Financial Institutions Use Information Resellers for Eligibility Determinations, Fraud Prevention, PATRIOT Act Compliance, and Marketing

Financial institutions in the banking, credit card, securities, and insurance  industries use personal data purchased from information resellers  primarily to help make eligibility determinations, comply with legal  requirements, prevent fraud, and market their products. Consumer Reports Sold by Credit Bureaus and Other CRAs Are Used to Make Credit and Insurance Eligibility Decisions

Banks, credit card companies, and other lenders rely on credit reports sold  by the three nationwide credit bureaus—Equifax, Experian, and  TransUnion—when deciding whether to offer credit to an individual, at  what rate, and on what terms. Federal Privacy and Information Security Laws Apply to Many Information Reseller Products, Depending on Their Use and Source

The Fair Credit Reporting Act (FCRA) and the Gramm-Leach-Bliley Act  (GLBA) are the primary federal laws governing the privacy and security of  personal data collected and shared by information resellers. Specifically, FCRA applies to  companies that furnish, contribute to, or use “consumer reports”—reports  containing information about an individual’s personal and credit  characteristics used to help determine eligibility for such things as credit,  insurance, employment, licenses, and certain other benefits. Since 1972, FTC has initiated numerous  formal enforcement actions against information resellers for providing  consumer report information without adequately ensuring that their  customers had a permissible purpose for obtaining the data. FTC has civil  penalty authority for violations of FCRA and, in limited situations, the FTC  Act, but it does not have such authority for GLBA, which may inhibit its  ability to most effectively enforce that law’s privacy and security  provisions. Unlike FTC, other regulators have civil penalty authority to enforce  violations of GLBA. Federal banking regulators have overseen compliance with the  privacy and security provisions of GLBA and FCRA by issuing rules and  guidance, conducting examinations, and taking formal and informal  enforcement actions when needed. For example, the banking agencies issued a  guide on small entities’ compliance with GLBA’s privacy provision to help  companies identify and comply with the requirements. Requiring information resellers to safeguard all  of the sensitive personal information they hold would help ensure that  explicit data security requirements apply more comprehensively to a class  of companies that maintains large amounts of such data. Appendix I: Scope and Methodology

Our report objectives were to examine (1) how financial institutions use  data products supplied by information resellers, the types of information  contained in these products, and the sources of the information; (2) how  federal laws governing the privacy and security of personal data apply to  information resellers, and what rights and opportunities exist for  individuals to view and correct data held by resellers; (3) how federal  financial institution regulators and the Federal Trade Commission (FTC)  oversee information resellers’ compliance with federal privacy and  information security laws; and (4) how federal financial institution  regulators, state insurance regulators, and FTC oversee financial  institutions’ compliance with federal privacy and information security  laws governing consumer information, including information supplied by  information resellers. The three  nationwide credit bureaus were included in this definition.
Why GAO Did This Study

The growth of information resellers--companies that collect and resell publicly available and private information on individuals--has raised privacy and security concerns about this industry. These companies collectively maintain large amounts of detailed personal information on nearly all American consumers, and some have experienced security breaches in recent years. GAO was asked to examine (1) financial institutions' use of resellers; (2) federal privacy and security laws applicable to resellers; (3) federal regulators' oversight of resellers; and (4) regulators' oversight of financial institution compliance with privacy and data security laws. To address these objectives, GAO analyzed documents and interviewed representatives from 10 information resellers, 14 financial institutions, 11 regulators, industry and consumer groups, and others.

What GAO Found

Financial institutions such as banks, credit card companies, securities firms, and insurance companies use personal data obtained from information resellers to help make eligibility determinations, comply with legal requirements, prevent fraud, and market their products. For example, lenders rely on credit reports sold by the three nationwide credit bureaus to help decide whether to offer credit and on what terms. Some companies also use reseller products to comply with PATRIOT Act rules, to investigate fraud, and to identify customers with specific characteristics for marketing purposes. GAO found that the applicability of the primary federal privacy and data security laws--the Fair Credit Reporting Act (FCRA) and Gramm-Leach-Bliley Act (GLBA)--to information resellers is limited. FCRA applies to information collected or used to help determine eligibility for such things as credit or insurance, while GLBA only applies to information obtained by or from a GLBA-defined financial institution. Although these laws include data security provisions, consumers could benefit from the expansion of such requirements to all sensitive personal information held by resellers. The Federal Trade Commission (FTC) is the primary federal agency responsible for enforcing information resellers' compliance with FCRA's and GLBA's privacy and security provisions. Since 1972, the agency has initiated formal enforcement actions against more than 20 resellers, including the three nationwide credit bureaus, for violating FCRA. However, FTC does not have civil penalty authority under the privacy and safeguarding provisions of GLBA, which may reduce its ability to enforce that law most effectively against certain violations, such as breaches of mass consumer data. In overseeing compliance with privacy and data security laws, federal banking and securities regulators have issued guidance, conducted examinations, and taken formal and informal enforcement actions. A recent national survey sponsored by the National Association of Insurance Commissioners (NAIC) identified some noncompliance with GLBA by insurance companies, but state regulators have not laid out clear plans with NAIC for following up to ensure these issues are adequately addressed.