H.R. 8398

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 8398 Introduced in House (IH)]

<DOC>

119th CONGRESS
2d Session
H. R. 8398

To make improvements to title V of the Gramm-Leach-Bliley Act, and for 
other purposes.

_______________________________________________________________________

IN THE HOUSE OF REPRESENTATIVES

April 21, 2026

Mr. Huizenga (for himself, Mr. Barr, Mr. Steil, and Mr. Hill of 
Arkansas) introduced the following bill; which was referred to the 
Committee on Financial Services

_______________________________________________________________________

A BILL

To make improvements to title V of the Gramm-Leach-Bliley Act, and for 
other purposes.

Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

(a) Short Title.--This Act may be cited as the ``Guidelines for 
Use, Access, and Responsible Disclosure of Financial Data Act'' or the 
``GUARD Financial Data Act''.
(b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
TITLE I--IMPROVEMENTS TO TREATMENT OF CONSUMER FINANCIAL DATA

Sec. 101. Subtitle and section heading alterations.
Sec. 102. Data minimization.
Sec. 103. Continuing consumer opt out right.
Sec. 104. Limits on use of consumer access credentials.
Sec. 105. Additional information to be included in notices to 
consumers.
Sec. 106. Customer access to privacy and disclosure policies.
Sec. 107. Requests for disclosure of or deletion of nonpublic personal 
information.
Sec. 108. Opt in for sensitive nonpublic personal information.
TITLE II--REGULATORY CONSIDERATION FOR SMALL FINANCIAL INSTITUTIONS

Sec. 201. Regulatory consideration for small financial institutions.
TITLE III--RELATION TO OTHER LAWS

Sec. 301. Relation to State laws.
TITLE IV--ADDITIONS TO DEFINITIONS

Sec. 401. Additions to definitions.

TITLE I--IMPROVEMENTS TO TREATMENT OF CONSUMER FINANCIAL DATA

SEC. 101. SUBTITLE AND SECTION HEADING ALTERATIONS.

The Gramm-Leach-Bliley Act is amended--
(1) in title V (15 U.S.C. 6801 et seq.)--
(A) in subtitle A, in the heading of the subtitle, 
by striking ``Disclosure'' and inserting ``Treatment''; 
and
(B) in section 502, by striking ``disclosures of'' 
and inserting ``nonpublic''; and
(2) in the table of contents for such Act--
(A) in the item relating to subtitle A of title V, 
by striking ``Disclosure'' and inserting ``Treatment''; 
and
(B) in the item relating to section 502, by 
striking ``disclosures of'' and inserting 
``nonpublic''.

SEC. 102. DATA MINIMIZATION.

(a) In General.--Section 502 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6802) is amended--
(1) in subsection (e), by striking ``Subsections (a) and 
(b)'' and inserting ``Subsections (a), (b), and (f)'';
(2) in subsection (e), by inserting ``collection or'' 
before ``disclosure''; and
(3) by adding at the end the following:
``(f) Data Minimization.--
``(1) In general.--A financial institution shall limit the 
collection or disclosure of nonpublic personal information to 
what is adequate, relevant, and reasonably necessary in 
relation to each purpose for which the nonpublic personal 
information is collected or disclosed, and if such collection 
or disclosure is not otherwise prohibited by this subtitle or 
the amendments made by this subtitle.
``(2) Rule of construction.--Nothing in paragraph (1) shall 
be construed to prevent a financial institution from disclosing 
nonpublic personal information--
``(A) to a nonaffiliated third party pursuant to 
subsection (b)(2);
``(B) to a nonaffiliated third party as required by 
section 1033 of the Consumer Financial Protection Act 
of 2010 (12 U.S.C. 5533);
``(C) to comply with a request from a consumer 
reporting agency (as defined in section 603(f) of the 
Fair Credit Reporting Act (15 U.S.C. 1681a(f))) to the 
extent the consumer reporting agency is engaged in 
activities subject to the Fair Credit Reporting Act;
``(D) to an agency with regulatory jurisdiction 
over the financial institution;
``(E) to a self-regulatory organization of which 
the financial institution is a member;
``(F) as otherwise permitted or required by this 
subtitle; or
``(G) as otherwise required by law.''.
(b) Effective Date.--This section shall take effect 2 years after 
the date of enactment of this Act.

SEC. 103. CONTINUING CONSUMER OPT OUT RIGHT.

Section 502(b)(1) of the Gramm-Leach-Bliley Act (15 U.S.C. 
6802(b)(1)) is amended--
(1) in subparagraph (B), by inserting after ``initially 
disclosed'' the following: ``and with that opportunity 
exercisable by the consumer at any time thereafter''; and
(2) in subparagraph (C), by inserting before the period at 
the end the following: ``before the time that such information 
is initially disclosed and with that explanation accessible to 
the consumer at any time thereafter''.

SEC. 104. LIMITS ON USE OF CONSUMER ACCESS CREDENTIALS.

(a) In General.--Section 502 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6802), as amended by section 102(3), is further amended by 
adding at the end the following:
``(g) Limits on Use of Consumer Access Credentials.--
``(1) Notice and opt out.--A financial data aggregator or 
nonaffiliated third party may not use the access credentials of 
a consumer to access an electronic form of the consumer's 
account at, or otherwise obtain an electronic form of nonpublic 
personal information of the consumer from, a financial 
institution unless--
``(A) before the time that such access credentials 
are initially collected, the financial data aggregator 
or nonaffiliated third party provides a clear and 
conspicuous disclosure to such consumer that includes--
``(i) how the financial data aggregator or 
nonaffiliated third party will use such access 
credentials;
``(ii) whether the financial data 
aggregator or nonaffiliated third party will 
disclose such access credentials to a third 
party not affiliated with the financial data 
aggregator or nonaffiliated third party; and
``(iii) a notification of--
``(I) the risks to privacy and 
security of nonpublic personal 
information associated with use of 
access credentials to obtain nonpublic 
personal information held by a 
financial institution; and
``(II) the practices of the 
financial data aggregator or 
nonaffiliated third party to ensure the 
privacy and security of nonpublic 
personal information obtained using 
access credentials; and
``(B) the consumer is given the opportunity to 
direct that such access credentials not be used to 
access the consumer's account at, or otherwise obtain 
nonpublic personal information of the consumer from, 
the financial institution.
``(2) Treatment of access credential-based request.--A 
financial institution may not deny a disclosure request from a 
financial data aggregator or a nonaffiliated third party using 
the access credentials of a consumer if the consumer--
``(A) has received the disclosure described in 
paragraph (1)(A); and
``(B) has been given the opportunity to direct that 
such access credentials not be used, as described in 
paragraph (1)(B).
``(3) Rule of construction.--Notwithstanding paragraphs (1) 
and (2), when complying with this subsection, a financial 
institution, financial data aggregator, or nonaffiliated third 
party shall comply with any requirements of section 1033 of the 
Consumer Financial Protection Act of 2010 (12 U.S.C. 5533) with 
respect to the use of the access credentials of a consumer to 
access an electronic form of the consumer's account at, or 
otherwise obtain an electronic form of nonpublic personal 
information of the consumer from, a financial institution.''.
(b) Effective Date.--This section shall take effect 1 year after 
the date of enactment of this Act.

SEC. 105. ADDITIONAL INFORMATION TO BE INCLUDED IN NOTICES TO 
CONSUMERS.

(a) In General.--Section 503(c) of the Gramm-Leach-Bliley Act (15 
U.S.C. 6803(c)) is amended--
(1) in paragraph (3) by striking ``and'' at the end;
(2) by redesignating paragraph (4) as paragraph (11); and
(3) by inserting after paragraph (3) the following:
``(4) the categories of purposes for which the financial 
institution--
``(A) collects nonpublic personal information; and
``(B) discloses nonpublic personal information to a 
nonaffiliated third party;
``(5) the categories of practices of the financial 
institution with respect to the financial institution's 
retention of nonpublic personal information;
``(6) the categories of practices of the financial 
institution with respect to the financial institution's use of 
artificial intelligence in the collection, processing, and 
utilization of nonpublic personal information;
``(7) whether any nonpublic personal information of the 
consumer is processed in, retained in, or disclosed to a 
covered nation;
``(8) an explanation of how a consumer can exercise the 
option pursuant to section 502(b) to direct that nonpublic 
personal information not be disclosed to a nonaffiliated third 
party before the time that such information is initially 
disclosed and at any time thereafter;
``(9) an explanation of how a customer can exercise the 
option to request a copy of the disclosure required by 
subsection (a) pursuant to subsection (g);
``(10) an explanation of how a customer or former customer 
can exercise the option to request disclosure of nonpublic 
personal information and how a former customer can exercise the 
option to request deletion of nonpublic personal information 
pursuant to section 503A; and''.
(b) Update of Model Forms.--
(1) In general.--The agencies referred to in section 
504(a)(1) of the Gramm-Leach-Bliley Act (15 U.S.C. 6804(a)(1)) 
shall, in consultation with the Federal functional regulators, 
jointly develop updates to the model form mandated by section 
503(e) of such Act.
(2) Safe harbor.--During the 2-year period beginning on the 
date the agencies finalize updates to the model form under 
paragraph (1), a financial institution shall be deemed to be 
compliant with section 502(a) of the Gramm-Leach-Bliley Act (15 
U.S.C. 6802(a)) if the disclosures of the financial institution 
under section 503 of such Act comply with the model form issued 
pursuant to section 503(e) in effect on the date of enactment 
of this Act.

SEC. 106. CUSTOMER ACCESS TO PRIVACY AND DISCLOSURE POLICIES.

Section 503 of the Gramm-Leach-Bliley Act (15 U.S.C. 6803) is 
amended by inserting at the end the following:
``(g) Customer Access to Privacy and Disclosure Policies.--A 
financial institution shall, upon a customer request, provide such 
customer with a copy of the disclosure required by subsection (a) in 
writing or in electronic form or other form permitted by the 
regulations prescribed under section 504.''.

SEC. 107. REQUESTS FOR DISCLOSURE OF OR DELETION OF NONPUBLIC PERSONAL 
INFORMATION.

(a) In General.--Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 
6801 et seq.) is amended by inserting after section 503 the following:

``SEC. 503A. REQUESTS FOR DISCLOSURE OF OR DELETION OF NONPUBLIC 
PERSONAL INFORMATION.

``(a) Customer or Former Customer Request for Disclosure of 
Nonpublic Personal Information.--
``(1) In general.--Upon a request from a customer or former 
customer of a financial institution, such financial institution 
shall disclose to the customer or former customer--
``(A) pursuant to the requirements of section 1033 
of the Consumer Financial Protection Act of 2010 (12 
U.S.C. 5533), any nonpublic personal information of the 
customer or former customer in the control or 
possession of the financial institution; and
``(B) a list of the categories of affiliates and 
nonaffiliated third parties to whom the financial 
institution has disclosed nonpublic personal 
information of the customer or former customer (other 
than disclosures of nonpublic personal information made 
to an affiliate or a nonaffiliated third party pursuant 
to an exception under section 502(e)).
``(2) Exception.--Paragraph (1) shall not apply to the 
extent that disclosure of nonpublic personal information to a 
customer or former customer is prohibited under other 
provisions of law.
``(b) Former Customer Request for Deletion of Nonpublic Personal 
Information.--
``(1) In general.--Upon a request from a former customer, a 
financial institution shall delete any nonpublic personal 
information of the former customer held by the financial 
institution.
``(2) Former customer deletion request exceptions.--
Paragraph (1) shall not require deletion of nonpublic personal 
information of a former customer by a financial institution 
where--
``(A) the nonpublic personal information is 
required to be retained for a continuing purpose 
pursuant to an exception described under section 
502(e);
``(B) the holder of the nonpublic personal 
information is a consumer reporting agency, as defined 
in section 603(f) of the Fair Credit Reporting Act (15 
U.S.C. 1681a(f)), and the nonpublic personal 
information is held solely to the extent that it is 
used in activities subject to the Fair Credit Reporting 
Act;
``(C) the nonpublic personal information is 
required to be retained to respond to a dispute under 
the Fair Credit Reporting Act; or
``(D) the nonpublic personal information is 
required to be retained as otherwise required by law.
``(3) Verification.--
``(A) In general.--A financial institution shall 
establish and implement procedures to verify the 
identity of a former customer submitting a request 
under paragraph (1) before deleting nonpublic personal 
information that is the subject of such request.
``(B) Requirements.--The procedures established by 
a financial institution pursuant to subparagraph (A) 
shall be designed to--
``(i) confirm that the individual making 
the request is the former customer to whom the 
nonpublic personal information relates;
``(ii) protect against unauthorized 
deletion of nonpublic personal information 
resulting from fraudulent requests; and
``(iii) protect against deletion of 
nonpublic personal information resulting from 
requests made by a former customer in error.
``(C) Exception.--A financial institution shall not 
be required to grant a request under paragraph (1) if 
the financial institution cannot confirm that the 
identity of the individual making such request is the 
same as the former customer to whom the nonpublic 
personal information relates.
``(4) Response period.--
``(A) In general.--A financial institution shall 
respond to a former customer submitting a request under 
paragraph (1) without undue delay, but in all cases 
within 45 days of receiving such request.
``(B) Extension.--A financial institution may 
extend the response period in subparagraph (A) once for 
an additional 45 days when necessary, taking into 
account the complexity and number of requests by the 
former customer, but must inform the former customer of 
such extension and the reason for such extension within 
the initial 45 day response period under subparagraph 
(A).
``(5) Apportionment of costs.--
``(A) Initial requests.--A former customer may 
submit 2 requests per year free of charge to a 
financial institution under paragraph (1).
``(B) Subsequent requests.--For any request of a 
former customer under paragraph (1) subsequent to the 
requests described in subparagraph (A), a financial 
institution may--
``(i) charge the former customer a fee, if 
the financial institution has notified the 
former customer of such fee and the former 
customer has consented to such fee; or
``(ii) decline to act on such request, if 
the former customer does not consent to the fee 
described under clause (i).
``(6) Appeal.--Subject to the exceptions in paragraph (2), 
a financial institution receiving a request under paragraph (1) 
shall--
``(A) establish a process for a former customer to 
appeal a determination by a financial institution to 
deny a request under paragraph (1);
``(B) make such appeal process under subparagraph 
(A) clearly and conspicuously disclosed to the former 
customer in the response required under paragraph (4) 
if the request under paragraph (1) is to be denied by 
the financial institution;
``(C) respond to such an appeal request by the 
former customer--
``(i) not later than 60 days after the date 
on which such appeal request is received; and
``(ii) by informing the former customer in 
writing or in electronic form or other form 
permitted by the regulations prescribed under 
section 504 of any action taken in response to 
the appeal, including an explanation of the 
reason for each action taken; and
``(D) if such an appeal is denied, provide the 
former customer with an online mechanism, if available, 
or other method through which the former customer may 
contact the appropriate enforcement agency or authority 
as described in section 505 to submit a complaint.''.
(b) Effective Date.--This section shall take effect 2 years after 
the date of enactment of this Act.
(c) Clerical Amendment.--The table of contents in section 1(b) of 
the Gramm-Leach-Bliley Act is amended by inserting after the item 
relating to section 503 the following:

``Sec. 503A. Requests for disclosure of or deletion of nonpublic 
personal information.''.

SEC. 108. OPT IN FOR SENSITIVE NONPUBLIC PERSONAL INFORMATION.

(a) In General.--Section 502 of the Gramm-Leach-Bliley Act (15 
U.S.C. 6802), as amended by sections 102(3) and 104, is further amended 
by adding at the end the following:
``(h) Opt in for Sensitive Nonpublic Personal Information.--
``(1) In general.--Notwithstanding subsection (b)(1), a 
financial institution may not collect sensitive nonpublic 
personal information or disclose sensitive nonpublic personal 
information to a nonaffiliated third party unless--
``(A) such financial institution clearly and 
conspicuously discloses to the consumer, in writing or 
in electronic form or other form permitted by the 
regulations prescribed under section 504, that such 
information may be collected or that such information 
may be disclosed to such third party;
``(B) such financial institution obtains the 
consent of the consumer to collect such information or 
to disclose such information to such third party before 
the time that such information is initially collected 
or disclosed; and
``(C) the consumer is given an explanation of how 
the consumer can revoke that consent pursuant to 
paragraph (2).
``(2) Continuing consumer consent revocation right.--A 
consumer may revoke their consent under paragraph (1)(B) at any 
time.
``(3) Rule of construction.--Paragraph (1) shall not be 
construed to prevent a financial institution from disclosing 
sensitive nonpublic personal information--
``(A) pursuant to section 502(e)(3)(A);
``(B) pursuant to section 502(e)(3)(B);
``(C) pursuant to section 502(e)(5); or
``(D) pursuant to section 502(e)(8).''.
(b) Effective Date.--This section shall take effect 1 year after 
the date of enactment of this Act.

TITLE II--REGULATORY CONSIDERATION FOR SMALL FINANCIAL INSTITUTIONS

SEC. 201. REGULATORY CONSIDERATION FOR SMALL FINANCIAL INSTITUTIONS.

Section 504 of the Gramm-Leach-Bliley Act (15 U.S.C. 6804) is 
amended by adding at the end the following:
``(c) Consideration of Effects on Financial Institutions With 
$15,000,000,000 or Less in Assets.--
``(1) In general.--Each of the agencies authorized under 
subsection (a)(1) to prescribe regulations shall take into 
account the effects of the regulations on financial 
institutions with $15,000,000,000 or less in assets, including 
the resource, technical, and personnel limitations of such 
financial institutions to comply with the regulations and the 
regulatory compliance costs relative to the size, complexity, 
financial activities, revenues, and noncompliance costs of such 
financial institutions.
``(2) Threshold adjustment.--By April 1, 2031, and the 1st 
day of each subsequent 5-year period, the agencies authorized 
under subsection (a)(1) to prescribe regulations shall increase 
the threshold described in paragraph (1) by the ratio, if 
greater than 1, of the annual value of current-dollar United 
States gross domestic product, published by the Department of 
Commerce, for the calendar year preceding the year in which the 
adjustment is calculated under this section, to the published 
annual value of such index for the calendar year preceding 
April 1, 2026.''.

TITLE III--RELATION TO OTHER LAWS

SEC. 301. RELATION TO STATE LAWS.

Section 507 of the Gramm-Leach-Bliley Act (15 U.S.C. 6807) is 
amended to read as follows:

``SEC. 507. RELATION TO STATE LAWS.

``(a) In General.--This subtitle and the amendments made by this 
subtitle shall supersede and preempt the application of any State 
statute, regulation, order, interpretation, or other law that 
establishes consumer data privacy or security requirements to nonpublic 
personal information subject to this subtitle. This subtitle and the 
amendments made by this subtitle shall supersede and preempt the 
application of any State statute, regulation, order, interpretation, or 
other law that establishes consumer data privacy or security 
requirements to a financial institution subject to this subtitle.
``(b) Regulation and Enforcement by State Insurance Authorities.--
Subsection (a) shall not be construed to alter, affect, or otherwise 
limit the authority of a State insurance authority to enforce this 
subtitle pursuant to section 505 or to adopt regulations to carry out 
this subtitle pursuant to section 504 in a manner consistent and 
comparable with, and not more restrictive than, the regulations 
prescribed by the Federal agencies authorized to prescribe regulations 
under section 504 as required by section 504(a)(2).''.

TITLE IV--ADDITIONS TO DEFINITIONS

SEC. 401. ADDITIONS TO DEFINITIONS.

Section 509 of the Gramm-Leach-Bliley Act (15 U.S.C. 6809) is 
amended--
(1) in paragraph (3)(A), by inserting before the period at 
the end the following: ``or a financial data aggregator'';
(2) by amending paragraph (4)(A) to read as follows:
``(A) The term `nonpublic personal information' 
means--
``(i) personally identifiable financial 
information--
``(I) provided by a consumer to a 
financial institution;
``(II) resulting from any 
transaction with the consumer or any 
service performed for the consumer; or
``(III) otherwise obtained by the 
financial institution;
``(ii) access credentials; and
``(iii) when used by a financial 
institution while engaging in financial 
activities as described in section 4(k) of the 
Bank Holding Company Act of 1956 (12 U.S.C. 
1843(k))--
``(I) biometric data; and
``(II) precise geolocation data.'';
(3) in paragraph (11), by striking ``Customer'' and 
inserting ``Time of establishing a customer''; and
(4) by adding at the end the following:
``(12) Access credentials.--The term `access credentials' 
means personally identifiable nonfinancial information that a 
consumer uses to access an account of such consumer at a 
financial institution, including a username, password, personal 
identification number, access code, answer to a security 
question, or a substantially similar item of personally 
identifiable nonfinancial information.
``(13) Artificial intelligence.--The term `artificial 
intelligence' has the meaning given such term in section 5002 
of the National Artificial Intelligence Initiative Act of 2020 
(15 U.S.C. 9401).
``(14) Biometric data.--The term `biometric data'--
``(A) means personally identifiable nonfinancial 
information of a consumer generated by automatic 
measurements of biological characteristics, including a 
fingerprint, voiceprint, eye retinas, eye irises, or 
other unique biological patterns or characteristics 
that are used to identify a specific consumer; and
``(B) does not include a physical or digital 
photograph, a video or audio recording or data 
generated therefrom, or information collected, used, or 
stored for health care treatment, payment, or 
operations under the Health Insurance Portability and 
Accountability Act or the amendments made by that Act.
``(15) Consent.--The term `consent' means a clear 
affirmative act by a consumer that--
``(A) signifies the freely given, specific, 
informed, and unambiguous agreement by the consumer to 
an action; and
``(B) is--
``(i) in writing or in electronic form or 
other form permitted by the regulations 
prescribed under section 504; or
``(ii) in any other unambiguous affirmative 
form.
``(16) Covered nation.--The term `covered nation' has the 
meaning given such term in section 4872(f) of title 10, United 
States Code.
``(17) Customer.--The term `customer' means a consumer who 
has a customer relationship with a financial institution.
``(18) Customer relationship.--The term `customer 
relationship' means a continuing relationship between a 
consumer and a financial institution under which the financial 
institution provides one or more financial products or services 
to the consumer that are to be used primarily for personal, 
family, or household purposes.
``(19) Financial data aggregator.--The term `financial data 
aggregator'--
``(A) means any person that operates a commercial 
enterprise for the primary business purpose of 
accessing, aggregating, collecting, processing, 
selling, or otherwise disclosing nonpublic personal 
information; and
``(B) does not include--
``(i) a person that receives, processes, or 
discloses nonpublic personal information solely 
to the extent that it performs services for or 
functions on behalf of a financial institution 
pursuant to section 502(b)(2) or pursuant to an 
exception described under section 502(e);
``(ii) a consumer reporting agency, as 
defined in section 603(f) of the Fair Credit 
Reporting Act (15 U.S.C. 1681a(f)), solely to 
the extent that it engages in activities 
subject to the Fair Credit Reporting Act;
``(iii) an attorney, accountant, investment 
adviser, or other person acting in a fiduciary 
or representative capacity on behalf of a 
consumer pursuant to section 502(e)(3)(E);
``(iv) a person--
``(I) to the extent that such 
person is not a financial institution; 
and
``(II) that operates a commercial 
enterprise that receives, processes, or 
discloses nonpublic personal 
information for the purpose of making 
or receiving payments associated with a 
sale, purchase, or exchange of goods or 
services; or
``(v) a self-regulatory organization that 
receives or processes nonpublic personal 
information disclosed to it by its members, or 
that discloses nonpublic personal information 
to an agency.
``(20) Former customer.--The term `former customer' means a 
consumer who has previously had a customer relationship with a 
financial institution and that is no longer a customer of the 
financial institution because that customer relationship has 
terminated.
``(21) Precise geolocation data.--The term `precise 
geolocation data'--
``(A) means personally identifiable nonfinancial 
information of a consumer generated by technological 
means, including global positioning systems, telemetry, 
telematics, and level, latitude, and longitude 
coordinates, or other means, that directly identifies 
the specific location of a consumer with precision and 
accuracy within a radius of 1,750 feet; and
``(B) does not include the content of 
communications or any data generated by or connected to 
advanced utility metering infrastructure systems or 
equipment for use by a utility.
``(22) Self-regulatory organization.--The term `self-
regulatory organization'--
``(A) has the meaning given that term in section 
3(a) of the Securities Exchange Act of 1934 (15 U.S.C. 
78c(a)); and
``(B) means--
``(i) a contract market, derivatives 
transaction execution facility, registered 
futures association, or other self-regulatory 
organization registered with the Commodity 
Futures Trading Commission; and
``(ii) any other self-regulatory 
organization registered with an agency 
authorized under section 504(a)(1) to prescribe 
regulations or with a Federal functional 
regulator, as determined by such agency or such 
Federal functional regulator.
``(23) Sensitive nonpublic personal information.--The term 
`sensitive nonpublic personal information' means, when used by 
a financial institution while engaging in financial activities 
as described in section 4(k) of the Bank Holding Company Act of 
1956 (12 U.S.C. 1843(k))--
``(A) personally identifiable nonfinancial 
information of a consumer that discloses the consumer's 
racial or ethnic origin, religious belief, mental or 
physical health diagnosis, sexual orientation, or 
citizenship or immigration status;
``(B) genetic or biometric data of a consumer that 
is disclosed for the purpose of uniquely identifying a 
specific consumer; and
``(C) precise geolocation data.
``(24) State.--The term `State' means each State of the 
United States, the District of Columbia, each commonwealth, 
territory, or possession of the United States, and each 
federally recognized Indian Tribe.''.
<all>