The Perils of Privacy
Deborah Thoren-Peden · ABA banking journal · 1999
The U.S. Bancorp settlement got a lot of people's attention, not least a group of state attorneys general. Here's what you should know and do in response Privacy is one of the hottest issues today. If anything, the new financial modernization law will make it even hotter because it imposes relatively modest restrictions on the use of customer data. Consumers are legitimately concerned about the potential release of their information to others. Businesses, including banks, are aware of the importance of customer data to their continued existence, as their ability to provide innovative products and services to customers is directly linked to data mining. Yet the sharing of customer data with others can be fraught with danger, and banks must be extremely careful about how and when they share such data. Recently, much press has been given to the sale by banks of personally identifiable customer data to third parties. In June, 1999 the Attorney General of Minnesota brought a suit against U.S. Bancorp for alleged violations of the Fair Credit Reporting Act, the Electronic Fund Transfer Act, Regulation E, National Automated Clearing House Association's (NACHA) Operating Rules, Minnesota's Prevention of Consumer Fraud Act, Minnesota's False Advertising Act, and Minnesota's Deceptive Trade Practices Act. The lawsuit alleged the Bank had sold its customer's private, confidential information to MemberWorks, Inc., a telemarketing company, for $4 million plus commissions of 22% of net revenue on sales made by MemberWorks. The information released to MemberWorks allegedly included the following: name, address, telephone numbers, checking account numbers, Social Security numbers, date of birth, account status and frequency of use, gender, marital status, homeowner, occupation, date account was opened, average account balance, year-to-date finance charges for credit card accounts, behavior score, bankruptcy score, credit insurance status, and last credit card purchase information. Allegedly MemberWorks used this confidential information to market membership service programs to consumers. According to the complaint, the Bank's customers were not advised of the extent and types of information being provided to telemarketers like MemberWorks and the Bank had approved the use of deceptive and misleading telemarketing practices. In response to the filing of the complaint, U.S. Bancorp voluntarily ended contracts with firms that marketed nonfinancial products to its customers. This decision to stop the practice in turn led to settlement approximately three weeks after the lawsuit had been filed. The Attorney General who had filed the suit commended the Bank for settling the case so quickly. U.S. Bancorp, which did not admit the allegations, settled the matter by agreeing to give certain charities $2.5 million and to reimburse the state of Minnesota for the costs of its investigation and lawsuit, in an amount of $500,000. The media coverage of the U.S. Bancorp matter triggered similar inquiries of other banks, which in turn has triggered additional lawsuits. In July 1999, a class action lawsuit was filed against a number of banks in California. The lawsuit alleges that the defendant banks have sold certain personally identifiable information to third parties. The plaintiffs allege, on information and belief, that defendant banks failed to inform their customers of the extent and type of information provided to third parties, and that this concealment has created an expectation that bank customers have a right to financial privacy at the defendant banks. The plaintiffs are suing the banks for invasion of privacy, violations of the Electronic Fund Transfer Act, and California's Business and Professions Code, which prohibits unfair and illegal practices and unfair competition. What attorneys general want Perhaps of greater concern to banks around the country are the inquiries that have been initiated by a number of State Attorneys General. …