HB 1623

HB 1623 - AS INTRODUCED

AN ACT relative to the disclosure of customer financial information by financial institutions.

SPONSORS: Rep. Kurk, Hills 5; Rep. Keans, Straf 16; Sen. Below, Dist 5; Sen. Gordon, Dist 2; Sen. F. King, Dist 1

This bill limits the disclosure of information relating to a customer by financial institutions to certain specified activities and establishes penalties for willful or negligent disclosure of customer financial information.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

AN ACT relative to the disclosure of customer financial information by financial institutions.

Be it Enacted by the Senate and House of Representatives in General Court convened:

I. It is the policy of this state to protect the privacy of customers of financial institutions without unduly inhibiting the free flow of commerce or legitimate law enforcement activities.

II. Privacy is a fundamental right of the citizens of the state of New Hampshire. The evolution of information technology, including the means of collecting, analyzing and transmitting data, now permits uses of personal information that severely threaten the privacy of the citizens of this state.

III. The sale, exchange, and dissemination of information relating to customers of financial institutions, for purposes not directly related to providing services customers have purchased or applied for, have caused significant harm to the people and the economy of this state. Such sale, exchange, and dissemination of information subjects consumers to fraudulent, misleading, deceptive, or intrusive telephone, direct mail, or internet solicitations; to fraud and abuse, including identity theft and unauthorized charges; and to discrimination in the offer or sale of products or services.

IV. Customers' relations with financial institutions are based on trust and confidence. Such trust and confidence are severely threatened by lack of adequate information concerning such institutions' privacy policies and information practices and by lack of customer control over the use and dissemination of their personal information. The customer trust necessary to the proper functioning of financial institutions depends on customers understanding and specifically consenting to disclosure of personal information for purposes not directly related to providing the services customers choose to purchase or apply for.

2 New Chapter; Disclosure of Customer Financial Information by Financial Institutions. Amend RSA by inserting after chapter 383 the following new chapter:

I. "Affiliate" means "affiliate" as defined in the federal Financial Services Modernization Act of 1999.

II. "Credit reporting agency" means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of reporting to third parties on the credit rating or creditworthiness of any consumer.

III. "Customer" means any person who deposits, borrows, invests, or insures with a financial institution, including a surety or a guarantor on a loan.

IV. "Financial information" means an original or copy of, or information derived from:

(b) A statement, ledger card, or other record of a deposit or share account that shows transactions in or with respect to that deposit or account;

(c) A check, clear draft, or money order that is drawn on a financial institution or issued and payable by or through a financial institution;

(d) Any item, other than an institutional or periodic charge, that is made under an agreement between a financial institution and another person's deposit or share account;

(e) Any information that relates to a deposit or share account, an application for a deposit or share account, a loan account or an application for a loan; or

(g) Any information that relates to an insurance policy or application for such policy including in each case health information and medical and family history however obtained.

(h) Any information that relates to a securities account or an application for such account.

(i) Any information that relates to a customer of an affiliate of a financial institution.

V. "Financial institution" means a bank, savings and loan association, credit union, bank subsidiary, lender, loan servicer, loan or mortgage broker, sales finance company, or similar organization licensed or required to be licensed pursuant to the laws of New Hampshire, or under the laws of the United States, or under the laws of any other state or territory of the United States, and an affiliate of any of them, including any institution which sells, services or underwrites insurance or insurance products, or securities or securities products.

VI. "Mercantile agency" means any person, which for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating business credit information or other information on businesses for the purpose of reporting to third parties on the credit rating or creditworthiness of any business.

383-A:2 Disclosure of Financial Records Prohibited. Except as otherwise expressly provided in this chapter, a financial institution, its officers, employees, agents, and directors shall not disclose to any person any financial information relating to a customer. Financial institutions shall adopt reasonable procedures to assure compliance with this chapter.

I. The provisions of this chapter shall not prohibit any of the following activities:

(b) Disclosure authorized by the customer, provided the disclosure is limited to the scope and purpose that the customer authorizes. No customer or potential customer shall be required to authorize the disclosure of financial information as a condition of doing business with a financial institution. For purposes of this subparagraph, the term "authorized" means upon knowledge and affirmative consent of the customer in a written statement dated and executed by the customer that is separate and distinct from any other document and that contains at least the following:

(1) A specific description of the information to be disclosed, including whether or not any account information such as transaction or experience information will be disclosed in any form, including encrypted account information;

(3) Identification of the entity or entities authorized to receive the disclosure and a specific description of the purpose for which such disclosure will by made;

(4) The expiration date of the authorization, which shall be no more than 2 years from the date of its execution;

(5) An acknowledgement by the customer executing the authorization that he or she has the right to revoke the authorization at any time.

(c) Disclosure of information sought by the department of health and human services, office of child support pursuant to its authority and obligations under RSA 161-C:3-a, or by an agency of similar function of another state, pursuant to similar authority.

(d) Disclosure of information sought by the department of health and human services pursuant to its authority and obligations regarding public assistance under RSA 167.

(e) Disclosure sought by higher education loan corporations pursuant to the authority and obligations under RSA 195-E.

(f) The preparation, examination, handling, or maintenance of financial records by any officer, employee, or agent of a financial institution that has custody of the records.

(g) The examination of financial records by a certified public accountant while engaged by the financial institution to perform an independent audit.

(h) The disclosure of information to a collection agency, its employees or agents, or to any person engaged by the financial institution to assist in recovering an amount owed to the financial institution, if such disclosure is made in the furtherance of recovering such amount.

(i) The examination of financial records by, or the disclosure of financial records to, any officer, employee, or agent of a state or federal regulatory agency under authority of state or federal law for use only in the exercise of that person's duties as an officer, employee, or agent.

(j) The publication of information derived from financial records if the information cannot be identified to any particular customer, deposit, or account.

(k) The making of reports, disclosures, or returns required by federal or state laws.

(l) The disclosure of any information permitted to be disclosed under the laws governing dishonor of negotiable instruments.

(m) The exchange, in the regular course of business, of credit information between a financial institution and a credit reporting agency, provided such exchange is in compliance with the fair credit reporting act, RSA 359-B, and the federal Fair Credit Reporting Act, 15 U.S.C. section 1681 et. seq.

(n) The exchange, in the regular course of business, of information between a financial institution and a mercantile agency, provided such exchange is solely for the purpose of reporting to third parties on the credit rating or creditworthiness of any business, and is in compliance with the fair credit reporting act, RSA 359-B, and the federal Fair Credit Reporting Act, 15 U.S.C. section 1681 et. seq.

(o) The exchange of loan information that specifically affects a sale, foreclosure, or loan closing, provided such exchange is for the purpose of accomplishing such sale, foreclosure, or loan closing.

(p) The disclosure to civil or criminal law enforcement authorities for use in the exercise of such authority's duties, or the sharing of information, within an industry network, of suspected criminal activities.

(r) Disclosure requested pursuant to subpoena or civil investigative demand, provided that no disclosure shall be made until 10 days after the financial institution has notified the customer that financial information has been requested by subpoena or civil investigative demand. Such notice shall be served by first class mail to the customer at the most recent address known to the financial institution. The provisions of this chapter shall not apply where the subpoena or civil investigative demand is issued by or on behalf of a regulatory, criminal, or civil law enforcement agency.

(t) Disclosure of customer financial information among directors, officers, employees, or agents of affiliated financial institutions, provided that such disclosure is limited to information necessary or appropriate to the fulfillment of any such persons' duties and responsibilities to the financial institution or institutions to facilitate transactions or the delivery of services requested by a customer or otherwise necessary to provide services in connection with existing contractual or service relationships between a customer and a financial institution.

(u) Disclosure of customer financial information of one financial institution to another financial institution in connection with a proposed merger, consolidation, acquisition or other reorganization transaction involving such institution, provided that no further disclosure is made except in compliance with this chapter, and provided further that such disclosure is made in compliance with the fair credit reporting act, RSA 359-B, and the federal Fair Credit Reporting Act, 15 U.S.C. section 1681 et. seq.

(v) Disclosure sought by the department of revenue administration pursuant to its authority and obligations under RSA 21-J or by federal or other state taxing or revenue authorities.

(a) Require any financial institution to make any disclosure not otherwise required by law.

(b) Require or encourage any financial institution to alter any procedures or practices not inconsistent with this chapter.

383-A:4 Rulemaking. The bank commissioner may adopt rules, pursuant to RSA 541-A, relative to the administration and enforcement of this chapter.

I. In addition to any authority granted to the bank commissioner under this title, the bank commissioner may impose an administrative penalty of not less than $1,000 for each violation of this chapter resulting from willful conduct, or from a failure by a financial institution to reasonably supervise its employees to prevent violations of this chapter.

II. A customer of a financial institution whose customer information was negligently or willfully disclosed in violation of this chapter may recover in a civil action the actual damages and any attorneys' fees, provided that a customer prevailing in such an action shall be awarded not less than $1,000.