Customers, regulators and even industry experts were surprised to discover this month that several large California banks have been sharing private customer information with third-party companies and telemarketers.
State and federal officials have questioned the policies and Congress is considering rewriting the laws that govern release of personal financial information. In the last two weeks, several banks have revised their privacy policies or halted the release of sensitive information.
Questions remain about why banks released the information in the first place and how consumers can protect their privacy in the future. Here are the answers to frequently asked questions about these policies:
Question: How can banks do this? Isn't it illegal?
Answer: State and federal laws are unclear on this issue, probably because legislators never envisioned that banks would ever sell or release this kind of information to marketing firms.
For example, credit card companies headquartered in California that want to share customer information must provide written notice to cardholders, but there's no similar law regarding banks, according to Gene Elerding, an attorney specializing in bank regulation at Manatt, Phelps & Phillips.
The state Constitution includes a right to privacy in financial affairs, and that protection has been interpreted by courts to include bank records, Elerding added. But a court would need to decide whether the banks' information-sharing practices violate those protections.
In Minnesota, state attorneys are claiming that U.S. Bancorp information-sharing violated state laws against deceptive business practices. The bank denies the accusations. Again, a judge will decide.
In California, a lawsuit has been filed in San Francisco Superior Court against Bank of America, Wells Fargo and Union Bank, alleging privacy violations and deceptive business practices. The banks denied that their practices violate state or federal laws. Los Angeles-based law firm Mehrban, Ghalchi & Yeroushalmi hopes to organize a class-action suit against the banks.
Q: What about federal laws?
A: Nothing in the federal Fair Credit Reporting Act prohibits banks from sharing information with third parties, as long as the information they release was gathered from the bank's own experience with that customer, according to John Byrne, senior counsel at the American Bankers Assn.
In other words, banks can share information such as account balances or payment history, Byrne said.
The act is far more restrictive when it comes to sharing information that a bank receives from an outside source, such as a credit report. As a result, banks avoid releasing that sort of information to third parties, Byrne said. In some cases, banks may share that outside information with their own affiliates, but if they do, they must get permission from the customer and offer a chance to "opt out."
Another federal law that might apply is the Electronic Fund Transfer Act, which requires banks to give notice to consumers when disclosing certain information to third parties.
Q: I never received disclosure about this. How could the bank release my information?
A: Check your original account agreement. You'll probably find some language about disclosing or sharing information with affiliates or third parties. Some banks also include disclosures in monthly statements. Remember, in most cases banks don't need to get your permission; they just need to disclose the practice.
Q: Is there any way I can stop my information from being disclosed?
A: Yes. Most banks offer the chance to opt out of information-sharing with third-party companies and affiliates. You might have to make separate requests for each type of opt-out. Some banks also require that you opt out separately for each type of account you have, such as your checking account, mortgage and credit card. (See accompanying box.)
Q: Are there drawbacks to opting out?
A: Maybe. If you opt out, you won't receive as many offers. That may cut down on your junk mail, but it might also prevent you from getting offers you want.
Q: If I opt out, does that mean my information will never be shared or released to third parties?
A: No. Banks will still release information when required by law, to credit-reporting agencies, or to outside companies or agents that provide services to the bank, such as a company that prints checks or processes credit card transactions.
Q: How long have banks been doing this?
A: Banks have worked with marketing firms for years, but disclosing or selling information to third parties is fairly new.
In the past, banks simply allowed marketing firms to stuff their offers into bank statements. But over the last two years, information-sharing has become more common.