I 
118TH CONGRESS 
1ST SESSION H. R. 1165 
To amend the Gramm-Leach-Bliley Act to modernize the protection of the 
nonpublic personal information of individuals with whom financial institu-
tions have customer or consumer relationship, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 24, 2023 
Mr. MCHENRY introduced the following bill; which was referred to the 
Committee on Financial Services 
A BILL 
To amend the Gramm-Leach-Bliley Act to modernize the 
protection of the nonpublic personal information of indi-
viduals with whom financial institutions have customer 
or consumer relationship, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Data Privacy Act of 2023’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
Sec. 1. Short title; table of contents. 
Sec. 2. Protection of nonpublic personal information. 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6211
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
Sec. 3. Obligations with respect to the collection and disclosure of nonpublic 
personal information. 
Sec. 4. Disclosure of institution privacy policy. 
Sec. 5. Rulemaking. 
Sec. 6. Relation to State laws. 
Sec. 7. Definitions. 
Sec. 8. Obligations with respect to access and deletion of nonpublic personal in-
formation. 
Sec. 9. Obligations with respect to the international sharing of nonpublic per-
sonal information. 
Sec. 10. Repeal of expired provisions. 
Sec. 11. GAO Report. 
Sec. 12. Sense of Congress. 
Sec. 13. Effective date. 
SEC. 2. PROTECTION OF NONPUBLIC PERSONAL INFORMA-
TION. 
Section 501 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801) is amended— 
(1) in subsection (a)— 
(A) by striking ‘‘of its customers’’ and in-
serting ‘‘of individuals with whom such finan-
cial institution has a customer or consumer re-
lationship’’; and 
(B) by striking ‘‘those customers’ non-
public personal information’’ and inserting 
‘‘those individual’s nonpublic personal informa-
tion’’; and 
(2) by adding at the end the following: 
‘‘(c) USE
OF
NONPUBLIC
PERSONAL
INFORMA-
TION.—It shall be unlawful for a financial institution to 
willfully use nonpublic personal information without the 
consent of an individual with whom the financial institu-
tion has a customer or consumer relationship.’’. 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 3. OBLIGATIONS WITH RESPECT TO THE COLLECTION 
AND DISCLOSURE OF NONPUBLIC PERSONAL 
INFORMATION. 
(a) IN GENERAL.—Section 502 of the Gramm-Leach- 
Bliley Act (15 U.S.C. 6802) is amended— 
(1) in the heading, by striking ‘‘DISCLOSURES 
OF’’ and inserting ‘‘THE COLLECTION AND DIS-
CLOSURE OF NONPUBLIC’’; 
(2) in subsection (a)— 
(A) by inserting before ‘‘disclose’’ the fol-
lowing: ‘‘collect nonpublic personal information 
from an individual with whom such financial in-
stitution has a customer or consumer relation-
ship or’’; and 
(B) by striking ‘‘has provided to the con-
sumer’’ and inserting ‘‘has provided to such in-
dividual’’; and 
(3) in subsection (b), by amending paragraph 
(1) to read as follows: 
‘‘(1) IN GENERAL.—A financial institution may 
not collect nonpublic personal information from an 
individual with whom such financial institution has 
a customer or consumer relationship or disclose non-
public personal information to a nonaffiliated third 
party unless the individual with whom such financial 
institution has a consumer or customer relationship 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(ii) 
a 
proposed 
or 
actual 
securitization, secondary market sale (in-
cluding sales of servicing rights), or similar 
transaction related to an account or a 
transaction of the individual which whom 
such entity or financial institution has a 
customer or consumer relationship; or 
‘‘(2) to a nonaffiliated third party to perform 
services for, or functions on behalf of, the financial 
institution, including marketing of the financial in-
stitution’s own products or services, or financial 
products or services offered pursuant to joint agree-
ments between two or more financial institutions 
that comply with the requirements imposed by the 
regulations prescribed under section 504, if the fi-
nancial institution fully discloses the providing of 
such information and enters into a contractual 
agreement with the third party that requires the 
third party to maintain the confidentiality of such 
information;’’; 
(B) in paragraph (3)— 
(i) in subparagraph (A)— 
(I) by striking ‘‘or security’’ and 
inserting ‘‘security, or integrity’’; 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
(II) by striking ‘‘pertaining to 
the consumer’’ and inserting ‘‘per-
taining to the individual with whom 
the financial institution has a cus-
tomer or consumer relationship’’; 
(III) by inserting before the 
semicolon the following: ‘‘, as well as 
the systems, processes, and services 
that handle such records’’; 
(ii) in subparagraph (B), by inserting 
after ‘‘fraud,’’ the following: ‘‘identity 
theft,’’; 
(iii) in subparagraph (C), by striking 
‘‘for resolving customer disputes or inquir-
ies’’ and inserting ‘‘for resolving disputes 
or inquires relating to individuals with 
whom the financial institution has a cus-
tomer or consumer relationship’’; 
(iv) in subparagraph (D), by striking 
‘‘relating to the consumer’’ and inserting 
‘‘relating to the individual with whom the 
financial institution has a customer or con-
sumer relationship’’; and 
(v) in subparagraph (E), by striking 
‘‘behalf of the consumer’’ and inserting 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘behalf of the individual with whom the fi-
nancial institution has a customer or con-
sumer relationship’’; and 
(C) in paragraph (7)— 
(i) by striking ‘‘or exchange’’ and in-
serting ‘‘exchange, or similar transaction’’; 
(ii) by striking ‘‘consumers of such 
business or unit’’ and inserting ‘‘individ-
uals with whom such business or unit have 
a customer or consumer relationship’’; and 
(iii) by inserting ‘‘collection or’’ before 
‘‘disclosure’’; 
(6) by adding at the end the following: 
‘‘(f) NOTIFICATION
TO
NONAFFILIATES
WHEN 
SHARING IS TERMINATED.— 
‘‘(1) IN GENERAL.—If a financial institution is 
required to terminate sharing nonpublic personal in-
formation, of an individual with whom such financial 
institution has a customer or consumer relationship, 
with a nonaffiliated third party— 
‘‘(A) the financial institution shall notify 
the nonaffiliated third party that the sharing 
has been terminated and that such nonaffiliated 
third party may not share any nonpublic infor-
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
mation of the individual already received from 
the financial institution; and 
‘‘(B) upon receipt of a notice described 
under subparagraph (A), the nonaffiliated third 
party may not share any nonpublic information 
of such individual already received from the fi-
nancial institution. 
‘‘(2) RULEMAKING.—The agencies referred to 
in section 504 shall issue rules to establish the re-
quirements for notices under paragraph (1), includ-
ing the form of such notices, taking into account any 
privacy risks posed by such notices. 
‘‘(g) REQUIREMENTS WITH RESPECT TO THE COL-
LECTION OF CONSUMER ACCOUNT CREDENTIALS.—A fi-
nancial institution may not collect from an individual with 
whom such financial institution has a customer or con-
sumer relationship account credentials such individual 
uses to access an account at a nonaffiliated third party 
that is a financial institution unless, prior to collecting the 
consumer account credentials— 
‘‘(1) the financial institution clearly and con-
spicuously discloses to the consumer, in a form per-
mitted by the regulations prescribed under section 
504— 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) that the financial institution is col-
lecting such account credentials; 
‘‘(B) how such credentials will be used by 
the financial institution; and 
‘‘(C) whether such credentials may be dis-
closed to a nonaffiliated third party; and 
‘‘(2) such individual is given an opportunity to 
direct that such credentials not be collected or to di-
rect that such credentials not be disclosed to any 
nonaffiliated third party.’’. 
(b) CONFORMING AMENDMENT.—Section 509(3)(D) 
of the Gramm-Leach-Bliley Act (15 U.S.C. 6809(3)(D)) 
is amended by striking ‘‘section 502(e)(1)(C)’’ and insert-
ing ‘‘section 502(e)(1)(D)(ii)’’. 
SEC. 4. DISCLOSURE OF INSTITUTION PRIVACY POLICY. 
Section 503 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6803) is amended— 
(1) in subsection (a)— 
(A) by striking ‘‘customer relationship with 
a consumer’’ and inserting ‘‘customer or con-
sumer relationship’’; 
(B) by striking ‘‘clear and conspicuous dis-
closure to such consumer’’ and inserting ‘‘clear 
and conspicuous disclosure to such individual 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB