; and (B) not be presumed to have given up such a legitimate expectation of privacy on the basis of the third-party doctrine articulated by the Supreme Court in United States v. Miller (1976). (4) Data privacy Data obtained by a covered bank— (A) may not be sold to third parties, except consumer reporting agencies; (B) that is shared with a third party by the covered bank, shall maintain an assumed right of privacy; (C) with respect to lending data, may only be shared with— (i) Federal, State, or Tribal agencies; or (ii) a third party that is a consumer reporting agency under the Fair Credit Reporting Act and is in compliance with such Act; and (D) with respect to account data, may only be accessed by appropriate warrant or administrative search subpoena. (5) Metadata A covered bank— (A) may not share metadata with private or for-profit third parties