SEC. 2. PERSONAL INFORMATION SHARING.
(a) DEPOSITORY INSTITUTIONS AND SUBSIDIARIES
OF DEPOSITORY INSTITUTIONS.—Section 18 of the Fed-
eral Deposit Insurance Act (12 U.S.C. 1828) is amended
by adding at the end the following new subsection:
‘‘(t) PERSONAL INFORMATION SHARING REQUIRE-
MENTS.—
‘‘(1) INFORMATION
SHARING
PROHIBITED
IF
CUSTOMER OPTS OUT.—Notwithstanding any other
provision of law and except as permitted under para-
graph (5), an insured depository institution and a
subsidiary of a depository institution may not dis-
close or transfer customer information relating to
any customer to any other person, including an affil-
iate of the depository institution, unless—
‘‘(A) the customer to whom such informa-
tion relates has been provided with notice in ac-
cordance with paragraph (2); and
‘‘(B) the customer has not provided a writ-
ten directive (including a transmission by e-
mail, facsimile, or other form of electronic com-
munication) to the insured depository institu-
tion or subsidiary, at any time before the close
of business on the 6th business day before such
disclosure or transfer, that such information
shall not be disclosed or transferred, except
when specifically authorized by the customer in
connection with and pertaining to a specific
transaction with the depository institution or
subsidiary.
‘‘(2) NOTICE.—
‘‘(A) IN GENERAL.—The notice referred to
in paragraph (1)(A) shall fully and fairly dis-
close, in accordance with regulations which the
Federal banking agencies shall jointly prescribe,
what information is being disclosed or trans-
ferred, the policy of the insured depository in-
stitution or subsidiary of an insured depository
institution with regard to information sharing,
and the right of the customer to prohibit the
disclosure or transfer of such information.
‘‘(B) FORM OF NOTICE.—
‘‘(i) IN
GENERAL.—The regulations
prescribed pursuant to subparagraph (A)
shall require that the notice required under
such subparagraph—
‘‘(I) be prominently displayed on
a document which is separate from
any other document;
‘‘(II) have the term ‘Privacy No-
tice’ in prominent typeface at the top
of the notice.
‘‘(ii) NOTICE REQUIREMENTS.—
‘‘(I) MAILING.—If the notice re-
quired under subparagraph (A) is
mailed to the customer, the notice
shall be mailed separately from any
other statement, document, or notice
mailed to the customer.
‘‘(II) IN PERSON.—If the notice
required under subparagraph (A) is
disclosed to the customer in person by
an officer, director, or agent of the
depository institution or subsidiary
thereof, the officer, employee, or agent
shall obtain the written acknowledge-
ment of the customer of the receipt of
such notice separately from any other
signature or written acknowledgment
of the customer.
‘‘(3) CUSTOMER INFORMATION DEFINED.—For
purposes of this subsection, the term ‘customer in-
formation’ means any information acquired from a
customer of the insured depository institution that is
personally identifiable to the customer, including in-
formation relating to transactions, balances, matu-
rity dates, payouts, and payout dates, and trans-
action or experience information.
‘‘(4) REASONABLE OPPORTUNITY TO RESPOND
TO NOTICE.—In order to provide any customer of an
insured depository institution or any subsidiary of
an insured depository institution with reasonable op-
portunity to respond to any notice referred to in
paragraph (1)(A), the prohibition contained in para-
graph (1) on the disclosure or transfer of any cus-
tomer information relating to such customer to any
other person, including an affiliate, shall continue
during the 30-day period beginning on the date the
notice referred to in such paragraph was sent or de-
livered to such customer, unless the customer has
authorized such disclosure or transfer.
‘‘(5) EXCEPTIONS.—Paragraph (1) shall not
apply to the disclosure or transfer of customer
information—
‘‘(A) in connection with processing a spe-
cific financial transaction that the customer to
whom the information relates has authorized,
if—
‘‘(i) the customer has been informed
that any such transaction will necessarily
involve the disclosure or transfer of such
information; and
‘‘(ii) the person to whom such infor-
mation is transferred or disclosed is sub-
ject to a legal or contractual obligation not
to use such information for any purpose
other than in connection with facilitating
the transaction;
‘‘(B) in connection with any routine finan-
cial transaction which does not involve mar-
keting of services or the sale of customer infor-
mation, if the person to whom such information
is transferred or disclosed is subject to a legal
or contractual obligation not to use such infor-
mation for any purpose other than in connec-
tion with effectuating the transaction;
‘‘(C) in connection with clearing checks,
processing credit transactions or electronic fund
transfers, or providing mailing services, if the
person to whom such information is transferred
or disclosed is subject to a legal or contractual
obligation not to use such information for any
purpose other than in connection with clearing
or processing the transaction or providing the
service;
‘‘(D) to a governmental, regulatory, or
self-regulatory authority having jurisdiction
over the insured depository institution for ex-
amination, compliance, or other authorized pur-
poses;
‘‘(E) to a court of competent jurisdiction;
‘‘(F) to a consumer reporting agency, as
defined in section 603(f) of the Fair Credit Re-
porting Act, for use solely in accordance with
such Act;
‘‘(G) in the case of a default by the cus-
tomer on an obligation to the depository institu-
tion or subsidiary, to a debt collector, as de-
fined in section 803(6) of the Fair Debt Collec-
tion Practices Act, counsel, or other entity in-
volved in debt collection, for use solely in ac-
cordance with such Act;
‘‘(H) in the case of any claim or litigation
between the customer and a depository institu-
tion or subsidiary, to a counsel or other person
involved in the resolution of the dispute;
‘‘(I) that is not personally identifiable to
the customer or is public information; or
‘‘(J) that is necessary to prevent or inves-
tigate fraudulent or unlawful acts which the de-
pository institution or subsidiary has a good
faith belief may occur or may have occurred.’’.
(b) BANK HOLDING COMPANIES AND AFFILIATES OF
BANK HOLDING COMPANIES.—Section 5 of the Bank
Holding Company Act of 1956 (12 U.S.C. 1844) is
amended by adding at the end the following new sub-
section:
‘‘(g) PERSONAL INFORMATION SHARING REQUIRE-
MENTS.—
‘‘(1) INFORMATION
SHARING
PROHIBITED
IF
CUSTOMER OPTS OUT.—Notwithstanding any other
provision of law and except as permitted under para-
graph (5), a bank holding company and an affiliate
of a bank holding company (other than a depository
institution subsidiary or subsidiary of such deposi-
tory institution) may not disclose or transfer cus-
tomer information relating to any customer to any
other person, including another affiliate of the bank
holding company, unless—
‘‘(A) the customer to whom such informa-
tion relates has been provided with notice in ac-
cordance with paragraph (2); and
‘‘(B) the customer has not provided a writ-
ten directive (including a transmission by e-
mail, facsimile, or other form of electronic com-
munication) to the bank holding company or af-
filiate, at any time before the close of business
on the 6th business day before such disclosure
or transfer, that such information shall not be
disclosed or transferred, except when specifi-
cally authorized by the customer in connection
with and pertaining to a specific transaction
with the bank holding company or affiliate.
‘‘(2) NOTICE.—
‘‘(A) IN GENERAL.—The notice referred to
in paragraph (1)(A) shall fully and fairly dis-
close, in accordance with regulations which the
Board shall prescribe, what information is being
disclosed or transferred, the policy of the bank
holding company or affiliate of a bank holding
company with regard to information sharing,
and the right of the customer to prohibit the
disclosure or transfer of such information.
‘‘(B) FORM OF NOTICE.—
‘‘(i) IN
GENERAL.—The regulations
prescribed pursuant to subparagraph (A)
shall require that the notice required under
such subparagraph—
‘‘(I) be prominently displayed on
a document which is separate from
any other document:
‘‘(II) have the term ‘Privacy No-
tice’ in prominent typeface at the top
of the notice.
‘‘(ii) NOTICE REQUIREMENTS.—
‘‘(I) MAILING.—If the notice re-
quired under subparagraph (A) is
mailed to the customer, the notice
shall be mailed separately from any
other statement, document, or notice
mailed to the customer.
‘‘(II) IN PERSON.—If the notice
required under subparagraph (A) is
disclosed to the customer in person by
an officer, director, or agent of the
bank holding company or affiliate
thereof, the officer, employee, or agent
shall obtain the written acknowledge-
ment of the customer of the receipt of
such notice separately from any other
signature or written acknowledgment
of the customer.
‘‘(3) CUSTOMER INFORMATION DEFINED.—For
purposes of this subsection, the term ‘customer in-
formation’ means any information acquired from a
customer of the bank holding company or affiliate
that is personally identifiable to the customer, in-
cluding information relating to transactions, bal-
ances, maturity dates, payouts, and payout dates,
and transaction or experience information.
‘‘(4) REASONABLE OPPORTUNITY TO RESPOND
TO NOTICE.—In order to provide any customer of a
bank holding company or any affiliate of a bank
holding company with reasonable opportunity to re-
spond to any notice referred to in paragraph (1)(A),
the prohibition contained in paragraph (1) on the
disclosure or transfer of any customer information
relating to such customer to any other person, in-
cluding another affiliate, shall continue during the
30-day period beginning on the date the notice re-
ferred to in such paragraph was sent or delivered to
such customer, unless the customer has authorized
such disclosure or transfer.
‘‘(5) EXCEPTIONS.—Paragraph (1) shall not
apply to the disclosure or transfer of customer
information—
‘‘(A) in connection with processing a spe-
cific financial transaction that the customer to
whom the information relates has authorized,
if—
‘‘(i) the customer has been informed
that any such transaction will necessarily
involve the disclosure or transfer of such
information; and
‘‘(ii) the person to whom such infor-
mation is transferred or disclosed is sub-
ject to a legal or contractual obligation not
to use such information for any purpose
other than in connection with facilitating
the transaction;
‘‘(B) in connection with any routine finan-
cial transaction which does not involve mar-
keting of services or the sale of customer infor-
mation, if the person to whom such information
is transferred or disclosed is subject to a legal
or contractual obligation not to use such infor-
mation for any purpose other than in connec-
tion with effectuating the transaction;
‘‘(C) in connection with clearing checks,
processing financial transactions or electronic
fund transfers, or providing mailing services, if
the person to whom such information is trans-
ferred or disclosed is subject to a legal or con-
tractual obligation not to use such information
for any purpose other than in connection with
clearing or processing the transaction or pro-
viding the service;
‘‘(D) to a governmental, regulatory, or
self-regulatory authority having jurisdiction
over the insured depository institution for ex-
amination, compliance, or other authorized pur-
poses;
‘‘(E) to a court of competent jurisdiction;
‘‘(F) to a consumer reporting agency, as
defined in section 603(f) of the Fair Credit Re-
porting Act, for use solely in accordance with
such Act;
‘‘(G) in the case of a default by the cus-
tomer on an obligation to the bank holding
company or affiliate, to a debt collector, as de-
fined in section 803(6) of the Fair Debt Collec-
tion Practices Act, counsel, or other entity in-
volved in debt collection, for use solely in ac-
cordance with such Act;
‘‘(H) in the case of any claim or litigation
between the customer and a depository institu-
tion or subsidiary, to counsel or any other per-
son involved in the resolution of the dispute;
‘‘(I) that is not personally identifiable to
the customer or is public information; or
‘‘(J) that is necessary to prevent or inves-
tigate fraudulent or unlawful acts which the
bank holding company or affiliate has a good
faith belief may occur or may have occurred.’’.
Æ