for a consumer privacy and data security program for protecting sensitive personally identifiable information. (c) Limitations Notwithstanding any other obligation under this subtitle, this subtitle does not apply to the following: (1) Financial institutions Financial institutions— (A) subject to and in compliance with the data security requirements and standards under section 501(b) of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801(b) )