such individual held by the financial institution, 
and provide such individual with clear instruc-
tions on how to make such request; and 
‘‘(B) for each additional 1-year period with 
respect to which such person continues to not 
use a product or service of the financial institu-
tion, resend the notice described under subpara-
graph (A). 
‘‘(3) EXCEPTION.— 
‘‘(A) IN GENERAL.—This subsection shall 
not require a financial institution to delete non-
public personal information if— 
‘‘(i) the financial institution is other-
wise required by law to retain the non-
public personal information; 
‘‘(ii) the nonpublic personal informa-
tion may be necessary to respond to a dis-
pute under the Fair Credit Reporting Act; 
or 
‘‘(iii) the nonpublic personal informa-
tion may be necessary to retain for a pur-
pose described in an exception under sec-
tion 502(e). 
‘‘(B) LIMITATION
ON
RETAINED
NON-
PUBLIC
PERSONAL
INFORMATION.—With re-
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
spect to nonpublic personal information that a 
financial institution would be required to delete 
under this subsection but for the application of 
this paragraph, the financial institution may 
only use such nonpublic personal information 
for the applicable purpose described under sub-
paragraph (A). 
‘‘(c) TIMING.—A financial institution that receives an 
authorized request, under this section, from an individual 
with whom such financial institution has a customer or 
consumer relationship, shall respond within 45 business 
days. 
‘‘(d) RULEMAKING.—Not later than the end of the 
1-year period beginning on the date of enactment of this 
section, each agency or authority described in section 504 
shall issue rules to carry out this section with respect to 
the financial institutions subject to its jurisdiction.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Gramm-Leach-Bliley Act is amended 
by inserting after the item relating to section 502 the fol-
lowing: 
‘‘Sec. 502A. Obligations with respect to access and deletion of nonpublic per-
sonal information.’’. 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6211
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 9. OBLIGATIONS WITH RESPECT TO THE INTER-
NATIONAL SHARING OF NONPUBLIC PER-
SONAL INFORMATION. 
(a) IN GENERAL.—Title V of the Gramm-Leach-Bli-
ley Act (15 U.S.C. 6801 et seq.), as amended by section 
10, is further amended by inserting after section 502A 
the following: 
‘‘SEC. 502B. OBLIGATIONS WITH RESPECT TO THE INTER-
NATIONAL SHARING OF NONPUBLIC PER-
SONAL INFORMATION. 
‘‘(a) IN GENERAL.—A financial institution may not 
share with a foreign government nonpublic personal infor-
mation relating to an individual with whom such financial 
institution has a customer or consumer relationship. 
‘‘(b) LAW ENFORCEMENT EXCEPTION.—Subsection 
(a) shall not apply to the sharing of the nonpublic personal 
information relating to such an individual with a foreign 
government authority if such sharing is— 
‘‘(1) done for legitimate law enforcement pur-
poses; or 
‘‘(2) to a foreign government authority having 
jurisdiction over the financial institution for exam-
ination, compliance, or other purposes as authorized 
by law.’’. 
(b) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of the Gramm-Leach-Bliley Act, as amend-
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
ed by section 10, is further amended by inserting after 
the item relating to section 502A the following: 
‘‘Sec. 502B. Obligations with respect to the international sharing of nonpublic 
personal information’’. 
SEC. 10. REPEAL OF EXPIRED PROVISIONS. 
The Gramm-Leach-Bliley Act is amended— 
(1) by striking section 508 (15 U.S.C. 6808); 
and 
(2) in the table of contents in section 1(b), by 
striking the item relating to section 508. 
SEC. 11. GAO REPORT. 
The Comptroller General of the United States shall, 
not later than 1 year after the date of the enactment of 
this Act, submit to the Congress a report that assesses— 
(1) whether the safeguard standards promul-
gated pursuant to section 501 of the Gramm-Leach- 
Bliley Act, including but not limited to protecting 
against unauthorized disclosure, are effective in pro-
tecting individuals with whom financial institutions 
have a customer or consumer relationship; and 
(2) whether the enforcement regime with re-
spect to those standards are effective in protecting 
customers and consumers, and whether additional 
remedies are necessary. 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 12. SENSE OF CONGRESS. 
It is the sense of the Congress that the Federal agen-
cies implementing the Gramm-Leach-Bliley Act should im-
plement such Act, to the extent possible, in a technology- 
agnostic manner so as to ensure it can adapt to different 
business models and technologies. 
SEC. 13. EFFECTIVE DATE. 
The amendments made by this Act shall take effect 
on the date that is the earlier of— 
(1) the date that is one year after the date on 
which all rulemaking required under this Act is com-
plete; or 
(2) the date that is 2 years after the date of the 
enactment of this Act. 
Æ 
VerDate Sep 11 2014 
22:48 Feb 24, 2023
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6301
E:\BILLS\H1165.IH
H1165
pbinns on DSKJLVW7X2PROD with $$_JOB