San Antonio Express-News
April 29, 2003

Beware of Credit Email

copyright 2003, Paul Premack

The Email you received was started by a well-intentioned individual who misunderstood the law. While it is not a scam, it is also not accurate. You should not forward the message to all your acquaintances.

According to the Privacy Rights Clearinghouse, the author of the Email confused two separate federal laws. First, the Financial Services Modernization Act (FSMA) required financial institutions to notify all customers of their internal privacy policies by July 1, 2002. You probably recall the barrage of privacy notices you received last year. FSMA required any financial institution that wants to release your customer data to third parties to provide you the opportunity to opt-out of the release. Note that this all took place last year (2002) and is not something coming up this summer.

Second, the Fair Credit Reporting Act (FCRA) was modified in 1996 to require credit bureaus – the four major ones are Trans Union, Experience, Equifax, and ANOVA – to allow an opt-out for consumers who do not want their name and address released for pre-approved credit card solicitations. I wrote about your option to opt-out of credit card solicitation under FCRA in April, 2002. A call to 888-5OPTOUT (888-567-8688) will take you off that pre-approved credit card solicitation list.

The email wrongly related those two federal laws. The above 888 number is limited to the pre-approved credit card opt-out; it has nothing to do with the FSMA notices, nothing to do with the July 1, 2002 date, and nothing to do with your financial institution releasing your private data.

Even thought the email analyzed the law incorrectly, the point is well taken: hardly anyone wants private information to be released without their knowledge and consent. Sadly, Congress was not on the side of confidentiality when FSMA was passed. According to the US Public Interest Research Group’s analysis of FSMA, your bank, broker, insurance company, mortgage company and others can share all your "experience and transaction information" with any of their affiliates, without your permission. The law only gave you a limited right to opt-out of information sharing with non-affiliated third parties, such as some telemarketers.

According to the Federal Trade Commission, if you did not opt out the first time you received a privacy notice from your financial institution, you can still act. The FTC advises you to contact your financial institution for instructions on how to opt out of future information releases. If the institution only releases information to its affiliates, there is nothing for you to opt out of. But if the company releases information to third parties, you can legally block future releases. Any of your personal financial information that has already been given out cannot be recovered.