Cybersecurity Policy Report, House Financial Services Committee seeks public feedback on privacy law, (Aug 1, 2025)

By Steven Melendez

Committee leaders are inviting public comment on current financial services privacy law and potential changes.

Leaders of the House Financial Services Committee have invited the public to submit comments on current privacy laws governing financial services and potential changes. Committee Chairman French Hill (R-Ark.) and Subcommittee on Financial Institutions Chairman Andy Barr (R-Ky.) are asking members of the public to submit comments or answers to specific questions posed about the current law, Title V, Subtitle A of the Gramm-Leach-Bliley Act (GLBA). Members of the public are invited to submit comments and answers to their questions via email by August 28, 2025.

The committee leaders ask the public to consider whether they should amend the GLBA "or consider a broader approach" and whether they should consider setting a federal privacy standard that preempts state laws "or maintain the current GLBA federal floor approach." They also invite comment on how privacy standards under GLBA for financial institutions should relate to other federal privacy laws, including sector-specific rules and "a potential general data privacy law."

One question requires the public to consider whether any states "have developed effective privacy frameworks" and, if so, what elements of those frameworks might be suited to implementation on a federal level. Another asks members of the public to consider whether the definitions of various terms—including non-public personal information, personally identifiable financial information, customer relationship, and financial institution—might require updating.

"Does the current definition of 'financial institution' sufficiently cover entities that should be subject to GLBA Title V requirements, such as data aggregators?" asks one of the committee leaders' 13 questions.

Other questions seek feedback on specific provisions that might be included in a potential federal financial privacy law update, including requiring consent for collecting various sorts of information like "PIN Numbers and IP addresses" or requiring that consumers be given "a list of all entities receiving their data."

Questions from the committee leaders ask for feedback on "mandating the deletion of data for accounts that have been inactive for over a year, provided the customer is notified and no response is received" and changing how liability is determined if a financial services provider shares data with a third-party which then experiences a security breach.

The legislators are also asking the public to weigh on whether they should "consider changes to require or encourage financial institutions, third parties, and other holders of consumer financial data to minimize data collection to only collection that is needed to effectuate a consumer transaction and place limits on the time-period for data retention."

LegislativeActivity: CyberPrivacyFeed DataPrivacy IdentityTheft Privacy StateBankingLaws DataSecurity