Private information might not
be so private under new law
By Holden Lewis • Bankrate.com

The proposed legislation would affect the way banks, insurance companies and investment brokers can use private information about you.

Already, many banks sell information about their customers to businesses that sell everything from health-club memberships to Caribbean cruises. When banks, brokerages and insurance companies combine, they find it easier to share information internally.

Such a free flow of information could have mixed results.

Tailored information
Industry executives boast that they'll be able to use the information to tailor products to suit your needs. For example, a related bank and life-insurance company could trade data about you to offer varieties of insurance and investments as your needs change over the years, from your first job until retirement. You might end up more prosperous and secure as a result.

But consumer advocates spy a dark cloud behind that silver lining. They worry that the law would make it easier for businesses to deny insurance or to sell investments to people who don't understand the financial risks.

Here's a scenario: A bank and an insurance company are owned by the same conglomerate. The bank denies a mortgage to a customer because the insurance company tells the bank that the mortgage applicant has health problems and probably won't live long enough to pay off the loan.

Mindful of this possibility, Rep. Jim Leach, R-Iowa, wanted to make it illegal to share medical records in such a way. But the reference to medical information was deleted under pressure from the White House. Congressional leaders say they plan to address medical privacy in separate legislation.

Another scenario: A bank and a brokerage share the same owner, and the bank regularly gives the brokerage a list of customers whose insured certificates of deposit are about to mature. What if the brokerage uses that information to sell uninsured mutual funds to unsophisticated customers, persuading them to trade safe savings for riskier investments?

Letting the market decide
Sen. Phil Gramm, R-Texas, says that the market, not the government, should settle these issues. He wanted to require banks to disclose how customer data are used, but to place few limits on the use of the information. Knowledge of a company's privacy policies is power, he says: "I don't have to do banking with you if I don't like your policy."

Faced with a veto threat, Gramm and his fellow Republicans compromised. They came up with language requiring financial institutions to disclose their privacy policies and to allow customers to "opt out" of data-sharing with outside companies selling nonfinancial products.

This means a couple of things: you can tell your bank or insurance company not to sell information about you to telemarketers selling non-financial products such as magazine subscriptions or exercise equipment. But a company can sell your personal data to a business selling financial products -- without giving you a say in the matter.

For example, a conglomerate can share data among its operations -- banks, securities firms, insurance companies -- without letting customers opt out. Or a small bank -- one that isn't part of a conglomerate -- can sell your information to, say, an insurance company, without giving you the chance to opt out.

They can sell your personal information to companies marketing non-financial products unless you tell them not to.

On the other hand, they can't sell your personal information to companies marketing nonfinancial products such as health-club memberships.

Basically, the legislation says that if you don't like your bank's or insurance company's privacy policies, go and find a company whose policy you prefer -- and hope the policy doesn't change. And at the last minute, a loophole was added, one that deals with "private label" credit cards. In a private label arrangement, a retailer sponsors a credit card issued and serviced by another company.

Under the new law, the retailer doesn't have to tell you its privacy policy and doesn't have to give you the option of opting out of information sharing. What does this mean? Say you have a Wal-Mart MasterCard from Chase. The card issuer, Chase, could inform the card sponsor, Wal-Mart, about your purchases. This information could be valuable.

Theoretically, if you used the card to buy a circular saw and electric drill at Sears, you could get mail and phone calls from Wal-Mart informing you about special deals on building supplies. Wal-Mart and Chase would have the option of informing you of their data-sharing or not. Likewise, they could let you block the data-sharing or not. There are scores of private-label credit cards, issued by the likes of Chase and GE Capital and sponsored by retailers such as Wal-Mart and Exxon.

The 'opt-in' option is out
Consumer advocacy groups such as the Consumers Union, the Public Interest Research Group and the Consumer Federation of America lobbied unsuccessfully to craft the law so that consumers could "opt in" to information sharing. Under that option, businesses wouldn't be able to share any information unless the consumer consented.

Business groups say the economy could be crippled if the law allowed consumers to halt the flow of information that way.

Businesses point out that they share consumers' data all the time. For example, banks have to provide your name, address and checking-account number to check printers, and businesses report your payment history to credit bureaus. What would businesses do if they had to ask permission every time they wanted to trade routine information?

The business argument won the day in Congress. As a backup position, Consumers Union, PIRG and Consumer Federation of America lobbied Congress to allow consumers to opt out of all information sharing.

"Consumers should be told how their personal financial information is being used and given the option of telling the institution not to use their data," the consumer groups wrote in a letter to Congress.

State attorneys general got into the action in September, when the National Association of Attorneys General said portions of the House bill "specifically allow practices that will further erode the rights of consumers to exercise some degree of control over their financial and medical records."

But by that time, congressional committees had shot down the opt-in option.

-- Posted: Oct. 15, 1999