BLOG

Question: I heard that there are state privacy laws going into effect in 2023 in Colorado, Connecticut, Utah, and Virginia. What does this mean for mortgage lenders operating in these states?

Answer: Each state’s privacy statute exempts financial institutions subject to the Gramm-Leach-Bliley Act (GLBA).  As such, since mortgage lenders are subject to the GLBA, they are exempt.  Below, please find a reference to each applicable statutory exemption:

Colorado Consumer Privacy Act (CPA) - SB 190 § 6-1-1304(2)(j)(II)

This part 13 does not apply to: Collected, processed, sold, or disclosed pursuant to the federal “Gramm-Leach-Bliley Act” U.S.C. SEC. 6801 et seq., as amended and implanting regulations, if the collection, processing, sale or disclosure is in compliance with that law.

Connecticut Data Privacy Act (CTDPA) - SB 6 § 3(a)

The provisions of sections 1 to 178 11, inclusive, of this act do not apply to any: financial institution or data subject to Title V of 184 the Gramm-Leach-Bliley Act, 15 USC 6801 et seq.

Utah Consumer Privacy Act (UCPA) - SB 227 § 13-61-102(2)(k)

This chapter does not apply to a financial institution or an affiliate of a financial institution governed by, or personal data collected, processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. Sec. 6801 et seq., and related regulations.

Virginia Consumer Data Protection Act (VCDPA) - § 59.1-576

This chapter shall not apply to any financial institution or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.).