The American Bankers Association, the Financial Services Roundtable and the Consumer Bankers Association have gone to the Ninth Circuit Court of Appeals to try to stop a California law that restricts how they can use customer information.

The outcome of their appeal, filed Aug. 2, will decide the fate of the strictest state privacy law on the books, and the crucial issue of whether federal law preempts such state laws.



Members of the three trade associations, such as Citigroup, Bank of America, Wells Fargo and Merrill Lynch, share customer information among their affiliates. Under the California Financial Information Privacy Act, commonly called SB1 after its bill number, they would have to either stop sharing among affiliates that are not in the same line of business (for example, a bank affiliate couldn’t share with an insurance affiliate), or submit to the law’s opt-out requirement. Under that rule, customers have the right to block, or opt-out, of the sharing of their information among affiliates. (A separate provision of the law requiring banks to get permission from customers before their information can be shared with third party companies is not under attack.)



The bankers argue that the affiliate sharing restrictions are plainly preempted by the federal Fair Credit Reporting Act. But on June 30, Judge Morrison C. England Jr. of the U.S. District Court in Sacramento ruled that the FCRA, whose overriding purpose is to regulate the use and dissemination of consumer reports, does not preempt SB1. Instead, the judge said, the Gramm-Leach-Bliley Act, which sets forth basic privacy protections in non-credit reporting situations, is the relevant federal law and it does allow states to enact more stringent privacy controls.



The California privacy law went into effect one day later on July 1. Financial institutions doing business in California now face penalties of up to $500,000 for negligent disclosure of nonpublic personal information, with no cap on what they can be fined for knowing and willful violations. Both state regulators and individual consumers can bring suit over alleged violations.