I
105TH CONGRESS
2D SESSION
H. R. 4388
To amend the Consumer Credit Protection Act to ensure financial institution
privacy protections, and for other purposes.
IN THE HOUSE OF REPRESENTATIVES
AUGUST 4, 1998
Mr. LAFALCE introduced the following bill; which was referred to the
Committee on Banking and Financial Services
A BILL
To amend the Consumer Credit Protection Act to ensure
financial institution privacy protections, and for other
purposes.
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Consumer Financial
Privacy Protection Act of 1998’’.
SEC. 2. CONSUMER FINANCIAL PRIVACY.
The Consumer Credit Protection Act (15 U.S.C.
1601 et seq.) is amended by adding at the end the follow-
ing new title:
‘‘TITLE X—CONSUMER
FINANCIAL PRIVACY
‘‘CHAPTER 1—GENERAL PROVISIONS
‘‘SEC. 1001. SHORT TITLE.
‘‘This chapter may be cited as the ‘Financial Institu-
tion Privacy Protection Act’.
‘‘SEC. 1002. DEFINITIONS.
‘‘For purposes of this title, the following definitions
shall apply:
‘‘(1) CUSTOMER.—The term ‘customer’ has the
meaning given to such term in section 1101(5) of
the Right to Financial Privacy Act of 1978.
‘‘(2) CUSTOMERS’ FINANCIAL INFORMATION.—
The term ‘customers’ financial information’ means
any information maintained by a financial institu-
tion which is derived from the relationship between
the financial institution and a customer of the finan-
cial institution and is identifiable to the customer,
including account numbers, account balances and
other account data, transactional information con-
cerning any account, and codes, passwords, and
other means of access to accounts or means to initi-
ate transactions.
‘‘(3) DOCUMENT.—The term ‘document’ means
any information in any form.—
‘‘(4) FINANCIAL INSTITUTION.—
‘‘(A) IN
GENERAL.—The term ‘financial
institution’ means any institution engaged in
the business of providing financial services to
customers who maintain a credit, deposit, trust,
or other financial account or relationship with
the institution.
‘‘(B) CERTAIN
FINANCIAL
INSTITUTIONS
SPECIFICALLY INCLUDED.—The term ‘financial
institution’ includes any depository institution
(as defined in section 19(b)(1)(A) of the Fed-
eral Reserve Act), any broker or dealer in in-
vestment securities, any insurance company,
any loan or finance company, any investment
adviser or investment company, any credit card
issuer or operator of a credit card system, and
any consumer reporting agency that compiles
and maintains files on consumers on a nation-
wide basis (as defined in section 603(p)).
‘‘(C) FURTHER DEFINITION BY REGULA-
TION.—The Federal Trade Commission may
prescribe regulations clarifying or describing
the types of institutions which shall be treated
as financial institutions for purposes of this
title.
document, file, film, electronic file, or other instru-
ment used to collect, aggregate, store, identify, or
disseminate personal or financial information.
‘‘SEC. 1003. PROTECTION OF FINANCIAL INFORMATION.
‘‘(a) IN GENERAL.—Financial institutions have an
affirmative and continuing obligation to respect the pri-
vacy of their customers and to protect the security and
confidentiality of customers’ financial and personal infor-
mation.
‘‘(b) FINANCIAL INSTITUTION SAFEGUARDS.—Pur-
suant to subsection (a), financial institutions shall estab-
lish appropriate administrative, technical and physical
safeguards to insure the security and confidentiality of fi-
nancial and personal records and to protect against any
anticipated threats or hazards to the security or integrity
of such records which could result in substantial harm,
embarrassment, inconvenience, or unfairness to any cus-
tomer or other persons on whom such information is main-
tained.
‘‘(c) INFORMATION
COLLECTION
AND
DISCLO-
SURE.—
‘‘(1) COLLECTION
OF
ONLY
ESSENTIAL
CUS-
TOMER INFORMATION.—A financial institution shall
collect personal and financial information about a
customer only to the extent necessary to facilitate
customer-initiated transactions and to administer an
ongoing business relationship with the customer,
provided that the financial institution reasonably be-
lieves that such information will be protected against
any disclosure or use that may harm, embarrass, or
inconvenience the customer.
‘‘(2) PROHIBITION ON DISCLOSURES.—A finan-
cial institution shall not disclose or provide customer
financial or personal information to a third party for
their independent use, except to the extent that dis-
closure of such information—
‘‘(A) is necessary to complete a customer-
initiated transaction;
‘‘(B) is requested by the customer and rea-
sonable steps are taken to verify the identity of
the customer pursuant to section 1004;
‘‘(C) is required by law by a public agency
or court as part of an investigation, subpoena,
judgment, or other legal or public proceeding;
or
‘‘(D) is disclosed to the customer, with
separate and explicit notice identifying the pur-
pose for such disclosure, the customer’s right to
deny disclosure of such information and the
procedures for making such denial, as provided
in regulation under section 1004(a)(5).
‘‘SEC. 1004. REGULATIONS.
‘‘(a) REGULATIONS REQUIRED.—The financial regu-
latory agencies shall prescribe uniform regulations to
carry out the purposes of this chapter.
‘‘(b) SAFEGUARDS.—Regulations prescribed under
this section shall require each financial institution (which
is subject to such regulation) to establish appropriate safe-
guards to insure the security and confidentiality of cus-
tomer records, including policies and procedures to—
‘‘(1) assure that customer records are current
and accurate and provide for prompt correction of
any record or information in response to a cus-
tomer’s inquiry where such customer has reason to
believe that the information is incomplete or inac-
curate.
‘‘(2) limit employee access to financial records
and personally identifiable information and to train
employees on how to maintain the security and con-
fidentiality of such records and information;
(3) maintain appropriate security standards
and procedures to prevent unauthorized access to
consumer identifiers and information, which shall in-
clude appropriate procedures for customer identifica-
tion and verification, including use of customer pass-
words other than information readily available in the
public domain, biometric identifiers, and other tech-
nical or electronic security measures;
‘‘(4) require that third parties that receive cus-
tomer information also agree to maintain the con-
fidentiality of customer information; and
‘‘(5) provide appropriate disclosure to cus-
tomers regarding the financial institution’s privacy
policies and customer privacy rights, which shall in-
clude clear and conspicuous disclosure of the follow-
ing information—
‘‘(A) the type of information to be dis-
closed to third parties and the purposes for
such disclosure;
‘‘(B) the option and procedure available to
the customer to prevent such disclosure of in-
formation; and
‘‘(C) the procedures for filing a complaint
regarding the use of any confidential informa-
tion disclosed to a third party by the financial
institution, including the appropriate telephone
numbers for filing a complaint with the finan-
cial institution and with Federal and State reg-
ulatory agencies.
‘‘(c) MODEL FORMS AND DISCLOSURES.—The finan-
cial regulatory agencies shall provide model disclosure
statements and clauses, as appropriate, to facilitate com-
pliance with the disclosure requirements of section
1003(c)(2)(D). A financial institution that properly uses
the material aspects of the model disclosures shall be
deemed to be in compliance with the requirement for dis-
closure under this section.
‘‘(d) EFFECTIVE DATES.—A regulation prescribed
under this section shall not take effect before the end of
the 6-month period beginning on the date the regulation
is published in final form in the Federal Register. A finan-
cial regulatory agency may lengthen this period where, in
its determination, additional time is necessary to permit
appropriate implementation of security measures by finan-
cial institutions.
‘‘SEC. 1005. ADMINISTRATIVE ENFORCEMENT.
‘‘(a) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.—
‘‘(1) IN GENERAL.—Except as provided in sub-
section (b), compliance with this title shall be en-
forced under the Federal Trade Commission Act by
the Federal Trade Commission.
‘‘(2) VIOLATIONS OF THIS TITLE TREATED AS
VIOLATIONS
OF
FEDERAL
TRADE
COMMISSION
ACT.—
‘‘(A) IN
GENERAL.—For the purpose of
the exercise by the Federal Trade Commission
of the Commission’s functions and powers
under the Federal Trade Commission Act, any
violation of any requirement or prohibition im-
posed under this title with respect to informa-
tion brokers shall constitute an unfair or decep-
tive act or practice in commerce in violation of
section 5(a) of the Federal Trade Commission
Act.
‘‘(B) ENFORCEMENT
AUTHORITY
UNDER
OTHER LAW.—All functions and powers of the
Federal Trade Commission under the Federal
Trade Commission Act shall be available to the
Commission to enforce compliance with this
title by any person subject to enforcement by
the Federal Trade Commission pursuant to this
subsection, including the power to enforce the
provisions of this title in the same manner as
if the violation had been a violation of any Fed-
eral Trade Commission trade regulation rule,
without regard to whether the person—
‘‘(i) is engaged in commerce; or
‘‘(ii) meets any other jurisdictional
tests in the Federal Trade Commission
Act.
‘‘(C) CIVIL PENALTIES.—Any person vio-
lating any of the provisions of this title (other
than a person subject to enforcement in accord-
ance with subsection (b)) shall be subject to the
penalties and entitled to the privileges and im-
munities provided in the Federal Trade Com-
mission Act as though the applicable terms and
provisions thereof were part of this title.
‘‘(b) ENFORCEMENT BY OTHER AGENCIES IN CER-
TAIN CASES.—
‘‘(1) IN GENERAL.—Compliance with this title
shall be enforced under—
‘‘(A) section 8 of the Federal Deposit In-
surance Act, in the case of—
‘‘(i) national banks, and Federal
branches and Federal agencies of foreign
banks, by the Comptroller of the Currency;
‘‘(ii) member banks of the Federal
Reserve System (other than national
banks), branches and agencies of foreign
banks (other than Federal branches, Fed-
eral agencies, and insured State branches
of foreign banks), commercial lending com-
panies owned or controlled by foreign
banks, and organizations operating under
section 25 or 25A of the Federal Reserve
Act, by the Board of Governors of the Fed-
eral Reserve System;
‘‘(iii) banks insured by the Federal
Deposit Insurance Corporation (other than
members of the Federal Reserve System)
and insured State branches of foreign
banks, by the Board of Directors of the
Federal Deposit Insurance Corporation;
‘‘(iv) savings associations the deposits
of which are insured by the Federal De-
posit Insurance Corporation, by the Direc-
tor of the Office of Thrift Supervision;
‘‘(B) the Federal Credit Union Act, by the
Administrator of the National Credit Union Ad-
ministration with respect to any Federal credit
union;
‘‘(C) the Farm Credit Act of 1971, by the
Farm Credit Administration with respect to any
Federal land bank, Federal land bank associa-
tion, Federal intermediate credit bank, or pro-
duction credit association
‘‘(D) the securities laws (as defined in sec-
tion 3(a)(47) of the Securities Exchange Act of
1934) by the Securities and Exchange Commis-
sion with respect to any person subject to the
securities laws; and
‘‘(E) the Commodity Exchange Act, by the
Commodity Futures Trading Commission with
respect to any person subject to such Act.
‘‘SEC. 1006. CIVIL LIABILITY.
‘‘If any person knowingly fails to comply with any
requirement of this chapter or any regulation issued under
this chapter and a customer of a financial institution sus-
tains substantial financial injury and inconvenience as a
result of the disclosure of confidential information, such
person shall be liable to the customer in an amount equal
to the sum of—
‘‘(1) the greater of—
‘‘(A) any actual damages sustained by the
customer as a result of the failure; or
‘‘(B) $500;
‘‘(2) such amount of additional damages as the
court may allow; and
‘‘(3) in the case of any successful action to en-
force any liability under this section, the costs of the
action together with reasonable attorney’s fees as de-
termined by the court.
‘‘SEC. 1007. WAIVER OF RIGHTS.
‘‘(a) WAIVER
OF RIGHTS, REMEDIES, REQUIRE-
MENTS, AND OBLIGATIONS PROHIBITED.—No writing or
other agreement between a financial institution and any
customer may contain any provision which constitutes a
waiver of any requirement or obligation under this chapter
nor a waiver of any right or cause of action created by
this chapter.
‘‘(b) RULE OF CONSTRUCTION.—Subsection (a) shall
not be construed as prohibiting any writing or other agree-
ment between a financial institution and a customer which
grants to a consumer a more extensive right or remedy
or greater protection than that contained in or required
under this chapter.
‘‘SEC. 1008. RELATION TO STATE LAW.
‘‘(a) IN GENERAL.—This chapter shall not be con-
strued as annulling, altering, or affecting the laws of any
State with respect to financial privacy practices, or ex-
empting any person subject to the provisions of this title
from complying with such State laws, except to the extent
that those laws are inconsistent with any provision of this
chapter, and then only to the extent of the inconsistency.
‘‘(b) GREATER PROTECTION UNDER STATE LAW.—
For purposes of this section, a State law is not inconsist-
ent with this title if the protection such law affords any
consumer is greater than the protection provided by this
chapter.’’.