Huvelle's decision, filed April 30 but not disseminated until Monday, is a blow to credit reporting agencies, which do brisk business selling names, addresses and Social Security numbers, along with other data, to marketers and other entities. The act requires the FTC, along with other government bodies such as the Federal Reserve and the Federal Deposit Insurance Corporation, to establish and enforce rules to protect the privacy of personal data used by financial institutions. The law covers firms ranging from banks and insurance companies to mortgage lenders and retailers who offer their own credit accounts. As of July 1, it requires financial institutions to provide customers with annual privacy notices and the chance to prevent the sharing of their data with third parties in many circumstances. Financial institutions have spent months studying their internal data handling and preparing mass mailings to their customers to comply with the law.
Consumer advocates say the law has too many loopholes to be effective.
The FTC's rule applies the law to credit header information, such as names, addresses and Social Security numbers that credit reporting agencies obtain from banks and other sources. The agencies resell credit header information, sometimes combined with other data, to marketing firms and individual reference services, such as those offered by Lexis-Nexis. The FTC rule generally forbids such reuses of credit header information obtained from financial institutions, unless the institution tells its customers that it shares their data with credit reporting agencies and gives them a chance to forbid it. Judge Huvelle recognized that Congress left considerable discretion to the agencies, and that the agencies exercised that discretion in a reasonable manner, consistent with both the statute and the First Amendment. Privacy Policy Stock data provided by Stockpoint and its data suppliers.