Privacy Protection for Customer Financial Information (CRS Report for Congress)
| Release Date |
Revised July 14, 2014 |
| Report Number |
RS20185 |
| Report Type |
Report |
| Authors |
M. Maureen Murphy, Legislative Attorney |
| Source Agency |
Congressional Research Service |
| Older Revisions |
-
Premium Revised Jan. 9, 2014 (9 pages, $24.95)
add
-
Premium Revised Feb. 4, 2013 (11 pages, $24.95)
add
-
Premium Revised Jan. 12, 2012 (10 pages, $24.95)
add
-
Premium Revised Jan. 7, 2009 (7 pages, $24.95)
add
-
Premium Revised April 18, 2005 (6 pages, $24.95)
add
-
Premium Revised June 30, 2003 (6 pages, $24.95)
add
-
Premium Revised June 13, 2003 (6 pages, $24.95)
add
-
Premium Revised May 2, 2003 (6 pages, $24.95)
add
-
Premium Revised April 16, 2003 (6 pages, $24.95)
add
-
Premium Revised Feb. 28, 2003 (6 pages, $24.95)
add
-
Premium Revised Jan. 31, 2003 (6 pages, $24.95)
add
-
Premium Revised Oct. 7, 2002 (6 pages, $24.95)
add
-
Premium Revised Aug. 6, 2002 (6 pages, $24.95)
add
-
Premium May 10, 2002 (6 pages, $24.95)
add
|
Summary:
One of the functions transferred to the Consumer Financial Protection Bureau (CFPB) under P.L. 111-203, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), is authority to issue regulations and take enforcement actions under the two major federal statutes that specify conditions under which customer financial information may be shared by financial institutions: Title V of the Gramm-Leach-Bliley Act of 1999 (GLBA, P.L. 106-102) and the Fair Credit Reporting Act (FCRA). Possible topics for congressional oversight in the 113th Congress include (1) the transition of power from the financial institution prudential regulators and the Federal Trade Commission to the CFPB; (2) CFPB's interaction with other federal regulators and coordination with state enforcement efforts; and (3) the CFPB's success at issuing rules that adequately protect consumers without unreasonably increasing the regulatory burden on financial institutions.
GLBA prohibits financial institutions from sharing nonpublic personally identifiable customer information with non-affiliated third parties without providing customers an opportunity to opt out and mandates various privacy policy notices. It requires financial institutions to safeguard the security and confidentiality of customer information. FCRA regulates the credit reporting industry by prescribing standards that address information collected by businesses that provide data used to determine eligibility of consumers for credit, insurance, or employment and limits purposes for which such information may be disseminated. One of its provisions, which became permanent with the enactment of P.L. 108-159, permits affiliated companies to share non-public personal information with one another provided the customer does not choose to opt out. The creation of CFPB alters the regulatory landscape for these laws. It has primary enforcement authority over non-depository institutions (subject to certain exceptions) and over depository institutions with more than $10 billion in assets. For depository institutions with assets of $10 billion or less, the CFPB's rules apply but enforcement authority remains with the banking regulators, subject to certain prerogatives of the CFPB.
In the first session of the 113th Congress, the House passed H.R. 749, which would eliminate the GLBA requirement for an annual privacy notice if the financial institution has not changed its policies and practice with respect to sharing nonpublic personal information since its last disclosure. A similar bill, S. 635, would require that any financial institution eliminating its annual privacy notice must provide electronic access to its privacy policies. Several bills that require data breach notifications, H.R. 3990, S. 1193, S. 1897, and S. 1995, provide exemptions for financial institutions covered by the GLBA privacy provisions.
For further information, see CRS Report R41338, The Dodd-Frank Wall Street Reform and Consumer Protection Act: Title X, The Consumer Financial Protection Bureau, by David H. Carpenter; and CRS Report RL31666, Fair Credit Reporting Act: Rights and Responsibilities, by Margaret Mikyung Lee.
