Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act

This bill amends the Gramm-Leach-Bliley Act to improve consumer financial data privacy, security, and access, with new rules on data minimization, consumer opt-out rights, use of access credentials, and sensitive data consent, while also considering small financial institutions and preempting state laws. Sec. 102, Data minimization: Financial institutions must limit collection or disclosure of nonpublic personal information to what is adequate, relevant, and reasonably necessary for each purpose, with exceptions for certain disclosures; effective 2 years after enactment. Sec. 103, Continuing consumer opt out right: Consumers can exercise the opt-out right at any time after initial disclosure, and the explanation must be accessible at any time. Sec. 104, Limits on use of consumer access credentials: Financial data aggregators and nonaffiliated third parties must provide clear disclosure and opt-out before using consumer access credentials; financial institutions cannot deny requests if conditions are met; effective 1 year after enactment. Sec. 105, Additional information in notices: Notices must include categories of data collection and disclosure, retention practices, AI use, whether data is processed in a covered nation, and how to exercise opt-out and access rights; agencies must update model forms with a 2-year safe harbor. Sec. 106, Customer access to policies: Financial institutions must provide a copy of privacy disclosures upon customer request. Sec. 107, Requests for disclosure or deletion: Customers or former customers can request disclosure of their nonpublic personal information and a list of recipients; former customers can request deletion, with exceptions for required retention, verification procedures, and a 45-day response period; up to 2 free requests per year. Sec. 108, Opt in for sensitive nonpublic personal information: Financial institutions must obtain consumer consent before collecting or disclosing sensitive nonpublic personal information, with a continuing revocation right; effective 1 year after enactment. Title II, Regulatory consideration for small institutions: Regulators must consider effects on institutions with $15 billion or less in assets, including resource and cost limitations; the threshold adjusts every 5 years based on GDP. Title III, Relation to state laws: This subtitle supersedes and preempts state consumer data privacy or security laws, but does not limit state insurance authority enforcement. Title IV, Additions to definitions: Defines access credentials, artificial intelligence, biometric data, consent, covered nation, customer, customer relationship, and financial data aggregator; expands nonpublic personal information to include access credentials, biometric data, and precise geolocation data when used in financial activities.