II

106TH CONGRESS

1ST SESSION S. 1924

To ensure personal privacy with respect to financial information, to provide

customers notice and choice about how their financial institutions share

or sell their personally identifiable sensitive financial information, to

provide for strong enforcement of these rights, and to protect States’

rights.

IN THE SENATE OF THE UNITED STATES

NOVEMBER 16, 1999

Mr. LEAHY (for himself, Mr. BRYAN, Mr. HARKIN, Mr. DURBIN, Mr. FEINGOLD, and Mr. ROBB) introduced the following bill; which was read twice

and referred to the Committee on Banking, Housing, and Urban Affairs

A BILL

To ensure personal privacy with respect to financial information, to provide customers notice and choice about how

their financial institutions share or sell their personally

identifiable sensitive financial information, to provide for

strong enforcement of these rights, and to protect States’

rights.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE.

4 This Act may be cited as the ‘‘Financial Information

5 Privacy and Security Act’’.
2

•S 1924 IS

1 SEC. 2. DEFINITIONS.

2 In this Act—

3 (1) the term ‘‘covered person’’ means—

4 (A) a person that is subject to the jurisdic5 tion of any of the Federal banking agencies;

6 (B) a broker or dealer, or a person associ7 ated with a broker or dealer, as those terms are

8 defined in the Securities Exchange Act of 1934;

9 (C) an investment advisor, as that term is

10 defined in section 202 of the Investment Advi11 sors Act of 1940, and any officer, director,

12 partner, copartner, or employee of such invest13 ment advisor; and

14 (D) an investment company, as that term

15 is defined in section 3 of the Investment Com16 pany Act of 1940, and any officer, director,

17 partner, copartner, or employee of such invest18 ment company; and

19 (2) the term ‘‘Federal financial regulatory au20 thorities’’ means—

21 (A) each of the Federal banking agencies,

22 as that term is defined in section 3(z) of the

23 Federal Deposit Insurance Act; and

24 (B) the Securities and Exchange Commis25 sion.
3

•S 1924 IS

1 SEC. 3. PRIVACY OF CONFIDENTIAL CUSTOMER INFORMA2 TION.

3 (a) RULEMAKING.—The Federal financial regulatory

4 authorities shall jointly issue final rules to protect the pri5 vacy of confidential customer information relating to the

6 customers of covered persons, not later than 270 days

7 after the date of enactment of this Act (and shall issue

8 a notice of proposed rulemaking not later than 150 days

9 after the date of enactment of this Act), which rules

10 shall—

11 (1) define the term ‘‘confidential customer in12 formation’’ to be personally identifiable data that in13 cludes social security numbers, transactions, experi14 ences, rejections, balances, maturity dates, payouts,

15 and payout dates, of—

16 (A) deposit and trust accounts;

17 (B) certificates of deposit;

18 (C) securities holdings; and

19 (D) insurance policies;

20 (2) require that a covered person may not dis21 close or share any confidential customer information

22 to or with any affiliate or agent of that covered per23 son if the customer to whom the information relates

24 has been provided written notice, as described in

25 paragraphs (4) and (5), to the covered person pro26 hibiting such disclosure or sharing—
4

•S 1924 IS

1 (A) with respect to an individual that be2 came a customer on or after the effective date

3 of such rules, at the time at which the business

4 relationship between the customer and the cov5 ered person is initiated; and

6 (B) with respect to an individual that was

7 a customer before the effective date of such

8 rules, at such time thereafter that provides a

9 reasonable and informed opportunity to the cus10 tomer to prohibit such disclosure or sharing;

11 (3) require that a covered person may not dis12 close or share any confidential customer information

13 to or with any person that is not an affiliate or

14 agent of that covered person unless the covered per15 son has first—

16 (A) given written notice to the customer to

17 whom the information relates, as described in

18 paragraphs (4) and (5); and

19 (B) obtained the informed written or elec20 tronic consent of that customer for such disclo21 sures or sharing;

22 (4) require that the covered person provide no23 tices and consent acknowledgments to customers, as

24 required by this section, in separate and easily iden25 tifiable and distinguishable form;
5

•S 1924 IS

1 (5) require that the covered person provide no2 tice as required by this section to the customer to

3 whom the information relates that describes what

4 specific types of information would be disclosed or

5 shared, and under what general circumstances, to

6 what specific types of businesses or persons, and for

7 what specific types of purposes such information

8 could be disclosed or shared, and not less frequently

9 than annually thereafter;

10 (6) require that the customer to whom the in11 formation relates be provided with access to the con12 fidential customer information that could be dis13 closed or shared so that the information may be re14 viewed for accuracy and corrected or supplemented;

15 (7) require that, before a covered person may

16 use any confidential customer information provided

17 by a third party that engages, directly or indirectly,

18 in activities that are financial in nature, as deter19 mined by the Federal financial regulatory authori20 ties, the covered person shall take reasonable steps

21 to assure that procedures that are substantially

22 similar to those described in paragraphs (2) through

23 (6) have been followed by the provider of the infor24 mation (or an affiliate or agent of that provider);
6

•S 1924 IS

1 (8) establish a means of examination for com2 pliance and enforcement of such rules and resolving

3 consumer complaints; and

4 (9) require financial institutions within the ju5 risdiction of the Federal financial regulatory

6 authorities—

7 (A) to establish appropriate administrative,

8 technical, and physical safeguards to ensure

9 protection of the security and confidentiality of

10 records of confidential customer information;

11 and

12 (B) to protect against any anticipated

13 threats or hazards to the security or integrity

14 of such records that could result in their unau15 thorized release or disclosure.

16 (b) LIMITATION.—The rules prescribed pursuant to

17 subsection (a) may not prohibit the release of confidential

18 customer information—

19 (1) that is essential to processing a specific fi20 nancial transaction that the customer to whom the

21 information relates has authorized;

22 (2) to a governmental, regulatory, or self-regu23 latory authority having jurisdiction over the covered

24 financial entity for examination, compliance, or other

25 authorized purposes;
7

•S 1924 IS

1 (3) to a court of competent jurisdiction;

2 (4) to a consumer reporting agency, as defined

3 in section 603 of the Fair Credit Reporting Act for

4 inclusion in a consumer report that may be released

5 to a third party only for a purpose permissible under

6 section 604 of that Act; or

7 (5) that is not personally identifiable.

8 SEC. 4. CIVIL LIABILITY FOR NONCOMPLIANCE.

9 (a) IN GENERAL.—Any individual whose rights under

10 this Act have been knowingly or negligently violated may

11 bring a civil action to recover—

12 (1) such preliminary and equitable relief as the

13 court determines to be appropriate; and

14 (2) the greater of compensatory damages or liq15 uidated damages of $5,000.

16 (b) PUNITIVE DAMAGES.—In any action brought

17 under this section in which the individual has prevailed

18 because of a knowing violation of a provision of this Act,

19 the court may, in addition to any relief awarded under

20 subsection (a), award such punitive damages as may be

21 warranted.

22 (c) ATTORNEY’S FEES.—In the case of a civil action

23 brought under subsection (a) in which the individual has

24 substantially prevailed, the court may assess against the

25 respondent a reasonable attorney’s fee and other litigation
8

•S 1924 IS

1 costs and expenses (including expert fees) reasonably in2 curred.

3 (d) LIMITATION.—No action may be commenced

4 under this section more than 3 years after the date on

5 which the violation was or should reasonably have been

6 discovered.

7 (e) AGENCY.—A principal is jointly and severally lia8 ble with the principal’s agent for damages under this sec9 tion for the actions of the principal’s agent acting within

10 the scope of the agency.

11 (f) ADDITIONAL REMEDIES.—The equitable relief or

12 damages that may be available under this section shall be

13 in addition to any other lawful remedy or award available.

14 SEC. 5. RELATION TO STATE LAWS.

15 (a) IN GENERAL.—This Act shall not be construed

16 as superseding, altering, or affecting the statutes, regula17 tions, orders, or interpretations in effect in any State, ex18 cept to the extent that such statutes, regulations, orders,

19 or interpretations are inconsistent with the provisions of

20 this Act, and then only to the extent of the inconsistency.

21 (b) GREATER PROTECTION UNDER STATE LAW.—

22 For purposes of this Act, a State statute, regulation,

23 order, or interpretation is not inconsistent with the provi24 sions of this subtitle if the protection such statute, regula-
9

•S 1924 IS

1 tion, order, or interpretation affords any person is greater

2 than the protection provided under this Act.

Æ