I 
117TH CONGRESS 
1ST SESSION H. R. 3910 
To amend the Gramm-Leach-Bliley Act to give the Bureau of Consumer 
Financial Protection rulemaking and enforcement authority over the safe-
guards rule with respect to data aggregators and other financial institu-
tions, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 15, 2021 
Mr. LYNCH introduced the following bill; which was referred to the Committee 
on Financial Services 
A BILL 
To amend the Gramm-Leach-Bliley Act to give the Bureau 
of Consumer Financial Protection rulemaking and en-
forcement authority over the safeguards rule with respect 
to data aggregators and other financial institutions, and 
for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Safeguarding Non- 
bank Consumer Information Act’’. 
VerDate Sep 11 2014 
00:51 Jul 02, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3910.IH
H3910
kjohnson on DSK79L0C42PROD with BILLS
SEC. 2. APPLICATION OF SAFEGUARDS RULE TO DATA 
AGGREGATORS. 
(a) APPLICATION OF SAFEGUARDS RULE.—Section 
501 of the Gramm-Leach-Bliley Act (15 U.S.C. 6801) is 
amended— 
(1) in the matter preceding paragraph (1), by 
inserting ‘‘and except as provided in subsection (c)’’ 
after ‘‘subsection (a)’’; 
(2) in subsection (b), by striking ‘‘, other than 
the Bureau of Consumer Financial Protection,’’; and 
(3) by adding at the end the following new sub-
section: 
‘‘(c) DATA AGGREGATORS.—The Bureau of Con-
sumer Financial Protection shall establish, by rule, appro-
priate standards for data aggregators relating to adminis-
trative, technical, and physical safeguards to protect 
records and information as described in paragraphs (1) 
through (3) of subsection (b).’’. 
(b) AUTHORITY OF THE BUREAU.—Title V of the 
Gramm-Leach-Bliley Act (15 U.S.C. 6801 et seq.) is 
amended— 
(1) in section 504(a)(1)(A), by striking ‘‘, ex-
cept that the Bureau of Consumer Financial Protec-
tion shall not have authority to prescribe regulations 
with respect to the standards under section 501’’; 
(2) in section 505— 
VerDate Sep 11 2014 
00:51 Jul 02, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3910.IH
H3910
kjohnson on DSK79L0C42PROD with BILLS
(A) in subsection (a)(8), by striking ‘‘, but 
not with respect to the standards under section 
501’’ 
and 
inserting 
‘‘, 
including 
data 
aggregators’’; 
(B) in subsection (b)(1), by striking ‘‘, 
other than the Bureau of Consumer Financial 
Protection,’’; and 
(C) in subsection (b)(2), by striking ‘‘and 
(7)’’ and inserting ‘‘(7), and (8)’’; and 
(3) in section 508(a), by striking ‘‘and the Fed-
eral Trade Commission’’ and inserting ‘‘, the Fed-
eral Trade Commission, and the Bureau of Con-
sumer Financial Protection’’. 
(c) DEFINITION.—Section 509 of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6809) is amended— 
(1) in paragraph (3)(A), by inserting before the 
period at the end ‘‘, and includes a data 
aggregator’’; and 
(2) by adding at the end the following new 
paragraph: 
‘‘(12) DATA
AGGREGATOR.—The term ‘data 
aggregator’ means a person that collects, maintains, 
utilizes, distributes, or gives access to individual or 
VerDate Sep 11 2014 
00:51 Jul 02, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3910.IH
H3910
kjohnson on DSK79L0C42PROD with BILLS
aggregate nonpublic personal information to another 
financial institution.’’. 
Æ 
VerDate Sep 11 2014 
00:51 Jul 02, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H3910.IH
H3910
kjohnson on DSK79L0C42PROD with BILLS