Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act
- Sponsor
- Rep. Huizenga, Bill [R-MI-4]
- Committees
- Financial Services Committee (primary)
- Last action
- Apr 21, 2026
Bottom line
The GUARD Financial Data Act overhauls financial data privacy regulations under GLBA, granting consumers more control and transparency over their nonpublic personal information while establishing new, substantial obligations for financial institutions and data aggregators.
What it actually does
This bill significantly amends Title V of the Gramm-Leach-Bliley Act (GLBA) to enhance consumer financial data privacy. It introduces requirements for data minimization, strengthens consumer opt-out rights, imposes limits on the use of consumer access credentials by financial data aggregators, and expands the information financial institutions must include in privacy notices. Furthermore, it grants consumers new rights to request disclosure or deletion of their nonpublic personal information and mandates opt-in consent for the collection or disclosure of sensitive nonpublic personal information. The bill also preempts state laws on consumer data privacy for information subject to GLBA and requires federal regulators to consider the impact on small financial institutions when prescribing regulations.
Proponents argue
Proponents argue that the bill empowers consumers by giving them greater control and transparency over their financial data, reduces the risk of data misuse through minimization and opt-in requirements, and modernizes GLBA to address challenges posed by financial data aggregators and artificial intelligence. They emphasize the importance of a uniform national standard for data privacy to streamline compliance and avoid a fragmented patchwork of state laws.
Opponents contend
Opponents might contend that the bill imposes significant new compliance burdens and costs on financial institutions, particularly smaller ones, potentially stifling innovation in financial technology. They may also argue that the broad preemption of state laws could weaken consumer protections in states with more stringent privacy regulations, and that certain definitions, such as 'sensitive nonpublic personal information,' could be overly broad or lead to unintended consequences.
The bill is moderately complex, requiring careful reading to understand the interplay of new provisions with existing GLBA text and the implications of new definitions.
Section 102, amending GLBA Section 502
Establishes Data Minimization Requirements
This provision requires financial institutions to limit the collection and disclosure of nonpublic personal information (NPI) to only what is adequate, relevant, and reasonably necessary for each specific purpose. It also clarifies several exceptions where disclosure is permitted, such as to nonaffiliated third parties under existing GLBA rules, consumer reporting agencies, regulatory agencies, and self-regulatory organizations.
Supporters argue
Supporters argue this provision is crucial for modern data privacy, preventing over-collection of data that could be vulnerable to breaches or misuse. It aligns U.S. financial privacy with global best practices for data protection.
Critics contend
Critics might argue that defining 'reasonably necessary' could be subjective and lead to regulatory uncertainty, increasing compliance costs and potentially hindering legitimate data uses for fraud prevention or service improvement.
Tradeoffs
This provision balances enhanced consumer privacy by limiting data collection with the operational needs of financial institutions and the utility of data for various financial services.
Section 103, amending GLBA Section 502(b)(1)
Ensures Perpetual Consumer Opt-Out Right
This amendment ensures that consumers have a continuous right to opt out of the disclosure of their nonpublic personal information to nonaffiliated third parties, not just at the initial disclosure but 'at any time thereafter.' It also mandates that the explanation of this opt-out right remains accessible to the consumer at all times.
Section 104, amending GLBA Section 502
Regulates Financial Data Aggregator Access Credentials
This section prohibits financial data aggregators or nonaffiliated third parties from using consumer access credentials (like usernames and passwords) to access accounts or obtain nonpublic personal information without first providing a clear and conspicuous disclosure. This disclosure must detail how credentials will be used, whether they will be shared with other third parties, and the associated privacy and security risks. Consumers must be given an opportunity to opt out of such use. Financial institutions are prohibited from denying disclosure requests if the aggregator has complied with these conditions.
Section 105, amending GLBA Section 503(c)
Mandates Additional Information in Consumer Privacy Notices
This section expands the information financial institutions must include in their privacy notices to consumers. New requirements include detailing the categories of purposes for NPI collection and disclosure, data retention practices, the use of artificial intelligence in NPI processing, whether NPI is processed, retained, or disclosed in a 'covered nation,' and clear explanations of consumer opt-out, access, and deletion rights.
Section 107, inserting new GLBA Section 503A
Establishes Consumer Data Access and Deletion Rights
This section creates new rights for customers and former customers to request disclosure of their nonpublic personal information held by a financial institution, including a list of categories of affiliates and nonaffiliated third parties to whom their data was disclosed (with certain exceptions). Former customers also gain the right to request deletion of their NPI, subject to specific exceptions (e.g., legal retention requirements, Fair Credit Reporting Act disputes). Financial institutions must verify the identity of the requester, respond within 45 days (with a possible 45-day extension), allow two free requests per year, and establish an appeal process for denied requests.
Section 108, amending GLBA Section 502
Requires Opt-In for Sensitive Nonpublic Personal Information
This section mandates that financial institutions obtain explicit 'consent' (defined as a clear affirmative act) from consumers before collecting or disclosing 'sensitive nonpublic personal information' to nonaffiliated third parties. Consumers must be informed of this requirement and how to revoke their consent at any time. 'Sensitive NPI' is defined to include data revealing racial or ethnic origin, religious belief, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, biometric data for unique identification, and precise geolocation data.
Section 201, amending GLBA Section 504
Mandates Small Institution Regulatory Consideration
This section requires federal agencies responsible for prescribing GLBA regulations to specifically consider the effects on financial institutions with $15 billion or less in assets. This includes taking into account their resource, technical, and personnel limitations, as well as compliance costs relative to their size and complexity. The asset threshold will be adjusted every five years.
Section 301, amending GLBA Section 507
Establishes Federal Preemption for Financial Data Privacy
This section states that GLBA and its amendments will 'supersede and preempt' any State law (statute, regulation, order, etc.) that establishes consumer data privacy or security requirements for nonpublic personal information subject to GLBA or for financial institutions subject to GLBA. It clarifies that State insurance authorities retain their power to enforce GLBA or adopt consistent regulations.
Section 401, amending GLBA Section 509
Adds Key Definitions for Modern Data Privacy
This section significantly expands the definitions within GLBA. It redefines 'nonpublic personal information' to include 'access credentials' and, when used in financial activities, 'biometric data' and 'precise geolocation data.' It also introduces new definitions for critical terms such as 'access credentials,' 'artificial intelligence,' 'biometric data,' 'consent' (requiring a clear affirmative act), 'covered nation,' 'financial data aggregator,' 'former customer,' 'precise geolocation data,' and 'sensitive nonpublic personal information.'
Defines 'consent' as a 'clear affirmative act' by a consumer, signifying 'freely given, specific, informed, and unambiguous agreement' to an action, which can be in writing, electronic form, or 'any other unambiguous affirmative form.'
Section 401(15), amending GLBA Section 509
Why it matters:While placing definitions at the end is standard legislative practice for brevity, this specific definition is critical for understanding the 'opt-in' requirements for sensitive nonpublic personal information and the broader consumer control mechanisms introduced by the bill.
Case for: Proponents argue this robust definition of consent is essential to ensure consumers genuinely agree to data practices, moving beyond passive acceptance or pre-checked boxes, thereby empowering individuals with true control over their data.
Case against: Critics might argue that requiring a 'clear affirmative act' and 'unambiguous agreement' could create friction in user experience and increase compliance hurdles for financial institutions, especially for managing existing data relationships and obtaining consent for various services.
Estimated impact: High, as this definition sets the standard for all consent-based data practices under the bill, particularly for the collection and disclosure of sensitive nonpublic personal information.
Defines 'covered nation' by cross-referencing section 4872(f) of title 10, United States Code. This external reference typically designates countries that pose a significant risk to the national security, foreign policy, or economic health of the United States, often including nations like China, Russia, Iran, and North Korea.
Section 401(16), amending GLBA Section 509
Why it matters:This is standard legislative practice for brevity and consistency with other federal laws, but it obscures the specific implications of the restriction on data processing or retention in such nations.
Case for: Proponents argue this is a crucial national security measure, preventing sensitive financial data from being processed or stored in adversarial countries where it could be vulnerable to state-sponsored espionage or exploitation.
Case against: Critics might argue that such restrictions could complicate international data flows for legitimate business operations, potentially increasing costs or limiting service availability for consumers with international ties, without always clearly justifying the security benefit.
Estimated impact: Potentially high for financial institutions with global operations or third-party vendors in countries that fall under the 'covered nation' designation.