Consumer complaint received 2025-03-19 00:00:00
Product: Credit card — Store credit card
Issue: Other features, terms, or problems — Privacy issues
Company: SYNCHRONY FINANCIAL
State: FL

Complaint narrative:
XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX FL XXXX Phone : XXXX Email : XXXXXXXX XXXX XXXX XXXXXX/XX/XXXX Consumer Financial Protection Bureau Attn : Consumer Response Division XXXX XXXX XXXX XXXX XXXXXXXX IA XXXX Subject : Formal Complaint Unauthorized Disclosure of Financial Information To Whom It May Concern : synchrony bank / Sams club Account number : XXXX XXXX XXXX XXXX I am writing to file a formal complaint with the Consumer Financial Protection Bureau regarding an unauthorized disclosure of my personal financial information by my financial institution. On XX/XX/XXXX, I discovered that [ synchrony bank / Sams club ] had disclosed my confidential financial records ( including detailed account and transaction information ) to an unauthorized third party without my knowledge or consent. I first became aware of this breach when I noticed unfamiliar entries on my credit report and began receiving inquiries from parties with whom I have no relationship. These entries revealed that my bank had shared my nonpublic personal information in a manner I had never approved. I immediately contacted [ synchrony bank / Sams club ] XX/XX/XXXX to report this issue and request an explanation and correction. However, the banks response was unsatisfactory they neither provided a valid justification for the disclosure nor took adequate steps to remediate the damage. To date, my private financial data remains improperly exposed. This experience has caused me significant distress, violated my privacy rights, and potentially harmed my credit reputation. Given the banks unwillingness to resolve the matter, I am seeking the CFPBs intervention to investigate and address these violations. 

This unauthorized reporting/disclosure of my financial information is a direct violation of several federal laws designed to protect consumer privacy. First, it violates the Privacy Act of 1974, which protects personal information held by federal agencies. The Privacy Act mandates that no federal agency shall disclose any record which is contained in a system of records except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains. In other words, agencies are generally prohibited from sharing an individuals personal data without permission. While the institution that disclosed my information is a private financial company ( not a government agency ), the spirit of the Privacy Act underscores the seriousness with which personal financial records must be safeguarded. If any federal entity had custody of or access to my information ( for example, through regulatory databases or inter-agency data sharing ), this disclosure would squarely violate the Privacy Acts provisions. Regardless, the principles of the Privacy Act set a clear expectation that sensitive personal data should remain confidential unless I have authorized its release. 

Second, this breach of confidentiality violates 15 U.S. Code 6802, a provision of the Gramm-Leach-Bliley Act ( GLBA ) governing financial institutions. Under 15 U.S.C. 6802, financial institutions must not disclose a consumers nonpublic personal information to any unaffiliated third party without providing the consumer with proper notice and an opportunity to opt out of such information sharing. In fact, the law requires banks to clearly inform customers about their information-sharing policies and give them the choice to prevent disclosure of their data to nonaffiliated parties. In my case, [ synchrony bank Sams club ] never provided me with any prior notice that it might share my personal financial details with outside parties, nor was I given any opt-out opportunity. I have always maintained a preference for strict privacy and would have expressly refused consent had I been notified. The banks action in sharing my account information without notice or opt-out is a blatant violation of 15 U.S.C. 6802s requirements. There was no lawful exception that would permit the banks disclosure of my nonpublic personal information ( such as account balances, transaction history, and identifying details ) in this context. By failing to comply with GLBAs privacy obligations, [ synchrony bank Sams club ] infringed on my rights to financial privacy and confidentiality.

Third, the unauthorized disclosure of my financial information contravenes the Fair Credit Reporting Act ( FCRA ), specifically the protections surrounding consumer reports. Under FCRA, my financial data ( including account status and payment history ) qualifies as part of my consumer report, as defined in 15 U.S.C. 1681a. This means it is subject to strict controls on disclosure and use. The FCRA stipulates that consumer reporting agencies and furnishers can only share or use a consumer report for certain permissible purposes explicitly outlined by law. In fact, 15 U.S.C. 1681b provides that a consumer reporting agency may furnish a consumer report only under the circumstances allowed by the statute, and no other. In this situation, my banks sharing of my information did not serve any legitimate purpose authorized by the FCRA. I had not applied for new credit, insurance, employment, or any service that would warrant pulling or disseminating my credit information. Nor did I provide written instruction or consent for this disclosure. Thus, there was no permissible purpose under FCRA for [ Name of Bank ] to report or release my financial details. This unauthorized communication of my data runs afoul of FCRAs provisions ( 15 U.S.C. 1681a, 1681b ), which exist to prevent exactly this kind of unwarranted intrusion into a consumers private financial profile. By breaching FCRAs rules on consumer reports, [ Name of Bank ] has potentially exposed itself to liability and caused me harm in the form of privacy invasion and reputational damage.

In light of the above violations and the harm I have experienced, I respectfully request the CFPBs assistance in investigating this matter and pursuing appropriate corrective action. [ synchrony bank Sams club ] has clearly failed to adhere to federal privacy laws, and I urge XXXX XXXXXXXX to use its authority to hold the bank accountable. Specifically, I ask that the CFPB : Investigate the full extent of [ synchrony bank Sams club ] unauthorized disclosures of my personal financial information, including how and why my data was shared, and identify any breaches of federal law or regulations. 
Direct [ synchrony / bank Sams club ] to immediately cease any further unauthorized sharing of my information and to implement measures to ensure full compliance with the Privacy Act ( as applicable ), GLBA, and FCRA going forward. This should include reviewing and improving their privacy policies, employee training, and oversight mechanisms to prevent future violations. 
Obtain relief on my behalf. At minimum, [ synchrony bank Sams club ] should be required to correct any erroneous information resulting from the improper disclosure ( removing any improperly placed entries on my credit report ) and notify all recipients of the information that it was shared in error and without authorization. If my credit score or reputation has been damaged by this incident, the bank should work with credit reporting agencies to restore my good standing.

Consider appropriate enforcement penalties if warranted. Given the seriousness of these privacy violations, the CFPB should evaluate whether civil penalties or other sanctions are necessary to deter [ Name of Bank ] and other financial institutions from similar conduct.

I trust that the CFPB will treat this complaint with the seriousness it deserves. The unauthorized exposure of consumers financial information is a grave matter, and prompt regulatory action is needed to protect my rights and prevent further harm. I appreciate your time and attention to this issue, and I am hopeful that XXXX XXXXXXXX intervention will result in a just resolution. Please keep me informed of the status of this complaint and any findings or actions taken. I am available to provide any additional information or documentation you may require. 

Thank you for addressing this urgent concern. I look forward to your prompt response and a satisfactory resolution of this matter. 

Sincerely, XXXX XXXX

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation