Statement for the Record before the House Financial Institutions Subcommittee on Data Privacy

The American Bankers Association (ABA) appreciates the opportunity to provide a Statement for the Record for this hearing, "Framework for the Future: Reviewing Data Privacy in Today's Financial System." ABA is the voice of the nation's $24.5 trillion banking industry, which is composed of small, regional, and large banks that together employ more than 2.1 million people, safeguard $19.5 trillion in deposits and extend $12.8 trillion in loans.

Summary

ABA member banks strongly support the protection of consumer data and privacy and consider safeguarding financial data to be a cornerstone of their business. This commitment to the protection of consumer financial data predates when Congress first began enacting data privacy laws in the 1970s, with the enactment of the Fair Credit Reporting Act ("FCRA") and the Right to Financial Privacy Act ("RFPA"). Our members have been subject to extensive federal privacy and data protection laws and regulations for almost half a century. Consumers trust banks because they know their personal data is secure. Unlike other entities, banks are already subject to robust privacy requirements under the Gramm-Leach-Bliley Act ("GLBA"), in addition to other federal privacy laws. We support applying privacy and data security protection standards to other industries who have not been subject to robust laws and oversight on the protection of consumer data.

GLBA: Data Security and Privacy

The primary privacy and data security consumer protection law to which financial institutions are subject is Title V of the GLBA. The GLBA represented the first time that Congress enacted sector-specific, comprehensive privacy and data security standards, in this first instance for financial institutions and consumer financial data. With the GLBA, Congress carefully constructed a privacy and data security regime that provides consumers with meaningful privacy rights, while also ensuring that consumers can conduct financial transactions seamlessly and safely. These privacy rights apply regardless of where customers live and ensure that financial institutions can protect against fraud, illicit finance, money laundering and terrorist financing.

Further, the GLBA provides various federal financial regulators with meaningful authority to adopt regulations to implement robust privacy and data security standards. This has allowed the regulatory regime to be flexible and adapt over time as privacy considerations evolve (a recent positive example is a needed exception to the annual privacy notice). In addition, federal financial regulators generally examine financial institutions for their compliance with privacy and data security requirements and have the authority to bring enforcement actions against those institutions that are found to be out of compliance with these requirements.

Notably, the GLBA requires that financial institutions provide consumers with notice relating to their collection and handling of consumer data and with information about their privacy and data security practices. Significantly, the GLBA prohibits a financial institution from disclosing information relating to a consumer to a nonaffiliated third party, unless the consumer is provided with notice and an opportunity to opt out of such disclosure and does not opt out or an exception applies permitting the disclosure (e.g., to process a transaction, prevent fraud, with the consumer's consent, to comply with applicable law). Moreover, the GLBA and its implementing regulations impose substantive obligations to put security controls in place to protect consumer information and, in many instances, provide consumers with notice of security incidents involving sensitive information.

Congress has also carefully balanced privacy protections with common sense exceptions to minimize disruptions to financial markets, transactions, and accounts. Any legislation to establish a national privacy standard must recognize the strong privacy and data security standards that are already in place for the financial sector under the GLBA and other financial privacy laws—a new national privacy framework must avoid provisions that duplicate or are inconsistent with those laws.

Download the statement for the record to read the full text.