The major law which deals with this subject with respect to financial companies is Title V of the Gramm-Leach-Bliley Act of 1999 (GLBA; P.L. The Fair Credit Reporting Act (FCRA), 15 U.S.C. It establishes standards for collection and permissible purposes for dissemination of data by consumer reporting agencies. With the passage of the Fair Credit Reporting Act Amendments of 1996, P.L. Other customer information, such as credit report or application information, may be shared with other companies in the corporate family if the customers are given "clear and conspicuous" notice about the sharing and an opportunity to direct that the information not be shared; that is, an "opt out." 108-159 , 117 Stat. The Consumer Financial Protection Act of 2010, Title X of P.L. 111-203 , the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank), makes the newly created Consumer Financial Protection Bureau (CFPB), which is located within the Federal Reserve System, the major rulemaking and enforcement authority for federal consumer protection laws, including the GLBA privacy provisions. GLBA requires that federal regulators issue rules that call for financial institutions to establish standards to insure the security and confidentiality of customer records. It prohibits financial institutions from disclosing nonpublic personal information to unaffiliated third parties without providing customers the opportunity to decline to have such information disclosed. The CFPB has primary enforcement authority over non-depository institutions (subject to certain exceptions) and over depository institutions with more than $10 billion in assets. Although depository institutions with assets of $10 billion or less are now subject to the CFPB's rules, enforcement remains with the "prudential regulators," subject to certain prerogatives of the CFPB. Given the CFPB's predominant role in implementing the GLBA privacy regime and increasing attention to the problem of Internet data security, Congress is likely to scrutinize how the CFPB implements such programs by (1) identifying any problems arising in the transfer of regulatory power from the financial institution prudential regulators and the FTC to the CFPB; (2) monitoring the CFPB's rulemaking efforts to determine whether any newly issued rules unreasonably increase the regulatory burden on struggling institutions; (3) evaluating any effect on financial institutions operating nationwide stemming from application of non-preempted state laws; and (4) examining issues that may arise in connection with the increasing use by banks of social media both to communicate with customers and for marketing purposes. Legislation in the 113th Congress

The 113 th Congress has two bills that would eliminate GLBA's requirement for an annual privacy notice under certain circumstances. H.R. S. 635 would eliminate the annual notice requirements for financial institutions if their privacy policies have not changed from their last disclosure notice and they share nonpublic personal information only pursuant to certain permissible exceptions to GLBA's prohibitions and otherwise provide customers access to their most recent disclosure in electronic or other form. Other bills, H.R. 3990 , S. 1193 , S. 1897 , and S. 1995 , would require commercial concerns to secure personal information and to provide notification of data breaches. Exemptions are provided for financial institutions covered by the GLBA privacy provisions.
One of the functions transferred to the Consumer Financial Protection Bureau (CFPB) under P.L. 111-203, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank), is authority to issue regulations and take enforcement actions under the two major federal statutes that specify conditions under which customer financial information may be shared by financial institutions: Title V of the Gramm-Leach-Bliley Act of 1999 (GLBA, P.L. 106-102) and the Fair Credit Reporting Act (FCRA). Possible topics for congressional oversight in the 113th Congress include (1) the transition of power from the financial institution prudential regulators and the Federal Trade Commission to the CFPB; (2) CFPB's interaction with other federal regulators and coordination with state enforcement efforts; and (3) the CFPB's success at issuing rules that adequately protect consumers without unreasonably increasing the regulatory burden on financial institutions.
GLBA prohibits financial institutions from sharing nonpublic personally identifiable customer information with non-affiliated third parties without providing customers an opportunity to opt out and mandates various privacy policy notices. It requires financial institutions to safeguard the security and confidentiality of customer information. FCRA regulates the credit reporting industry by prescribing standards that address information collected by businesses that provide data used to determine eligibility of consumers for credit, insurance, or employment and limits purposes for which such information may be disseminated. One of its provisions, which became permanent with the enactment of P.L. 108-159, permits affiliated companies to share non-public personal information with one another provided the customer does not choose to opt out. The creation of CFPB alters the regulatory landscape for these laws. It has primary enforcement authority over non-depository institutions (subject to certain exceptions) and over depository institutions with more than $10 billion in assets. For depository institutions with assets of $10 billion or less, the CFPB's rules apply but enforcement authority remains with the banking regulators, subject to certain prerogatives of the CFPB.
In the first session of the 113th Congress, the House passed H.R. 749, which would eliminate the GLBA requirement for an annual privacy notice if the financial institution has not changed its policies and practice with respect to sharing nonpublic personal information since its last disclosure. A similar bill, S. 635, would require that any financial institution eliminating its annual privacy notice must provide electronic access to its privacy policies. Several bills that require data breach notifications, H.R. 3990, S. 1193, S. 1897, and S. 1995, provide exemptions for financial institutions covered by the GLBA privacy provisions.
For further information, see CRS Report R41338, The Dodd-Frank Wall Street Reform and Consumer Protection Act: Title X, The Consumer Financial Protection Bureau, by [author name scrubbed]; and CRS Report RL31666, Fair Credit Reporting Act: Rights and Responsibilities, by [author name scrubbed].