I 
117TH CONGRESS 
1ST SESSION H. R. 3911 
To amend the Gramm-Leach-Bliley Act to establish procedures for disclosures 
by financial institutions of nonpublic personal information, and for other 
purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 15, 2021 
Mr. LYNCH introduced the following bill; which was referred to the Committee 
on Financial Services 
A BILL 
To amend the Gramm-Leach-Bliley Act to establish proce-
dures for disclosures by financial institutions of non-
public personal information, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. DATA BREACHES. 
(a) IN GENERAL.—Title V of the Gramm-Leach-Bli-
ley Act (15 U.S.C. 6801 et seq.) is amended by inserting 
after section 502 the following: 
‘‘SEC. 502A. DATA BREACHES. 
‘‘(a) IN GENERAL.—A financial institution shall sub-
mit to the Director of the Bureau of Consumer Financial 
VerDate Sep 11 2014 
00:51 Jul 02, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3911.IH
H3911
kjohnson on DSK79L0C42PROD with BILLS
Protection a report if the financial institution discloses 
nonpublic personal information of a consumer in violation 
of this subtitle. Such report shall— 
‘‘(1) be submitted not later than 72 hours after 
the financial institution discovers such violation; 
‘‘(2) identify the name and contact information 
of an individual who can provide more information 
to the Bureau about the violation; 
‘‘(3) describe the nature of the violation, includ-
ing (if possible) the categories and approximate 
number of consumers affected and the categories 
and approximate number of records of nonpublic 
personal information affected; 
‘‘(4) describe the likely consequences of the vio-
lation; and 
‘‘(5) describe the measures taken or proposed 
to be taken by the financial institution to address 
the violation, including, where appropriate, measures 
to mitigate its possible adverse effects. 
‘‘(b) BUREAU DETERMINATION.— 
‘‘(1) IN GENERAL.—Upon receipt of a report 
under subsection (a), the Director of the Bureau of 
Consumer Financial Protection shall assess whether 
any violation described in such report poses a high 
risk of harm to consumers affected by such a viola-
VerDate Sep 11 2014 
00:51 Jul 02, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3911.IH
H3911
kjohnson on DSK79L0C42PROD with BILLS
tion, and if so, require the financial institution to 
disclose the violation to such consumers. 
‘‘(2) REQUIREMENTS.—The disclosure required 
under paragraph (1) shall— 
‘‘(A) describe the nature of the violation, 
including (if possible) the categories and ap-
proximate number of consumers affected and 
the categories and approximate number of 
records of nonpublic personal information af-
fected; 
‘‘(B) identify the name and contact infor-
mation of an individual who can provide more 
information to consumers about the violation; 
‘‘(C) describe the likely consequences of 
the of the violation; and 
‘‘(D) describe of the measures taken or 
proposed to be taken by the financial institution 
to address the violation, including, where appro-
priate, measures to mitigate its possible adverse 
effects. 
‘‘(3) DISCLOSURE NOT REQUIRED.—A financial 
institution is not required to disclose a violation 
under paragraph (1) if— 
‘‘(A) the financial institution has imple-
mented appropriate measures to ensure that the 
VerDate Sep 11 2014 
00:51 Jul 02, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3911.IH
H3911
kjohnson on DSK79L0C42PROD with BILLS
the nonpublic personal information affected by 
the violation would not be usable by a third 
party; and 
‘‘(B) the Director of the Bureau of Con-
sumer Financial Protection has determined that 
the financial institution has taken action to pre-
vent harm to consumers as a result of the viola-
tion. 
‘‘(c) RULEMAKING.—Not later than the end of the 
1-year period beginning on the date of enactment of this 
section, the Director of the Bureau of Consumer Financial 
Protection and the Federal agencies described under sec-
tion 505(a) shall, jointly, issue rules to carry out this sec-
tion.’’. 
Æ 
VerDate Sep 11 2014 
00:51 Jul 02, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H3911.IH
H3911
kjohnson on DSK79L0C42PROD with BILLS