Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Data Privacy Act of 2023’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Protection of nonpublic personal information. 
Sec. 3. Obligations with respect to the collection and disclosure of nonpublic per-
sonal information. 
Sec. 4. Disclosure of institution privacy policy. 
Sec. 5. Rulemaking. 
Sec. 6. Relation to State laws. 
Sec. 7. Obligations with respect to access and deletion of nonpublic personal in-
formation. 
Sec. 8. Obligations with respect to the international sharing of nonpublic per-
sonal information. 
Sec. 9. Definitions. 
Sec. 10. Repeal of expired provisions. 
Sec. 11. GAO Report. 
Sec. 12. Sense of Congress. 
Sec. 13. Effective date. 
SEC. 2. PROTECTION OF NONPUBLIC PERSONAL INFORMA-
TION. 
Section 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6801) is amended— 
(1) in subsection (a)— 
(A) by striking ‘‘of its customers’’ and in-
serting ‘‘of individuals with whom such financial 
institution has a customer or consumer relation-
ship’’; and 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
(B) by striking ‘‘those customers’ nonpublic 
personal information’’ and inserting ‘‘those indi-
vidual’s nonpublic personal information’’; and 
(2) by adding at the end the following: 
‘‘(c) USE OF NONPUBLIC PERSONAL INFORMATION.— 
Unless otherwise permitted under section 502(e), it shall be 
unlawful for a financial institution to willfully use non-
public personal information without the consent of an indi-
vidual with whom the financial institution has a customer 
or consumer relationship.’’. 
SEC. 3. OBLIGATIONS WITH RESPECT TO THE COLLECTION 
AND DISCLOSURE OF NONPUBLIC PERSONAL 
INFORMATION. 
(a) IN GENERAL.—Section 502 of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6802) is amended— 
(1) in the heading, by striking ‘‘DISCLOSURES 
OF’’ and inserting ‘‘THE COLLECTION AND DIS-
CLOSURE OF NONPUBLIC’’; 
(2) in subsection (a)— 
(A) by inserting before ‘‘disclose’’ the fol-
lowing: ‘‘collect nonpublic personal information 
from an individual with whom such financial 
institution has a customer or consumer relation-
ship or’’; and 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
(B) by striking ‘‘has provided to the con-
sumer’’ and inserting ‘‘has provided to such in-
dividual’’; and 
(3) in subsection (b), by amending paragraph 
(1) to read as follows: 
‘‘(1) IN GENERAL.—A financial institution may 
not collect nonpublic personal information from an 
individual with whom such financial institution has 
a customer or consumer relationship or disclose non-
public personal information to a nonaffiliated third 
party unless the individual with whom such financial 
institution has a consumer or customer relationship 
is given the opportunity, before the time that such in-
formation is initially collected or disclosed, to direct 
that such information not be collected or disclosed to 
such third party.’’; 
(4) in subsection (d)— 
(A) by striking ‘‘of a consumer’’ and insert-
ing ‘‘of an individual with whom such financial 
institution has a customer or consumer relation-
ship’’; and 
(B) by striking ‘‘telemarketing, direct mail 
marketing, or other marketing through electronic 
mail to the consumer’’ and inserting ‘‘marketing 
to the individual with whom such financial in-
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
stitution has a customer or consumer relation-
ship, regardless of medium’’; 
(5) in subsection (e)— 
(A) in the heading, by striking ‘‘GENERAL’’; 
(B) by striking ‘‘Subsections (a) and (b) 
shall not prohibit the disclosure of nonpublic 
personal information’’ and inserting ‘‘The gen-
eral collection and disclosure procedures provided 
in subsections (a) and (b) shall not prohibit or 
otherwise limit the collection or disclosure of 
nonpublic personal information’’; 
(C) by striking paragraphs (1) and (2) and 
inserting the following: 
‘‘(1) if the collection or disclosure is— 
‘‘(A) necessary to effect, administer, or en-
force a transaction requested or authorized by the 
individual with whom the financial institution 
has a customer or consumer relationship; 
‘‘(B) in connection with servicing or proc-
essing a financial product or service requested or 
authorized by the individual with whom the fi-
nancial institution has a customer or consumer 
relationship; 
‘‘(C) with the consent or at the direction of 
the individual with whom the financial institu-
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
tion has a customer or consumer relationship, 
and the financial institution obtains, from such 
individual, evidence of such individual’s author-
ization for such collection or disclosure; or 
‘‘(D) in connection with— 
‘‘(i) maintaining or servicing the ac-
count, with such financial institution or 
with another entity as part of a private 
label or co-brand credit card program or an 
extension of credit on behalf of such entity, 
of an individual with whom such financial 
institution or entity has a customer or con-
sumer relationship; or 
‘‘(ii) 
a 
proposed 
or 
actual 
securitization, secondary market sale (in-
cluding sales of servicing rights), or similar 
transaction related to an account or a 
transaction of the individual which whom 
such entity or financial institution has a 
customer or consumer relationship; or 
‘‘(2) to a nonaffiliated third party to perform 
services for, or functions on behalf of, the financial in-
stitution, including marketing of the financial insti-
tution’s own products or services, or financial prod-
ucts or services offered pursuant to joint agreements 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
between two or more financial institutions that com-
ply with the requirements imposed by the regulations 
prescribed under section 504, if the financial institu-
tion fully discloses the providing of such information 
and enters into a contractual agreement with the 
third party that requires the third party to maintain 
the confidentiality of such information;’’; 
(D) in paragraph (3)— 
(i) in subparagraph (A)— 
(I) by striking ‘‘or security’’ and 
inserting ‘‘, security, or integrity’’; 
(II) by striking ‘‘pertaining to the 
consumer’’ and inserting ‘‘pertaining 
to the individual with whom the finan-
cial institution has a customer or con-
sumer relationship’’; 
(III) by inserting before the semi-
colon the following: ‘‘, as well as the 
systems, processes, and services that 
handle such records’’; 
(ii) in subparagraph (B), by inserting 
after ‘‘fraud,’’ the following: ‘‘identity 
theft,’’; 
(iii) in subparagraph (C), by striking 
‘‘for resolving customer disputes or inquir-
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
ies’’ and inserting ‘‘for resolving disputes or 
inquires relating to individuals with whom 
the financial institution has a customer or 
consumer relationship’’; 
(iv) in subparagraph (D), by striking 
‘‘relating to the consumer’’ and inserting 
‘‘relating to the individual with whom the 
financial institution has a customer or con-
sumer relationship’’; and 
(v) in subparagraph (E), by striking 
‘‘behalf of the consumer’’ and inserting ‘‘be-
half of the individual with whom the finan-
cial institution has a customer or consumer 
relationship’’; and 
(E) in paragraph (7)— 
(i) by striking ‘‘or exchange’’ and in-
serting ‘‘exchange, or similar transaction’’; 
(ii) by striking ‘‘consumers of such 
business or unit’’ and inserting ‘‘individ-
uals with whom such business or unit have 
a customer or consumer relationship’’; and 
(iii) by inserting ‘‘collection or’’ before 
‘‘disclosure’’; 
(6) by adding at the end the following: 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(f) NOTIFICATION TO NONAFFILIATES WHEN SHAR-
ING IS TERMINATED.— 
‘‘(1) IN GENERAL.—If a financial institution is 
required to terminate sharing nonpublic personal in-
formation, of an individual with whom such financial 
institution has a customer or consumer relationship, 
with a nonaffiliated third party— 
‘‘(A) the financial institution shall notify 
the nonaffiliated third party that the sharing has 
been terminated and that such nonaffiliated 
third party may not share any nonpublic infor-
mation of the individual already received from 
the financial institution; and 
‘‘(B) upon receipt of a notice described 
under subparagraph (A), the nonaffiliated third 
party may not share any nonpublic information 
of such individual already received from the fi-
nancial institution. 
‘‘(2) RULEMAKING.—The agencies referred to in 
section 504 shall issue rules to establish the require-
ments for notices under paragraph (1), including the 
form of such notices, taking into account any privacy 
risks posed by such notices. 
‘‘(g) REQUIREMENTS WITH RESPECT TO THE COLLEC-
TION OF ACCOUNT CREDENTIALS.—A financial institution 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
may not collect from an individual with whom such finan-
cial institution has a customer or consumer relationship ac-
count credentials such individual uses to access an account 
at a nonaffiliated third party that is a financial institution 
unless, prior to collecting the account credentials— 
‘‘(1) the financial institution clearly and con-
spicuously discloses to the individual, in a form per-
mitted by the regulations prescribed under section 
504— 
‘‘(A) that the financial institution is col-
lecting such account credentials; 
‘‘(B) how such credentials will be used by 
the financial institution; and 
‘‘(C) whether such credentials may be dis-
closed to a nonaffiliated third party; and 
‘‘(2) such individual is given an opportunity to 
direct that such credentials not be collected or to di-
rect that such credentials not be disclosed to any non-
affiliated third party.’’. 
(b) CONFORMING AMENDMENT.—Section 509(3)(D) of 
the Gramm-Leach-Bliley Act (15 U.S.C. 6809(3)(D)) is 
amended by striking ‘‘section 502(e)(1)(C)’’ and inserting 
‘‘section 502(e)(1)(D)(ii)’’. 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
SEC. 4. DISCLOSURE OF INSTITUTION PRIVACY POLICY. 
Section 503 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6803) is amended— 
(1) in subsection (a)— 
(A) by striking ‘‘customer relationship with 
a consumer’’ and inserting ‘‘customer or con-
sumer relationship’’; 
(B) by striking ‘‘clear and conspicuous dis-
closure to such consumer’’ and inserting ‘‘clear 
and conspicuous disclosure to such individual 
with whom such financial institution has a cus-
tomer or consumer relationship’’; 
(C) by redesignating paragraphs (1), (2), 
and (3) as paragraphs (2), (3), and (4), respec-
tively; 
(D) by inserting before paragraph (2), as so 
redesignated, the following: 
‘‘(1) collecting nonpublic personal information;’’; 
(E) in paragraph (3), as so redesignated, by 
striking ‘‘have ceased to be customers of’’ and in-
serting ‘‘have ceased to have a customer or con-
sumer relationship with’’; and 
(F) in paragraph (4), as so redesignated, by 
striking ‘‘personal information of consumers’’ 
and inserting ‘‘personal information of individ-
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
uals with whom such financial institution has a 
customer or consumer relationship’’; 
(2) by redesignating subsections (b) through (f) 
as subsections (c) through (g), respectively; 
(3) by inserting after subsection (a) the fol-
lowing: 
‘‘(b) DISCLOSURE UPON REQUEST.—Upon the request 
of an individual with whom a financial institution has a 
customer or consumer relationship, a financial institution 
shall provide such individual with a copy of the disclosures 
required by subsection (a) in writing or in electronic or 
other form as permitted by the regulations prescribed under 
section 504.’’; and 
(4) in subsection (d), as so redesignated— 
(A) in paragraph (1)— 
(i) by inserting ‘‘collecting or’’ before 
‘‘disclosing nonpublic’’; and 
(ii) by striking subparagraph (B) and 
inserting the following: 
‘‘(B) the purpose for which the financial in-
stitution collects the nonpublic personal informa-
tion of individuals with whom the financial in-
stitution has a customer or consumer relation-
ship, as well as how the information will be 
used;’’; 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
(B) in paragraph (2), by inserting before 
the semicolon the following: ‘‘, provided in a 
manner that provides individuals with whom the 
financial institution has a customer or consumer 
relationship a meaningful understanding of the 
information that is collected’’; 
(C) in paragraph (3), by striking ‘‘and’’ at 
the end; 
(D) in paragraph (4), by striking the pe-
riod at the end and inserting a semicolon; and 
(E) by adding at the end the following: 
‘‘(5) if the financial institution collects non-
public personal information for any purpose other 
than to provide a specific product or service such an 
individual is seeking— 
‘‘(A) a description of such information; 
‘‘(B) the purpose for which such informa-
tion is collected; and 
‘‘(C) the right of such individual to opt out 
of having such nonpublic personal information 
collected or disclosed to a nonaffiliated third 
party, and the manner in which such individual 
may make such opt out election; 
‘‘(6) the data retention policies of the financial 
institution, including— 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(A) the period of time for which the finan-
cial institution retains the nonpublic personal 
information relating to such individual; or 
‘‘(B) the criteria used by the financial insti-
tution to determine the period of time for which 
such information is retained; 
‘‘(7) the right of such individual to direct the fi-
nancial institution to terminate the sharing of non-
public personal information with a nonaffiliated 
third party, and the manner in which such indi-
vidual may make such direction; 
‘‘(8) the right of such individual to request that 
the financial institution provide the individual with 
a list of all nonpublic personal information relating 
to the individual held by the financial institution, 
and the manner in which the individual may make 
such request; and 
‘‘(9) the right of such individual to direct the fi-
nancial institution to delete nonpublic personal infor-
mation of the individual held by the financial institu-
tion (subject to the exceptions provided under section 
502A(b)(3)), and the manner in which the individual 
may make such direction.’’; 
(5) in subsection (f), as so redesignated— 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
carry out the purposes of this subtitle, sub-
ject to section 505(c). 
‘‘(ii) LIMITATION.—Regulations issued 
by a State insurance authority under this 
subparagraph may be no more restrictive 
for a person engaged in providing insurance 
than those regulations issued by the agencies 
coordinating for consistency and com-
parability under paragraph (2).’’; and 
(2) by adding at the end the following: 
‘‘(c) CONSIDERATION OF COMPLIANCE COSTS.—When 
prescribing rules under this subtitle, agencies shall take into 
account the compliance cost such rules will impose on small 
institutions.’’. 
SEC. 6. RELATION TO STATE LAWS. 
Section 507 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6807) is amended to read as follows: 
‘‘SEC. 507. RELATION TO STATE LAWS. 
‘‘This subtitle and the amendments made by this sub-
title supersede any statute or rule of a State or political 
subdivision thereof that regulates the obligations of a finan-
cial institution with respect to— 
‘‘(1) the collection or disclosure of personal infor-
mation; 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(2) the disclosure of the financial institution’s 
privacy policy or information about the financial in-
stitution’s privacy policies and practices; 
‘‘(3) the access to, deletion of, or other individual 
privacy rights with respect to personal information; 
or 
‘‘(4) the international sharing of personal infor-
mation.’’. 
SEC. 7. OBLIGATIONS WITH RESPECT TO ACCESS AND DE-
LETION OF NONPUBLIC PERSONAL INFORMA-
TION. 
(a) IN GENERAL.—Title V of the Gramm-Leach-Bliley 
Act (15 U.S.C. 6801 et seq.) is amended by inserting after 
section 502 the following: 
‘‘SEC. 502A. OBLIGATIONS WITH RESPECT TO ACCESS AND 
DELETION OF NONPUBLIC PERSONAL INFOR-
MATION. 
‘‘(a) ACCESS TO INFORMATION.— 
‘‘(1) IN GENERAL.—Upon an authorized request 
from an individual with whom a financial institu-
tion has a customer or consumer relationship, a fi-
nancial institution shall disclose— 
‘‘(A) any nonpublic personal information 
relating to such individual held by the financial 
institution; 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(B) the list of categories of nonaffiliated 
third parties with whom the financial institu-
tion shares nonpublic personal information re-
lating to such individual; and 
‘‘(C) the list of categories of nonaffiliated 
third parties from whom the financial institu-
tion has received nonpublic personal information 
relating to such individual. 
‘‘(2) 
FORMAT.—Disclosures 
described 
under 
paragraph (1) shall be in a structured, commonly 
used, and machine-readable format. 
‘‘(3) EXCEPTION.—For purposes of subpara-
graphs (B) and (C) of paragraph (1), a financial in-
stitution is not required to disclose a nonaffiliated 
third party with whom the financial institution 
shares or receives nonpublic personal information re-
lating to such individual pursuant to an exception 
described under any of paragraphs (3) through (8) of 
section 502(e). 
‘‘(b) DELETION OF INFORMATION.— 
‘‘(1) IN GENERAL.—Upon an authorized request 
from an individual with whom a financial institu-
tion has a customer or consumer relationship, a fi-
nancial institution shall delete any nonpublic per-
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
sonal information relating to such individual held by 
the financial institution. 
‘‘(2) CERTAIN INACTIVE ACCOUNTS.—If such in-
dividual has not used a product or service provided 
by a financial institution for 1 year, the financial in-
stitution shall— 
‘‘(A) notify such individual that such indi-
vidual has the right to request the deletion of any 
nonpublic personal information relating to such 
individual held by the financial institution, and 
provide such individual with clear instructions 
on how to make such request; and 
‘‘(B) for each additional 1-year period with 
respect to which such person continues to not use 
a product or service of the financial institution, 
resend the notice described under subparagraph 
(A). 
‘‘(3) EXCEPTION.— 
‘‘(A) IN
GENERAL.—This subsection shall 
not require a financial institution to delete non-
public personal information if— 
‘‘(i) the financial institution is other-
wise required by law to retain the non-
public personal information; 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(ii) the nonpublic personal informa-
tion may be necessary to respond to a dis-
pute under the Fair Credit Reporting Act; 
or 
‘‘(iii) the nonpublic personal informa-
tion may be necessary to retain for a pur-
pose described in an exception under section 
502(e). 
‘‘(B) LIMITATION ON RETAINED NONPUBLIC 
PERSONAL INFORMATION.—With respect to non-
public personal information that a financial in-
stitution would be required to delete under this 
subsection but for the application of this para-
graph, the financial institution may only use 
such nonpublic personal information for the ap-
plicable purpose described under subparagraph 
(A). 
‘‘(c) TIMING.—A financial institution that receives an 
authorized request, under this section, from an individual 
with whom such financial institution has a customer or 
consumer relationship, shall respond within 45 business 
days. 
‘‘(d) RULEMAKING.—Not later than the end of the 1- 
year period beginning on the date of enactment of this sec-
tion, each agency or authority described in section 504 shall 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
issue rules to carry out this section with respect to the fi-
nancial institutions subject to its jurisdiction.’’. 
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of the Gramm-Leach-Bliley Act is amended by 
inserting after the item relating to section 502 the following: 
‘‘Sec. 502A. Obligations with respect to access and deletion of nonpublic personal 
information.’’. 
SEC. 8. OBLIGATIONS WITH RESPECT TO THE INTER-
NATIONAL SHARING OF NONPUBLIC PER-
SONAL INFORMATION. 
(a) IN GENERAL.—Title V of the Gramm-Leach-Bliley 
Act (15 U.S.C. 6801 et seq.), as amended by section 10, 
is further amended by inserting after section 502A the fol-
lowing: 
‘‘SEC. 502B. OBLIGATIONS WITH RESPECT TO THE INTER-
NATIONAL SHARING OF NONPUBLIC PER-
SONAL INFORMATION. 
‘‘(a) IN GENERAL.—A financial institution may not 
share with a foreign government nonpublic personal infor-
mation relating to an individual with whom such financial 
institution has a customer or consumer relationship. 
‘‘(b) LAW ENFORCEMENT EXCEPTION.—Subsection (a) 
shall not apply to the sharing of the nonpublic personal 
information relating to such an individual with a foreign 
government authority if such sharing is— 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(1) done for legitimate law enforcement pur-
poses; or 
‘‘(2) to a foreign government authority having 
jurisdiction over the financial institution for exam-
ination, compliance, or other purposes as authorized 
by law.’’. 
(b) CLERICAL AMENDMENT.—The table of contents in 
section 1(b) of the Gramm-Leach-Bliley Act, as amended 
by section 10, is further amended by inserting after the item 
relating to section 502A the following: 
‘‘Sec. 502B. Obligations with respect to the international sharing of nonpublic 
personal information’’. 
SEC. 9. DEFINITIONS. 
Section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6809) is amended— 
(1) in paragraph (3)(A), by inserting before the 
period at the end the following: ‘‘and includes a data 
aggregator’’; 
(2) in paragraph (4), by striking ‘‘personally 
identifiable financial information’’ and inserting ‘‘in-
formation that identifies, relates to, describes, is rea-
sonably capable of being associated with, or could rea-
sonably be linked, directly or indirectly, with a par-
ticular individual and is’’; 
(3) in paragraph (7), by inserting ‘‘collection 
or’’ before ‘‘disclosure’’ each place such term appears; 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
(4) by striking paragraph (9); 
(5) by amending paragraph (11) to read as fol-
lows: 
‘‘(11) CUSTOMER
OR
CONSUMER
RELATION-
SHIP.— 
‘‘(A) IN GENERAL.—The term ‘customer or 
consumer relationship’ means a customer rela-
tionship or a consumer relationship. 
‘‘(B) CUSTOMER RELATIONSHIP.—The term 
‘customer relationship’ shall have the meaning 
given the term in rules issued pursuant to sec-
tion 504. 
‘‘(C) CONSUMER RELATIONSHIP.—The term 
‘consumer relationship’ shall have the meaning 
given the term in rules issued pursuant to sec-
tion 504 and such meaning shall— 
‘‘(i) include situations in which a fi-
nancial institution obtains nonpublic infor-
mation from an individual with whom the 
financial institution does not have a cus-
tomer relationship; and 
‘‘(ii) deem a financial institution to no 
longer to be in a consumer relationship 
with an individual at such time as the fi-
nancial institution no longer collects, con-
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
trols, possesses, transmits, or maintains any 
nonpublic personal information of such in-
dividual. 
‘‘(D) TREATMENT
OF
CERTAIN
TRANS-
ACTIONS.—When the terms ‘customer relation-
ship’ and ‘consumer relationship’ are defined by 
rule, it shall be specified that the following trans-
actions do not, by themselves, establish a con-
sumer relationship or a consumer relationship: 
‘‘(i) The use of an automated teller 
machine. 
‘‘(ii) The use of a credit card or debit 
card to make a purchase. 
‘‘(iii) Such other similar transactions 
as the agencies determine appropriate.’’; 
and 
(6) by adding at the end the following: 
‘‘(12) ACCOUNT
CREDENTIALS.—The term ‘ac-
count credentials’ means nonpublic personal informa-
tion that an individual with whom a financial insti-
tution has a customer or consumer relationship uses 
to access an account of the individual at such finan-
cial institution, including a username, password, or 
an answer to a security question. 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(13) DATA
AGGREGATOR.—The term ‘data 
aggregator’— 
‘‘(A) means any person that operates a 
commercial business or enterprise for the busi-
ness purpose of accessing, aggregating, collecting, 
selling, or sharing nonpublic personal informa-
tion about financial accounts or transactions re-
lating to an individual; and 
‘‘(B) does not include— 
‘‘(i) a service provider acting at the ex-
press instruction of a financial institution 
that accesses, aggregates, collects, or shares 
nonpublic personal information about an 
individual with whom such financial insti-
tution has a customer or consumer relation-
ship in accordance with paragraphs (1), 
(2), (3)(A), (3)(B), (3)(C), (3)(D), or (6) of 
section 502(e); or 
‘‘(ii) an attorney or accountant acting 
on behalf of an individual with whom such 
attorney or accountant has a customer or 
consumer relationship, in accordance with 
section 502(e)(3)(E). 
‘‘(14) PERSON ENGAGED IN PROVIDING INSUR-
ANCE.—The term ‘person engaged in providing insur-
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
ance’ means a person that engages in the business of 
insurance, as that term is defined in section 1002 of 
the Dodd-Frank Wall Street Reform and Consumer 
Protection Act (12 U.S.C. 5481).’’. 
SEC. 10. REPEAL OF EXPIRED PROVISIONS. 
The Gramm-Leach-Bliley Act is amended— 
(1) by striking section 508 (15 U.S.C. 6808); 
and 
(2) in the table of contents in section 1(b), by 
striking the item relating to section 508. 
SEC. 11. GAO REPORT. 
(a) IN GENERAL.—The Comptroller General of the 
United States shall, not later than 1 year after the date 
of the enactment of this Act, submit to the Congress a report 
that assesses— 
(1) whether the safeguard standards promulgated 
pursuant to section 501 of the Gramm-Leach-Bliley 
Act, including protecting against unauthorized disclo-
sure, are effective in protecting individuals with 
whom financial institutions have a customer or con-
sumer relationship; and 
(2) whether the enforcement regime with respect 
to those standards are effective in protecting cus-
tomers and consumers, and whether additional rem-
edies are necessary. 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
(b) DEFINITIONS.—In this section, the terms ‘‘cus-
tomer or consumer relationship’’ and ‘‘financial institu-
tion’’ have the meaning given those terms, respectively, 
under section 509 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6809), as amended by section 9. 
SEC. 12. SENSE OF CONGRESS. 
It is the sense of the Congress that the Federal agencies 
implementing the Gramm-Leach-Bliley Act should imple-
ment such Act, to the extent possible, in a technology-agnos-
tic manner so as to ensure it can adapt to different business 
models and technologies. 
SEC. 13. EFFECTIVE DATE. 
The amendments made by this Act shall take effect on 
the date that is the earlier of— 
(1) the date that is one year after the date on 
which all rulemaking required under this Act is com-
plete; or 
(2) the date that is 2 years after the date of the 
enactment of this Act. 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS
Union Calendar No. 673 
118TH CONGRESS 
2D SESSION 
H. R. 1165 
[Report No. 118–822] 
A BILL 
To amend the Gramm-Leach-Bliley Act to mod-
ernize the protection of the nonpublic personal 
information of individuals with whom financial 
institutions have customer or consumer relation-
ship, and for other purposes. 
DECEMBER 5, 2024 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
01:27 Dec 06, 2024
Jkt 059200
PO 00000
Frm 00030
Fmt 6651
Sfmt 6651
E:\BILLS\H1165.RH
H1165
ssavage on LAPJG3WLY3PROD with BILLS