Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act

Data Minimization: Financial institutions will be required to limit the collection or disclosure of nonpublic personal information to what is adequate, relevant, and reasonably necessary for a specific purpose (Section 102).

Enhanced Opt-Out Rights: Consumers gain the ability to exercise their right to opt out of data sharing at any time after the initial disclosure (Section 103).

Increased Transparency for Access Credentials: Financial data aggregators and third parties must provide clear disclosures regarding how they use access credentials, the associated privacy risks, and their security practices (Section 104).

More Detailed Consumer Notices: Notices provided to consumers will include specific information such as categories of purposes for data collection, data retention practices, and the use of artificial intelligence (Section 105).

Right to Access and Delete Information: Customers and former customers can request that a financial institution disclose their nonpublic personal information or delete it (Section 107).

Protection for Sensitive Information: Financial institutions are required to obtain explicit consumer consent before collecting or disclosing sensitive nonpublic personal information, such as racial or ethnic origin or precise geolocation data (Section 108).

Costs for Former Customers: While a consumer can make two requests for information or deletion free of charge, any subsequent requests may require the consumer to pay a fee (Section 107).

Regulatory Burden on Small Institutions: While the law requires regulators to consider the limitations of small institutions, the new requirements for data minimization, updated notices, and handling deletion requests still place new obligations on financial institutions (Section 201).