Credit Bureaus Lose Privacy Challenge

Matt Johnson, ACA International Compliance Attorney, reports in Credalert that a federal appeals court has upheld a decision of a lower court involving the financial data privacy provisions of the Gramm-Leach-Bililey Act (GLBA). Trans Union brought the suit in an attempt to protect its use of "credit header" information. GLBA limits the way in which financial institutions may disclose to a third party personally identifiable information about consumers and their credit histories. Regulations took effect in November 2000, with compliance required by July 2001. The critical part of the regulations required that when consumers provide personal financial information to a financial institution, they had the right to "opt out" of having that information provided to a third party.

Trans Union argued (unsuccessfully) that a credit reporting agency (CRA) was not a "financial institution" as defined under the act, and that the definition of "personally identifiable" information was too broad and should exclude personal identification information, such as social security numbers.

The circuit court unanimously confirmed the decision of the district court. So what are Trans Union's options? It could request a rehearing or appeal the case to the full D.C. circuit court. Stay tuned.