H.R. 8398, the Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act, strengthens consumer privacy protections by requiring financial institutions to provide customers with copies of their privacy policies upon request, disclose nonpublic personal information when asked, and allow customers to request deletion of their data within 45 days at no cost for up to two requests annually. The bill establishes an "opt-in" requirement for collecting or sharing sensitive personal information like health status, race, religion, or precise location with third parties, and gives consumers the ability to revoke consent at any time. The legislation updates privacy definitions to address modern financial practices, including coverage of financial data aggregators, access credentials, biometric data, and geolocation information. While the bill preempts most state privacy laws, it preserves state insurance regulators' authority and requires federal regulators to consider compliance costs for smaller financial institutions with $15 billion or less in assets. These changes apply to all financial institutions and their customers and former customers.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.