Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act

Key Points

• Banks and financial companies would have to limit the personal data they collect or share to only what is "adequate, relevant, and reasonably necessary" for the specific service being provided. This data minimization rule takes effect two years after the bill becomes law.
• Former customers could ask their bank to delete personal information, with up to two free requests per year. Banks would have 45 days to respond and must set up a verification process and appeals system for denied requests.
• Financial companies would need your clear, opt-in consent before collecting or sharing sensitive data like biometrics, precise location, health info, religious beliefs, race, sexual orientation, or immigration status. You could revoke that consent at any time.
• Financial data aggregators and third-party apps that use your bank login credentials would have to clearly warn you about privacy and security risks, tell you how they use your credentials, and give you a chance to opt out before accessing your account.
• The bill would override state data privacy and security laws that apply to financial data, replacing them with a single federal standard. State insurance authorities could still enforce the law and adopt consistent regulations.
• Financial institutions must disclose whether they use AI to process your data and whether your information is sent to or stored in certain foreign countries classified as "covered nations." Companies must also tell you how to exercise your opt-out rights at any time.