Consumer complaint received 2015-04-11
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: PA
Product: Credit card
Issue: Privacy

Complaint:
I have a credit card with Bank of America and recently received their " XXXX XXXX XXXX Privacy Notice '' ( also posted at XXXX ) which is the standard form listing " Reasons we can share your personal information '' and XXXX categories where XXXX " Does Bank of America Share '' and " Can you limit this sharing '' were " Yes. '' There was no information about whether or not they 'd registered a previous request to limit this sharing, so I have to go through these steps every year for every account. I was already logged in to my Bank of America account online, but nowhere in the extensive Account Management pages could these privacy settings be found. While still logged in, in a new browser tab, I visited the URL on the privacy notice ( XXXX ). This URL does not have a form for managing privacy preferences as indicated, but a page with lots of lip service to privacy and security. There is XXXX stylized shield image labeled " Privacy : Learn how we collect and use information '' ( which does not say anything about managing preferences ) and XXXX must simply guess that this is the right place to click to manage preferences. The page this links to shows even more lip service saying that consumers should " Count on us to make your privacy a priority '' but still it 's not obvious how or where one can manage privacy preferences. Scrolling down, there is some information about protecting social security numbers. On this page, only in a small box on the right labeled " Update your privacy choices '' is there a button " below the fold '' to actually update those choices. 

Although these pages contained a " Sign In '' link in the upper right, and I was already signed in to my account ( & not timed out, & could easily navigate on that page in the other browser tab where it was opened ), none of these pages recognized that I was already logged in as an authenticated customer. This remained true in a later test where I used *that* sign-in link on *that* page to create an authenticated session - doing so provided access to my account and the management pages that did not include privacy preferences, but the " privacy '' site would n't recognize that information for the purpose of setting privacy preferences. 

To set preferences, I had to re-enter my full legal name, address, phone, e-mail address ( at least XXXX, manually ), account type and number ( XXXX times, not allowing spaces as printed on statements and the card itself ; the XXXX XXXX entries were cleared out after selecting the account type as Credit Card )XXXX mentally handle XXXX negative defaults that seemed explicitly designed to confuse, and explicitly click off all those defaults. A warning indicated that any tiny error in data entry ( which might include any inconsistency with their records ) might invalidate the whole request. 

In a chat with customer service representative " XXXX XXXX '' I asked why those options to limit information sharing were not available and why all the information had to be repeatedly manually entered. The rep told me that " Your account security is a prime concern to us. That is the only reason we ask to provide all the details. '' When I noted a contradiction there, the representative immediately terminated the chat. Thus, the option in the privacy notice to " Talk to a banking center associate '' might not really be an option as described. 

Making it intentionally significantly harder for customers to protect the privacy and security of their account information ( plus adding additional transmissions of sensitive information ) *reduces* rather than *enhances* both privacy and security. The Bank clearly wants to discourage opt-outs and seems to be doing everything it can to try to minimize the number of customers who successfully complete opt-outs.

Company public response: Company chooses not to provide a public response
Company response to consumer: Closed with explanation