Product: Credit reporting or other personal consumer reports

I am filing a formal complaint against Upstart Loan Operations for violations of my consumer rights. 

Upstart failed to provide me the opportunity of opting out before sharing my personally identifiable financial information with third parties, including other financial institutions and consumer reporting agencies, which is a violation of both my Federal ( Gramm-Leach-Bliley-Act ) and CA State ( CA Financial Information Protection Act ) rights. 

I notified Upstart that I did not consent to them sharing my private information with third parties. Upstart responded that they had a right to share my personally identifiable financial information per the Upstart Privacy Policy and Privacy Notice. However, this notice states that : ... personally identifiable financial information collected by financial institutions ( like Upstart ), as that information is subject instead to other federal privacy laws ( like the Gramm-Leach-Bliley-Act ( GLBA ) ). For California Residents : We will not share information we collect about you with non-affiliated third parties, except as permitted by California law, such as to process your transactions or to maintain your account. 

Further, XXXX XXXX XXXX is listed as the current creditor on this account. I have never signed any contract with XXXX XXXX XXXX or given Upstart permission to share or sell my nonpublic personal information or account to another financial institution. 

I have asked Upstart twice for the full accounting on this account, including specific documentary evidence signed by an accountant representative, so that I can clarify who actually funded the account and the true amount owing. Upstart has failed to provide this accounting information and only sends me a copy of the Promissory Note, which is with XXXX XXXX, not XXXX XXXX XXXX, and which evidences multiple violations of the Truth in Lending Act ( TILA ). 

Upstart is also in violation of the Rosenthal Act - I clearly stated in my two most recent notices to Upstart that all mail must be sent to a specific address, and any mail sent to any other address for me will be deemed inconvenient and an invasion of privacy. Despite this, Upstart continues to send mail to an address which is inconvenient for me to receive mail at. 

Federal law defines identity theft as a fraud committed using the identifying information of another person ( 15 USC 1681a ( q ) ( 3 ) ). Upstart is committing identity theft against me by sharing my personally identifiable financial information to third parties without my legally obtained consent in order to deprive me of my rights under color of law ( 18 USC 242 ) and to collect on extensions of credit by extortionate means ( 18 USC 894 ).

CA Civil Code 1668 voids all contracts which have for their object, directly or indirectly, to exempt any one from responsibility for his own fraud, or willful injury to the person or property of another, or violation of law, whether willful or negligent. 

This contract has an aim to commit identity theft, deprive me of my rights, and extort payments out of me. The Promissory Note violates TILA, XXXX, and XXXX. The alleged current creditor, XXXX XXXX XXXX, is a bank that I have never signed any agreement with and is in possession of my personally identifiable financial information by way of identity theft. The contract/Promissory Note is void and unenforceable, with potential damages due to me for violations of the Rosenthal Act, FCRA, TILA, XXXX, and XXXX.