Consumer complaint received 2023-02-01
Company: TD BANK US HOLDING COMPANY
State: FL
Product: Credit reporting, credit repair services, or other personal consumer reports
Sub-product: Credit reporting
Issue: Improper use of your report
Sub-issue: Reporting company used your report improperly

Complaint:
On XX/XX/2022 I sent TD Bank an letter via certified mail XXXX XXXX XXXX XXXX XXXX XXXX. Starting In the 4th paragraph on the 1st page I requested an opt-out pursuant to the Graham Leach Bliley Acts ( GLBA ) privacy provisions codified at 15 U.S.C. 68016809. The FTC has provided a Graham Leach Bliley Act business guidance resource at the following link. XXXX XXXX XXXXXXXX  According to GLBA subsection Exercising the Opt-Out Right says that Consumers and customers who have the right to opt out may do so at any time. Once you receive an opt-out direction from your existing consumers or customers, you must comply with it as soon as is reasonably possible. 

According to the GLBA TD Bank is obligated by law to discontinue sharing my nonpublic personal information with all non-affiliated third-parties which includes all credit reporting agencies such as XXXX and XXXX see attached credit report for private data sharing violation. According to the FTCs website under the GLBA section What information is covered, nonpublic personal information ( or NPI ) is described as any information an individual gives you to get a financial product or service ( for example, name, address, income, Social Security number, or other information on an application ) ; any information you get about an individual from a transaction involving your financial product ( s ) or service ( s ) ( for example, the fact that an individual is your consumer or customer, account numbers, payment history, loan or deposit balances, and credit or debit card purchases ) ; or any information you get about an individual in connection with providing a financial product or service ( for example, information from court records or from a consumer report ).

TD Bank neglected its initial obligation to provide me with a privacy notice and opt out disclosures that satisfies GLBA guidelines. Under the section Who Gets a Privacy Notice? Subsection : Customers- its states, Whether or not you share customer NPI , you must give all your customers a privacy notice. You must provide an " initial notice '' by the time the customer relationship is established. If this would substantially delay the customer 's transaction, you may provide the notice within a reasonable time after the customer relationship is established, but only if the customer agrees. 
If you share NPI with nonaffiliated third parties outside of the exceptions described within ( see " Exceptions '' ), you also must give your customers : an " opt-out '' notice explaining the individual 's right to direct you not to share her NPI with a nonaffiliated third party ; a reasonable way to opt out ; and a reasonable amount of time to opt out before you disclose her NPI. 

I was never given the initial opportunity to opt-out of my non-public personal information being shared and TD Bank has continued to deny my right to privacy evidenced by their continued reporting to XXXX and XXXX. Penalties for non-compliance with the GLBA can include fines up to {$100000.00} per violation, with fines for officers and directors of up to {$10000.00} per violation, criminal penalties of up to 5 years, and the revocation of licenses.

Company response to consumer: Closed with non-monetary relief