Financial privacy laws regulate the manner in which financial institutions handle the nonpublic financial information of consumers. In the United States, financial privacy is regulated through laws enacted at the federal and state level. Federal regulations are primarily represented by the Bank Secrecy Act, Right to Financial Privacy Act, the Gramm-Leach-Bliley Act, and the Fair Credit Reporting Act. Provisions within other laws like the Credit and Debit Card Receipt Clarification Act of 2007 as well as the Electronic Funds Transfer Act also contribute to financial privacy in the United States. State regulations vary from state to state. While each state approaches financial privacy differently, they mostly draw from federal laws and provide more stringent outlines and definitions. Government agencies like the Consumer Financial Protection Bureau and the Federal Trade Commission provide enforcement for financial privacy regulations.
Federal laws
Right to Financial Privacy Act
The Right to Financial Privacy Act of 1978 (RFPA) was passed in 1978 primarily as a response to the Supreme Court ruling on United States v. Miller 1976 and to supplement the Bank Secrecy Act. The act was put in place to limit the government's ability to freely access nonpublic financial records. The RFPA defines financial institutions as any institution that engages in activities regarding banking, credit cards, and consumer finance. It also defines financial records as any documentation of a consumer's relationship with a financial institution. The act required that the U.S. government deliver a legal notice to a customer or receive consent from a customer before they can legally access their financial information. Customers must also be informed that they have the ability to challenge the government when the government is actively trying to access their financial information. In the event that the government successfully gains access to a customer's information, the government is not allowed to transfer the information between government agencies without clarifying that the information in question is being used in the name of law enforcement. The customer must be notified immediately if conditions are met and their information is going to be transferred between agencies.
The Right to Financial Privacy Act included many exceptions to expedite federal investigations. Federal agencies can access any financial records if the records in question are connected to a law enforcement investigation. The act also gives any government department or agency the ability to request access to a customer's information.
The government can access financial records through six exceptions:
Grand jury subpoena
Customer authorization giving consent
Administrative summons
Search warrant issued under the Federal Rules of Criminal Procedure
Judicial subpoena
Formal written request
Any preexisting rules regarding search warrants are applied to the exceptions. When a search warrant for a customer's financial information is issued, the government has 90 days to inform the customer of the existence of the search warrant. A consumer can give permission to the government through written approval which allows the government access for a maximum of three months. At any given time, the consumer can void the approval. If the government is given access via approval, the financial institution holding the information must document which government agencies are given access. In the event that financial records are requested using an administrative summons, a judicial subpoena, or a formal written request, the government must notify the customer of what specific records are being requested, why they are being requested, and the procedures used to access the records. Financial institutions must verify that all laws, regulations, and procedures were followed before any financial records that were requested can be handed over to federal agencies.
The RFPA was later amended to increase financial institutions' ability to help facilitate criminal investigations and prosecutions. Under the new amendments, financial institutions are allowed to disclose information to the government if they believe that a regulation has been violated. If an institution decides to share a customer's financial information this way, then the institution is only allowed to disclose information that identifies the suspect. The institution will also not be held liable for disclosing the information. The amendments also states that a court can compel a financial institution to notify a customer that their information has been subpoenaed.