The FPA is the centerpiece of federal legislation protecting individual privacy. The FPA protects customer records maintained by certain financial institutions from improper disclosure to officials or agencies of the federal government without notifying the customer. There is a “waiting period” during which the customer can challenge and prevent disclosure through legal action.
Disclosures to the federal government, its officers, agents, agencies, and departments are governed by the Act. It does not apply to private businesses or state or local governments. Additionally, the law specifies which financial institutions fall under its requirements. In the FPA, the term financial institution refers to any office of a credit card issuer.
The Consumer Credit Protection Act defines the term ‘credit card issuer’ as any entity that issues credit cards. The definition also includes retailers and other merchants (such as gas stations) which issue their own credit cards, even though these entities are not typically considered financial institutions.
For example, the definition was expanded beginning in July 2002 and now includes many entities that most individuals would not consider to be financial institutions, such as:
- Depositories (banks, thrifts, credit unions)
- Money services business
- Issuers, sellers, and redeemers of money orders
- Issuers, sellers, and redeemers of traveler’s checks
- U.S. Postal Service
- Securities and futures industries
- Futures commission merchants
- Commodity trading advisor
- Card clubs and casinos
One point of confusion has been whether the definition includes issuers of travel and entertainment cards that do not permit customers to defer payment. Case law on this issue has been mixed.
The FPA also specifies that covered customers are individuals or partnerships of 5 or fewer individuals. The FPA does not apply to corporations, trusts, estates, unincorporated associations such as unions, and large partnerships. Accordingly, FPA protection is dependent on the type of person or entity whose records are sought.
Federal law enforcement officials have partly opposed the FPA because they fear the proposed privacy protections would impede their efforts to investigate and prosecute white-collar and organized crime. Despite this, the FPA allows financial information to be disclosed based on a much weaker showing than the Fourth Amendment requirement of probable cause.
In the late 1980s, the law was weakened to allow banks to postpone notice to customers in drug trafficking and espionage investigations, and again by the US Patriot Act to allow disclosure when terrorism is suspected.
Can You Sue a Bank for Disclosing Personal Information?
A federal law known as Gramm-Leach-Bliley Act (GBLA) regulates how banks may handle consumer information. Consumer banking customers have rights regarding their nonpublic personal information (NPI) under the GLBA. Information about consumers includes information consumers provide to banks to obtain a financial product or service, as well as information banks gather about a consumer from a financial transaction with that consumer.
Examples of NPI include:
- Income;
- Monthly expenses;
- Social security number; and
- Other information on an application for a credit card or bank account.
NPI information cannot be publicly available. Publicly available information includes information that appears in public records, such as telephone books, land records, and driver’s license information from state motor vehicle departments.
The GLBA requires banks to inform their customers what kinds of information they collect and to whom they may provide the information. When a bank intends to share your nonpublic personal information with another entity, the bank must give you the option to opt-out (say “no”). The bank must honor your opt-out request. Consumers may prevent the bank from sharing their NPI with outside companies upon request. If a bank negligently or intentionally shares such information, a consumer may file a complaint with the Federal Trade Commission (FTC).
The FTC conducts an investigation. The FTC may impose monetary fines and prison time on banks that violate the GLBA if it finds the bank has violated the law. In the GLBA, there is no private right of action, which means individuals cannot sue banks in civil court.
Does the FPA Protect My Records from Disclosure to State and Local Authorities?
Only federal information may be disclosed to the federal government, not to state or local governments or private parties. FPA coverage is also limited to certain financial institutions and certain customers.
Before releasing customer records, covered financial institutions must get a certificate of compliance with the FPA. If the institution relies on this certificate in good faith to disclose the records, the statute generally prohibits civil liability.
What Are the Coverage Limitations of the FPA?
The Financial Privacy Act is limited in three ways:
- It applies only to requests or orders for information by certain federal “government authorities.”
- The statute covers only certain specified classes of financial institutions.
- Only individuals and small partnerships are defined as customers whose records are protected by the Financial Privacy Act.
Are Financial Institutions Liable for Wrongful Disclosure of My Records?
A federal agency, department, or financial institution that obtains or discloses financial records or information violating the statute is liable to the customer for civil penalties. A customer, however, must bring the action to a United States district court within three years of the violation or three years from the date it is discovered, whichever is later.
When Can You Sue a Bank?
Depending on the law, you may also be able to sue a bank. The Truth in Lending Act (TILA), the Fair Debt Collection Practices Act (FDCPA), and the Fair Credit Reporting Act (FCRA) are three such laws. The TILA requires banks to provide consumers with accurate information about credit transactions. Banks must accurately disclose the interest rate, monthly payments, and other pertinent details about mortgages and credit loans.
According to the FDCPA, banks may not use harassing techniques, or inaccurate information, in an attempt to collect a valid debt. You may be able to sue a bank for refusing to remove false information from your credit report under the FCRA.
How Do You File a Lawsuit Against a Bank?
Other than in the circumstances listed above, individuals usually cannot sue a bank in civil court unless a specific law allows it. However, under some circumstances, an individual may be able to sue a bank in small claims court. These specialized courts hear claims involving limited monetary damages (damages of up to a certain amount only). Small claims courts in each state have different damages amounts and filing procedures.
You must file a complaint in a small claims court to file a claim. The bank must receive a copy of the complaint. The bank may then respond. The court will set a trial date once it has copies of the complaint and the answer. Each side will present evidence at the trial. The court will then decide.
You can file a claim against a bank if you believe it owes you money and will not pay. Suppose a bank wrongly imposes a non-sufficient funds penalty (a penalty for not having enough money in your account to cover a check you write) three times instead of once. In that case, you can sue to recover the money improperly taken out by the bank.
Should I Contact a Lawyer?
Suppose you believe that your information was wrongfully turned over to the government by a financial institution. In that case, you may wish to contact a financial lawyer to determine whether your claim falls under the coverage of the FPA. If this happens, you will have to hire a lawyer to file a claim against them and the government institution that requested your information.
