This bill, known as the "Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act" or the "GUARD Financial Data Act," significantly amends Title V of the Gramm-Leach-Bliley Act (GLBA) to bolster consumer financial data privacy and security. Its core purpose is to establish more stringent rules for how financial institutions collect, use, and disclose nonpublic personal information, while empowering consumers with greater control over their data. Key provisions include data minimization, enhanced opt-out rights, and new requirements for sensitive information. The Act mandates data minimization , requiring financial institutions to limit the collection and disclosure of nonpublic personal information to what is adequate, relevant, and reasonably necessary for each purpose. Consumers are granted a continuing opt-out right , allowing them to direct that their nonpublic personal information not be disclosed to nonaffiliated third parties at any time. Furthermore, financial data aggregators and nonaffiliated third parties must provide clear disclosures and an opt-out opportunity before using consumer access credentials to obtain data from financial institutions. Financial institutions will be required to provide more comprehensive privacy notices to consumers, detailing categories of data collection and disclosure purposes, data retention practices, and the use of artificial intelligence in data processing. These notices must also disclose if consumer data is processed or retained in a "covered nation." Consumers will also gain the right to request a copy of these privacy and disclosure policies. New consumer rights are established, allowing customers and former customers to request disclosure of their nonpublic personal information held by a financial institution, along with a list of affiliates and nonaffiliated third parties to whom it was shared. Former customers can also request the deletion of their nonpublic personal information , subject to certain exceptions, with financial institutions required to establish identity verification, response periods, and appeal processes for such requests. A significant change is the requirement for explicit opt-in consent from consumers before financial institutions can collect or disclose "sensitive nonpublic personal information," which includes biometric data, precise geolocation data, and information revealing racial or ethnic origin, religious belief, or health diagnoses. Finally, the bill clarifies its relation to state laws, establishing federal preemption for consumer data privacy and security requirements while preserving state insurance authority.
Get AI-generated questions to help you understand this bill better
Timeline
Introduced in House
Referred to the House Committee on Financial Services.
Introduced in House
Referred to the House Committee on Financial Services.
Finance and Financial Sector
Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act
USA119th CongressHR-8398| House
| Updated: 4/21/2026
This bill, known as the "Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act" or the "GUARD Financial Data Act," significantly amends Title V of the Gramm-Leach-Bliley Act (GLBA) to bolster consumer financial data privacy and security. Its core purpose is to establish more stringent rules for how financial institutions collect, use, and disclose nonpublic personal information, while empowering consumers with greater control over their data. Key provisions include data minimization, enhanced opt-out rights, and new requirements for sensitive information. The Act mandates data minimization , requiring financial institutions to limit the collection and disclosure of nonpublic personal information to what is adequate, relevant, and reasonably necessary for each purpose. Consumers are granted a continuing opt-out right , allowing them to direct that their nonpublic personal information not be disclosed to nonaffiliated third parties at any time. Furthermore, financial data aggregators and nonaffiliated third parties must provide clear disclosures and an opt-out opportunity before using consumer access credentials to obtain data from financial institutions. Financial institutions will be required to provide more comprehensive privacy notices to consumers, detailing categories of data collection and disclosure purposes, data retention practices, and the use of artificial intelligence in data processing. These notices must also disclose if consumer data is processed or retained in a "covered nation." Consumers will also gain the right to request a copy of these privacy and disclosure policies. New consumer rights are established, allowing customers and former customers to request disclosure of their nonpublic personal information held by a financial institution, along with a list of affiliates and nonaffiliated third parties to whom it was shared. Former customers can also request the deletion of their nonpublic personal information , subject to certain exceptions, with financial institutions required to establish identity verification, response periods, and appeal processes for such requests. A significant change is the requirement for explicit opt-in consent from consumers before financial institutions can collect or disclose "sensitive nonpublic personal information," which includes biometric data, precise geolocation data, and information revealing racial or ethnic origin, religious belief, or health diagnoses. Finally, the bill clarifies its relation to state laws, establishing federal preemption for consumer data privacy and security requirements while preserving state insurance authority.