California Passes Landmark Privacy Law

To the surprise of many observers (including your editors) the California legislature resurrected and passed a controversial privacy bill in mid-August that will affect most diversified financial service providers doing business in the state and could influence the ongoing debate over Fair Credit Reporting Act reform at the Federal level. Passage of The California Financial Information Privacy Act occurred suddenly after insertion into the bill of compromise language that was worked out between consumer groups and a small group of large financial services firms. The language prompted most (not all) of the financial services lobby to withdraw opposition to the bill, clearing the way for many legislators to cast a "yes" vote.

The key components of the bill involve new limits on the sharing of personal information. The new bill will require financial institutions to get affirmative consent from customers before sharing personal information with third parties, and to offer customers the opportunity to "opt-out" of sharing with holding-company affiliates in different lines of business and/or subject to oversight by a different regulatory agency. Both standards are tougher than the federal standard. More importantly, the limit on affiliate sharing is apparently at odds with existing Federal law under the Fair Credit Reporting Act. It also runs against a recent Federal appeals court decision in California that overturned ordinances passed by three Bay-area municipalities that limited the sharing of information across affiliates of financial institutions. Financial institutions have vigorously resisted attempts to limit their ability to share information across affiliates, arguing that such limits would negate the synergies anticipated in the GLB Financial Services Modernization Act passed in 1999.

Why did the financial services industry withdraw its opposition? Credit goes to the looming threat of a California ballot initiative, which privacy advocates were prepared to file by August 20 if lawmakers failed to enact new limits on data sharing. The ballot initiative would have placed an even tougher law before the California voters in a statewide election in March 2004. To forestall the ballot initiative, the financial services industry acquiesced to the privacy bill, albeit with the knowledge that a California court had already effectively negated its affiliate-sharing component.

Passage of the California bill has escalated the FCRA battle in Washington. The U.S. Senate Banking Committee will begin debating its own version of an FCRA bill this month. The House Financial Services Committee approved an FCRA bill in July that preserves the existing Federal pre-emption of state and local laws regarding sharing of information across affiliates. A similar measure in the Senate seems far less likely at this point, and the supporters of the California bill have pledged to take their cause to Congress to advocate the Calilfornia approach as a model for the rest of the country. Having been surprised by their success thus far, we won't discount the likelihood that they will succeed.