Learn more about the expanded rights available to Californians

Read the Decision

Wednesday, June 30, 2004

Shelley Curran or Gail Hillebrand: 415-431-6747


Judge Rules Federal Law Does Not Preempt California Statute
That Gives Consumers New Rights to Protect Financial Privacy

SACRAMENTO, CA – A U.S. District Court today upheld a landmark California privacy law that gives consumers new rights to limit how widely their personal financial information is shared among banks, insurance companies and other financial institutions. The new law, recognized as the strongest financial privacy statute in the country, is set to go into effect on Thursday, July 1.

“This is a major victory for California consumers who have made it clear that they want greater control over who has access to their personal financial information,” said Shelley Curran, Policy Analyst with Consumers Union’s West Coast Office. “Today’s ruling confirms what we’ve said all along – Congress never intended to prevent states from enacting stronger financial privacy protections than those provided by federal law.”

The lawsuit filed by the American Bankers Association, Financial Services Roundtable, and Consumer Bankers Association in the U.S. District Court in Sacramento challenged the provision of California’s law that restricts the sharing of customer information between financial institutions and their affiliates. In today’s decision, the court ruled in favor of the state’s argument that the federal Fair Credit and Reporting Act does not preempt states like California from enacting laws that give consumers the right to restrict affiliate information sharing.

Current federal law gives consumers very little control over how their personal information is used among financial institutions and their affiliates and leaves consumers vulnerable to identity theft, aggressive marketing practices and fraud. Some financial institutions have thousands of “affiliates” and routinely share with them such information as customers’ Social Security numbers, account balances, and spending habits without any restriction.

Under the California law, consumers will have the right to stop the sharing of their personal information by financial institutions with affiliates unless they meet very strict criteria. Consumers who object to such affiliate information sharing are given the right to “opt-out” under the California law. Financial institutions must get permission first before sharing or selling their customers’ private information with most outside companies (known as an “opt-in” right for consumers). The law imposes penalties of $2,500 per violation of the law, with a cap of $500,000 for negligent violations. There is no cap for knowing and willful violations of the law.

Financial institutions must inform consumers of these rights in a user-friendly and understandable form so they can more easily exercise their rights. Independent reviews of financial institution privacy notices have revealed that most current notices are written in complicated language that the average consumer finds difficult to understand. California’s law requires notices to be written in simple language and sent in envelopes that are marked “Important Privacy Notices.”

“Consumers can say goodbye to the confusing and incomprehensible privacy statements they receive from their banks and insurance companies that give them virtually no ability to stop the flow of their private financial information to others,” said Curran. “California’s new law gives consumers important new protections and imposes stiff penalties for businesses which fail to comply.”

The lawsuit challenging the California law was filed earlier this year despite the fact that many financial institutions represented by the trade associations signed off on the California law when it was enacted in 2003. At the time, financial industry lobbyists said the law represented a “reasonable and workable” compromise.

“We hope that today’s court ruling will persuade the financial industry to give up its legal challenge of this important new law,” said Curran. “It’s time for banks and insurance companies to start delivering these privacy protections instead of fighting them in court.”