IB 
Union Calendar No. 849 
115TH CONGRESS 
2D SESSION 
H. R. 6743 
[Report No. 115–1097] 
To amend the Gramm-Leach-Bliley Act to provide a national standard for 
financial institution data security and breach notification on behalf of 
all consumers, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 7, 2018 
Mr. LUETKEMEYER introduced the following bill; which was referred to the 
Committee on Financial Services 
DECEMBER 21, 2018 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on September 7, 2018] 
VerDate Sep 11 2014 
23:36 Dec 21, 2018
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H6743.RH
H6743
lotter on DSKBCFDHB2PROD with BILLS
A BILL 
To amend the Gramm-Leach-Bliley Act to provide a national 
standard for financial institution data security and 
breach notification on behalf of all consumers, and for 
other purposes. 
VerDate Sep 11 2014 
22:13 Dec 21, 2018
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H6743.RH
H6743
lotter on DSKBCFDHB2PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Consumer Information 
Notification Requirement Act’’. 
SEC. 2. BREACH NOTIFICATION STANDARDS. 
Section 501 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6801) is amended— 
(1) in subsection (b)(3) by striking the period at 
the end and inserting ‘‘, including through the provi-
sion of a breach notice in the event of unauthorized 
access that is reasonably likely to result in identity 
theft, fraud, or economic loss.’’; and 
(2) by adding at the end the following: 
‘‘(c) STANDARDS WITH RESPECT TO BREACH NOTIFI-
CATION.—Subject to section 504(a)(2) and sections 505(b) 
and 505(c), within 6 months after the date of enactment 
of this subsection, each agency or authority required to es-
tablish standards described under subsection (b)(3) with re-
spect to the provision of a breach notice shall ensure that 
such standards are in compliance with subsection (b). 
‘‘(d) INSURANCE.— 
‘‘(1) ENFORCEMENT.—Notwithstanding section 
505(a)(6), with respect to an entity engaged in pro-
VerDate Sep 11 2014 
23:37 Dec 21, 2018
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H6743.RH
H6743
lotter on DSKBCFDHB2PROD with BILLS
viding insurance, the standards under subsection (b) 
shall be enforced— 
‘‘(A) with respect to any such standards re-
lated to data security safeguards, by— 
‘‘(i) the State insurance authority of 
the State in which the entity is domiciled; 
or 
‘‘(ii) in the case of an insurance agen-
cy or brokerage, the State insurance author-
ity of the State in which such agency or 
brokerage has its principal place of busi-
ness; and 
‘‘(B) with respect to any such standards re-
lated to notification of the breach of data secu-
rity, by the State insurance authority of any 
State in which customers of the entity are af-
fected by such a breach of data security. 
‘‘(2) NOTIFICATION BY ASSUMING INSURER.— 
‘‘(A) IN
GENERAL.—Notwithstanding sub-
section (b), an assuming insurer that experiences 
a breach of data security shall only be required 
to notify the State insurance authority of the 
State in which the assuming insurer is domi-
ciled. 
VerDate Sep 11 2014 
22:13 Dec 21, 2018
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H6743.RH
H6743
lotter on DSKBCFDHB2PROD with BILLS
‘‘(B) ASSUMING
INSURER
DEFINED.—For 
purposes of this paragraph, the term ‘assuming 
insurer’ means an entity engaged in providing 
insurance that acquires an insurance obligation 
or risk from another entity engaged in providing 
insurance pursuant to a reinsurance agreement. 
‘‘(3) 
SAFEGUARDS
FOR
INSURANCE
CUS-
TOMERS.—In carrying out subsection (b) with respect 
to an entity engaged in providing insurance, a State 
insurance authority shall establish the standards for 
safeguarding customer information maintained by en-
tities engaged in activities described in section 
4(k)(4)(B) of the Bank Holding Company Act of 1956 
(12 U.S.C. 1843(4)(k)(4)(B)) that are the same as the 
standards contained in the interagency guidelines 
issued by the Comptroller of the Currency, the Board 
of Governors of the Federal Reserve Board, the Fed-
eral Deposit Insurance Corporation, and the Office of 
Thrift Supervision titled ‘Interagency Guidelines Es-
tablishing Standards for Safeguarding Customer In-
formation’, published February 1, 2001 (66 Fed. Reg. 
8633), and such standards shall be applied as if the 
entity engaged in providing insurance was a bank to 
the extent appropriate and practicable.’’. 
VerDate Sep 11 2014 
22:13 Dec 21, 2018
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H6743.RH
H6743
lotter on DSKBCFDHB2PROD with BILLS
SEC. 3. PREEMPTION WITH RESPECT TO FINANCIAL INSTI-
TUTION SAFEGUARDS. 
Section 507 of the Gramm-Leach-Bliley Act (15 U.S.C. 
6807) is amended to read as follows: 
‘‘SEC. 507. RELATION TO STATE LAWS. 
‘‘(a) IN GENERAL.—This subtitle preempts any law, 
rule, regulation, requirement, standard, or other provision 
having the force and effect of law of any State, or political 
subdivision of a State, with respect to a financial institu-
tion or affiliate thereof securing personal information from 
unauthorized access or acquisition, including notification 
of unauthorized access or acquisition of data. 
‘‘(b) INSURANCE.—Subsection (a) shall not prevent a 
State or political subdivision of a State from establishing 
the standards for entities engaged in providing insurance 
required by sections 501(c) and 501(d), provided the stand-
ards established by such State or political subdivision do 
not impose any requirement that is in addition to or dif-
ferent from those standards, except where necessary to effec-
tuate the purposes of this subtitle.’’. 
VerDate Sep 11 2014 
22:13 Dec 21, 2018
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H6743.RH
H6743
lotter on DSKBCFDHB2PROD with BILLS
VerDate Sep 11 2014 
22:13 Dec 21, 2018
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H6743.RH
H6743
lotter on DSKBCFDHB2PROD with BILLS
Union Calendar No. 849 
115TH CONGRESS 
2D SESSION 
H. R. 6743 
[Report No. 115–1097] 
A BILL 
To amend the Gramm-Leach-Bliley Act to provide 
a national standard for financial institution data 
security and breach notification on behalf of all 
consumers, and for other purposes. 
DECEMBER 21, 2018 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Sep 11 2014 
22:13 Dec 21, 2018
Jkt 089200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\H6743.RH
H6743
lotter on DSKBCFDHB2PROD with BILLS