Privacy Wake Up Call

Privacy Wake Up Call Commentary by J. Bradley Jansen July 23, 2002 Last month, North Dakota sent a clear message to the financial community that privacy matters. While some state legislators have passed opt-in privacy rules on the selling and sharing of personal financial information, this was the first clear popular referendum. There are several important lessons to be learned from the people of North Dakota. First of all, many financial institutions and Beltway regulators underestimate the importance that people hold regarding their personally-identifiable financial information. Despite being outspent at least six to one, proponents of the “optin” requirement persuaded nearly three quarters of the voters to agree with them. Money for fancy ads did not override privacy concerns. Secondly, the effort made to defeat the proposal shows what financial institutions consider the “opt-in” approach is unworkable as a business plan. Some bankers argue they do not sell information because it would be stupid since customers would leave them. Others maintained that the proposal would interfere with firms that do business globally and nationally and therefore make the state an unattractive place to do business. The patchwork of different state policies complicates business’ ability to appeal to customers. The choice is not only unworkable but unnecessary. Unfortunately, the traditional consumer financial privacy protections that existed under common law and in a climate of business competition to respect privacy is gone. Since the implementation of the Bank Secrecy Act of 1970, the United States Supreme Court has ruled effectively that we do not have an expectation of privacy on the records someone else has on us. Then-President Richard Nixon gave us the BSA as part of the War on Drugs, but the law has been spectacularly ineffective in getting illegal drugs off our streets, but it has been effective in eviscerating the privacy expectations of ordinary, law-abiding citizens. It has ushered in the current climate of identity theft, fear of online transactions and distrust of financial institutions’ use of our personal information. By removing our previous privacy expectations, the BSA has enabled a growing epidemic of identity fraud and lowered public confidence in our financial institutions. The privacy provision of the financial modernization law, Title V of the GrammLeach-Bliley Act of 2000, established a floor and invites states to raise it. Now that North Dakota has spoken, California may take up the gauntlet with the help of a deep-pocketed funder. Should we address the problem differently, we need to do so now. The current framework possibilities. Until strangled by the BSA, new framework such as

of the opt-in/opt-out choice gives us two inferior we restore our common law tradition of privacy expectations a better approach to the status quo would be to initiate a a “home state” regulation approach.

Under a home state privacy regulation regime, each financial institution in the country would have to claim one state where it is headquartered as its domicile. The company would then follow only one set of rules and could operate throughout the country. Such an approach is very workable for businesses. What would consumers have to gain?

The answer is everything: real choices for

real privacy and an easier way of determining the company that best fits one’s preferences. Decide what level of comfort you have with an institution sharing—or selling—your personal financial information and pick the best company following the rules of the state that best matches your preferences. Such competition would get us closer to the consent-based approach of data-use that really underlies the current debate. George Mason University Law Professors Bruce Kobayashi and Larry Ribstein have made a similar case for the state regulation of computer cookies. Yale Law School professor Roberta Romano argued similarly for securities’ regulation. Current headlines belie the benefits of the Security and Exchange Commission’s monopoly regulation. One or more states could adopt rules that meet the European Union’s safe harbor data-use requirements which would greatly facilitate international commerce—and the U.S. position in it. Home state privacy regulation would even encourage large financial institutions to establish affiliates in various states that could compete with one another for customers by appealing to their privacy preferences. Both business and consumers would be better off under home state privacy regulation rather than having inside the Beltway bureaucrats dictate regulations that work against them.