I
106TH CONGRESS
2D SESSION
H. R. 4380
To strengthen consumers’ control over the use and disclosure of their personal
financial and health information by financial institutions, and for other
purposes.
IN THE HOUSE OF REPRESENTATIVES
MAY 4, 2000
Mr. LAFALCE (for himself, Mr. DINGELL, Mr. MARKEY, Mr. FRANK of Mas-
sachusetts, Mr. KANJORSKI, Ms. WATERS, Mrs. MALONEY of New York,
Mr. GUTIERREZ, Mr. MEEKS of New York, Ms. LEE, Mr. INSLEE, Ms.
SCHAKOWSKY, Mrs. JONES of Ohio, Mr. SANDERS, Mr. KENNEDY of
Rhode Island, Mr. WAXMAN, Ms. ESHOO, Mr. BARRETT of Wisconsin,
Mr. LUTHER, Mr. STARK, Mr. HINCHEY, and Mr. RUSH) introduced the
following bill; which was referred to the Committee on Banking and Fi-
nancial Services, and in addition to the Committee on Commerce, for a
period to be subsequently determined by the Speaker, in each case for
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned
A BILL
To strengthen consumers’ control over the use and disclosure
of their personal financial and health information by
financial institutions, and for other purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE; TABLE OF CONTENTS.
(a) SHORT TITLE.—This Act may be cited as the
‘‘Consumer Financial Privacy Act’’.
(b) TABLE OF CONTENTS.—The table of contents for
this Act is as follows:
Sec. 1. Short title; table of contents.
Sec. 2. Opt-out requirement for disclosure to affiliates and nonaffiliated third
parties.
Sec. 3. Restricting the transfer of information about personal spending habits.
Sec. 4. Restricting the use of health information in making credit and other fi-
nancial decisions.
Sec. 5. Limits on redisclosure and reuse of information.
Sec. 6. Consumer rights to access and correct information.
Sec. 7. Improved enforcement authority.
Sec. 8. Enhanced disclosure of privacy policies.
Sec. 9. Limit on disclosure of account numbers.
Sec. 10. General exceptions.
Sec. 11. Definitions.
Sec. 12. Issuance of implementing regulations.
Sec. 13. FTC rulemaking authority under the Fair Credit Reporting Act.
SEC. 2. OPT-OUT REQUIREMENT FOR DISCLOSURE TO AF-
FILIATES AND NONAFFILIATED THIRD PAR-
TIES.
Section 502(a) of the Gramm-Leach-Bliley Act (15
U.S.C. 6802(a)) is amended to read as follows:
‘‘(a) DISCLOSURE OF NONPUBLIC PERSONAL INFOR-
MATION.—Except as otherwise provided in this subtitle,
a financial institution may not disclose any nonpublic per-
sonal information to an affiliate or a nonaffiliated third
party unless such financial institution—
‘‘(1) has provided to the consumer a clear and
conspicuous notice, in writing or electronic form or
other form permitted by the regulations imple-
menting this subtitle, of the categories of informa-
tion that may be disclosed to the—
‘‘(A) affiliate; or
‘‘(B) nonaffiliated third party;
‘‘(2) has given the consumer an opportunity,
before the time that such information is initially dis-
closed, to direct that such information not be dis-
closed to such—
‘‘(A) affiliate; or
‘‘(B) nonaffiliated third party; and
‘‘(3) has given the consumer the ability to exer-
cise that nondisclosure option through the same
method of communication by which the consumer re-
ceived the notice described in paragraph (1) or an-
other method at least as convenient to the consumer,
and an explanation of how the consumer can exer-
cise such option.’’.
SEC. 3. RESTRICTING THE TRANSFER OF INFORMATION
ABOUT PERSONAL SPENDING HABITS.
Section 502(b) of the Gramm-Leach-Bliley Act (15
U.S.C. 6802(b)) is amended to read as follows:
‘‘(b) RESTRICTION ON THE TRANSFER OF INFORMA-
TION ABOUT PERSONAL SPENDING HABITS.—
‘‘(1) IN GENERAL.—Notwithstanding subsection
(a), if a financial institution provides a service to a
consumer through which the consumer makes or re-
ceives payments or transfers by check, debit card,
credit card, or other similar instrument, the finan-
cial institution shall not transfer to an affiliate or a
nonaffiliated third party—
‘‘(A) an individualized list of that con-
sumer’s transactions or an individualized de-
scription of that consumer’s interests, pref-
erences, or other characteristics; or
‘‘(B) any such list or description con-
structed in response to an inquiry about a spe-
cific, named individual;
if the list or description is derived from information
collected in the course of providing that service.
‘‘(2) RESTRICTION ON TRANSFER OF AGGRE-
GATE LISTS CONTAINING CERTAIN HEALTH INFOR-
MATION.—Notwithstanding subsection (a), a finan-
cial institution shall not transfer to an affiliate or a
nonaffiliated third party any aggregate list of con-
sumers containing or derived from individually iden-
tifiable health information.
‘‘(3) EXCEPTIONS.—
‘‘(A) IN GENERAL.—The financial institu-
tion may disclose the information described in
paragraph (1) or (2) to an affiliate or a non-
affiliated 
third 
party 
if 
such 
financial
institution—
‘‘(i) has clearly and conspicuously re-
quested in writing or in electronic form or
other form permitted by the regulations
implementing this subtitle, that the con-
sumer affirmatively consent to such disclo-
sure; and
‘‘(ii) has obtained from the consumer
such affirmative consent and such consent
has not been withdrawn.
‘‘(B) RULE OF CONSTRUCTION.—This sub-
section shall not be construed as preventing a
financial institution from transferring the infor-
mation described in paragraph (1) or (2) to an
affiliate or a nonaffiliated third party for the
purposes described in paragraph (1), (2), (3),
(5), (7), (8), (9), or (10) of subsection (f).
‘‘(C) SCOPE OF APPLICATION.—Paragraph
(1) shall not apply to the transfer of aggregate
lists of consumers.’’.
SEC. 4. RESTRICTING THE USE OF HEALTH INFORMATION
IN MAKING CREDIT AND OTHER FINANCIAL
DECISIONS.
(a) RESTRICTION ON USE OF CONSUMER HEALTH
INFORMATION.—Section 502(c) of the Gramm-Leach-Bli-
ley Act (15 U.S.C. 6802(c)) is amended to read as follows:
‘‘(c) USE
OF CONSUMER HEALTH INFORMATION
AVAILABLE
FROM
AFFILIATES
AND
NONAFFILIATED
THIRD PARTIES.—In deciding whether, or on what terms,
to offer, provide, or continue to provide a financial product
or service to a consumer, a financial institution shall not
obtain or receive individually identifiable health informa-
tion about the consumer from an affiliate or nonaffiliated
third party, or evaluate or otherwise consider any such in-
formation, unless the financial institution—
‘‘(1) has clearly and conspicuously requested in
writing or in electronic form or other form permitted
by the regulations implementing this subtitle, that
the consumer affirmatively consent to the transfer
and use of that information with respect to a par-
ticular financial product or service;
‘‘(2) has obtained from the consumer such af-
firmative consent and such consent has not been
withdrawn; and
‘‘(3) requires the same health information
about all consumers as a condition for receiving the
financial product or service.’’.
(b) EXISTING PROTECTIONS FOR HEALTH INFORMA-
TION NOT AFFECTED.—Title V of the Gramm-Leach-Bli-
ley Act (15 U.S.C. 6801 et seq.) is amended by adding
after section 510 the following new section:
‘‘SEC. 511. RELATION TO STANDARDS ESTABLISHED UNDER
THE HEALTH INSURANCE PORTABILITY AND
ACCOUNTABILITY ACT OF 1996.
‘‘Nothing in this subtitle shall be construed as—
‘‘(1) modifying, limiting, or superseding stand-
ards governing the privacy and security of individ-
ually identifiable health information promulgated by
the Secretary of Health and Human Services under
sections 262(a) and 264 of the Health Insurance
Portability and Accountability Act of 1996; or
‘‘(2) authorizing the use or disclosure of indi-
vidually identifiable health information in a manner
other than as permitted by other applicable law.’’.
(c) DEFINITION
OF INDIVIDUALLY IDENTIFIABLE
HEALTH INFORMATION.—Section 509 of the Gramm-
Leach-Bliley Act (15 U.S.C. 6809) is amended by adding
at the end the following new paragraph:
‘‘(12) INDIVIDUALLY
IDENTIFIABLE
HEALTH
INFORMATION.—The term ‘individually identifiable
health information’ means any information, includ-
ing demographic information obtained from or about
an 
individual, 
that 
is 
described 
in 
section
1171(6)(B) of the Social Security Act.’’.
(d) TECHNICAL AND CONFORMING AMENDMENT.—
Section 505(a)(6) of the Gramm-Leach-Bliley Act (15
U.S.C. 6805(a)(6)) is amended by inserting before the pe-
riod at the end ‘‘to the extent the provisions of such sec-
tion are not inconsistent with the provisions of this sub-
title’’.
SEC. 5. LIMITS ON REDISCLOSURE AND REUSE OF INFOR-
MATION.
Section 502 of the Gramm-Leach-Bliley Act (15
U.S.C. 6802) is amended—
(1) by redesignating subsections (d) and (e) as
subsections (e) and (f), respectively; and
(2) by inserting after subsection (c) the fol-
lowing new subsection:
‘‘(d) LIMITS ON REDISCLOSURE AND REUSE OF IN-
FORMATION.—
‘‘(1) IN
GENERAL.—An affiliate or a non-
affiliated third party that receives nonpublic per-
sonal information from a financial institution shall
not disclose such information to any other person
unless such disclosure would be lawful if made di-
rectly to such other person by the financial institu-
tion.
‘‘(2) DISCLOSURE UNDER A GENERAL EXCEP-
TION.—Notwithstanding paragraph (1), any person
that receives nonpublic personal information from a
financial institution in accordance with one of the
general exceptions in subsection (f) may use or dis-
close such information only—
‘‘(A) as permitted under that general ex-
ception; or
‘‘(B) under another general exception in
subsection (f), if necessary to carry out the pur-
pose for which the information was disclosed by
the financial institution.’’.
SEC. 6. CONSUMER RIGHTS TO ACCESS AND CORRECT IN-
FORMATION.
Title V of the Gramm-Leach-Bliley Act (15 U.S.C.
6801 et seq.) is amended by adding after section 511 (as
added by section 4(b) of this Act), the following new sec-
tion:
‘‘SEC. 512. ACCESS TO AND CORRECTION OF INFORMATION.
‘‘(a) ACCESS.—
(1) IN GENERAL.—Upon the request of a con-
sumer, a financial institution shall make available to
the consumer information about the consumer that
is under the control of, and reasonably available to,
the financial institution.
‘‘(2) 
EXCEPTIONS.—Notwithstanding 
para-
graph (1), a financial institution—
‘‘(A) shall not be required to disclose to a
consumer any confidential commercial informa-
tion, such as an algorithm used to derive credit
scores or other risk scores or predictors;
‘‘(B) shall not be required to create new
records in order to comply with the consumer’s
request;
‘‘(C) shall not be required to disclose to a
consumer any information assembled by the fi-
nancial institution, in a particular matter, as
part of the financial institution’s efforts to com-
ply with laws preventing fraud, money laun-
dering, or other unlawful conduct; and
‘‘(D) shall not disclose any information re-
quired to be kept confidential by any other Fed-
eral law.
‘‘(b) CORRECTION.—A financial institution shall pro-
vide a consumer the opportunity to dispute the accuracy
of any information disclosed to the consumer pursuant to
subsection (a), and to present evidence thereon. A finan-
cial institution shall correct or delete material information
identified by a consumer that is materially incomplete or
inaccurate.
‘‘(c) COORDINATION AND CONSULTATION.—In pre-
scribing regulations implementing this section, the Federal
agencies specified in section 504(a) shall consult with one
another to ensure that the rules—
‘‘(1) impose consistent requirements on the fi-
nancial institutions under their respective jurisdic-
tions;
‘‘(2) take into account conditions under which
financial institutions do business both in the United
States and in other countries; and
‘‘(3) are consistent with the principle of tech-
nology neutrality.
‘‘(d) CHARGES FOR DISCLOSURES.—A financial insti-
tution may impose a reasonable charge for making a dis-
closure under this section, which charge must be disclosed
to the consumer before making the disclosure. ’’.
SEC. 7. IMPROVED ENFORCEMENT AUTHORITY.
(a) COMPLIANCE WITH PRIVACY POLICY.—Section
503 of the Gramm-Leach-Bliley Act (15 U.S.C. 6803) is
amended by adding at the end the following new sub-
section:
‘‘(c) COMPLIANCE WITH PRIVACY POLICY.—A finan-
cial institution’s failure to comply with any of its policies
or practices disclosed to a consumer under this section
constitutes a violation of the requirements of this sec-
tion.’’.
(b) UNFAIR AND DECEPTIVE TRADE PRACTICE.—
Section 505(a)(7) of the Gramm-Leach-Bliley Act (15
U.S.C. 6805(a)(7)) is amended by adding at the end the
following new sentence: ‘‘A violation of any requirement
of this subtitle, or the regulations of the Federal Trade
Commission prescribed under this subtitle, by a financial
institution or other person described in this paragraph
shall constitute an unfair or deceptive act or practice in
commerce in violation of section 5(a) of the Federal Trade
Commission Act.’’.
(c) SUPPLEMENTAL STATE ENFORCEMENT FOR FTC
REGULATED ENTITIES.—Section 505 of the Gramm-
Leach-Bliley Act (15 U.S.C. 6805) is amended by adding
at the end the following new subsection:
‘‘(e) STATE ACTION FOR VIOLATIONS.—
‘‘(1) AUTHORITY OF THE STATES.—In addition
to such other remedies as are provided under State
law, if the attorney general of a State, or an officer
authorized by the State, has reason to believe that
any financial institution or other person described in
section 505(a)(7) has violated or is violating this
subtitle or the regulations prescribed thereunder by
the Federal Trade Commission, the State may—
‘‘(A) bring an action on behalf of the resi-
dents of the State to enjoin such violation in
any appropriate United States district court or
in any other court of competent jurisdiction;
and