,i  #aagth ,,congress  #ast ,session    
,h4 ,r4 #ciaa  ,,in ,,the ,,house ,,of  
,,representatives  ,june #ae1 #bjba,mr4 
,lynch introduced the following bill2   
which was referred to the ,committee on 
,financial ,services  ,a ,,bill  ,to    
amend the ,gramm-,leach-,bliley ,act to 
establish procedures for disclosures by 
financial institutions of nonpublic     
personal information1 and for other     
purposes4  #a4 ,data breaches  7a7 ,in  
general ,title ,v of the                
,gramm-,leach-,bliley ,act 7#ae         
,u4,s4,c4 #fhja et seq47 is amended by  
inserting after section #ejb the        
following3  #ejb;,a4 ,data breaches  7a7
 ,in general ,a financial institution   
shall submit to the ,director of the    
,bureau of ,consumer ,financial         
,protection a report if the financial   
institution discloses nonpublic personal
 information of a consumer in violation 
of this subtitle4 ,such report shall--  
7#a7 be submitted not later than #gb    
hours after the financial institution   

discovers such violation2  7#b7 identify
 the name and contact information of an 
individual who can provide more         
information to the ,bureau about the    
violation2  7#c7 describe the nature of 
the violation1 including 7if possible7  
the categories and approximate number of
 consumers affected and the categories  
and approximate number of records of    
nonpublic personal information affected2
  7#d7 describe the likely consequences 
of the violation2 and  7#e7 describe the
 measures taken or proposed to be taken 
by the financial institution to address 
the violation1 including1 where         
appropriate1 measures to mitigate its   
possible adverse effects4  7b7 ,bureau  
determination  7#a7 ,in general ,upon   
receipt of a report under subsection    
7a71 the ,director of the ,bureau of    
,consumer ,financial ,protection shall  
assess whether any violation described  
in such report poses a high risk of harm
 to consumers affected by such a        
violation1 and if so1 require the       

financial institution to disclose the   
violation to such consumers4  7#b7      
,requirements ,the disclosure required  
under paragraph 7#a7 shall-- 7,a7       
describe the nature of the violation1   
including 7if possible7 the categories  
and approximate number of consumers     
affected and the categories and         
approximate number of records of        
nonpublic personal information affected2
  7,b7 identify the name and contact    
information of an individual who can    
provide more information to consumers   
about the violation2  7,c7 describe the 
likely consequences of the of the       
violation2 and  7,d7 describe of the    
measures taken or proposed to be taken  
by the financial institution to address 
the violation1 including1 where         
appropriate1 measures to mitigate its   
possible adverse effects4  7#c7         
,disclosure not required ,a financial   
institution is not required to disclose 
a violation under paragraph 7#a7 if--   
7,a7 the financial institution has      

implemented appropriate measures to     
ensure that the the nonpublic personal  
information affected by the violation   
would not be usable by a third party2   
and  7,b7 the ,director of the ,bureau  
of ,consumer ,financial ,protection has 
determined that the financial           
institution has taken action to prevent 
harm to consumers as a result of the    
violation4  7c7 ,rulemaking ,not later  
than the end of the #a-year period      
beginning on the date of enactment of   
this section1 the ,director of the      
,bureau of ,consumer ,financial         
,protection and the ,federal agencies   
described under section #eje7;a7 shall1 
jointly1 issue rules to carry out this  
section4  4