II

106TH CONGRESS

1ST SESSION S. 1903

To amend the privacy provisions of the Gramm-Leach-Bliley Act.

IN THE SENATE OF THE UNITED STATES

NOVEMBER 10, 1999

Mr. SHELBY (for himself and Mr. BRYAN) introduced the following bill; which

was read twice and referred to the Committee on Banking, Housing, and

Urban Affairs

A BILL

To amend the privacy provisions of the Gramm-Leach-Bliley

Act.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Consumer’s Right to

5 Financial Privacy Act’’.

6 SEC. 2. AMENDMENT.

7 Title V of the Gramm-Leach-Bliley Act is amended

8 to read as follows:
2

•S 1903 IS

1 ‘‘TITLE V—PRIVACY OF

2 CONSUMER INFORMATION

3 ‘‘Subtitle A—Disclosure of

4 Nonpublic Personal Information

5 ‘‘SEC. 501. PROTECTION OF NONPUBLIC PERSONAL INFOR6 MATION.

7 ‘‘(a) PRIVACY OBLIGATION POLICY.—It is the policy

8 of the Congress that each financial institution has an af9 firmative and continuing obligation to respect the privacy

10 of its customers and to protect the security and confiden11 tiality of those customers’ nonpublic personal information.

12 ‘‘(b) FINANCIAL INSTITUTIONS SAFEGUARDS.—In

13 furtherance of the policy in subsection (a), each agency

14 or authority described in section 504(a) shall establish by

15 rule or order appropriate standards for the financial insti16 tutions subject to their jurisdiction, and the Commission

17 shall establish such standards for any financial institu18 tions not subject to such jurisdiction, relating to adminis19 trative, technical, and physical safeguards—

20 ‘‘(1) to insure the security and confidentiality of

21 customer records and information;

22 ‘‘(2) to protect against any anticipated threats

23 or hazards to the security or integrity of such

24 records; and
3

•S 1903 IS

1 ‘‘(3) to protect against unauthorized access to

2 or use of such records or information which could

3 result in substantial harm or inconvenience to any

4 customer.

5 ‘‘SEC. 502. OBLIGATIONS WITH RESPECT TO PERSONAL

6 INFORMATION.

7 ‘‘(a) GENERAL REQUIREMENTS.—Except as other8 wise provided in this subtitle, a financial institution may

9 not, directly or through any affiliate, disclose or make an

10 unrelated use of any nonpublic personal information col11 lected by the financial institution in connection with any

12 transaction with a consumer in any financial product or

13 any financial service, unless such financial institution pro14 vides or has provided to the consumer a notice that com15 plies with section 503 and the rules thereunder.

16 ‘‘(b) OPT-IN REQUIRED FOR INFORMATION TRANS17 FERS.—

18 ‘‘(1) AFFIRMATIVE CONSENT REQUIRED.—Each

19 agency or authority described in section 504(a) shall

20 by rule prohibit a financial institution that is subject

21 to its jurisdiction from making available any non22 public personal information to any affiliate or other

23 person that is not an employee or agent of the insti24 tution, unless the consumer to whom the information

25 pertains—
4

•S 1903 IS

1 ‘‘(A) has affirmatively consented in accord2 ance with such rule to the transfer of such in3 formation; and

4 ‘‘(B) has not withdrawn the consent.

5 ‘‘(2) FLEXIBILITY OF FORM.—A financial insti6 tution may, in complying with paragraph (1),

7 present the opportunity to consent in a clear and

8 conspicuous manner that permits the consumer to

9 consent—

10 ‘‘(A)(i) with respect to both affiliates and

11 nonaffiliated persons;

12 ‘‘(ii) separately with respect to affiliates

13 generally and nonaffiliated persons generally; or

14 ‘‘(iii) separately with respect to specified

15 affiliates and nonaffiliated persons; and

16 ‘‘(B) separately with respect to specified fi17 nancial and nonfinancial products and services

18 that may be offered to the consumer.

19 ‘‘(3) DENIAL OF SERVICE PROHIBITED.—The

20 rule prescribed pursuant to paragraph (1) shall pro21 hibit a financial institution from denying any con22 sumer a financial product or a financial service for

23 the refusal by the consumer to grant the consent re24 quired by such rule.
5

•S 1903 IS

1 ‘‘(c) ACCESS TO AND CORRECTION OF INFORMATION

2 VENDED TO THIRD PARTIES.—

3 ‘‘(1) RULE REQUIRED.—Each agency or au4 thority described in section 504(a) shall by rule re5 quire a financial institution that is subject to its ju6 risdiction and that makes available nonpublic per7 sonal information collected by the financial institu8 tion to any person or entity other than an employee

9 or agent of such institution to afford that

10 consumer—

11 ‘‘(A) the opportunity to examine, upon re12 quest, all nonpublic personal information that

13 was so made available; and

14 ‘‘(B) the opportunity to dispute the accu15 racy of any of such information, and to present

16 evidence thereon.

17 ‘‘(d) LIMITATIONS ON THE SHARING OF ACCOUNT

18 NUMBER INFORMATION FOR MARKETING PURPOSES.—A

19 financial institution shall not disclose an account number

20 or similar form of access number or access code for a cred21 it card account, deposit account, or transaction account

22 of a consumer to any affiliate or any nonaffiliated third

23 party for use in telemarketing, direct mail marketing, or

24 other marketing through electronic mail or other electronic

25 means to the consumer.
6

•S 1903 IS

1 ‘‘(e) LIMITS ON REUSE OF INFORMATION.—Except

2 as otherwise provided in this subtitle, an affiliate or a non3 affiliated third party that receives from a financial institu4 tion nonpublic personal information under this section

5 shall not, directly or through an affiliate of such receiving

6 third party, disclose such information to any other person

7 that is an affiliate or a nonaffiliated third party of both

8 the financial institution and such receiving third party,

9 unless such disclosure would be lawful if made directly to

10 such other person by the financial institution.

11 ‘‘(f) GENERAL EXCEPTIONS.—Subsections (a) and

12 (b) shall not prohibit the disclosure of nonpublic personal

13 information—

14 ‘‘(1) as necessary to effect, administer, or en15 force a transaction requested or authorized by the

16 consumer, or in connection with—

17 ‘‘(A) servicing or processing a financial

18 product or service requested or authorized by

19 the consumer;

20 ‘‘(B) maintaining or servicing the con21 sumer’s account with the financial institution;

22 or

23 ‘‘(C) a proposed or actual securitization,

24 secondary market sale (including sales of serv-
7

•S 1903 IS

1 icing rights), or similar transaction related to a

2 transaction of the consumer;

3 ‘‘(2) with the consent or at the direction of the

4 consumer;

5 ‘‘(3)(A) to protect the confidentiality or security

6 of the financial institution’s records pertaining to

7 the consumer, the service or product, or the trans8 action therein; (B) to protect against or prevent ac9 tual or potential fraud, unauthorized transactions,

10 claims, or other liability; (C) for required institu11 tional risk control, or for resolving customer disputes

12 or inquiries; (D) to persons holding a legal or bene13 ficial interest relating to the consumer; or (E) to

14 persons acting in a fiduciary or representative capac15 ity on behalf of the consumer;

16 ‘‘(4) to provide information to insurance rate

17 advisory organizations, guaranty funds or agencies,

18 applicable rating agencies of the financial institu19 tion, and the institution’s attorneys, accountants,

20 and auditors;

21 ‘‘(5) to the extent specifically permitted or re22 quired under other provisions of law and in accord23 ance with the Right to Financial Privacy Act of

24 1978, to law enforcement agencies (including a Fed25 eral functional regulator, the Secretary of the Treas-
8

•S 1903 IS

1 ury with respect to subchapter II of chapter 53 of

2 title 31, United States Code, and chapter 2 of title

3 I of Public Law 91–508 (12 U.S.C. 1951–1959), a

4 State insurance authority, or the Federal Trade

5 Commission), self-regulatory organizations, or for an

6 investigation on a matter related to public safety;

7 ‘‘(6)(A) to a consumer reporting agency in ac8 cordance with the Fair Credit Reporting Act, or (B)

9 from a consumer report reported by a consumer re10 porting agency in accordance with the Fair Credit

11 Reporting Act;

12 ‘‘(7) in connection with a proposed or actual

13 sale, merger, transfer, or exchange of all or a por14 tion of a business or operating unit if the disclosure

15 of nonpublic personal information concerns solely

16 consumers of such business or unit; or

17 ‘‘(8) to comply with Federal, State, or local

18 laws, rules, and other applicable legal requirements;

19 to comply with a properly authorized civil, criminal,

20 or regulatory investigation or subpoena or summons

21 by Federal, State, or local authorities; or to respond

22 to judicial process or government regulatory authori23 ties having jurisdiction over the financial institution

24 for examination, compliance, or other purposes as

25 authorized by law.
9

•S 1903 IS

1 ‘‘SEC. 503. NOTICE CONCERNING DISCLOSING INFORMA2 TION.

3 ‘‘(a) RULE REQUIRED.—Each agency or authority

4 described in section 504(a) shall prescribe rules in accord5 ance with this section to prohibit unfair and deceptive acts

6 or practices in connection with the disclosing of nonpublic

7 personal information or with making unrelated uses of

8 such information. Such rules shall require any financial

9 institution, through the use of a form that complies with

10 the rules prescribed under subsection (b), to clearly and

11 conspicuously disclose to the consumer at the time of es12 tablishing a customer relationship with a consumer and

13 not less than annually during the continuation of such

14 relationship—

15 ‘‘(1) the categories of nonpublic personal infor16 mation that are collected by the financial institution;

17 ‘‘(2) the practices and policies of the financial

18 institution with respect to disclosing nonpublic per19 sonal information, or making unrelated uses of such

20 information, including—

21 ‘‘(A) the categories of persons to whom the

22 information is or may be disclosed or who may

23 be permitted to make unrelated uses of such in24 formation, other than the persons to whom the

25 information must be provided to effect, admin26 ister, or enforce the transaction; and
10

•S 1903 IS

1 ‘‘(B) the practices and policies of the insti2 tution with respect to disclosing or making un3 related uses of nonpublic personal information

4 of persons who have ceased to be customers of

5 the financial institution;

6 ‘‘(3) the policies that the institution maintains

7 to protect the confidentiality and security of non8 public personal information;

9 ‘‘(4) the practices and policies of the institution

10 with respect to providing consumers the opportunity

11 to examine and dispute information pursuant to the

12 rule prescribed under section 502(c); and

13 ‘‘(5) the right of the consumer under such sec14 tion to examine, upon request, the nonpublic per15 sonal information, to dispute the accuracy of any of

16 such information, and to present evidence thereon.

17 ‘‘(b) DESIGN OF NOTICE REQUIREMENTS.—In pre18 scribing the form of a notice for purposes of subsection

19 (a), each agency or authority described in section 504(a)

20 shall ensure that consumers are provided a clear and con21 spicuous disclosure that permits them to compare dif22 ferences in the measures that the financial institution

23 takes, and the policies that the institution has established,

24 to protect the consumer’s privacy as compared to the

25 measures taken and the policies established by other fi-
11

•S 1903 IS

1 nancial institutions. Such form shall specifically identify

2 the rights the institution affords consumers to grant or

3 deny consent to (1) the disclosing of nonpublic personal

4 information for any purpose other than as required in

5 order to effect, administer, or enforce the consumer’s

6 transaction, or (2) the making of an unrelated use of such

7 information.

8 ‘‘(c) ADDITIONAL CONTENTS OF RULES; EXEMPTIVE

9 RULES.—Each agency or authority described in section

10 504(a) shall, by rule, and may by order—

11 ‘‘(1) specify the disclosures and uses of infor12 mation which, for purposes of this subtitle and the

13 rules prescribed thereunder, may be treated as nec14 essary to effect, administer, or enforce a consumer’s

15 transaction with respect to a variety of financial

16 services and financial products;

17 ‘‘(2) specify timing requirements with respect to

18 notices to new and existing customers, which shall

19 not require notices more frequently than annually

20 unless there has been a change in the information

21 required to be disclosed pursuant to subsection (a);

22 and

23 ‘‘(3) provide, consistent with the purposes of

24 this subtitle, exemptions or temporary waivers to, or
12

•S 1903 IS

1 delayed effective dates for, any requirement of this

2 subtitle or the rules prescribed thereunder.

3 ‘‘SEC. 504. ENFORCEMENT.

4 ‘‘(a) IN GENERAL.—This subtitle and the rules pre5 scribed thereunder shall be enforced by the Federal func6 tional regulators, the State insurance authorities, and the

7 Federal Trade Commission with respect to financial insti8 tutions and other persons subject to their jurisdiction

9 under applicable law, as follows:

10 ‘‘(1) Under section 8 of the Federal Deposit In11 surance Act, in the case of—

12 ‘‘(A) national banks, Federal branches and

13 Federal agencies of foreign banks by the Office

14 of the Comptroller of the Currency;

15 ‘‘(B) member banks of the Federal Reserve

16 System (other than national banks), branches

17 and agencies of foreign banks (other than Fed18 eral branches, Federal agencies, and insured

19 State branches of foreign banks), commercial

20 lending companies owned or controlled by for21 eign banks, organizations operating under sec22 tion 25 or 25A of the Federal Reserve Act,

23 bank holding companies by the Board of Gov24 ernors of the Federal Reserve System;
13

•S 1903 IS

1 ‘‘(C) banks insured by the Federal Deposit

2 Insurance Corporation (other than members of

3 the Federal Reserve System), insured State

4 branches of foreign banks by the Board of Di5 rectors of the Federal Deposit Insurance Cor6 poration; and

7 ‘‘(D) savings association the deposits of

8 which are insured by the Federal Deposit In9 surance Corporation by the Director of the Of10 fice of Thrift Supervision.

11 ‘‘(2) Under the Federal Credit Union Act, by

12 the Administrator of the National Credit Union Ad13 ministration with respect to any Federal or state

14 chartered credit union.

15 ‘‘(3) Under the Securities Exchange Act of

16 1934, by the Securities and Exchange Commission

17 with respect to any broker-dealer.

18 ‘‘(4) Under the Investment Company Act of

19 1940, by the Securities and Exchange Commission

20 with respect to investment companies.

21 ‘‘(5) Under the Investment Advisers Act of

22 1940, by the Securities and Exchange Commission

23 with respect to investment advisers registered with

24 the Commission under such Act.
14

•S 1903 IS

1 ‘‘(6) Under the Federal Home Loan Bank Act,

2 by the Federal Housing Finance Board with respect

3 to Federal home loan banks.

4 ‘‘(7) In the case of any person engaged in pro5 viding insurance, by the State insurance authority,

6 if that State has elected to become a participating

7 State, notwithstanding any of the limitations of sec8 tion 104 of the Gramm-Leach-Bliley Act.

9 ‘‘(8) Under the Federal Trade Commission Act,

10 by the Federal Trade Commission for—

11 ‘‘(A) any other financial institution (other

12 than a person engaged in providing insurance)

13 or any other person that is not subject to the

14 jurisdiction of any agency or authority under

15 paragraphs (1) through (6) of this subsection;

16 and

17 ‘‘(B) any person engaged in providing in18 surance who is domiciled in a State that does

19 not elect to become a participating State.

20 ‘‘(b) ENFORCEMENT OF SECTION 501.—

21 ‘‘(1) IN GENERAL.—Except as provided in para22 graph (2), the agencies and authorities described in

23 subsection (a) shall implement the standards pre24 scribed under section 501(b) in the same manner, to

25 the extent practicable, as standards prescribed pur-
15

•S 1903 IS

1 suant to subsection (a) of section 39 of the Federal

2 Deposit Insurance Act are implemented pursuant to

3 such section.

4 ‘‘(2) EXCEPTION.—The agencies and authori5 ties described in paragraphs (3), (4), (5), (7), and

6 (8) of subsection (a) shall implement the standards

7 prescribed under section 501(b) by rule with respect

8 to the financial institutions subject to their respec9 tive jurisdictions under subsection (a).

10 ‘‘(c) STATE ACTION FOR VIOLATIONS.—

11 ‘‘(1) AUTHORITY OF STATES.—In addition to

12 such other remedies as are provided under State

13 law, if the chief law enforcement officer of a State,

14 or an official or agency designated by a State, has

15 reason to believe that any person has violated or is

16 violating this subtitle or a rule prescribed under this

17 subtitle, other than section 501 or a rule prescribed

18 under such section, the State—

19 ‘‘(A) may bring an action to enjoin such

20 violation in any appropriate United States dis21 trict court or in any other court of competent

22 jurisdiction; and

23 ‘‘(B) may bring an action on behalf of the

24 residents of the State to enforce compliance

25 with such rule, to obtain damages, restitution,
16

•S 1903 IS

1 or other compensation on behalf of residents of

2 such State, or to obtain such further and other

3 relief as the court may deem appropriate.

4 ‘‘(2) RIGHTS OF FEDERAL REGULATORS.—

5 ‘‘(A) PRIOR NOTICE.—The State shall

6 serve prior written notice of any action under

7 paragraph (1) upon the Federal Trade Commis8 sion and provide the Federal Trade Commission

9 with a copy of its complaint, except in any case

10 in which such prior notice is not feasible, in

11 which case the State shall serve such notice im12 mediately upon instituting such action.

13 ‘‘(B) RIGHT TO INTERVENE.—The Federal

14 Trade Commission shall transmit the notice re15 ceived under subparagraph (A) to the agency or

16 authority that has jurisdiction of the subject of

17 the complaint, and such agency or authority

18 shall have the right—

19 ‘‘(i) to intervene in an action under

20 paragraph (1);

21 ‘‘(ii) upon so intervening, to be heard

22 on all matters arising therein;

23 ‘‘(iii) to remove the action to the ap24 propriate United States district court; and

25 ‘‘(iv) to file petitions for appeal.
17

•S 1903 IS

1 ‘‘(3) INVESTIGATORY POWERS.—For purposes

2 of bringing any action under this subsection, no pro3 vision of this subsection shall be construed as pre4 venting the chief law enforcement officer, or an offi5 cial or agency designated by a State, from exercising

6 the powers conferred on the chief law enforcement

7 officer or such official by the laws of such State to

8 conduct investigations or to administer oaths or af9 firmations or to compel the attendance of witnesses

10 or the production of documentary and other evi11 dence.

12 ‘‘(4) LIMITATION ON STATE ACTION WHILE

13 FEDERAL ACTION PENDING.—If a Federal agency or

14 authority has instituted a civil action for a violation

15 of this subtitle, no State may, during the pendency

16 of such action, bring an action under this section

17 against any defendant named in the complaint of the

18 Federal agency or authority or such agency for any

19 violation of this subtitle that is alleged in that com20 plaint.

21 ‘‘(d) DEFINITIONS.—The terms used in subsection

22 (a)(1) that are not defined in this subtitle or otherwise

23 defined in section 3(s) of the Federal Deposit Insurance

24 Act shall have the meaning given to them in section 1(b)

25 of the International Banking Act of 1978.
18

•S 1903 IS

1 ‘‘SEC. 505. FAIR CREDIT REPORTING ACT AMENDMENT.

2 ‘‘(a) AMENDMENT.—Section 621 of the Fair Credit

3 Reporting Act (15 U.S.C. 1681s) is amended—

4 ‘‘(1) in subsection (d), by striking everything

5 following the end of the second sentence; and

6 ‘‘(2) by striking subsection (e) and inserting in

7 lieu thereof the following:

8 ‘‘ ‘(e) REGULATORY AUTHORITY.—

9 ‘‘ ‘(1) The Federal banking agencies referred to

10 in paragraphs (1) and (2) of subsection (b) shall

11 jointly prescribe such regulations as necessary to

12 carry out the purposes of this Act with respect to

13 any persons identified under paragraphs (1) and (2)

14 of subsection (b).

15 ‘‘ ‘(2) The Administrator of the National Credit

16 Union Administration shall prescribe such regula17 tions as necessary to carry out the purposes of this

18 Act with respect to any persons identified under

19 paragraph (3) of subsection (b).

20 ‘‘ ‘(3) The Federal Trade Commission shall pre21 scribe such regulations as necessary to carry out the

22 purposes of this Act with respect to any persons

23 identified under subsection (a).’.

24 ‘‘(b) RELATION TO OTHER PROVISIONS.—Except for

25 the amendment made by this section, nothing in this title

26 shall be construed to modify, limit, or supersede the oper-
19

•S 1903 IS

1 ation of the Fair Credit Reporting Act, and no inference

2 shall be drawn on the basis of the provisions of this title

3 regarding whether information is transaction or experience

4 information under section 603 of such Act.

5 ‘‘SEC. 506. STATE ELECTION TO PARTICIPATE.

6 ‘‘(a) REGULATIONS.—The Secretary of the Treasury

7 may promulgate such regulations as may be necessary to

8 establish the procedures governing whether the election re9 quired under section 504(a)(7) has been made.

10 ‘‘(b) DEADLINE.—The deadline for a State to elect

11 to become a participating state is the first day of the first

12 calendar quarter beginning after the close of the first leg13 islative session of the State legislature that begins on or

14 after the date the regulations required by section 504(a)

15 are issued in final form. For purposes of the previous sen16 tence, in the case of a State that has a 2-year legislative

17 session, each year of such session shall be deemed to be

18 a separate regular session of the State legislature.

19 ‘‘SEC. 507. RELATION TO STATE LAWS.

20 ‘‘(a) IN GENERAL.—This subtitle shall not be con21 strued as superseding, altering, or affecting the statutes,

22 regulations, orders, or interpretations in effect in any

23 State, except to the extent that such statutes, regulations,

24 orders, or interpretations are inconsistent with the provi-
20

•S 1903 IS

1 sions of this subtitle, and then only to the extent of the

2 inconsistency.

3 ‘‘(b) GREATER PROTECTION UNDER STATE LAW.—

4 For purposes of this section, a State statute, regulation,

5 order, or interpretation is not inconsistent with the provi6 sions of this subtitle if the protection such statute, regula7 tion, order, or interpretation affords any person is greater

8 than the protection provided under this subtitle as deter9 mined by the Commission or a Federal functional regu10 lator, on its own motion or upon the petition of any inter11 ested party.

12 ‘‘SEC. 508. DEFINITIONS.

13 ‘‘As used in this subtitle:

14 ‘‘(1) COMMISSION.—The term ‘Commission’

15 means the Federal Trade Commission.

16 ‘‘(2) FEDERAL FUNCTIONAL REGULATOR.—The

17 term ‘Federal functional regulator’ means—

18 ‘‘(A) the Board of Governors of the Fed19 eral Reserve System;

20 ‘‘(B) the Office of the Comptroller of the

21 Currency;

22 ‘‘(C) the Board of Directors of the Federal

23 Deposit Insurance Corporation;

24 ‘‘(D) the Director of the Office of Thrift

25 Supervision;
21

•S 1903 IS

1 ‘‘(E) the National Credit Union Adminis2 tration Board; and

3 ‘‘(F) the Securities and Exchange Commis4 sion.

5 ‘‘(3) FINANCIAL INSTITUTION.—The term ‘fi6 nancial institution’ means any institution the busi7 ness of which is engaging in financial activities or

8 activities that are incidental or complementary to fi9 nancial activities, as determined under section 4(k)

10 of the Bank Holding Company Act of 1956.

11 ‘‘(4) NONPUBLIC PERSONAL INFORMATION.—

12 ‘‘(A) The term ‘nonpublic personal infor13 mation’ means personally identifiable financial

14 information—

15 ‘‘(i) provided by a consumer to a fi16 nancial institution;

17 ‘‘(ii) resulting from any transaction

18 with the consumer or the service performed

19 for the consumer; or

20 ‘‘(iii) otherwise obtained by the finan21 cial institution.

22 ‘‘(B) Such term does not include publicly

23 available information, as such term is defined

24 by the regulations prescribed under section 504.
22

•S 1903 IS

1 ‘‘(C) Notwithstanding subparagraph (B),

2 such term—

3 (i) shall include any list, description,

4 or other grouping of consumers (and pub5 licly available information pertaining to

6 them) that is derived using any personally

7 identifiable information other than publicly

8 available information; but

9 ‘‘(ii) shall not include any list, de10 scription, or other grouping of consumers

11 (and publicly available information per12 taining to them) that is derived without

13 using any nonpublic personal information.

14 ‘‘(5) DIRECTORY INFORMATION.—The term

15 ‘publicly available directory information’ means sub16 scriber list information required to be made available

17 for publication pursuant to section 222(e) of the

18 Communications Act of 1934 (47 U.S.C. 222(3)).

19 ‘‘(6) UNRELATED USE.—The term ‘unrelated

20 use’, when used with respect to information collected

21 by the financial institution in connection with any

22 transaction with a consumer in any financial product

23 or any financial service, means any use other than

24 a use that is necessary to effect, administer, or en25 force such transaction.
23

•S 1903 IS

1 ‘‘(7) AFFILIATE.—The term ‘affiliate’ means

2 any company that controls, is controlled by, or is

3 under common control with another company.

4 ‘‘(8) NONAFFILIATED THIRD PARTY.—The term

5 ‘nonaffiliated third party’ means any entity that is

6 not an affiliate of, or related by common ownership

7 or affiliated by corporate control with, the financial

8 institution, but does not include a joint employee of

9 such institution.

10 ‘‘(9) NECESSARY TO EFFECT, ADMINISTER, OR

11 ENFORCE.—The disclosing or use of nonpublic per12 sonal information shall be treated as necessary to ef13 fect or administer a transaction with a consumer if

14 the disclosing or use—

15 ‘‘(A) is required, or is a usual, appropriate,

16 or acceptable method, to carry out the trans17 action or the product or service business of

18 which the transaction is a part, and record or

19 service or maintain the consumer’s account in

20 the ordinary course of providing the financial

21 service or financial product, or to administer or

22 service benefits or claims relating to the trans23 action or the product or service business of

24 which it is a part, and includes—
24

•S 1903 IS

1 ‘‘(i) providing the consumer or the

2 consumer’s agent or broker with a con3 firmation, statement, or other record of the

4 transaction, or information on the status

5 or value of the financial service or financial

6 product; and

7 ‘‘(ii) the accrual or recognition of in8 centives or bonuses associated with the

9 transaction that are provided by the finan10 cial institution or any other party;

11 ‘‘(B) is required, or is one of the lawful or

12 appropriate methods, to enforce the rights of

13 the financial institution or of other persons en14 gaged in carrying out the financial transaction,

15 or providing the product or service;

16 ‘‘(C) is required, or is a usual, appropriate,

17 or acceptable method, for insurance under18 writing at the consumer’s request or for rein19 surance purposes, or for any of the following

20 purposes as they relate to a consumer’s insur21 ance: account administration, reporting, inves22 tigating, or preventing fraud or material mis23 representation, processing premium payments,

24 processing insurance claims, administering in25 surance benefits (including utilization review ac-
25

•S 1903 IS

1 tivities), participating in research projects, or as

2 otherwise required or specifically permitted by

3 Federal or State law; or

4 ‘‘(D) the disclosure is required, or is a

5 usual, appropriate or acceptable method, in con6 nection with—

7 ‘‘(i) the authorization, settlement, bill8 ing, processing, clearing, transferring, rec9 onciling, or collection of amounts charged,

10 debited, or otherwise paid using a debit,

11 credit or other payment card, check, or ac12 count number, or by other payment means;

13 ‘‘(ii) the transfer of receivables, ac14 counts or interests therein; or

15 ‘‘(iii) the audit of debit, credit or

16 other payment information.

17 Each agency or authority described in section 504(a)

18 shall, consistent with the purposes of this subtitle,

19 prescribe by rule actions that shall, in a variety of

20 financial services, and with respect to a variety of fi21 nancial products, be treated as necessary to effect,

22 administer, or enforce a financial transaction.

23 ‘‘(10) FINANCIAL SERVICES; FINANCIAL PROD24 UCTS; TRANSACTION; RELATED TRANSACTION.—

25 Each agency or authority described in section 504(a)
26

•S 1903 IS

1 shall, consistent with the purposes of this subtitle,

2 prescribe by rule definitions of the terms ‘financial

3 services’, ‘financial products’, ‘transaction’, ‘related

4 transaction’, and ‘unrelated third party’ for purposes

5 of this subtitle.

6 ‘‘(11) STATE INSURANCE AUTHORITY.—The

7 term ‘State insurance authority’ means, in the case

8 of any person engaged in providing insurance, the

9 State insurance authority of the State in which the

10 person is domiciled.

11 ‘‘(12) CONSUMER.—The term ‘consumer’

12 means an individual who obtains, from a financial

13 institution, financial products or services which are

14 to be used primarily for personal, family, or house15 hold purposes, and also means the legal representa16 tive of such an individual.

17 ‘‘(13) CUSTOMER RELATIONSHIP.—The term

18 ‘time of establishing a customer relationship’ shall

19 be defined by the regulations prescribed under sec20 tion 504.

21 ‘‘SEC. 509. EFFECTIVE DATE.

22 ‘‘This subtitle shall take effect 6 months after the

23 date on which rules are required to be prescribed under

24 section 504(a)(3), except—
27

•S 1903 IS

1 ‘‘(1) to the extent that a later date is specified

2 in the rules prescribed under section 504; and

3 ‘‘(2) that sections 504 and 506 shall be effec4 tive upon enactment.

5 ‘‘Subtitle B—Fraudulent Access to

6 Financial Information

7 ‘‘SEC. 521. PRIVACY PROTECTION FOR CUSTOMER INFOR8 MATION OF FINANCIAL INSTITUTIONS.

9 ‘‘(a) PROHIBITION ON OBTAINING CUSTOMER INFOR10 MATION BY FALSE PRETENSES.—It shall be a violation

11 of this subtitle for any person to obtain or attempt to ob12 tain, or cause to be disclosed or attempt to cause to be

13 disclosed to any person, customer information of a finan14 cial institution relating to another person—

15 ‘‘(1) by making a false, fictitious, or fraudulent

16 statement or representation to an officer, employee,

17 or agent of a financial institution;

18 ‘‘(2) by making a false, fictitious, or fraudulent

19 statement or representation to a customer of a fi20 nancial institution; or

21 ‘‘(3) by providing any document to an officer,

22 employee, or agent of a financial institution, know23 ing that the document is forged, counterfeit, lost, or

24 stolen, was fraudulently obtained, or contains a
28

•S 1903 IS

1 false, fictitious, or fraudulent statement or represen2 tation.

3 ‘‘(b) PROHIBITION ON SOLICITATION OF A PERSON

4 TO OBTAIN CUSTOMER INFORMATION FROM FINANCIAL

5 INSTITUTION UNDER FALSE PRETENSES.—It shall be a

6 violation of this subtitle to request a person to obtain cus7 tomer information of a financial institution, knowing that

8 the person will obtain, or attempt to obtain, the informa9 tion from the institution in any manner described in sub10 section (a).

11 ‘‘(c) NONAPPLICABILITY TO LAW ENFORCEMENT

12 AGENCIES.—No provision of this section shall be con13 strued so as to prevent any action by a law enforcement

14 agency, or any officer, employee, or agent of such agency,

15 to obtain customer information of a financial institution

16 in connection with the performance of the official duties

17 of the agency.

18 ‘‘(d) NONAPPLICABILITY TO FINANCIAL INSTITU19 TIONS IN CERTAIN CASES.—No provision of this section

20 shall be construed so as to prevent any financial institu21 tion, or any officer, employee, or agent of a financial insti22 tution, from obtaining customer information of such finan23 cial institution in the course of—
29

•S 1903 IS

1 ‘‘(1) testing the security procedures or systems

2 of such institution for maintaining the confiden3 tiality of customer information;

4 ‘‘(2) investigating allegations of misconduct or

5 negligence on the part of any officer, employee, or

6 agent of the financial institution; or

7 ‘‘(3) recovering customer information of the fi8 nancial institution which was obtained or received by

9 another person in any manner described in sub10 section (a) or (b).

11 ‘‘(e) NONAPPLICABILITY TO INSURANCE INSTITU12 TIONS FOR INVESTIGATION OF INSURANCE FRAUD.—No

13 provision of this section shall be construed so as to prevent

14 any insurance institution, or any officer, employee, or

15 agency of an insurance institution, from obtaining infor16 mation as part of an insurance investigation into criminal

17 activity, fraud, material misrepresentation, or material

18 nondisclosure that is authorized for such institution under

19 State law, regulation, interpretation, or order.

20 ‘‘(f) NONAPPLICABILITY TO CERTAIN TYPES OF CUS21 TOMER INFORMATION OF FINANCIAL INSTITUTIONS.—No

22 provision of this section shall be construed so as to prevent

23 any person from obtaining customer information of a fi24 nancial institution that otherwise is available as a public
30

•S 1903 IS

1 record filed pursuant to the securities laws (as defined in

2 section 3(a)(47) of the Securities Exchange Act of 1934).

3 ‘‘SEC. 522. ADMINISTRATIVE ENFORCEMENT.

4 ‘‘(a) ENFORCEMENT BY FEDERAL TRADE COMMIS5 SION.—Compliance with this subtitle shall be enforced by

6 the Federal Trade Commission in the same manner and

7 with the same power and authority as the Commission has

8 under the title VIII, the Fair Debt Collection Practices

9 Act, to enforce compliance with such title.

10 ‘‘(b) NOTICE OF ACTIONS.—The Federal Trade Com11 mission shall—

12 ‘‘(1) notify the Securities and Exchange Com13 mission whenever the Federal Trade Commission ini14 tiates an investigation with respect to a financial in15 stitution subject to regulation by the Securities and

16 Exchange Commission;

17 ‘‘(2) notify the Federal banking agency (as de18 fined in section 3(z) of the Federal Deposit Insur19 ance Act) whenever the Commission initiates an in20 vestigation with respect to a financial institution

21 subject to regulation by such Federal banking agen22 cy; and

23 ‘‘(3) notify the appropriate State insurance reg24 ulator whenever the Commission initiates an inves-
31

•S 1903 IS

1 tigation with respect to a financial institution sub2 ject to regulation by such regulator.

3 ‘‘(c) STATE ACTION FOR VIOLATIONS.—

4 ‘‘(1) AUTHORITY OF STATES.—In addition to

5 such other remedies as are provided under State

6 law, if the chief law enforcement officer of a State,

7 or an official or agency designated by a State, has

8 reason to believe that any person has violated or is

9 violating this subtitle, the State—

10 ‘‘(A) may bring an action to enjoin such

11 violation in any appropriate United States dis12 trict court or in any other court of competent

13 jurisdiction;

14 ‘‘(B) may bring an action on behalf of the

15 residents of the State to recover damages of not

16 more than $1,000 for each violation; and

17 ‘‘(C) in the case of any successful action

18 under subparagraph (A) or (B), shall be award19 ed the costs of the action and reasonable attor20 ney fees as determined by the court.

21 ‘‘(2) RIGHTS OF FEDERAL REGULATORS.—

22 ‘‘(A) PRIOR NOTICE.—The State shall

23 serve prior written notice of any action under

24 paragraph (1) upon the Federal Trade Commis25 sion and provide the Federal Trade Commission
32

•S 1903 IS

1 with a copy of its complaint, except in any case

2 in which such prior notice is not feasible, in

3 which case the State shall serve such notice im4 mediately upon instituting such action.

5 ‘‘(B) RIGHT TO INTERVENE.—The Federal

6 Trade Commission shall have the right—

7 ‘‘(i) to intervene in an action under

8 paragraph (1);

9 ‘‘(ii) upon so intervening, to be heard

10 on all matters arising therein;

11 ‘‘(iii) to remove the action to the ap12 propriate United States district court; and

13 ‘‘(iv) to file petitions for appeal.

14 ‘‘(3) INVESTIGATORY POWERS.—For purposes

15 of bringing any action under this subsection, no pro16 vision of this subsection shall be construed as pre17 venting the chief law enforcement officer, or an offi18 cial or agency designated by a State, from exercising

19 the powers conferred on the chief law enforcement

20 officer or such official by the laws of such State to

21 conduct investigations or to administer oaths or af22 firmations or to compel the attendance of witnesses

23 or the production of documentary and other evi24 dence.
33

•S 1903 IS

1 ‘‘(4) LIMITATION ON STATE ACTION WHILE

2 FEDERAL ACTION PENDING.—If the Federal Trade

3 Commission has instituted a civil action for a viola4 tion of this subtitle, no State may, during the pend5 ency of such action, bring an action under this sec6 tion against any defendant named in the complaint

7 of the Federal Trade Commission or such agency for

8 any violation of this subtitle that is alleged in that

9 complaint.

10 ‘‘SEC. 523. CRIMINAL PENALTY.

11 ‘‘(a) IN GENERAL.—Whoever knowingly and inten12 tionally violates, or knowingly and intentionally attempts

13 to violate, section 521 shall be fined in accordance with

14 title 18, United States Code, or imprisoned for not more

15 than 5 years, or both.

16 ‘‘(b) ENHANCED PENALTY FOR AGGRAVATED

17 CASES.—Whoever violates, or attempts to violate, section

18 521 while violating another law of the United States or

19 as part of a pattern of any illegal activity involving more

20 than $100,000 in a 12-month period shall be fined twice

21 the amount provided in subsection (b)(3) or (c)(3) (as the

22 case may be) of section 3571 of title 18, United States

23 Code, imprisoned for not more than 10 years, or both.
34

•S 1903 IS

1 ‘‘SEC. 524. RELATION TO STATE LAWS.

2 ‘‘(a) IN GENERAL.—This subtitle shall not be con3 strued as superseding, altering, or affecting the statutes,

4 regulations, orders, or interpretations in effect in any

5 State, except to the extent that such statutes, regulations,

6 orders, or interpretations are inconsistent with the provi7 sions of this subtitle, and then only to the extent of the

8 inconsistency.

9 ‘‘(b) GREATER PROTECTION UNDER STATE LAW.—

10 For purposes of this section, a State statute, regulation,

11 order, or interpretation is not inconsistent with the provi12 sions of this subtitle if the protection such statute, regula13 tion, order, or interpretation affords any person is greater

14 than the protection provided under this subtitle as deter15 mined by the Commission, on its own motion or upon the

16 petition of any interested party.

17 ‘‘SEC. 525. AGENCY GUIDANCE.

18 ‘‘In furtherance of the objectives of this subtitle, each

19 Federal banking agency (as defined in section 3(z) of the

20 Federal Deposit Insurance Act) and the Securities and

21 Exchange Commission or self-regulatory organizations, as

22 appropriate, shall review regulations and guidelines appli23 cable to financial institutions under their respective juris24 dictions and shall prescribe such revisions to such regula25 tions and guidelines as may be necessary to ensure that

26 such financial institutions have policies, procedures, and
35

•S 1903 IS

1 controls in place to prevent the unauthorized disclosure

2 of customer financial information and to deter and detect

3 activities proscribed under section 521.

4 ‘‘SEC. 526. REPORTS.

5 ‘‘(a) REPORT TO THE CONGRESS.—Before the end of

6 the 18-month period beginning on the date of the enact7 ment of this Act, the Comptroller General, in consultation

8 with the Federal Trade Commission, Federal banking

9 agencies, the Securities and Exchange Commission, appro10 priate Federal law enforcement agencies, and appropriate

11 State insurance regulators, shall submit to the Congress

12 a report on the following:

13 ‘‘(1) The efficacy and adequacy of the remedies

14 provided in this subtitle in addressing attempts to

15 obtain financial information by fraudulent means or

16 by false pretenses.

17 ‘‘(2) Any recommendations for additional legis18 lative or regulatory action to address threats to the

19 privacy of financial information created by attempts

20 to obtain information by fraudulent means or false

21 pretenses.

22 ‘‘(b) ANNUAL REPORT BY ADMINISTERING AGEN23 CIES.—The Federal Trade Commission and the Attorney

24 General shall submit to Congress an annual report on
36

•S 1903 IS

1 number and disposition of all enforcement actions taken

2 pursuant to this subtitle.

3 ‘‘SEC. 527. DEFINITIONS.

4 ‘‘For purposes of this subtitle, the following defini5 tions shall apply:

6 ‘‘(1) CUSTOMER.—The term ‘customer’ means,

7 with respect to a financial institution, any person (or

8 authorized representative of a person) to whom the

9 financial institution provides a product or service,

10 including that of acting as a fiduciary.

11 ‘‘(2) CUSTOMER INFORMATION OF A FINANCIAL

12 INSTITUTION.—The term ‘‘customer information of

13 a financial institution’’ means any information main14 tained by or for a financial institution which is de15 rived from the relationship between the financial in16 stitution and a customer of the financial institution

17 and is identified with the customer.

18 ‘‘(3) DOCUMENT.—The term ‘document’ means

19 any information in any form.

20 ‘‘(4) FINANCIAL INSTITUTION.—

21 ‘‘(A) IN GENERAL.—The term ‘financial

22 institution’ means any institution engaged in

23 the business of providing financial services to

24 customers who maintain a credit, deposit, trust,
37

•S 1903 IS

1 or other financial account or relationship with

2 the institution.

3 ‘‘(B) CERTAIN FINANCIAL INSTITUTIONS

4 SPECIFICALLY INCLUDED.—The term ‘financial

5 institution’ includes any depository institution

6 (as defined in section 19(b)(1)(A) of the Fed7 eral Reserve Act), any broker or dealer, any in8 vestment adviser or investment company, any

9 insurance company, any loan or finance com10 pany, any credit card issuer or operator of a

11 credit card system, and any consumer reporting

12 agency that compiles and maintains files on

13 consumers on a nationwide basis (as defined in

14 section 603(p)).

15 ‘‘(C) SECURITIES INSTITUTIONS.—For

16 purposes of subparagraph (B)—

17 ‘‘(i) the terms ‘broker’ and ‘dealer’

18 have the meanings provided in section 3 of

19 the Securities Exchange Act of 1934 (15

20 U.S.C. 78c);

21 ‘‘(ii) the term ‘investment adviser’ has

22 the meaning provided in section 202(a)(11)

23 of the Investment Advisers Act of 1940

24 (15 U.S.C. 80b–2(a)); and
38

•S 1903 IS

1 ‘‘(iii) the term ‘investment company’

2 has the meaning provided in section 3 of

3 the Investment Company Act of 1940 (15

4 U.S.C. 80a–3).

5 ‘‘(D) FURTHER DEFINITION BY REGULA6 TION.—The Federal Trade Commission, after

7 consultation with Federal banking agencies and

8 the Securities and Exchange Commission, may

9 prescribe regulations clarifying or describing

10 the types of institutions which shall be treated

11 as financial institutions for purposes of this

12 subtitle.

Æ