Consumer complaint received 2023-12-04
Company: WELLS FARGO & COMPANY
State: GA
Product: Credit reporting or other personal consumer reports
Sub-product: Credit reporting
Issue: Problem with a company's investigation into an existing problem
Sub-issue: Their investigation did not fix an error on your report

Complaint:
Wells Fargo Dealer Services is releasing my nonpublic information to the reporting agencies without my expressed written consent. XXXX and XXXX are both financial institutions that make a profit from selling my information. Since this is my financial information I am entitled to the proceeds of this sale. I have asked for the accounting records from Wells Fargo, XXXX, and XXXX neither have provided the records. Furthermore each financial institution is required to provide me with an opt out notice each month so I have the right to opt out of my nonpublic financial information being shared. 
17 CFR 248.124 - Reasonable opportunity to opt out. 
CFR prev | next 248.124 Reasonable opportunity to opt out.

( a ) In general. You must not use eligibility information that you receive from an affiliate to make marketing solicitations to a consumer about your products or services unless the consumer is provided a reasonable opportunity to opt out, as required by 248.121 ( a ) ( 1 ) ( ii ).

( b ) Examples of a reasonable opportunity to opt out. The consumer is given a reasonable opportunity to opt out if : ( 1 ) By mail. The opt out notice is mailed to the consumer. The consumer is given 30 days from the date the notice is mailed to elect to opt out by any reasonable means.

( 2 ) By electronic means.

( i ) The opt out notice is provided electronically to the consumer, such
as by posting the notice at an Internet Web site at which the consumer has obtained a product or service. The consumer acknowledges receipt of the electronic notice. The consumer is given 30 days after the date the consumer acknowledges receipt to elect to opt out by any reasonable means.

( ii ) The opt out notice is provided to the consumer by e-mail where the consumer has agreed to receive disclosures by e-mail from the person sending the notice. The consumer is given 30 days after the e-mail is sent to elect to opt out by any reasonable means.

( 3 ) At the time of an electronic transaction. The opt out notice is provided to the consumer at the time of an electronic transaction, such as a transaction conducted on an Internet Web site. The consumer is required to decide, as a necessary part of proceeding with the transaction, whether to opt out before completing the transaction. There is a simple process that the consumer may use to opt out at that time using the same mechanism through which the transaction is conducted.

(

4 ) At the time of an in-person transaction. The opt out notice is provided to the consumer in writing at the time of an in-person transaction. The consumer is required to decide, as a necessary part of proceeding with the transaction, whether to opt out before completing the transaction, and is not permitted to complete the transaction without making a choice. There is a simple process that the consumer may use during the course of the in-person transaction to opt out, such as completing a form that requires consumers to write a yes or no to indicate their opt out preference or that requires the consumer to check one of two blank check boxesone that allows consumers to indicate that they want to opt out and one that allows consumers to indicate that they do not want to opt out.

( 5 ) By including in a privacy notice. The opt out notice is included in a GLBA privacy notice. The consumer is allowed to exercise the opt out within a reasonable period of time and in the same manner as the opt out under that privacy notice. 
The purpose of these regulations is to prescribe responsibilities, rules, guidelines, and policies and procedures to implement the Privacy Act of 1974 ( Pub. L. 93579, as amended ; 5 U.S.C. 552a ) to assure that personal information about individuals collected by the United States Section is limited to that which is legally authorized and necessary and is maintained in a manner which precludes unwarranted intrusions upon individual privacy. Further, these regulations establish procedures by which an individual can : ( a ) Determine if the United States Section maintains records or a system of records which includes a record pertaining to the individual and ( b ) gain access to a record pertaining to him or her for the purpose of review, amendment or correction.

1101.2 Definitions.

For the purpose of these regulations : ( a ) Act means the Privacy Act of 1974.

( b ) Agency is defined to include any executive department, military department, Government corporation, Government controlled corporation or other establishment in the execut
ive branch of the Government ( including the

Executive Office of the President, or any independent regulatory agency ) ( 5 U.S.C. 552 ) ). ( c ) Commission means the International Boundary and Water Commission, United States and XXXX. ( d ) Commissioner means head of the United States Section, International Boundary and Water Commission, United States and XXXX.

( e ) Individual means a citizen of the United States or an alien lawfully admitted for permanent residence.

( f ) Maintain includes maintain, collect, use, or disseminate.

( g ) Record means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph. 

( h ) Routine use means, with respect to the disclosure of a record, the use of such record for a purpose which is compatible with the purpose for which it is collected. 

( i ) Section means the United States Section, International Boundary and Water Commission, United States and XXXX.

( j ) Statistical record means a record in a system of records maintained for statistical research or reporting purposes only and not used in whole or in part in making any determination about an identifiable individual, except as provided by 13 U.S.C. 8 ( Census data ).

( k ) System of records means a group of any records under the control of any agency from which information is retrieved by the name of the individual or by some identifying number, symbol, or other identifying particular assigned to the individual.

1101.3 General policy : Collection and use of personal information.

( a ) Heads of Divisions, Branches, and the projects shall ensure that all Section personnel subject to their supervision are advised of the provisions of the Act, including the criminal penalties and civil liabilities provided therein, and that Section personnel are made aware of their responsibilities to protect the security of personal information, to assure its accuracy, relevance, timeliness and completeness, to avoid unauthorized disclosure either orally or in writing, and to ensure that no system of records concerning individuals, no matter how small or specialized, is maintained without public notice.

( b ) Section personnel shall : ( 1 ) Collect no information of a personal nature from individuals unless authorized to collect it to achieve a function or carry out a responsibility or function of the Section.

( 2 ) Collect from individuals only that information which is necessary to Section responsibilities or functions ; ( 3 ) Collect information, wherever possible, directly from the individual to whom it relates ; ( 4 ) Inform individuals from whom information is collected of the authority for collection, the purpose thereof, the uses that will be made of the information, and the effects, both legal and practical, of not furnishing the information ; ( 5 ) Neither collect, maintain, use nor disseminate information concerning an individual 's religious or political beliefs or activities or his membership in associations or organizations, unless ( i ) the individual has volunteered such information for his own benefit ; ( ii ) the information is expressly authorized by statute to be collected, maintained, used or disseminated ; or ( iii ) the activities involved are pertinent to and within the scope of an authorized investigation or adjudication activity ; ( 6 ) Advise an individual 's supervisors of the existence or contemplated development of any system of records which retrieves information about individuals by individual identified ; ( 7 ) Maintain an accounting of all disclosures of information to other than Section personnel ; ( 8 ) Disclose no information concerning individuals to other than Section personnel except when authorized by the Act or pursuant to a routine use published in the Federal Register ; ( 9 ) Maintain and process information concerning individuals with care in order to ensure that no inadvertent disclosure of the information is made to other than Section personnel ; and ( 10 ) Call to the attention of the PA Officer any information in a system maintained by the Section which is not authorized to be maintained under the provisions of the Act, including information on First Amendment activities, information that is inaccurate, irrelevant or so incomplete as to risk unfairness to the individual concerned.

( c ) The system of records maintained by the Section shall be reviewed annually by the PA Officer to ensure compliance with the provisions of the Act.

( d ) Information which may be used in making determinations about an individual 's rights, benefits, and privileges shall, to the greatest extent practicable, be collected directly from that individual. In deciding whether collection of information from an individual, as opposed to a third party source, is practicable, the following criteria, among others, may be considered : ( 1 ) Whether the nature of the information sought is such that it can only be obtained from a third party ; ( 2 ) Whether the cost of collecting the information from the individual is unreasonable when compared with the cost of collecting it from a third party ; ( 3 ) Whether there is a risk that information requested from the third parties, if inaccurate, could result in an adverse determination to the individual concerned; ( 4 ) Whether the information, if supplied by the individual, would have to be verified by a third party; or ( 5 ) Whether provisions can be made for verification by the individual of information collected from third parties.

( e ) Employees whose duties require handling of records subject to the Act shall, at all times, take care to protect the integrity, security and confidentiality of these records.

( f ) No employee of the section may alter or destroy a record subject to the Act unless ( 1 ) such alteration or destruction is properly undertaken in the course of the employee 's regular duties or ( 2 ) such alteration or destruction is required by a decision of the Commissioner or the decision of a court of competent jurisdiction.

1101.4 Reports on new systems of records ; computer matching programs.

( a ) Before establishing any new systems of records, or making any significant change in a system of records, the Section shall provide adequate advance notice to : ( 1 ) The Committee on Government Operations of the House of Representatives ; ( 2 ) The Committee on Governmental Affairs of the Senate ; and ( 3 ) The Office of Management and Budget.

( b ) Before participating in any computerized information matching program, as that term is defined by 5 U.S.C. 552a ( a ) ( 8 ) the Section will comply with the provisions of 5 U.S.C. 552a ( o ), and will provide adequate advance notice as described in 1101.4 ( a ) above.

1101.5 Security, confidentiality and protection of records.

( a ) The Act requires that records subject to the Act be maintained with appropriate administrative, technical and physical safeguards to ensure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience or unfairness to any individual on whom information is maintained.

( b ) When maintained in manual form ( typed, printed, handwritten, etc. ) records shall be maintained, at a minimum, subject to the following safeguards, or safeguards affording comparable protection : ( 1 ) Areas in which the records are maintained or regularly used shall be posted with an appropriate warning stating that access to the records is limited to authorized persons. The warning shall also summarize the requirements of 1101.3 and state that the Act contains a criminal penalty for the unauthorized dislosure of records to which it applies.

( 2 ) During working hours : ( i ) The area in which the records are maintained or regularly used shall be occupied by authorized personnel or ( ii ) access to the records shall be restricted by their storage in locked metal file cabinets or a locked room.

( 3 ) During non-working hours, access to the records shall be restricted by their storage in locked metal file cabinets or a locked room.

( 4 ) Where a locked room is the method of security provided for a system, that security shall be supplemented by : ( i ) Providing lockable file cabinets or containers for the records or ( ii ) changing the lock or locks for the room so that they may not be opened with a master key. For purposes of this paragraph, a master key is a key which may be used to open rooms other than the room containing records subject to the Act, unless those rooms are utilized by officials or employees authorized to have access to the records subject to the Act.

( 5 ) Personnel handling personal information during routine use will ensure that the information is properly controlled to prevent unintentional or unauthorized disclosure. Such information will be used, held, or stored only where facilities or conditions are adequate to prevent unauthorized or unintentional disclosure.

( c ) When the records subject to the Act are maintained in computerized form, safeguards shall be utilized based on those recommended in the National Bureau of Standard 's booklet Computer Security Guidelines for Implementing the Privacy Act of 1974 ( May 30, 1975 ), and any supplements thereto, which are adequate and appropriate to assuring the integrity of the records.

1101.6 Requests for access to records.

( a ) Any individual may submit an inquiry to the Section to ascertain whether a system of records contains a record pertaining to him or her.

( b ) The inquiry should be made either in person or by mail addressed to the PA Officer, United States Section, International Boundary and Water Commission, XXXX XXXX XXXX XXXX XXXX XXXX XXXX  TX XXXX. The PA Officer shall provide assistance to the individual making the inquiry to assure the timely identification of the appropriate systems of records. The office of the PA Officer is located in Suite C316 and is open to an individual between the hours of 8 a.m. and 4:30 p.m., Monday through Friday ( excluding holidays ).

( c ) Inquiries submitted by mail should be marked PRIVACY ACT REQUEST on the bottom left-hand corner of the envelope.

( d ) The letter should state that the request is being made under the Privacy Act.

( e ) Inquiries concerning whether a system of records contains a record pertaining to an individual should contain the following : ( 1 ) Name, address and telephone number ( optional ) of the individual making the inquiry ; ( 2 ) Name, address and telephone number ( optional ) of the individual to whom the record pertains, if the inquiring individual is either the parent of a minor or the legal guardian of the individual to whom a record pertains ; ( 3 ) A certified or authenticated copy of documents establishing parentage or guardianship ; ( 4 ) Whether the individual to whom the record pertains is a citizen of the United States or an alien lawfully admitted for permanent residence into the United States ; ( 5 ) Name of the system of records, as published in the Federal Register ; ( 6 ) Location of the system of records, as published in the Federal Register ; ( 7 ) Such additional information as the individual believes will or might assist the Section in responding to the inquiry and in verifying the individual 's identity ( for example : date of birth, place of birth, names of parents, place of work, dates of employment, position title, etc. ) ; ( 8 ) Date of inquiry ; and ( 9 ) Signature of the requester.

The Section reserves the right to require compliance with the identification procedures appearing at paragraph ( f ) of this section where conditions warrant.

( f ) The requirement for identification of individuals seeking access to records are as follows : ( 1 ) In person : Each individual making a request in person shall be required to present satisfactory proof of identity. The means of proof, in the order of preference and priority, are : ( i ) A document bearing the individual 's photograph ( for example, driver 's license, passport or military or civilian identification card ) ; ( ii ) A document bearing the individual 's signature, preferably issued for participation in a federally sponsored program ( for example, Social Security card, unemployment insurance book, employer 's identification card, national credit card and professional, craft or union membership card ) ; and ( iii ) A document bearing either the photograph or the signature of the individual, preferably issued for participation in a federally sponsored program ( for example, Medicaid card ). In the event the individual can provide no suitable documentation of identity, the Section will require a signed statement asserting the individual 's identity and stipulating that the individual understands the penalty provision of 5 U.S.C. 552a ( i ) ( 3 ).

( 2 ) Not in person : If the individual making a request does not appear in person before the PA Officer, a certificate of a notary public or equivalent officer empowered to administer oaths must accompany the request.

( 3 ) Parents of minors and legal guardians : An individual acting as the parent of a minor or the legal guardian of the individual or an heir or legal representative of a deceased person to whom a record pertains shall establish his or her personal identity in the manner prescribed in either paragraph ( f ) ( 1 ) or ( 2 ) of this section. In addition, such individual shall establish his or her identity in the representative capacity of parent or legal guardian. In the case of the parent of a minor, the proof of identity shall be a certified or authenticated copy of the minor 's birth certificate. In the case of a legal guardian of an individual who has been declared incompetent due to physical or mental incapacity or age by a court of competent jurisdiction, the proof of identity shall be a certified or authenticated copy of the court 's order. A parent or legal guardian may act only for a living individual, not for a decedent. A parent or legal guardian may be accompanied during personal access to a record by another individual, provided the requirements of paragraph ( f ) of 1101.7 are satisfied. In the case of an heir or legal representative of a deceased person the proof of identity shall be a certified copy of the Will, if any ; the order of a court of competent jurisdiction admitting the Will to probate ; the order of a court of competent jurisdiction appointing an executor, executrix, or administrator ; a letter of administration ; or any other documentary evidence which establishes the identity of the individual as an heir or legal representative of a deceased person.

( g ) When the provisions of this part are alleged to have the effect of impeding an individual in exercising his or her right to access, the Section will consider, from an individual making a request, alternative suggestions regarding proof of identity and access to records.

( h ) An inquiry which is not addressed as specified in paragraph ( b ) of this section or which is not marked as specified in paragraph ( c ) of this section will be so addressed and marked by the Section 's personnel and forwarded immediately to the PA Officer. An inquiry which is not properly addressed by the individual will not be deemed to have been received for purposes of measuring time periods for response until forwarding of the inquiry to the PA Officer has been effected. In each instance when an inquiry so forwarded is received, the PA Officer shall notify the individual that his or her inquiry was improperly addressed and the date when the inquiry was received at the proper address.

( i ) Each inquiry received shall be acted upon promptly by the PA Officer. Although there is no fixed time when an agency must respond to a request for access to records under the Act, every effort will be made to respond within ten ( 10 ) days ( excluding Saturdays, Sundays and holidays ) of the date of receipt. If a response can not be made within ten ( 10 ) days, the PA Officer shall send an acknowledgment during that period providing information on the status of the inquiry and asking for such further information as may be necessary to process the inquiry. Every effort will be made to provide the requested records within thirty ( 30 ) days.

( j ) An individual shall not be required to state a reason or otherwise justify his or her inquiry.

1101.7 Disclosure of records to individuals who are subjects of those records.

( a ) Each request received shall be acted upon promptly by the PA Officer. Every effort will be made to respond within ten ( 10 ) days ( excluding Saturdays, Sundays, and holidays ) of the date of receipt. If a response can not be made within ten ( 10 ) days due to unusual circumstances, the PA Officer shall send an acknowledgment during that period providing information on the status of the request and asking for such further information as may be necessary to process the request. Every effort will be made to provide the requested records within thirty ( 30 ) days. Unusual circumstances shall include circumstances where a search for and collection of requested records from inactive storage, field facilities or other establishments are required, cases where a voluminous amount of data is involved, instances where information on other individuals must be separated or expunged from the particular record, and cases where consultations with other agencies having a substantial interest in the determination of the request are necessary.

( b ) Grant of access : ( 1 ) Notification.

( i ) An individual shall be granted access to a record pertaining to him or her except where the record is subject to an exemption under the Act and these rules.

( ii ) The PA Officer shall notify the individual of such determination and provide the following information : ( A ) The methods of access, as set forth in paragraph ( b ) ( 2 ) of this section ; ( B ) The place at which the records may be inspected ; ( C ) The earliest date on which the record may be inspected and the period of time that the records will remain available for inspection. In no event shall the earliest date be later than thirty ( 30 ) days from the date of notification ; ( D ) The estimated date by which a copy of the record could be mailed and the estimate of fees pursuant to 1101.11. In no event shall be estimated date be later than thirty ( 30 ) days from the date of notification ; ( E ) The fact that the individual, if he or she wishes, may be accompanied by another individual during the personal access, subject to the procedures set forth in paragraph ( f ) of this section; and ( F ) Any additional requirements needed to grant access to a specific record.

( 2 ) Method of access : The following methods of access to records by an individual may be available depending on the circumstances of a given situation : ( i ) Inspection in person may be made in the office specified by the PA Officer, between the hours of 8 a.m. and 4:30 p.m., Monday through Friday ( excluding holidays ) ; ( ii ) Transfer of records to a Federal facility more convenient to the individual may be arranged, but only if the PA Officer determines that a suitable facility is available, that the individual 's access can be properly supervised at that facility, and that transmittal of the records to that facility will not unduly interfere with operations of the section or involve unreasonable costs, in terms of both money and manpower ; and ( iii ) Copies may be mailed at the request of the individual, subject to payment of the fees prescribed in 1101.11. The Section, at its own initiative, may elect to provide a copy by mail, in which case no fee will be charged to the individual.

( c ) Access to medical records : Upon advice by a physician that release of medical information directly to the requester could have an adverse effect on the requester, the Section may attempt to arrange an acceptable alternative. This will normally involve release of such information to a physician named by the requester, with the requester 's written consent. ( Note that release to any third party, including a physician or family member, must comply with the provisions of 1101.8 of this part. ) ( d ) The Section shall supply such other information and assistance at the time of access to make the record intelligible to the individual.

( e ) The Section reserves the right to limit access to copies and abstracts of original records, rather than the original records. This election would be appropriate, for example, when the record is in an automated data media such as tape of disc, when the record contains information on other individuals, and when deletion of information is permissible under exemptions ( for example 5, U.S.C. 552 ( k ) ( 1 ) ). In no event shall original records of the Section be made available to the individual except under the immediate supervision of the PA Officer or his designee. Title 18 U.S.C. 2701 ( a ) makes it a crime to conceal, mutilate, obliterate, or destroy a record filed in a public office, or to attempt to do any of the foregoing.

( f ) Any individual who requests access to a record pertaining to that individual may be accompanied by another individual of his or her choice. Accompanied includes discussion of the record in the presence of the other individual. The individual to whom the record pertains shall authorize the presence of the other individual in writing and shall include the name of the other individual, a specific description of the record to which access is sought, and the date and the signature of the individual to whom the record pertains. The other individual shall sign the authorization in the presence of the PA Officer or his designee. An individual shall not be required to state a reason or otherwise justify his or her decision to be accompanied by another individual during the personal access to a record.

( g ) Initial denial of access : ( 1 ) Grounds. Access by an individual to a record which pertains to that individual will be denied only upon a determination by the PA Officer that : ( i ) The record is subject to an exemption under the Act and these rules ; ( ii ) The record is information compiled in reasonable anticipation of a civil action or proceeding ; ( iii ) The provisions of 1101.7 ( c ) pertaining to medical records have been temporarily invoked ; or ( iv ) The individual unreasonably has failed to comply with the procedural requirements of these rules.

( 2 ) Notification. The PA Officer shall give notice of denial of access of records to the individual in writing and shall include the following information : ( i ) The PA Officer 's name and title or position ; ( ii ) The date of denial ; ( iii ) The reasons for the denial, including citation to the appropriate section of the Act and these rules ; ( iv ) The individual 's opportunities for further administrative consideration, including the identity and address of the responsible official ; ( v ) If stated to be administratively final within the Section, the individual 's right to judicial review under 5 U.S.C. 552a ( g ) ( 1 ) and ( 5 ).

( 3 ) Administrative review : When an initial denial of a request is issued by the PA Officer, the individual 's opportunities for further consideration shall be as follows : ( i ) As to denial under paragraph ( g ) ( 1 ) ( i ) of this section, the sole procedure is a petition for the issuance, amendment, or repeal of a rule under 5 U.S.C. 553 ( e ). Such petition shall be filed with the Commissioner, United States Section, International Boundary and Water Commission, XXXX XXXX XXXX XXXX XXXX XXXX XXXX  TX XXXX. If the exception was determined by another agency, the PA Officer will provide the individual with the name and address of the other agency and any relief sought by the individual shall be that provided by the regulations of the other agency. Within the Section, no such denial is administratively final until such a petition has been filed by the individual and disposed of on the merits by the Commissioner.

( ii ) As to denial under paragraphs ( g ) ( 1 ), ( ii ), ( iii ) or ( iv ) of this section, the individual may file for review with the Commissioner, as indicated in the PA Officer 's initital denial notification.

( h ) If a request is partially granted and partially denied, the PA Officer shall follow the appropriate procedures of this section as to the records within the grant and the records within the denial.

1101.8 Disclosure of records to third-parties.

( a ) The Section will not disclose any information about an individual to any person other than the individual except in the following instances : ( 1 ) Upon written request by the individual about whom the information is maintained ; ( 2 ) With prior written consent of the individual about whom the information is maintained ; ( 3 ) To the parent ( s ) of a minor child, or the legal guardian of an incompetent person, when said parent ( s ) or legal guardian act ( s ) on behalf of said minor or incompetent person.

( 4 ) When permitted under 5 U.S.C. 552a ( b ) ( 1 ) through ( 11 ) which provides as follows : ( i ) To those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties ; ( ii ) Required under 5 U.S.C. 552 of the U.S. Code ; ( iii ) For a routine use as defined in the Act at 5 U.S.C. 552a ( a ) ( 7 ) ; ( iv ) To the Bureau of the Census for purposes of planning or carrying out a census or survey or related activity pursuant to the provisions of title 13 of the U.S. Code ; ( v ) To a recipient who has provided the agency with advance adequate written assurance that the record will be used solely as a statistical research or reporting record, and the record is to be transferred in a form that is not individually identifiable ; ( vi ) To the National Archives of the United States as a record which has sufficient historical or other value to warrant its continued preservation by the United States Government, or for evaluation by the Administrator of General Services or his designee to determine whether the record has such value ; ( vii ) To another agency or to an instrumentality of any governmental jurisdiction within or under the control of the United States for a civil or criminal law enforcement activity if the activity is authorized by law, if the head of the agency or instrumentality has made a written request to the agency which maintains the record specifying the particular portion desired and the law enforcement activity for which the record is sought ; ( viii ) To a person pursuant to a showing of compelling circumstances affecting the health or safety of an individual if upon such disclosure notification is transmitted to the last known address of such individual ; ( ix ) To either House of Congress, or, to the extent of matter within its jurisdiction, any committee or subcommittee thereof, any XXXX XXXX XXXX XXXX or XXXX of any such join

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation