subsidiary.

5 ‘‘(2) NOTICE.—

6 ‘‘(A) IN GENERAL.—The notice referred to

7 in paragraph (1)(A) shall fully and fairly dis8 close, in accordance with regulations which the

9 Federal banking agencies shall jointly prescribe,

10 what information is being disclosed or trans11 ferred, the policy of the insured depository in12 stitution or subsidiary of an insured depository

13 institution with regard to information sharing,

14 and the right of the customer to prohibit the

15 disclosure or transfer of such information.

16 ‘‘(B) FORM OF NOTICE.—

17 ‘‘(i) IN GENERAL.—The regulations

18 prescribed pursuant to subparagraph (A)

19 shall require that the notice required under

20 such subparagraph—

21 ‘‘(I) be prominently displayed on

22 a document which is separate from

23 any other document;
4

•HR 1929 IH

1 ‘‘(II) have the term ‘Privacy No2 tice’ in prominent typeface at the top

3 of the notice.

4 ‘‘(ii) NOTICE REQUIREMENTS.—

5 ‘‘(I) MAILING.—If the notice re6 quired under subparagraph (A) is

7 mailed to the customer, the notice

8 shall be mailed separately from any

9 other statement, document, or notice

10 mailed to the customer.

11 ‘‘(II) IN PERSON.—If the notice

12 required under subparagraph (A) is

13 disclosed to the customer in person by

14 an officer, director, or agent of the

15 depository institution or subsidiary

16 thereof, the officer, employee, or agent

17 shall obtain the written acknowledge18 ment of the customer of the receipt of

19 such notice separately from any other

20 signature or written acknowledgment

21 of the customer.

22 ‘‘(3) CUSTOMER INFORMATION DEFINED.—For

23 purposes of this subsection, the term ‘customer in24 formation’ means any information acquired from a

25 customer of the insured depository institution that is
5

•HR 1929 IH

1 personally identifiable to the customer, including in2 formation relating to transactions, balances, matu3 rity dates, payouts, and payout dates, and trans4 action or experience information.

5 ‘‘(4) REASONABLE OPPORTUNITY TO RESPOND

6 TO NOTICE.—In order to provide any customer of an

7 insured depository institution or any subsidiary of

8 an insured depository institution with reasonable op9 portunity to respond to any notice referred to in

10 paragraph (1)(A), the prohibition contained in para11 graph (1) on the disclosure or transfer of any cus12 tomer information relating to such customer to any

13 other person, including an affiliate, shall continue

14 during the 30-day period beginning on the date the

15 notice referred to in such paragraph was sent or de16 livered to such customer, unless the customer has

17 authorized such disclosure or transfer.

18 ‘‘(5) EXCEPTIONS.—Paragraph (1) shall not

19 apply to the disclosure or transfer of customer

20 information—

21 ‘‘(A) in connection with processing a spe22 cific financial transaction that the customer to

23 whom the information relates has authorized,

24 if—
6

•HR 1929 IH

1 ‘‘(i) the customer has been informed

2 that any such transaction will necessarily

3 involve the disclosure or transfer of such

4 information; and

5 ‘‘(ii) the person to whom such infor6 mation is transferred or disclosed is sub7 ject to a legal or contractual obligation not

8 to use such information for any purpose

9 other than in connection with facilitating

10 the transaction;

11 ‘‘(B) in connection with any routine finan12 cial transaction which does not involve mar13 keting of services or the sale of customer infor14 mation, if the person to whom such information

15 is transferred or disclosed is subject to a legal

16 or contractual obligation not to use such infor17 mation for any purpose other than in connec18 tion with effectuating the transaction;

19 ‘‘(C) in connection with clearing checks,

20 processing credit transactions or electronic fund

21 transfers, or providing mailing services, if the

22 person to whom such information is transferred

23 or disclosed is subject to a legal or contractual

24 obligation not to use such information for any

25 purpose other than in connection with clearing
7

•HR 1929 IH

1 or processing the transaction or providing the

2 service;

3 ‘‘(D) to a governmental, regulatory, or

4 self-regulatory authority having jurisdiction

5 over the insured depository institution for ex6 amination, compliance, or other authorized pur7 poses;

8 ‘‘(E) to a court of competent jurisdiction;

9 ‘‘(F) to a consumer reporting agency, as

10 defined in section 603(f) of the Fair Credit Re11 porting Act, for use solely in accordance with

12 such Act;

13 ‘‘(G) in the case of a default by the cus14 tomer on an obligation to the depository institu15 tion or subsidiary, to a debt collector, as de16 fined in section 803(6) of the Fair Debt Collec17 tion Practices Act, counsel, or other entity in18 volved in debt collection, for use solely in ac19 cordance with such Act;

20 ‘‘(H) in the case of any claim or litigation

21 between the customer and a depository institu22 tion or subsidiary, to a counsel or other person

23 involved in the resolution of the dispute;

24 ‘‘(I) that is not personally identifiable to

25 the customer or is public information; or
8

•HR 1929 IH

1 ‘‘(J) that is necessary to prevent or inves2 tigate fraudulent or unlawful acts which the de3 pository institution or subsidiary has a good

4 faith belief may occur or may have occurred.’’.

5 (b) BANK HOLDING COMPANIES AND AFFILIATES OF

6 BANK HOLDING COMPANIES.—Section 5 of the Bank

7 Holding Company Act of 1956 (12 U.S.C. 1844) is

8 amended by adding at the end the following new sub9 section:

10 ‘‘(g) PERSONAL INFORMATION SHARING REQUIRE11 MENTS.—

12 ‘‘(1) INFORMATION SHARING PROHIBITED IF

13 CUSTOMER OPTS OUT.—Notwithstanding any other

14 provision of law and except as permitted under para15 graph (5), a bank holding company and an affiliate

16 of a bank holding company (other than a depository

17 institution subsidiary or subsidiary of such deposi18 tory institution) may not disclose or transfer cus19 tomer information relating to any customer to any

20 other person, including another affiliate of the bank

21 holding company, unless—

22 ‘‘(A) the customer to whom such informa23 tion relates has been provided with notice in ac24 cordance with paragraph (2); and
9

•HR 1929 IH

1 ‘‘(B) the customer has not provided a writ2 ten directive (including a transmission by e3 mail, facsimile, or other form of electronic com4 munication) to the bank holding company or af5 filiate, at any time before the close of business

6 on the 6th business day before such disclosure

7 or transfer, that such information shall not be

8 disclosed or transferred, except when specifi9 cally authorized by the customer in connection

10 with and pertaining to a specific transaction

11 with the bank holding company or affiliate.

12 ‘‘(2) NOTICE.—

13 ‘‘(A) IN GENERAL.—The notice referred to

14 in paragraph (1)(A) shall fully and fairly dis15 close, in accordance with regulations which the

16 Board shall prescribe, what information is being

17 disclosed or transferred, the policy of the bank

18 holding company or affiliate of a bank holding

19 company with regard to information sharing,

20 and the right of the customer to prohibit the

21 disclosure or transfer of such information.

22 ‘‘(B) FORM OF NOTICE.—

23 ‘‘(i) IN GENERAL.—The regulations

24 prescribed pursuant to subparagraph (A)
10

•HR 1929 IH

1 shall require that the notice required under

2 such subparagraph—

3 ‘‘(I) be prominently displayed on

4 a document which is separate from

5 any other document:

6 ‘‘(II) have the term ‘Privacy No7 tice’ in prominent typeface at the top

8 of the notice.

9 ‘‘(ii) NOTICE REQUIREMENTS.—

10 ‘‘(I) MAILING.—If the notice re11 quired under subparagraph (A) is

12 mailed to the customer, the notice

13 shall be mailed separately from any

14 other statement, document, or notice

15 mailed to the customer.

16 ‘‘(II) IN PERSON.—If the notice

17 required under subparagraph (A) is

18 disclosed to the customer in person by

19 an officer, director, or agent of the

20 bank holding company or affiliate

21 thereof, the officer, employee, or agent

22 shall obtain the written acknowledge23 ment of the customer of the receipt of

24 such notice separately from any other
11

•HR 1929 IH

1 signature or written acknowledgment

2 of the customer.

3 ‘‘(3) CUSTOMER INFORMATION DEFINED.—For

4 purposes of this subsection, the term ‘customer in5 formation’ means any information acquired from a

6 customer of the bank holding company or affiliate

7 that is personally identifiable to the customer, in8 cluding information relating to transactions, bal9 ances, maturity dates, payouts, and payout dates,

10 and transaction or experience information.

11 ‘‘(4) REASONABLE OPPORTUNITY TO RESPOND

12 TO NOTICE.—In order to provide any customer of a

13 bank holding company or any affiliate of a bank

14 holding company with reasonable opportunity to re15 spond to any notice referred to in paragraph (1)(A),

16 the prohibition contained in paragraph (1) on the

17 disclosure or transfer of any customer information

18 relating to such customer to any other person, in19 cluding another affiliate, shall continue during the

20 30-day period beginning on the date the notice re21 ferred to in such paragraph was sent or delivered to

22 such customer, unless the customer has authorized

23 such disclosure or transfer.
12

•HR 1929 IH

1 ‘‘(5) EXCEPTIONS.—Paragraph (1) shall not

2 apply to the disclosure or transfer of customer

3 information—

4 ‘‘(A) in connection with processing a spe5 cific financial transaction that the customer to

6 whom the information relates has authorized,

7 if—

8 ‘‘(i) the customer has been informed

9 that any such transaction will necessarily

10 involve the disclosure or transfer of such

11 information; and

12 ‘‘(ii) the person to whom such infor13 mation is transferred or disclosed is sub14 ject to a legal or contractual obligation not

15 to use such information for any purpose

16 other than in connection with facilitating

17 the transaction;

18 ‘‘(B) in connection with any routine finan19 cial transaction which does not involve mar20 keting of services or the sale of customer infor21 mation, if the person to whom such information

22 is transferred or disclosed is subject to a legal

23 or contractual obligation not to use such infor24 mation for any purpose other than in connec25 tion with effectuating the transaction;
13

•HR 1929 IH

1 ‘‘(C) in connection with clearing checks,

2 processing financial transactions or electronic

3 fund transfers, or providing mailing services, if

4 the person to whom such information is trans5 ferred or disclosed is subject to a legal or con6 tractual obligation not to use such information

7 for any purpose other than in connection with

8 clearing or processing the transaction or pro9 viding the service;

10 ‘‘(D) to a governmental, regulatory, or

11 self-regulatory authority having jurisdiction

12 over the insured depository institution for ex13 amination, compliance, or other authorized pur14 poses;

15 ‘‘(E) to a court of competent jurisdiction;

16 ‘‘(F) to a consumer reporting agency, as

17 defined in section 603(f) of the Fair Credit Re18 porting Act, for use solely in accordance with

19 such Act;

20 ‘‘(G) in the case of a default by the cus21 tomer on an obligation to the bank holding

22 company or affiliate, to a debt collector, as de23 fined in section 803(6) of the Fair Debt Collec24 tion Practices Act, counsel, or other entity in-
14

•HR 1929 IH

1 volved in debt collection, for use solely in ac2 cordance with such Act;

3 ‘‘(H) in the case of any claim or litigation

4 between the customer and a depository institu5 tion or subsidiary, to counsel or any other per6 son involved in the resolution of the dispute;

7 ‘‘(I) that is not personally identifiable to

8 the customer or is public information; or

9 ‘‘(J) that is necessary to prevent or inves10 tigate fraudulent or unlawful acts which the

11 bank holding company or affiliate has a good

12 faith belief may occur or may have occurred.’’.

Æ