Landmark Ruling: Judge Says Customers Own Data

Financial institutions may not sell customers’ personal information without their consent, a federal judge has ruled.

U.S. District Judge Ellen Segal Huvelle has upheld federal regulations barring banks, insurance companies, credit card issuers and other financial organizations from selling the data. The data includes consumers’ names, addresses, Social Security numbers and phone numbers that they provide as they take routine actions such as open checking accounts or applying for credit cards.

In her decision, the judge said that consumers control their own names and addresses, and that their not being in control of their data can be harmful, said Marty Abrams, executive director of the Center for Information Policy Leadership at the law firm of Hunton & Williams, Atlanta.

“Direct marketing has never been considered a harmful use of information,” Abrams said. “And suddenly this judge is saying that not having control of your name and address can be defined as harm and that opens a Pandora’s box in terms of freedom to communicate with folks who might be your prospects.”

The court rejected a challenge to the regulations by a credit bureau trade association.

The trade association, Individual Reference Services Group (IRSG), whose members include Trans Union LLC and Equifax Inc., said that federal agencies overstepped their authority in issuing the regulations last year.

The privacy regulations were promulgated by the Federal Trade Commission and federal banking regulatory agencies. Congress mandated the protections when it passed the Gramm-Leach-Bliley Act, which modernized banking laws in 1999. The Act requires banks and other financial firms to disclose to customers how their personal information is collected, protected and used.

As a result of the judge’s ruling this week, credit bureaus may have to get customers’ consent before they can sell “credit headers”–personally identifiable information at the top of a credit report.

Credit bureaus also have to give customers the ability to block the sale or transfer of some personal information to third parties, such as marketing firms, according to reports.

The judge ruled on April 30, but the decision was not released until Monday.