I
106TH CONGRESS
1ST SESSION
H. R. 3320
To amend the privacy provisions of the Gramm-Leach-Bliley Act.
IN THE HOUSE OF REPRESENTATIVES
NOVEMBER 10, 1999
Mr. MARKEY (for himself, Mr. BARTON of Texas, Mr. DINGELL, Mr. CAMP-
BELL, Mr. LUTHER, Mr. WAXMAN, Mr. KUCINICH, Mr. HINCHEY, Ms.
ESCHOO, Ms. LEE, Ms. RIVERS, Ms. SCHAKOWSKY, Ms. BALDWIN, Ms.
ROYBAL-ALLARD, Mr. LEWIS of Georgia, Mr. TIERNEY, Mr. KILDEE, Mr.
OBEY, Mrs. MEEK of Florida, Mr. EVANS, Mr. JACKSON of Illinois, Ms.
WOOLSEY, and Mr. BARRETT of Wisconsin) introduced the following bill;
which was referred to the Committee on Banking and Financial Services,
and in addition to the Committee on Commerce, for a period to be subse-
quently determined by the Speaker, in each case for consideration of such
provisions as fall within the jurisdiction of the committee concerned
A BILL
To amend the privacy provisions of the Gramm-Leach-Bliley
Act.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Consumer’s Right to
Financial Privacy Act’’.
SEC. 2. AMENDMENT.
Title V of the Gramm-Leach-Bliley Act is amended
to read as follows:
‘‘TITLE V—PRIVACY OF
CONSUMER INFORMATION
‘‘Subtitle A—Disclosure of
Nonpublic Personal Information
‘‘SEC. 501. PROTECTION OF NONPUBLIC PERSONAL INFOR-
MATION.
‘‘(a) PRIVACY OBLIGATION POLICY.—It is the policy
of the Congress that each financial institution has an af-
firmative and continuing obligation to respect the privacy
of its customers and to protect the security and confiden-
tiality of those customers’ nonpublic personal information.
‘‘(b) FINANCIAL INSTITUTIONS SAFEGUARDS.—In
furtherance of the policy in subsection (a), each agency
or authority described in section 504(a) shall establish by
rule or order appropriate standards for the financial insti-
tutions subject to their jurisdiction, and the Commission
shall establish such standards for any financial institu-
tions not subject to such jurisdiction, relating to adminis-
trative, technical, and physical safeguards—
‘‘(1) to insure the security and confidentiality of
customer records and information;
‘‘(2) to protect against any anticipated threats
or hazards to the security or integrity of such
records; and
‘‘(3) to protect against unauthorized access to
or use of such records or information which could
result in substantial harm or inconvenience to any
customer.
‘‘SEC. 502. OBLIGATIONS WITH RESPECT TO PERSONAL
INFORMATION.
‘‘(a) GENERAL REQUIREMENTS.—Except as other-
wise provided in this subtitle, a financial institution may
not, directly or through any affiliate, disclose or make an
unrelated use of any nonpublic personal information col-
lected by the financial institution in connection with any
transaction with a consumer in any financial product or
any financial service, unless such financial institution pro-
vides or has provided to the consumer a notice that com-
plies with section 503 and the rules thereunder.
‘‘(b) OPT-IN REQUIRED FOR INFORMATION TRANS-
FERS.—
‘‘(1) AFFIRMATIVE CONSENT REQUIRED.—Each
agency or authority described in section 504(a) shall
by rule prohibit a financial institution that is subject
to its jurisdiction from making available any non-
public personal information to any affiliate or other
person that is not an employee or agent of the insti-
tution, unless the consumer to whom the information
pertains—
‘‘(A) has affirmatively consented in accord-
ance with such rule to the transfer of such in-
formation; and
‘‘(B) has not withdrawn the consent.
‘‘(2) FLEXIBILITY OF FORM.—A financial insti-
tution may, in complying with paragraph (1),
present the opportunity to consent in a clear and
conspicuous manner that permits the consumer to
consent—
‘‘(A)(i) with respect to both affiliates and
nonaffiliated persons;
‘‘(ii) separately with respect to affiliates
generally and nonaffiliated persons generally; or
‘‘(iii) separately with respect to specified
affiliates and nonaffiliated persons; and
‘‘(B) separately with respect to specified fi-
nancial and nonfinancial products and services
that may be offered to the consumer.
‘‘(3) DENIAL OF SERVICE PROHIBITED.—The
rule prescribed pursuant to paragraph (1) shall pro-
hibit a financial institution from denying any con-
sumer a financial product or a financial service for
the refusal by the consumer to grant the consent re-
quired by such rule.
‘‘(c) ACCESS TO AND CORRECTION OF INFORMATION
VENDED TO THIRD PARTIES.—
‘‘(1) RULE
REQUIRED.—Each agency or au-
thority described in section 504(a) shall by rule re-
quire a financial institution that is subject to its ju-
risdiction and that makes available nonpublic per-
sonal information collected by the financial institu-
tion to any person or entity other than an employee
or agent of such institution to afford that
consumer—
‘‘(A) the opportunity to examine, upon re-
quest, all nonpublic personal information that
was so made available; and
‘‘(B) the opportunity to dispute the accu-
racy of any of such information, and to present
evidence thereon.
‘‘(d) LIMITATIONS ON THE SHARING OF ACCOUNT
NUMBER INFORMATION FOR MARKETING PURPOSES.—A
financial institution shall not disclose an account number
or similar form of access number or access code for a cred-
it card account, deposit account, or transaction account
of a consumer to any affiliate or any nonaffiliated third
party for use in telemarketing, direct mail marketing, or
other marketing through electronic mail or other electronic
means to the consumer.
‘‘(e) LIMITS ON REUSE OF INFORMATION.—Except
as otherwise provided in this subtitle, an affiliate or a non-
affiliated third party that receives from a financial institu-
tion nonpublic personal information under this section
shall not, directly or through an affiliate of such receiving
third party, disclose such information to any other person
that is an affiliate or a nonaffiliated third party of both
the financial institution and such receiving third party,
unless such disclosure would be lawful if made directly to
such other person by the financial institution.
‘‘(f) GENERAL EXCEPTIONS.—Subsections (a) and
(b) shall not prohibit the disclosure of nonpublic personal
information—
‘‘(1) as necessary to effect, administer, or en-
force a transaction requested or authorized by the
consumer, or in connection with—
‘‘(A) servicing or processing a financial
product or service requested or authorized by
the consumer;
‘‘(B) maintaining or servicing the con-
sumer’s account with the financial institution;
or
‘‘(C) a proposed or actual securitization,
secondary market sale (including sales of serv-
icing rights), or similar transaction related to a
transaction of the consumer;
‘‘(2) with the consent or at the direction of the
consumer;
‘‘(3)(A) to protect the confidentiality or security
of the financial institution’s records pertaining to
the consumer, the service or product, or the trans-
action therein; (B) to protect against or prevent ac-
tual or potential fraud, unauthorized transactions,
claims, or other liability; (C) for required institu-
tional risk control, or for resolving customer disputes
or inquiries; (D) to persons holding a legal or bene-
ficial interest relating to the consumer; or (E) to
persons acting in a fiduciary or representative capac-
ity on behalf of the consumer;
‘‘(4) to provide information to insurance rate
advisory organizations, guaranty funds or agencies,
applicable rating agencies of the financial institu-
tion, and the institution’s attorneys, accountants,
and auditors;
‘‘(5) to the extent specifically permitted or re-
quired under other provisions of law and in accord-
ance with the Right to Financial Privacy Act of
1978, to law enforcement agencies (including a Fed-
eral functional regulator, the Secretary of the Treas-
ury with respect to subchapter II of chapter 53 of
title 31, United States Code, and chapter 2 of title
I of Public Law 91–508 (12 U.S.C. 1951–1959), a
State insurance authority, or the Federal Trade
Commission), self-regulatory organizations, or for an
investigation on a matter related to public safety;
‘‘(6)(A) to a consumer reporting agency in ac-
cordance with the Fair Credit Reporting Act, or (B)
from a consumer report reported by a consumer re-
porting agency in accordance with the Fair Credit
Reporting Act;
‘‘(7) in connection with a proposed or actual
sale, merger, transfer, or exchange of all or a por-
tion of a business or operating unit if the disclosure
of nonpublic personal information concerns solely
consumers of such business or unit; or
‘‘(8) to comply with Federal, State, or local
laws, rules, and other applicable legal requirements;
to comply with a properly authorized civil, criminal,
or regulatory investigation or subpoena or summons
by Federal, State, or local authorities; or to respond
to judicial process or government regulatory authori-
ties having jurisdiction over the financial institution
for examination, compliance, or other purposes as
authorized by law.
‘‘SEC. 503. NOTICE CONCERNING DISCLOSING INFORMA-
TION.
‘‘(a) RULE REQUIRED.—Each agency or authority
described in section 504(a) shall prescribe rules in accord-
ance with this section to prohibit unfair and deceptive acts
or practices in connection with the disclosing of nonpublic
personal information or with making unrelated uses of
such information. Such rules shall require any financial
institution, through the use of a form that complies with
the rules prescribed under subsection (b), to clearly and
conspicuously disclose to the consumer at the time of es-
tablishing a customer relationship with a consumer and
not less than annually during the continuation of such
relationship—
‘‘(1) the categories of nonpublic personal infor-
mation that are collected by the financial institution;
‘‘(2) the practices and policies of the financial
institution with respect to disclosing nonpublic per-
sonal information, or making unrelated uses of such
information, including—
‘‘(A) the categories of persons to whom the
information is or may be disclosed or who may
be permitted to make unrelated uses of such in-
formation, other than the persons to whom the
information must be provided to effect, admin-
ister, or enforce the transaction; and
‘‘(B) the practices and policies of the insti-
tution with respect to disclosing or making un-
related uses of nonpublic personal information
of persons who have ceased to be customers of
the financial institution;
‘‘(3) the policies that the institution maintains
to protect the confidentiality and security of non-
public personal information;
‘‘(4) the practices and policies of the institution
with respect to providing consumers the opportunity
to examine and dispute information pursuant to the
rule prescribed under section 502(c); and
‘‘(5) the right of the consumer under such sec-
tion to examine, upon request, the nonpublic per-
sonal information, to dispute the accuracy of any of
such information, and to present evidence thereon.
‘‘(b) DESIGN OF NOTICE REQUIREMENTS.—In pre-
scribing the form of a notice for purposes of subsection
(a), each agency or authority described in section 504(a)
shall ensure that consumers are provided a clear and con-
spicuous disclosure that permits them to compare dif-
ferences in the measures that the financial institution
takes, and the policies that the institution has established,
to protect the consumer’s privacy as compared to the
measures taken and the policies established by other fi-
nancial institutions. Such form shall specifically identify
the rights the institution affords consumers to grant or
deny consent to (1) the disclosing of nonpublic personal
information for any purpose other than as required in
order to effect, administer, or enforce the consumer’s
transaction, or (2) the making of an unrelated use of such
information.
‘‘(c) ADDITIONAL CONTENTS OF RULES; EXEMPTIVE
RULES.—Each agency or authority described in section
504(a) shall, by rule, and may by order—
‘‘(1) specify the disclosures and uses of infor-
mation which, for purposes of this subtitle and the
rules prescribed thereunder, may be treated as nec-
essary to effect, administer, or enforce a consumer’s
transaction with respect to a variety of financial
services and financial products;
‘‘(2) specify timing requirements with respect to
notices to new and existing customers, which shall
not require notices more frequently than annually
unless there has been a change in the information
required to be disclosed pursuant to subsection (a);
and
‘‘(3) provide, consistent with the purposes of
this subtitle, exemptions or temporary waivers to, or
delayed effective dates for, any requirement of this
subtitle or the rules prescribed thereunder.
‘‘SEC. 504. ENFORCEMENT.
‘‘(a) IN GENERAL.—This subtitle and the rules pre-
scribed thereunder shall be enforced by the Federal func-
tional regulators, the State insurance authorities, and the
Federal Trade Commission with respect to financial insti-
tutions and other persons subject to their jurisdiction
under applicable law, as follows:
‘‘(1) Under section 8 of the Federal Deposit In-
surance Act, in the case of—
‘‘(A) national banks, Federal branches and
Federal agencies of foreign banks by the Office
of the Comptroller of the Currency;
‘‘(B) member banks of the Federal Reserve
System (other than national banks), branches
and agencies of foreign banks (other than Fed-
eral branches, Federal agencies, and insured
State branches of foreign banks), commercial
lending companies owned or controlled by for-
eign banks, organizations operating under sec-
tion 25 or 25A of the Federal Reserve Act,
bank holding companies by the Board of Gov-
ernors of the Federal Reserve System;
‘‘(C) banks insured by the Federal Deposit
Insurance Corporation (other than members of
the Federal Reserve System), insured State
branches of foreign banks by the Board of Di-
rectors of the Federal Deposit Insurance Cor-
poration; and
‘‘(D) savings association the deposits of
which are insured by the Federal Deposit In-
surance Corporation by the Director of the Of-
fice of Thrift Supervision.
‘‘(2) Under the Federal Credit Union Act, by
the Administrator of the National Credit Union Ad-
ministration with respect to any Federal or state
chartered credit union.
‘‘(3) Under the Securities Exchange Act of
1934, by the Securities and Exchange Commission
with respect to any broker-dealer.
‘‘(4) Under the Investment Company Act of
1940, by the Securities and Exchange Commission
with respect to investment companies.
‘‘(5) Under the Investment Advisers Act of
1940, by the Securities and Exchange Commission
scribed under section 501(b) in the same manner, to
the extent practicable, as standards prescribed pur-
suant to subsection (a) of section 39 of the Federal
Deposit Insurance Act are implemented pursuant to
such section.
‘‘(2) EXCEPTION.—The agencies and authori-
ties described in paragraphs (3), (4), (5), (7), and
(8) of subsection (a) shall implement the standards
prescribed under section 501(b) by rule with respect
to the financial institutions subject to their respec-
tive jurisdictions under subsection (a).
‘‘(c) STATE ACTION FOR VIOLATIONS.—
‘‘(1) AUTHORITY OF STATES.—In addition to
such other remedies as are provided under State
law, if the chief law enforcement officer of a State,
or an official or agency designated by a State, has
reason to believe that any person has violated or is
violating this subtitle or a rule prescribed under this
subtitle, other than section 501 or a rule prescribed
under such section, the State—
‘‘(A) may bring an action to enjoin such
violation in any appropriate United States dis-
trict court or in any other court of competent
jurisdiction; and
‘‘(B) may bring an action on behalf of the
residents of the State to enforce compliance
with such rule, to obtain damages, restitution,
or other compensation on behalf of residents of
such State, or to obtain such further and other
relief as the court may deem appropriate.
‘‘(2) RIGHTS OF FEDERAL REGULATORS.—
‘‘(A) PRIOR
NOTICE.—The State shall
serve prior written notice of any action under
paragraph (1) upon the Federal Trade Commis-
sion and provide the Federal Trade Commission
with a copy of its complaint, except in any case
in which such prior notice is not feasible, in
which case the State shall serve such notice im-
mediately upon instituting such action.
‘‘(B) RIGHT TO INTERVENE.—The Federal
Trade Commission shall transmit the notice re-
ceived under subparagraph (A) to the agency or
authority that has jurisdiction of the subject of
the complaint, and such agency or authority
shall have the right—
‘‘(i) to intervene in an action under
paragraph (1);
‘‘(ii) upon so intervening, to be heard
on all matters arising therein;