Financial privacy laws regulate the manner in which financial institutions handle the nonpublic financial information of consumers. In the United States, financial privacy is regulated through laws enacted at the federal and state level. Federal regulations are primarily represented by the Bank Secrecy Act, Right to Financial Privacy Act, the Gramm-Leach-Bliley Act, and the Fair Credit Reporting Act. Provisions within other laws like the Credit and Debit Card Receipt Clarification Act of 2007 as well as the Electronic Funds Transfer Act also contribute to financial privacy in the United States. State regulations vary from state to state. While each state approaches financial privacy differently, they mostly draw from federal laws and provide more stringent outlines and definitions. Government agencies like the Consumer Financial Protection Bureau and the Federal Trade Commission provide enforcement for financial privacy regulations.
Federal laws
Right to Financial Privacy Act The Right to Financial Privacy Act of 1978 (RFPA) was passed in 1978 primarily as a response to the Supreme Court ruling on United States v. Miller 1976 and to supplement the Bank Secrecy Act. The act was put in place to limit the government's ability to freely access nonpublic financial records. The RFPA defines financial institutions as any institution that engages in activities regarding banking, credit cards, and consumer finance. It also defines financial records as any documentation of a consumer's relationship with a financial institution. The act required that the U.S. government deliver a legal notice to a customer or receive consent from a customer before they can legally access their financial information. Customers must also be informed that they have the ability to challenge the government when the government is actively trying to access their financial information. In the event that the government successfully gains access to a customer's information, the government is not allowed to transfer the information between government agencies without clarifying that the information in question is being used in the name of law enforcement. The customer must be notified immediately if conditions are met and their information is going to be transferred between agencies.
The Right to Financial Privacy Act included many exceptions to expedite federal investigations. Federal agencies can access any financial records if the records in question are connected to a law enforcement investigation. The act also gives any government department or agency the ability to request access to a customer's information.
The government can access financial records through six exceptions:
Grand jury subpoena Customer authorization giving consent Administrative summons Search warrant issued under the Federal Rules of Criminal Procedure Judicial subpoena Formal written request
Any preexisting rules regarding search warrants are applied to the exceptions. When a search warrant for a customer's financial information is issued, the government has 90 days to inform the customer of the existence of the search warrant. A consumer can give permission to the government through written approval which allows the government access for a maximum of three months. At any given time, the consumer can void the approval. If the government is given access via approval, the financial institution holding the information must document which government agencies are given access. In the event that financial records are requested using an administrative summons, a judicial subpoena, or a formal written request, the government must notify the customer of what specific records are being requested, why they are being requested, and the procedures used to access the records. Financial institutions must verify that all laws, regulations, and procedures were followed before any financial records that were requested can be handed over to federal agencies.
The RFPA was later amended to increase financial institutions' ability to help facilitate criminal investigations and prosecutions. Under the new amendments, financial institutions are allowed to disclose information to the government if they believe that a regulation has been violated. If an institution decides to share a customer's financial information this way, then the institution is only allowed to disclose information that identifies the suspect. The institution will also not be held liable for disclosing the information. The amendments also states that a court can compel a financial institution to notify a customer that their information has been subpoenaed.
Criticisms Criticism has been directed at the written approval. The act never specifies if the customer is responsible for submitting the approval directly to the financial institution or if the government is responsible for only providing proof that a written approval has been submitted to them.
Gramm-Leach-Bliley Act The Gramm–Leach–Bliley Act (GLBA) was enacted in 1999 to repeal the Glass–Steagall Act. The repeal of Glass-Steagall allowed mergers between different types of financial institutions to occur, which enabled increased efficiency in the dissemination of financial information. To promote consumer privacy, the Gramm-Leach-Bliley Act included regulations to limit the ways in which companies handled and shared financial data.
Protection of information is generally elaborated through three set rules in the act:
Financial institutions must create privacy policies, if one was not already in place, and inform customers of their policy Financial institutions must specifically disclose to customers the conditions in which policy exceptions would allow financial information to be distributed to unaffiliated third parties Financial institutions must give customers an "opt-out" option to allow customers the ability to prevent private information to be disclosed
Despite the regulations put forth by GLBA, exceptions in the act allow financial institutions the ability to disclose financial information under certain conditions. If a financial product provided by a financial institution is owned by two or more parties, the institution is only required to notify one party. Financial institutions are also allowed to disclose information without ever notifying the customer if the information in question is used for an investigation regarding public safety.
Safeguards Rule The Safeguards Rule was implemented into GLBA by the Federal Trade Commission (FTC) to set standards that financial institutions must follow when protecting financial information. The rule required that financial institutions create and implement a security program that is appropriate to the size of the institutions' operations. The program must keep information safe from any unauthorized access of information, unauthorized use of information, and threats to the safety of the information. Information systems that processes, stores, transmits, and destroys information must be used in the security program. The rule also states that institutions must dedicate employees to the development, implementation, and maintenance of the security program. There must be people trained to identity and respond to any security threats or data breaches.
Criticisms The Gramm-Leach-Bliley Act has been the subject of much criticism as experts claim that the act provides weak protection due to its broad language. Without clear explanation and better defined language, the act is open to interpretation which will ultimately work against consumers. The privacy policies required by the act are also unhelpful, as many of the policies written by financial institutions are intentionally complex to prevent customer comprehension. There is also a lack of rules that punish financial institutions for any noncompliance. Criticism has also been targeted at the opt-out rule in the act. Former president of the Federal Reserve Bank of Richmond, Jeffrey M. Lacker argues that the opt-out option, provided by banks in their policies to customers, is ineffective due to a weak marketplace for financial information. Sharing financial information is not profitable enough to motivate financial institutions to pay for customer consent, so opt-out notifications are rarely distributed. In situations where customers are notified, only an estimated 5% respond. The low response rate is evidence that consumers do not seem to care about their financial privacy. With unconcerned customers and a weak market, the opt-out option is rendered ineffective.
Fair Credit Reporting Act The Fair Credit Reporting Act (FCRA) was passed in 1970 to regulate credit agencies and promote fair and secure handling of consumer information.
The FCRA attempts to limit the dissemination of information through five main rules:
Credit reports and investigative reports must be differentiated so that any irrelevant is not mixed Reports can only be made available to those with "legitimate business needs" The subject of a report must be notified of any request for their information Agencies must give consumers access to their own files if they ever should request it A time limit is set for the retention of information on reports. Information that is seven years or older must be deleted while information regarding bankruptcies can be removed only after fourteen years
According to the FCRA, obsolete information may not be investigated and included on reports. Information found in reports can be contested in the event that a mistake is found. The credit agency must begin an investigation, and if a mistake is proven to exist, the information must be removed immediately. If a consumer if affected by the contents of their report, the user of the report must notify the consumer so that he or she can access their file and receive an explanation of the contents of their file from the agency. The FCRA also includes the Red Flag Rule, which was added by the Fair and Accurate Credit Transactions Act. A Change of Address Rule is also set in place so that government financial agencies must verify change of addresses.
The FRCA includes multiple measures to promote compliance. The act states that unauthorized access to a file or receiving a report under false pretext will result in a criminal offense. Reporting agencies and those using the reports are held liable for any noncompliance as well. The consumer is also entitled to reparations as a result of any damages from any misuse of their information.
Criticisms The Fair Credit Reporting Act faced criticism over the strength of its regulations as the act only limits the distribution of information instead of the collection of it. The act is also written with broad language which invites open interpretation that may lead to loopholes. Some criticism has also been directly aimed at the vagueness in defining "accuracy." In the context of the act, "accuracy" can be interpreted as a credit report that is either correct or incomplete.
Fair and Accurate Credit Transactions Act The Fair and Accurate Credit Transactions Act (FACTA) was passed by Congress in 2003 to amend the Fair Credit Reporting Act (FCRA). The amendments ensured that any state laws with stricter regulations than those outlined in the FCRA would be enforced first. State laws regarding credit scores, credit reports, and insurance that were to remain in effect as a result of the amendments were outlined within the act. Under the act, consumers received more rights to explanations of their credit scores and the right to a free credit report each year.
The Disposal Rule