with whom such financial institution has a cus-
tomer or consumer relationship’’; 
(C) by redesignating paragraphs (1), (2), 
and (3) as paragraphs (2), (3), and (4), respec-
tively; 
(D) by inserting before paragraph (2), as 
so redesignated, the following: 
‘‘(1) collecting nonpublic personal informa-
tion;’’; 
(E) in paragraph (3), as so redesignated, 
by striking ‘‘have ceased to be customers of’’ 
and inserting ‘‘have ceased to have a customer 
or consumer relationship with’’; and 
(F) in paragraph (4), as so redesignated, 
by striking ‘‘personal information of con-
sumers’’ and inserting ‘‘personal information of 
individuals with whom such financial institution 
has a customer or consumer relationship’’; 
(2) by redesignating subsections (b) through (f) 
as subsections (c) through (g), respectively; 
(3) in paragraph (3), as so redesignated, by 
striking ‘‘ceased to be customers of the financial in-
stitution’’ and inserting ‘‘ceased to have a customer 
or consumer relationship with the financial institu-
tion’’; and 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
(4) in paragraph (4), as so redesignated, by 
striking ‘‘nonpublic personal information of con-
sumers’’ and inserting ‘‘nonpublic personal informa-
tion of individual with whom the financial institution 
has a customer or consumer relationship’’. 
(5) by inserting after subsection (a) the fol-
lowing: 
‘‘(b) DISCLOSURE UPON REQUEST.—Upon the re-
quest of an individual with whom a financial institution 
has a customer or consumer relationship, a financial insti-
tution shall provide such individual with a copy of the dis-
closures required by subsection (a) in writing or in elec-
tronic or other form as permitted by the regulations pre-
scribed under section 504.’’; and 
(6) in subsection (d), as so redesignated— 
(A) in paragraph (1)— 
(i) by inserting ‘‘collecting or’’ before 
‘‘disclosing nonpublic’’; and 
(ii) by striking subparagraph (B) and 
inserting the following: 
‘‘(B) the purpose for which the financial 
institution collects the nonpublic personal infor-
mation of individuals with whom the financial 
institution has a customer or consumer rela-
tionship, as well as how the data will be used;’’; 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
(B) in paragraph (2), by inserting before 
the semicolon the following: ‘‘, provided in a 
manner that provides individuals with whom the 
financial institution has a customer or con-
sumer relationship a meaningful understanding 
of the information that is collected’’; 
(C) in paragraph (3), by striking ‘‘and’’ at 
the end; 
(D) in paragraph (4), by striking the pe-
riod at the end and inserting a semicolon; and 
(E) by adding at the end the following: 
‘‘(5) if the financial institution collects non-
public personal information for any purpose other 
than to provide a specific product or service such an 
individual is seeking— 
‘‘(A) a description of such information; 
‘‘(B) the purpose for which such informa-
tion is collected; and 
‘‘(C) the right of such individual to opt out 
of having such nonpublic personal information 
collected or disclosed to a nonaffiliated third 
party, and the manner in which such individual 
may make such opt out election; 
‘‘(6) the data retention policies of the financial 
institution, including the period of time for which 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
the institution retains the nonpublic personal infor-
mation relating to such individual; 
‘‘(7) the right of such individual to direct the 
financial institution to terminate the sharing of non-
public personal information with a nonaffiliated 
third party, and the manner in which such individual 
may make such direction; 
‘‘(8) the right of such individual to request that 
the financial institution provide the individual with 
a list of all nonpublic personal information relating 
to the individual held by the financial institution, 
and the manner in which the individual may make 
such request; and 
‘‘(9) the right of such individual to direct the 
financial institution to delete nonpublic personal in-
formation of the individual held by the financial in-
stitution (subject to the exceptions provided under 
section 502A(b)(3)), and the manner in which the 
individual may make such direction.’’; 
(7) in subsection (f), as so redesignated— 
(A) in paragraph 2(A), by striking ‘‘to con-
sumers’’ and inserting ‘‘to individuals with 
whom a financial institution has a customer or 
consumer relationship’’; and 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
(B) in paragraph 2(C), by striking ‘‘enable 
consumers’’ and inserting ‘‘enable individuals 
with whom a financial institution has a cus-
tomer or consumer relationship’’; and 
(8) in subsection (g), as so redesignated, by 
striking ‘‘sent to consumers’’ and inserting ‘‘sent to 
individuals with whom a financial institution has a 
customer or consumer relationship’’. 
SEC. 5. RULEMAKING. 
Section 504 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6804) is amended— 
(1) in subsection (a)(1)— 
(A) by striking subparagraph (D) and in-
serting the following: 
‘‘(D) INSURANCE.— 
‘‘(i) IN
GENERAL.—With respect to 
any person engaged in providing insurance, 
the applicable State insurance authority of 
the State in which the person is domiciled 
shall issue regulations as may be necessary 
to carry out the purposes of this subtitle, 
subject to section 505(c). 
‘‘(ii) 
LIMITATION.—Regulations 
issued by a State insurance authority 
under this subparagraph may be no more 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
restrictive for a person engaged in pro-
viding insurance than those regulations 
issued by the agencies coordinating for 
consistency and comparability under para-
graph (2).’’; and 
(2) by adding at the end the following: 
‘‘(c) CONSIDERATION
OF COMPLIANCE COSTS.— 
When prescribing rules under this subtitle, agencies shall 
take into account the compliance cost such rules will im-
pose on small institutions.’’. 
SEC. 6. RELATION TO STATE LAWS. 
Section 507 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6807) is amended to read as follows: 
‘‘SEC. 507. RELATION TO STATE LAWS. 
‘‘This subtitle and the amendments made by this sub-
title supersede any statute or rule of a State or political 
subdivision thereof that regulates the obligations of a fi-
nancial institution with respect to— 
‘‘(1) the collection or disclosure of personal in-
formation; 
‘‘(2) the disclosure of the financial institution’s 
privacy policy or information about the financial in-
stitution’s privacy policies and practices; 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(3) the access to, deletion of, or other indi-
vidual privacy rights with respect to personal infor-
mation; or 
‘‘(4) the international sharing of personal infor-
mation.’’. 
SEC. 7. DEFINITIONS. 
Section 509 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6809) is amended— 
(1) in paragraph (3)(A), by inserting before the 
period at the end the following: ‘‘and includes a data 
aggregator’’; 
(2) in paragraph (4), by striking ‘‘personally 
identifiable financial information’’ and inserting ‘‘in-
formation that identifies, relates to, describes, is rea-
sonably capable of being associated with, or could 
reasonably be linked, directly or indirectly, with a 
particular individual and is’’; 
(3) in paragraph (7), by inserting ‘‘collection 
or’’ before ‘‘disclosure’’ each place such term ap-
pears; 
(4) by striking paragraph (9); 
(5) by amending paragraph (11) to read as fol-
lows: 
‘‘(11) CUSTOMER
OR
CONSUMER
RELATION-
SHIP.— 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(A) IN
GENERAL.—The term ‘customer 
or consumer relationship’ means a customer re-
lationship or a consumer relationship. 
‘‘(B) 
CUSTOMER
RELATIONSHIP.—The 
term ‘customer relationship’ shall have the 
meaning given the term in rules issued pursu-
ant to section 504. 
‘‘(C) 
CONSUMER
RELATIONSHIP.—The 
term ‘consumer relationship’ shall have the 
meaning given the term in rules issued pursu-
ant to section 504 and such meaning shall— 
‘‘(i) include situations in which a fi-
nancial institution obtains nonpublic infor-
mation from an individual with whom the 
financial institution does not have a cus-
tomer relationship; and 
‘‘(ii) deem a financial institution to no 
longer to be in a consumer relationship 
with an individual at such time as the fi-
nancial institution no longer collects, con-
trols, possesses, transmits, or maintains 
any nonpublic personal information of such 
individual. 
‘‘(D) TREATMENT
OF
CERTAIN
TRANS-
ACTIONS.—When the terms ‘customer relation-
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
ship’ and ‘consumer relationship’are defined by 
rule, it shall be specified that the following 
transactions do not, by themselves, establish a 
consumer relationship or a consumer relation-
ship: 
‘‘(i) The use of an automated teller 
machine. 
‘‘(ii) The use of a credit card or debit 
card to make a purchase. 
‘‘(iii) Such other similar transactions 
as the agencies determine appropriate.’’; 
and 
(6) by adding at the end the following: 
‘‘(12) ACCOUNT CREDENTIALS.—The term ‘ac-
count credentials’ means nonpublic information that 
an individual with whom a financial institution has 
a customer or consumer relationship uses to access 
an account of the individual at such financial insti-
tution, including a username, password, or an an-
swer to a security question. 
‘‘(13) DATA
AGGREGATOR.—The term ‘data 
aggregator’— 
‘‘(A) means any person that operates a 
commercial business or enterprise for the busi-
ness purpose of accessing, aggregating, col-
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
lecting, selling, or sharing nonpublic personal 
information about financial accounts or trans-
actions, relating to an individual; and 
‘‘(B) does not include— 
‘‘(i) a service provider acting at the 
express instruction of a financial institu-
tion, that accesses, aggregates, collects, or 
shares 
nonpublic 
personal 
information 
about an individual with whom such finan-
cial institution has a customer or consumer 
relationship in accordance with paragraphs 
(1), (2), (3)(A), (3)(B), (3)(C), (3)(D), or 
(6) of section 502(2); or 
‘‘(ii) an attorney or accountant acting 
on behalf of an individual with whom such 
attorney or accountant has a customer or 
consumer relationship, in accordance with 
section 502(e)(3)(E). 
‘‘(14) PERSON ENGAGED IN PROVIDING INSUR-
ANCE.—The term ‘person engaged in providing in-
surance’ means a person that engages in the ‘busi-
ness of insurance’, as that term is defined in section 
1002 of the Dodd-Frank Wall Street Reform and 
Consumer Protection Act (12 U.S.C. 5481).’’. 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 8. OBLIGATIONS WITH RESPECT TO ACCESS AND DE-
LETION OF NONPUBLIC PERSONAL INFORMA-
TION. 
(a) IN GENERAL.—Title V of the Gramm-Leach-Bli-
ley Act (15 U.S.C. 6801 et seq.) is amended by inserting 
after section 502 the following: 
‘‘SEC. 502A. OBLIGATIONS WITH RESPECT TO ACCESS AND 
DELETION OF NONPUBLIC PERSONAL INFOR-
MATION. 
‘‘(a) ACCESS TO INFORMATION.— 
‘‘(1) IN
GENERAL.—Upon an authorized re-
quest from an individual with whom a financial in-
stitution has a customer or consumer relationship, a 
financial institution shall disclose— 
‘‘(A) any nonpublic personal information 
relating to such individual held by the financial 
institution; 
‘‘(B) the list of categories of nonaffiliated 
third parties with whom the financial institution 
shares nonpublic personal information relating 
to such individual; and 
‘‘(C) the list of categories of nonaffiliated 
third parties from whom the financial institu-
tion has received nonpublic personal informa-
tion relating to such individual. 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
‘‘(2) FORMAT.—Disclosures described under 
paragraph (1) shall be in a structured, commonly 
used, and machine-readable format. 
‘‘(3) EXCEPTION.—For purposes of subpara-
graphs (B) and (C) of paragraph (1), a financial in-
stitution is not required to disclose a nonaffiliated 
third party with whom the financial institution 
shares or receives nonpublic personal information re-
lating to such individual pursuant to an exception 
described under any of paragraphs (3) through (8) 
of section 502(e). 
‘‘(b) DELETION OF INFORMATION.— 
‘‘(1) IN
GENERAL.—Upon an authorized re-
quest from an individual with whom a financial in-
stitution has a customer or consumer relationship, a 
financial institution shall delete any nonpublic per-
sonal information relating to such individual held by 
the financial institution. 
‘‘(2) CERTAIN
INACTIVE
ACCOUNTS.—If such 
individual has not used a product or service provided 
by a financial institution for 1 year, the financial in-
stitution shall— 
‘‘(A) notify such individual that such indi-
vidual has the right to request the deletion of 
any nonpublic personal information relating to 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB