Financial Privacy

Posted: Dec 01 2000  | Revised: Oct 25 2018

  1. Introduction
  2. Privacy Notices
  3. How Your Financial Institution Shares Your Data
  4. Joint Marketing Agreements
  5. Service Providers
  6. Financial Privacy in California
  7. File a Complaint

1. Introduction

The Gramm-Leach-Bliley Act (GLB) (15 U.S.C. §§ 6801-6809) (also known as the Financial Services Modernization Act of 1999) requires your financial institution to provide you with a privacy notice.  The privacy notice must describe three things:

  • Privacy Policy:  Your financial institution must tell you the kinds of information it collects about you and how it uses that information.
  • Right to Opt Out: Your financial institution must explain your ability to prevent the sharing of your customer data with third parties.
  • Safeguards: Your financial institution must disclose how its safeguards for preventing unauthorized access to your confidential financial information.

GLB gives you the right to opt-out of certain types of information sharing.  Your data can be shared with third parties unless you opt out.

 

2. Privacy Notices

Which financial institutions must provide me with a privacy notice?

You should receive a privacy notice from any companies that offer financial products or services to individuals. This includes your bank, credit card issuers, payday loan companies, mortgage brokers, insurance companies, investment companies and investment advisors.

 

Will the privacy notice say exactly what information about me can be disclosed?

You will get notice of the categories of information the financial institution collects and the categories of information that may be sold or shared with a third party. The privacy notice must give you specific examples of each category, but this is by no means a complete list of the data that may be disclosed.

 

My financial institution's privacy notice does not give me an opt out. Am I missing something?

Perhaps their privacy policy says it does not share information with third-party companies.  If a company does not share your information with third parties or if the company does not have affiliates, the privacy notice should explain this.

 

Do I have only one chance to opt out?

If you are a customer with a continuing relationship with the company, your right to opt out is continuing. If you fail to opt out, your financial institution may sell or share your personal data after a "reasonable" time. If you later decide you want to keep your financial institution from disclosing your personal data, you always have the right to opt out. It goes without saying, however, that information that is disclosed before you opt out is already "out there." You can't bring it back.

 

What are model privacy notices?

Most financial institutions have chosen to use a model privacy notice.  The model notice is a two-page disclosure form designed to allow consumers to compare the privacy practices of different financial institutions.  Use of the model privacy form is voluntary.  A financial institution that properly uses the model privacy notice will be considered to be in compliance with the disclosure requirements for privacy notices under GLB. 

 

3. How Your Financial Institution Shares Your Data

What kinds of companies can get my personal information?

The privacy notice you receive from financial institutions does not have to tell you the names of any specific companies or organizations that may buy or receive your personal information. Only the categories of companies have to be disclosed to you.

 

The relationship between your company and the company that receives your information determines if you have a right to opt out, that is to stop the information flow. Your financial institution may have relationships with the following categories of companies:

  • Third party nonaffiliated (outside) companies
  • Affiliated companies
  • Joint marketing companies
  • Service providers
     

GLB only gives you the right to opt out when it comes to third-party nonaffiliated (outside) companies.

 

What is a third party nonaffiliate?

It means a company that is not owned or controlled by the company you're doing business with. For example, your bank's privacy notice may say it shares your personal information with third party nonaffiliates. The notice may go on to identify one such category as "financial services providers."  An example could be an insurance company that is not affiliated with your bank.

 

Other categories of nonaffiliated companies that could receive your information might be identified in the privacy notice as "non-financial service providers" such as retailers, direct marketers, telemarketers, or "other companies" like nonprofit organizations. Remember, if the company sells customer data to third party nonaffiliates, it must give you the right to opt out.

 

What is an affiliate?

Large companies often have many separate companies that do business under the corporate umbrella. Although each company operates separately, it is still under the control of the parent corporation. Your bank's affiliates, for example, might include other financial companies such as a credit card company, a brokerage firm, a mortgage company, an insurance company, or an automobile financing company. Affiliates may also include nonfinancial companies such as auto parts or repair companies.  

 

Can I stop my financial company from sharing my personal information with its affiliates?

Under GLB, a company can share your personal information with its affiliates. However, the notice you receive is also likely to explain your right to opt out under another law, the federal Fair Credit Reporting Act (FCRA). This law gives you the right to prevent a company from sharing information about your "creditworthiness" with affiliates. This includes information such as the amount and source of your income, your debt level, and your history of paying bills on time.

 

Your "transaction and experience" information can still be shared with affiliates without your consent.  This information encompasses account activity like deposits, withdrawals, debits, and credits. Also included in this category are specifics such as what you buy, where you buy it, and how much you pay. This is valuable information, particularly when a company wants to sell you every variety of its financial products. 

 

4. Joint Marketing Agreements

When your information is disclosed under a contract between your financial institution and a joint marketer, this is called a "joint marketing agreement." You have no right to know any details about these joint marketing agreements, and you have no say in the information flow under these contracts.

 

What is a joint marketer?

A joint marketer is a company that contracts with another company to sell you financial services or products. Information can be freely shared under such contracts. GLB requires that such contracts be for the purpose of marketing financial products or services. The law does not enable you to say "no" to sharing your information under these marketing agreements.

 

How does joint marketing weaken my right to opt out?

Joint marketing agreements are entered into by third-party, non-related companies. But for GLB's joint marketing loophole, you could stop this data sharing by simply opting out. Consider the expansive definition of a financial "service or product" and companies that fall under the "financial institution" heading. A financial institution is not just companies like banks, brokerage houses, and insurance companies. Payday lenders, mortgage brokers and automobile dealers are also "financial institutions." Joint marketing agreements thus open the door for data sharing among an array of third-party nonaffiliated companies.

 

5. Service Providers

A "service provider" is a company that contracts with your bank to service your account or process your transactions.  Many financial institutions contract with other companies to perform some service, such as printing or mailing statements.  GLB gives you no control or right to opt-out when your financial institution shares your information with service providers.

 

Personal data necessary to perform accounting functions, operate customer call centers, and process transactions are now routinely sent offshore. Personal data at stake includes any information you would give your bank. For example, your name, Social Security number, and account numbers are all data items needed to "service" your account.

 

6. Financial Privacy in California

California's Financial Information Privacy Act (known as FIPA or SB 1) (Cal. Financial Code §§ 4050-4060) exists specifically to offer privacy protections that GLB lacks.   FIPA provides more protection than GLB, but it does not prevent financial institutions from sharing your personal information with affiliates.  FIPA provides that:

  • A financial institution must notify you and obtain your consent to share information with unaffiliated businesses (a business is unaffiliated when it is not under the control of the same company). (Cal. Financial Code § 4052.5)
  • You can opt out of information sharing that results from joint-marketing agreements that a financial institution makes with outside companies to market financial products and services. (Cal. Financial Code § 4053(a)(1))

7. File a Complaint

Where to Complain:

To report violations of the federal Gramm-Leach-Bliley Act:

Consumer Financial Protection Bureau
        Phone:  (855) 411-CFPB (2372)

To report violations of California's Financial Information Privacy Act, contact the appropriate state agency: