Regulates disclosure of customer records

The banking institution must give written notice to the customer of the intent to release such information. The customer has the right to prohibit the release of this information by notifying the bank in writing of his or her objection. Any disclosure of this information may be made no sooner than 15 days after the customer received the notice, if the notice was given in person or 15 days after the notice was mailed. The notice shall be given to those customers who have not objected to the release of his or her customer information. Banking institutions desiring to release customer information to their subsidiaries or affiliates or public customer information to third parties may provide the objection form to new customers at the time an account is opened, at the time a loan application is submitted or approved, or other transaction is entered into. Written notice must be provided to existing customers in a timely manner, although a separate mailing is not required.

A bank, for statement. than to the example, may include the notice with or in a monthly account Banking institutions may release to third parties, other subsidiaries or affiliates, customer information that is

NOT contained in public records, provided that the institution procures the consent of the customer after providing the customer with notice of its intent to release the customer information and the right of the customer to prevent such release. The bank must supply a plainly worded form that the customer may use to provide such consent. The consent form must state that the bank intends to release information, that the customer may object to the release, and that without the customer's express written authorization, the bank will not disclose the information, except in certain limited circumstances as outlined in the bill (e.g. pursuant to subpoena).

The legislation further outlines other provisions that must be printed on the document. The financial institution must receive and retain a copy of the customer's authorization for its records. In this way, the bank may sell or make publicly available non-public customer information, and third parties can conduct direct mail solicitations aimed at the customers in a manner that respects the privacy expectations of the customers. At least once every 2 years after the banking institution releases customer information, such institution that desires to continue such practice must provide written notice to the customers reminding them that the banking institution may release

such information and of the customer's continuing right to withdraw authorization.

Thus, the institution is not required to secure authorization again. The institution may comply with this requirement, for example, by providing the customer with a preprinted and self addressed form with which the customer may withdraw the authorization. Because of the need for continued confidentiality of customer information following the release to certain exempted parties, the bill provides, as did the federal rule, that certain persons execute written confidentiality agreements prior to the release of customer information: parties to whom a customer has authorized such release; agents and contractors of a financial institution responsible for preparing, handling or processing customer data; other financial institutions or credit reporting agencies; the bank's bond or insurance companies and persons engaged in secondary market transactions.

The confidentiality agreements must contain a statement of the specific use to be made of the records and prohibit disclosure by the third party except as required by law. Notwithstanding the other provisions, the bill stipulates that the banking institution shall disclose its customer information to persons making demand pursuant to a subpoena, summons, warrant or court order. Finally, the bill provides for civil penalties if the banking institution fails to notify the customer of disclosure practices or notifies the customer but fails to honor the preference. The penalty for failure to notify is $100 a day as modeled after section 104(5) of the Banking Law. Furthermore, the penalty for disclosure, failing to honor a customer's preference, is forfeiture to the state of the proceeds received from disclosure, modeled after section 130(1) in the Banking Law.

Effects of present law which this bill would alter

The banking law is amended by adding a new section 9-t.

Justification

Many believe that the details of their personal finances disclosed to banking institutions are confidential and private. All too often, this assumption does not conform to practice. Information generated from personal records (e.g. transaction and check history, credit line, savings account data, mortgage data, financial holdings) is sold or released to third parties for the compilation of comprehensive data bases which in turn are used for various marketing and investigative purposes without the knowledge and consent of the data subject.

A person's banking transactions, especially the checks that he or she issues, are a mirror of his or her life-style, personal interests and beliefs. From these records, an interested third party could easily identify the groups he or she joins and supports, the material he or she buys and the causes that he or she supports. If an individual applies for a mortgage or a personal loan, the statement of financial condition would reveal even more intimate financial details that most consumers do not want released or used for other or secondary purposes. On the federal level, The Right to Financial Privacy Act of 1978, established procedures for federal officials to follow concerning access to customer records.

As a general rule, a customer may challenge a government agency's subpoena or written request to a financial institution for customer records by filing a motion in a federal district court. The agency and the financial institution are liable to pay actual or punitive damages in the event of violation of the act. Thus, on the federal level there is recognition of the customer's right to privacy. By enacting this legislation, New York would join several other. states including California, Connecticut, Georgia, New Jersey, Florida, Illinois, Texas, Indiana, North Carolina and Oklahoma in acknowledging that financial institutions owe confidentiality to their customers. FISCAL IMPLICATIONS : None.

Effective date

This act shall take effect on the first of January next succeeding the date on which it shall have become law.