II

106TH CONGRESS

2D SESSION S. 2513

To strengthen control by consumers over the use and disclosure of their

personal financial and health information by financial institutions, and

for other purposes.

IN THE SENATE OF THE UNITED STATES

MAY 4, 2000

Mr. LEAHY (for himself, Mr. SARBANES, Mr. ROBB, Mr. DODD, Mr. KERRY,

Mr. BRYAN, Mr. EDWARDS, Mr. DURBIN, Mr. HARKIN, and Mrs. FEINSTEIN) introduced the following bill; which was read twice and referred

to the Committee on Banking, Housing, and Urban Affairs

A BILL

To strengthen control by consumers over the use and disclosure of their personal financial and health information

by financial institutions, and for other purposes.

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled,

3 SECTION 1. SHORT TITLE AND TABLE OF CONTENTS.

4 (a) SHORT TITLE.—This Act may be cited as the

5 ‘‘Financial Information Privacy Protection Act of 2000’’.

6 (b) TABLE OF CONTENTS.—The table of contents for

7 this Act is as follows:

Sec. 1. Short title; table of contents.
2

•S 2513 IS

Sec. 2. Opt-out requirement for disclosure to affiliates and nonaffiliated third

parties.

Sec. 3. Restricting the transfer of information about personal spending habits.

Sec. 4. Restricting the use of health information in making credit and other financial decisions.

Sec. 5. Limits on redisclosure and reuse of information.

Sec. 6. Consumer rights to access and correct information.

Sec. 7. Improved enforcement authority.

Sec. 8. Enhanced disclosure of privacy policies.

Sec. 9. Limit on disclosure of account numbers.

Sec. 10. General exceptions.

Sec. 11. Definitions.

Sec. 12. Issuance of implementing regulations.

Sec. 13. FTC rulemaking authority under the Fair Credit Reporting Act.

1 SEC. 2. OPT-OUT REQUIREMENT FOR DISCLOSURE TO AF2 FILIATES AND NONAFFILIATED THIRD PAR3 TIES.

4 Section 502(a) of the Gramm-Leach-Bliley Act (15

5 U.S.C. 6802(a)) is amended to read as follows:

6 ‘‘(a) DISCLOSURE OF NONPUBLIC PERSONAL INFOR7 MATION.—Except as otherwise provided in this subtitle,

8 a financial institution may not disclose any nonpublic per9 sonal information to an affiliate or a nonaffiliated third

10 party unless such financial institution—

11 ‘‘(1) has provided to the consumer a clear and

12 conspicuous notice, in writing or electronic form or

13 other form permitted by the regulations imple14 menting this subtitle, of the categories of informa15 tion that may be disclosed to the—

16 ‘‘(A) affiliate; or

17 ‘‘(B) nonaffiliated third party;

18 ‘‘(2) has given the consumer an opportunity,

19 before the time that such information is initially dis-
3

•S 2513 IS

1 closed, to direct that such information not be dis2 closed to such—

3 ‘‘(A) affiliate; or

4 ‘‘(B) nonaffiliated third party; and

5 ‘‘(3) has given the consumer the ability to exer6 cise that nondisclosure option through the same

7 method of communication by which the consumer re8 ceived the notice described in paragraph (1) or an9 other method at least as convenient to the consumer,

10 and an explanation of how the consumer can exer11 cise such option.’’.

12 SEC. 3. RESTRICTING THE TRANSFER OF INFORMATION

13 ABOUT PERSONAL SPENDING HABITS.

14 Section 502(b) of the Gramm-Leach-Bliley Act (15

15 U.S.C. 6802(b)) is amended to read as follows:

16 ‘‘(b) RESTRICTION ON THE TRANSFER OF INFORMA17 TION ABOUT PERSONAL SPENDING HABITS.—

18 ‘‘(1) IN GENERAL.—Notwithstanding subsection

19 (a), if a financial institution provides a service to a

20 consumer through which the consumer makes or re21 ceives payments or transfers by check, debit card,

22 credit card, or other similar instrument, the finan23 cial institution shall not transfer to an affiliate or a

24 nonaffiliated third party—
4

•S 2513 IS

1 ‘‘(A) an individualized list of that con2 sumer’s transactions or an individualized de3 scription of that consumer’s interests, pref4 erences, or other characteristics; or

5 ‘‘(B) any such list or description con6 structed in response to an inquiry about a spe7 cific, named individual;

8 if the list or description is derived from information

9 collected in the course of providing that service.

10 ‘‘(2) RESTRICTION ON TRANSFER OF AGGRE11 GATE LISTS CONTAINING CERTAIN HEALTH INFOR12 MATION.—Notwithstanding subsection (a), a finan13 cial institution shall not transfer to an affiliate or a

14 nonaffiliated third party any aggregate list of con15 sumers containing or derived from individually iden16 tifiable health information.

17 ‘‘(3) EXCEPTIONS.—

18 ‘‘(A) IN GENERAL.—The financial institu19 tion may disclose the information described in

20 paragraph (1) or (2) to an affiliate or a non21 affiliated third party if such financial

22 institution—

23 ‘‘(i) has clearly and conspicuously re24 quested in writing or in electronic form or

25 other form permitted by the regulations
5

•S 2513 IS

1 implementing this subtitle, that the con2 sumer affirmatively consent to such disclo3 sure; and

4 ‘‘(ii) has obtained from the consumer

5 such affirmative consent and such consent

6 has not been withdrawn.

7 ‘‘(B) RULE OF CONSTRUCTION.—This sub8 section shall not be construed as preventing a

9 financial institution from transferring the infor10 mation described in paragraph (1) or (2) to an

11 affiliate or a nonaffiliated third party for the

12 purposes described in paragraph (1), (2), (3),

13 (5), (7), (8), (9), or (10) of subsection (f).

14 ‘‘(C) SCOPE OF APPLICATION.—Paragraph

15 (1) shall not apply to the transfer of aggregate

16 lists of consumers.’’.

17 SEC. 4. RESTRICTING THE USE OF HEALTH INFORMATION

18 IN MAKING CREDIT AND OTHER FINANCIAL

19 DECISIONS.

20 (a) RESTRICTION ON USE OF CONSUMER HEALTH

21 INFORMATION.—Section 502(c) of the Gramm-Leach-Bli22 ley Act (15 U.S.C. 6802(c)) is amended to read as follows:

23 ‘‘(c) USE OF CONSUMER HEALTH INFORMATION

24 AVAILABLE FROM AFFILIATES AND NONAFFILIATED

25 THIRD PARTIES.—In deciding whether, or on what terms,
6

•S 2513 IS

1 to offer, provide, or continue to provide a financial product

2 or service to a consumer, a financial institution shall not

3 obtain or receive individually identifiable health informa4 tion about the consumer from an affiliate or nonaffiliated

5 third party, or evaluate or otherwise consider any such in6 formation, unless the financial institution—

7 ‘‘(1) has clearly and conspicuously requested in

8 writing or in electronic form or other form permitted

9 by the regulations implementing this subtitle, that

10 the consumer affirmatively consent to the transfer

11 and use of that information with respect to a par12 ticular financial product or service;

13 ‘‘(2) has obtained from the consumer such af14 firmative consent and such consent has not been

15 withdrawn; and

16 ‘‘(3) requires the same health information

17 about all consumers as a condition for receiving the

18 financial product or service.’’.

19 (b) EXISTING PROTECTIONS FOR HEALTH INFORMA20 TION NOT AFFECTED.—Title V of the Gramm-Leach-Bli21 ley Act (15 U.S.C. 6801 et seq.) is amended by adding

22 after section 510 the following new section:
7

•S 2513 IS

1 ‘‘SEC. 511. RELATION TO STANDARDS ESTABLISHED UNDER

2 THE HEALTH INSURANCE PORTABILITY AND

3 ACCOUNTABILITY ACT OF 1996.

4 ‘‘Nothing in this subtitle shall be construed as—

5 ‘‘(1) modifying, limiting, or superseding stand6 ards governing the privacy and security of individ7 ually identifiable health information promulgated by

8 the Secretary of Health and Human Services under

9 sections 262(a) and 264 of the Health Insurance

10 Portability and Accountability Act of 1996; or

11 ‘‘(2) authorizing the use or disclosure of indi12 vidually identifiable health information in a manner

13 other than as permitted by other applicable law.’’.

14 (c) DEFINITION OF INDIVIDUALLY IDENTIFIABLE

15 HEALTH INFORMATION.—Section 509 of the Gramm16 Leach-Bliley Act (15 U.S.C. 6809) is amended by adding

17 at the end the following new paragraph:

18 ‘‘(12) INDIVIDUALLY IDENTIFIABLE HEALTH

19 INFORMATION.—The term ‘individually identifiable

20 health information’ means any information, includ21 ing demographic information obtained from or about

22 an individual, that is described in section

23 1171(6)(B) of the Social Security Act.’’.

24 (d) TECHNICAL AND CONFORMING AMENDMENT.—

25 Section 505(a)(6) of the Gramm-Leach-Bliley Act (15

26 U.S.C. 6805(a)(6)) is amended by inserting before the pe-
8

•S 2513 IS

1 riod at the end ‘‘to the extent the provisions of such sec2 tion are not inconsistent with the provisions of this sub3 title’’.

4 SEC. 5. LIMITS ON REDISCLOSURE AND REUSE OF INFOR5 MATION.

6 Section 502 of the Gramm-Leach-Bliley Act (15

7 U.S.C. 6802) is amended—

8 (1) by redesignating subsections (d) and (e) as

9 subsections (e) and (f), respectively; and

10 (2) by inserting after subsection (c) the fol11 lowing new subsection:

12 ‘‘(d) LIMITS ON REDISCLOSURE AND REUSE OF IN13 FORMATION.—

14 ‘‘(1) IN GENERAL.—An affiliate or a non15 affiliated third party that receives nonpublic per16 sonal information from a financial institution shall

17 not disclose such information to any other person

18 unless such disclosure would be lawful if made di19 rectly to such other person by the financial institu20 tion.

21 ‘‘(2) DISCLOSURE UNDER A GENERAL EXCEP22 TION.—Notwithstanding paragraph (1), any person

23 that receives nonpublic personal information from a

24 financial institution in accordance with one of the
9

•S 2513 IS

1 general exceptions in subsection (f) may use or dis2 close such information only—

3 ‘‘(A) as permitted under that general ex4 ception; or

5 ‘‘(B) under another general exception in

6 subsection (f), if necessary to carry out the pur7 pose for which the information was disclosed by

8 the financial institution.’’.

9 SEC. 6. CONSUMER RIGHTS TO ACCESS AND CORRECT

10 INFORMATION.

11 Title V of the Gramm-Leach-Bliley Act (15 U.S.C.

12 6801 et seq.) is amended by adding after section 511 (as

13 added by section 4(b) of this Act), the following new sec14 tion:

15 ‘‘SEC. 512. ACCESS TO AND CORRECTION OF INFORMATION.

16 ‘‘(a) ACCESS.—

17 (1) IN GENERAL.—Upon the request of a con18 sumer, a financial institution shall make available to

19 the consumer information about the consumer that

20 is under the control of, and reasonably available to,

21 the financial institution.

22 ‘‘(2) EXCEPTIONS.—Notwithstanding para23 graph (1), a financial institution—

24 ‘‘(A) shall not be required to disclose to a

25 consumer any confidential commercial informa-
10

•S 2513 IS

1 tion, such as an algorithm used to derive credit

2 scores or other risk scores or predictors;

3 ‘‘(B) shall not be required to create new

4 records in order to comply with the consumer’s

5 request;

6 ‘‘(C) shall not be required to disclose to a

7 consumer any information assembled by the fi8 nancial institution, in a particular matter, as

9 part of the financial institution’s efforts to com10 ply with laws preventing fraud, money laun11 dering, or other unlawful conduct; and

12 ‘‘(D) shall not disclose any information re13 quired to be kept confidential by any other Fed14 eral law.

15 ‘‘(b) CORRECTION.—A financial institution shall pro16 vide a consumer the opportunity to dispute the accuracy

17 of any information disclosed to the consumer pursuant to

18 subsection (a), and to present evidence thereon. A finan19 cial institution shall correct or delete material information

20 identified by a consumer that is materially incomplete or

21 inaccurate.

22 ‘‘(c) COORDINATION AND CONSULTATION.—In pre23 scribing regulations implementing this section, the Federal

24 agencies specified in section 504(a) shall consult with one

25 another to ensure that the rules—
11

•S 2513 IS

1 ‘‘(1) impose consistent requirements on the fi2 nancial institutions under their respective jurisdic3 tions;

4 ‘‘(2) take into account conditions under which

5 financial institutions do business both in the United

6 States and in other countries; and

7 ‘‘(3) are consistent with the principle of tech8 nology neutrality.

9 ‘‘(d) CHARGES FOR DISCLOSURES.—A financial insti10 tution may impose a reasonable charge for making a dis11 closure under this section, which charge must be disclosed

12 to the consumer before making the disclosure. ’’.

13 SEC. 7. IMPROVED ENFORCEMENT AUTHORITY.

14 (a) COMPLIANCE WITH PRIVACY POLICY.—Section

15 503 of the Gramm-Leach-Bliley Act (15 U.S.C. 6803) is

16 amended by adding at the end the following new sub17 section:

18 ‘‘(c) COMPLIANCE WITH PRIVACY POLICY.—A finan19 cial institution’s failure to comply with any of its policies

20 or practices disclosed to a consumer under this section

21 constitutes a violation of the requirements of this sec22 tion.’’.

23 (b) UNFAIR AND DECEPTIVE TRADE PRACTICE.—

24 Section 505(a)(7) of the Gramm-Leach-Bliley Act (15

25 U.S.C. 6805(a)(7)) is amended by adding at the end the
12

•S 2513 IS

1 following new sentence: ‘‘A violation of any requirement

2 of this subtitle, or the regulations of the Federal Trade

3 Commission prescribed under this subtitle, by a financial

4 institution or other person described in this paragraph

5 shall constitute an unfair or deceptive act or practice in

6 commerce in violation of section 5(a) of the Federal Trade

7 Commission Act.’’.

8 (c) SUPPLEMENTAL STATE ENFORCEMENT FOR FTC

9 REGULATED ENTITIES.—Section 505 of the Gramm10 Leach-Bliley Act (15 U.S.C. 6805) is amended by adding

11 at the end the following new subsection:

12 ‘‘(e) STATE ACTION FOR VIOLATIONS.—

13 ‘‘(1) AUTHORITY OF THE STATES.—In addition

14 to such other remedies as are provided under State

15 law, if the attorney general of a State, or an officer

16 authorized by the State, has reason to believe that

17 any financial institution or other person described in

18 section 505(a)(7) has violated or is violating this

19 subtitle or the regulations prescribed thereunder by

20 the Federal Trade Commission, the State may—

21 ‘‘(A) bring an action on behalf of the resi22 dents of the State to enjoin such violation in

23 any appropriate United States district court or

24 in any other court of competent jurisdiction;

25 and
13

•S 2513 IS

1 ‘‘(B) bring an action on behalf of the resi2 dents of the State to enforce compliance with

3 this subtitle and the regulations prescribed

4 thereunder by the Federal Trade Commission,

5 to obtain damages, restitution, or other com6 pensation on behalf of the residents of such

7 State, or to obtain such further and other relief

8 as the court may deem appropriate.

9 ‘‘(2) RIGHTS OF THE FEDERAL TRADE COMMIS10 SION.—The State shall serve prior written notice of

11 any action under paragraph (1) upon the Federal

12 Trade Commission and shall provide the Commission

13 with a copy of its complaint; provided that, if such

14 prior notice is not feasible, the State shall serve such

15 notice immediately upon instituting such action. The

16 Federal Trade Commission shall have the right—

17 ‘‘(A) to move to stay the action, pending

18 the final disposition of a pending Federal mat19 ter as described in paragraph (4);

20 ‘‘(B) to intervene in an action under para21 graph (1);

22 ‘‘(C) upon so intervening, to be heard on

23 all matters arising therein;

24 ‘‘(D) to remove the action to the appro25 priate United States district court; and
14

•S 2513 IS

1 ‘‘(E) to file petitions for appeal.

2 ‘‘(3) INVESTIGATORY POWERS.—For purposes

3 of bringing any action under this subsection, nothing

4 in this subsection shall prevent the attorney general,

5 or officers of such State who are authorized by such

6 State to bring such actions, from exercising the pow7 ers conferred on the attorney general or such offi8 cers by the laws of such State to conduct investiga9 tions or to administer oaths or affirmations or to

10 compel the attendance of witnesses or the production

11 of documentary and other evidence.

12 ‘‘(4) LIMITATION ON STATE ACTION WHILE

13 FEDERAL ACTION IS PENDING.—If the Federal

14 Trade Commission has instituted an action for a vio15 lation of this subtitle, no State may, during the

16 pendency of such action, bring an action under this

17 section against any defendant named in the com18 plaint of the Commission for any violation of this

19 subtitle that is alleged in that complaint.’’.

20 (d) STATE ACTION FOR VIOLATIONS OF BAN ON

21 PRETEXT CALLING.—Section 522 of the Gramm-Leach22 Bliley Act (15 U.S.C. 6822) is amended by adding at the

23 end the following new subsection:

24 ‘‘(c) STATE ACTION FOR VIOLATIONS.—
15

•S 2513 IS

1 ‘‘(1) AUTHORITY OF THE STATES.—In addition

2 to such other remedies as are provided under State

3 law, if the attorney general of a State, or an officer

4 authorized by the State, has reason to believe that

5 any person (other than a person described in sub6 section (b)(1)) has violated or is violating this sub7 title, the State may—

8 ‘‘(A) bring an action on behalf of the resi9 dents of the State to enjoin such violation in

10 any appropriate United States district court or

11 in any other court of competent jurisdiction;

12 and

13 ‘‘(B) bring an action on behalf of the resi14 dents of the State to enforce compliance with

15 this subtitle, to obtain damages, restitution, or

16 other compensation on behalf of the residents of

17 such State, or to obtain such further and other

18 relief as the court may deem appropriate.

19 ‘‘(2) RIGHTS OF FEDERAL AGENCIES.—The

20 State shall serve prior written notice of any action

21 commenced under paragraph (1) upon the Attorney

22 General and the Federal Trade Commission, and

23 shall provide the Attorney General and the Commis24 sion with a copy of the complaint; provided that, if

25 such prior notice is not feasible, the State shall serve
16

•S 2513 IS

1 such notice immediately upon instituting such ac2 tion. The Attorney General and the Federal Trade

3 Commission shall have the right—

4 ‘‘(A) to move to stay the action, pending

5 the final disposition of a pending Federal mat6 ter as described in paragraph (4);

7 ‘‘(B) to intervene in an action under para8 graph (1);

9 ‘‘(C) upon so intervening, to be heard on

10 all matters arising therein;

11 ‘‘(D) to remove the action to the appro12 priate United States district court; and

13 ‘‘(E) to file petitions for appeal.

14 ‘‘(3) INVESTIGATORY POWERS.—For purposes

15 of bringing any action under this subsection, nothing

16 in this subsection shall prevent the attorney general,

17 or officers of such State who are authorized by such

18 State to bring such actions, from exercising the pow19 ers conferred on the attorney general or such offi20 cers by the laws of such State to conduct investiga21 tions or to administer oaths or affirmations or to

22 compel the attendance of witnesses or the production

23 of documentary and other evidence.

24 ‘‘(4) LIMITATION ON STATE ACTION WHILE

25 FEDERAL ACTION IS PENDING.—If the Attorney
17

•S 2513 IS

1 General has instituted a criminal proceeding or the

2 Federal Trade Commission has instituted a civil ac3 tion for a violation of this subtitle, no State may,

4 during the pendency of such proceeding or action,

5 bring an action under this section against any de6 fendant named in the criminal proceeding or civil ac7 tion for any violation of this subtitle that is alleged

8 in that proceeding or action.’’.

9 SEC. 8. ENHANCED DISCLOSURE OF PRIVACY POLICIES.

10 (a) TIMING OF NOTICE TO CONSUMERS.—Section

11 503(a) of the Gramm-Leach-Bliley Act (15 U.S.C.

12 6803(a)) is amended to read as follows:

13 ‘‘(a) DISCLOSURE REQUIRED.—

14 ‘‘(1) TIME OF DISCLOSURE.—A financial insti15 tution shall provide a disclosure that complies with

16 paragraph (2)—

17 ‘‘(A) to an individual upon the individual’s

18 request;

19 ‘‘(B) as part of an application for a finan20 cial product or service from the financial insti21 tution; and

22 ‘‘(C) to a consumer, prior to establishing a

23 customer relationship with the consumer and

24 not less frequently than annually during the

25 continuation of such relationship.
18

•S 2513 IS

1 ‘‘(2) DISCLOSURE FORMAT.—The disclosure re2 quired by paragraph (1) shall be a clear and con3 spicuous notice, in writing or in electronic form or

4 other form permitted by the regulations imple5 menting this subtitle, of such financial institution’s

6 policies and practices with respect to—

7 ‘‘(A) disclosing nonpublic personal infor8 mation to affiliates and nonaffiliated third par9 ties, consistent with section 502, including the

10 categories of information that may be disclosed;

11 ‘‘(B) disclosing nonpublic personal infor12 mation of persons who have ceased to be cus13 tomers of the financial institution; and

14 ‘‘(C) protecting the nonpublic personal in15 formation of consumers.

16 Such disclosure shall be made in accordance with the

17 regulations implementing this subtitle.’’.

18 (b) NOTICE OF RIGHTS TO ACCESS AND CORRECT

19 INFORMATION.—Section 503(b)(2) of the Gramm-Leach20 Bliley Act (15 U.S.C. 6803(b)(2)) is amended by inserting

21 ‘‘, and a statement of the consumer’s right to access and

22 correct such information, consistent with section 512’’

23 after ‘‘institution’’.

24 (c) TECHNICAL AND CONFORMING AMENDMENT.—

25 Section 503(b)(1)(A) of the Gramm-Leach-Bliley Act (15
19

•S 2513 IS

1 U.S.C. 6803(b)(1)(A)) is amended by striking ‘‘502(e)’’

2 and inserting ‘‘502(f)’’.

3 SEC. 9. LIMIT ON DISCLOSURE OF ACCOUNT NUMBERS.

4 Section 502 of the Gramm-Leach-Bliley Act (15

5 U.S.C. 6802) is amended in subsection (e) (as so redesig6 nated by section 5) by inserting ‘‘affiliate or’’ before ‘‘non7 affiliated third party’’.

8 SEC. 10. GENERAL EXCEPTIONS.

9 Section 502(f) of the Gramm-Leach-Bliley Act (15

10 U.S.C. 6802)) (as so redesignated by section 5 of this Act)

11 is amended—

12 (1) in the matter preceding paragraph (1), by

13 striking ‘‘Subsections (a) and (b)’’ and inserting

14 ‘‘Subsection (a)’’;

15 (2) in paragraph (1)—

16 (A) by striking ‘‘or’’ at the end of subpara17 graph (B);

18 (B) by inserting ‘‘or’’ after the semicolon

19 at the end of subparagraph (C); and

20 (C) by inserting after subparagraph (C)

21 the following new subparagraph:

22 ‘‘(D) performing services for or functions

23 solely on behalf of the financial institution with

24 respect to the financial institution’s own cus25 tomers, including marketing of the financial in-
20

•S 2513 IS

1 stitution’s own products or services to the fi2 nancial institution’s customers;’’;

3 (3) in paragraph (4), by striking ‘‘, and the in4 stitution’s attorneys, accountants, and auditors’’;

5 (4) in paragraph (5), by inserting ‘‘section 21

6 of the Federal Deposit Insurance Act,’’ after ‘‘title

7 31, United States Code,’’;

8 (5) in paragraph (7), by striking ‘‘or’’ at the

9 end;

10 (6) in paragraph (8), by striking the period and

11 inserting a semicolon; and

12 (7) by adding at the end the following new

13 paragraphs:

14 ‘‘(9) in order to facilitate customer service, such

15 as maintenance and operation of consolidated cus16 tomer call centers or the use of consolidated cus17 tomer account statements; or

18 ‘‘(10) to the institution’s attorneys, account19 ants, and auditors.’’.

20 SEC. 11. DEFINITIONS.

21 Section 509 of the Gramm-Leach-Bliley Act (15

22 U.S.C. 6809) is amended—

23 (1) in paragraph (3)—

24 (A) by striking ‘‘(3) FINANCIAL INSTITU25 TION’’ and all that follows through ‘‘The term
21

•S 2513 IS

1 ‘financial institution’ ’’ and inserting ‘‘(3) FI2 NANCIAL INSTITUTION.—The term ‘financial in3 stitution’ ’’; and

4 (B) by striking subparagraphs (B), (C),

5 and (D);

6 (2) by amending paragraph (4) to read as fol7 lows:

8 ‘‘(4) NONPUBLIC PERSONAL INFORMATION.—

9 The term ‘nonpublic personal information’ means—

10 ‘‘(A) any personally identifiable informa11 tion, including a Social Security number—

12 ‘‘(i) provided by a consumer to a fi13 nancial institution, in an application or

14 otherwise, to obtain a financial product or

15 service from the financial institution;

16 ‘‘(ii) resulting from any transaction

17 between a financial institution and a con18 sumer involving a financial product or

19 service; or

20 ‘‘(iii) obtained by the financial institu21 tion about a consumer in connection with

22 providing a financial product or service to

23 that consumer, other than publicly avail24 able information, as such term is defined
22

•S 2513 IS

1 by the regulations prescribed under section

2 504; and

3 ‘‘(B) any list, description or other grouping

4 of one or more consumers of the financial insti5 tution and publicly available information per6 taining to them.’’; and

7 (3) in paragraph (9), by inserting ‘‘applies for

8 or’’ before ‘‘obtains’’.

9 SEC. 12. ISSUANCE OF IMPLEMENTING REGULATIONS.

10 (a) IN GENERAL.—The Federal agencies specified in

11 section 504(a) of the Gramm-Leach-Bliley Act (15 U.S.C.

12 6804(a)) shall prescribe regulations implementing the

13 amendments to subtitle A of title V of the Gramm-Leach14 Bliley Act made by this Act, and shall include such re15 quirements determined to be appropriate to prevent their

16 circumvention or evasion.

17 (b) COORDINATION, CONSISTENCY, AND COM18 PARABILITY.—The regulations issued under subsection (a)

19 shall be issued in accordance with the requirements of sec20 tion 504(a) of the Gramm-Leach-Bliley Act (15 U.S.C.

21 6804(a)), except that the deadline in section 504(a)(3)

22 shall not apply.
23

•S 2513 IS

1 SEC. 13. FTC RULEMAKING AUTHORITY UNDER THE FAIR

2 CREDIT REPORTING ACT.

3 Section 621(e) of the Fair Credit Reporting Act (15

4 U.S.C. 1681s(e)) is amended by adding at the end the fol5 lowing new paragraph:

6 ‘‘(3) REGULATIONS.—The Federal Trade Com7 mission shall prescribe such regulations as necessary

8 to carry out the provisions of this title with respect

9 to any persons identified under paragraph (1) of

10 subsection (a). Prior to prescribing such regulations,

11 the Federal Trade Commission shall consult with the

12 Federal banking agencies referred to in paragraph

13 (1) of this subsection in order to ensure, to the ex14 tent possible, comparability and consistency with the

15 regulations issued by the Federal banking agencies

16 under that paragraph.’’.

Æ