Guidelines for Use, Access, and Responsible Disclosure of Financial Data Act

On April 21, 2026, Rep. Huizenga (R-MI) introduced HR 8398, the GUARD Financial Data Act, which was referred to the House Committee on Financial Services. The bill amends the Gramm-Leach-Bliley Act to require financial institutions to limit collection and disclosure of nonpublic personal information to what is adequate, relevant, and reasonably necessary (data minimization). It also mandates opt-in consent for sensitive nonpublic personal information, establishes consumer rights to request deletion of data, and requires regulators to consider small financial institutions when writing rules. The bill has 4 cosponsors (all Republicans) and is in early stage — no hearings, markup, or floor votes scheduled. The bill authorizes zero dollars — it is a regulatory mandate, not a spending bill. The money trail runs through compliance costs for financial institutions and revenue opportunities for technology vendors that sell data governance, consent management, and core banking platforms. There is no appropriation; if enacted, the Federal Reserve, CFPB, FTC, and state insurance regulators would write implementing rules, with costs borne by the private sector. Structural winners are compliance software vendors: FIS and JKHY serve the banking and credit union market and can embed new GLBA requirements into their platforms, driving upgrade cycles and professional services revenue. Palantir (PLTR) faces a mixed impact — its Foundry platform could see reduced data availability from financial clients, but its Gotham/government compliance tools could see demand if financial institutions adopt Palantir for data governance. Larger diversified tech firms (MSFT, ORCL) have financial services cloud businesses but the bill's impact is too diffuse to materially affect their revenue. No real market data was provided for stock prices. The competitive landscape shows FIS and JKHY as dominant vendors to US banks and credit unions, with established relationships and recurring revenue models. Both have compliance and risk management product lines that directly address the bill's requirements. The legislative timeline is uncertain. The bill is in the 119th Congress (2025-2027) and has only been referred to committee. It must pass the House Financial Services Committee, the full House, the Senate (likely via Banking Committee), and be signed by the President. With 4 Republican cosponsors and no Democratic support yet, passage is not guaranteed. The bill's early stage and lack of bipartisan sponsorship suggest a low probability of enactment in the current session, though it could serve as a marker for future financial data privacy legislation.