U.S. PIRG Consumer Blog: US Judge Preempts Part of Landmark Cal Privacy Law SB1

Federal judge Morrison England has ruled, on remand from the Ninth Circuit, that the federal Fair Credit Reporting Act preempts the affiliate-sharing provisions of the landmark California financial privacy law SB1, so that SB1 can no longer give consumers the right to opt-out of the sharing of their confidential personal information among affiliated companies. California citizens are now subject to the same industry-approved weak federal privacy laws governing affiliate sharing (that is, virtually no rights at all) as citizens in other states. On the positive side, firms cannot share information about Californians with many third parties unless they convince the consumer to say yes (opt-in) to the sharing. That part of the stronger California law was not challenged.

Privacy expert Chris Hoofnagle of EPIC has posted the anti-privacy, anti-states' rights decision and more comment on his blog.

Some history:
The PIRG-backed law was championed by State Senator Jackie Speier (her page) for four years and was finally enacted as a compromise in 2003.

In return for the banks agreeing to no longer block final enactment of the law, CALPIRG, Consumers Union, AARP, the pro-privacy E-Loan Bank and others withdrew from filing an even stronger voter ballot petition on the very deadline for filing the hundreds of thousands of signatures we'd already collected. Of course, the banks that agreed to the negotiation then looked the other way when the American Bankers Association (ABA) and their other trade associations then filed suit against California Attorney General Bill Lockyer to overturn the law. EPIC's ABA v. Lockyer page lists the history of the litigation. [Judge England originally allowed SB1 to take effect, then was partially reversed and ordered to review the case again by the Ninth Circuit, US Court of Appeals. Today's decision holds that the bank-friendly and anti-stronger state law Fair Credit Reporting Act (FCRA) trumps the pro-stronger state law Gramm-Leach-Bliley Act (GLBA).]

The federal GLBA and FCRA grant consumers virtually no rights to prevent the sharing of confidential information. The 1999 Gramm-Leach-Bliley Act states that information can be shared with affiliates and many third parties regardless of a consumer's preference; only information sharing with other third parties (primarily telemarketers) is subject to a weak opt-out under GLBA, which also gave states the right to enact stronger privacy laws. An as yet unimplemented provision -- rife with loopholes -- of comprehensive 2003 FCRA amendments would give consumers a right, not to fully opt-out of affiliate sharing for all secondary purposes, but merely to opt-out of certain but not all marketing uses of the information after it has already been shared. The banks are fighting back during the rulemaking process to weaken even this modest provision so that it provides virtually no rights.

On the other hand, SB1 had created an opt-out right for affiliate sharing (subject to some exceptions) where federal law had no right at all. It also took third party transactions subject to the weak federal opt-out right and strengthened that right to an opt-in.

In detail, SB 1 established a consumer right to say no, or opt-out, of the sharing of their confidential account and personal information by financial firms (banks, insurance companies, brokerages, etc) with their affiliates, for any secondary purpose (such as marketing or profiling) not related to their account transactions. [Some sharing with "like" affiliates was not subject to the opt-out; further, some third parties selling products in the name of the firm were treated like affiliates, not third parties, and subject only to the opt-out.]

Under SB1, before a bank shares information with other third parties, it must gain a consumer's affirmative consent (says yes or opts-in). This provision was not preempted and is still in force. We'll have more as we analyze the decision further.