Data Privacy Act of 2023

This bill addresses the privacy and security of personal information held by financial institutions. The bill expands the application of current protections, it provides individuals with controls for limiting the collection of their information, and it establishes data privacy standards nationwide.

Currently, financial institutions must protect personal information and provide notice about privacy practices. The bill expands personal information protections that currently apply to customers (individuals who have a continuing relationship with a financial institution) to consumers (individuals who have a more limited relationship with a financial institution, such as those who apply for but do not receive a loan). The bill also expands notice requirements to apply to the collection of individual data.

Under the bill, financial institutions must (1) inform individuals for what purpose their data is collected and how the data will be used, and (2) give individuals the opportunity to opt out of data collection. An individual may also end the sharing of the individual's data with third parties, as well as demand the deletion of the individual's data.

The bill also prohibits states from establishing different privacy protections than those at the federal level. Under current law, states are allowed to establish stricter privacy protections.