Consumer complaint received 2024-10-01 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Improper use of your report — Reporting company used your report improperly
Company: Early Warning Services, LLC
State: TN

Complaint narrative:
I am writing this letter due to receiving my Early Warning report from Early Warning Services ( hereinafter EWS ). The companys very existence goes against every Privacy law that is on the books as they are tracking and reporting your daily banking account balance. I have never signed a contract with EWS nor done any direct business with them besides requesting the report. Firstly, Id like to verify their written consent by me the consumer to collect this information, and secondly then provide/sell the information to any affiliates. Thirdly, Id like to evaluate their assumed authority to maintain these types of records. Any and all written, unwritten, verbal and non-verbal consent they have assumed they had has now and will ALWAYS be revoked until time immemorial. 
The following is directly from EWSs prospectus. GLBA stands for the Gramm Leach Bliley Act.

GLBA. To the extent that any information obtained by the Receiving Party is nonpublic personal information about consumers or customers as such terms are defined in GLBA and in regulations issued thereunder ( collectively, Consumer Data ), then in addition to the obligations of the Receiving Party under this Section 7, the Receiving Party agrees that it will not disclose or use such Consumer Data provided to it by the Disclosing Party under this Agreement other than to carry out the purpose of this Agreement or in any manner prohibited by the GLBA or the regulations issued thereunder. The Receiving Party further covenants and agrees to maintain appropriate measures designed to meet the objectives of the applicable guidelines establishing information security standards as adopted by any federal regulatory agencies having jurisdiction over Receiving Partys affairs. These measures include appropriate disposal of Consumer Data, as required, and taking appropriate actions to address incidents of unauthorized access to sensitive Consumer Data, including notification to the other Party as soon as possible of any such incident. Without limiting the foregoing, each Party represents and warrants that its information security program is designed to : ( i ) ensure the security and confidentiality of Consumer Data ; ( ii ) protect against any anticipated threats or hazards to the security or integrity of such data ; and ( iii ) protect against unauthorized access to or use of such data that could result in substantial harm or inconvenience to any consumer.

7.8 Security Breach. In the event of a breach in security resulting in actual or suspected loss of or unauthorized access to any Customer Data, the breached Party shall : ( a ) immediately notify the other Party of the breach both orally and in writing ; ( b ) promptly conduct a forensics examination to determine to what extent such information was compromised ; ( c ) promptly provide to the other Party, in writing, details concerning the breach, including ( i ) nature and impact of the breach, ( ii ) assessment of immediate risk due to the breach, ( iii ) corrective actions already taken, and ( iv ) corrective actions to be taken ; ( d ) promptly cooperate with the other PartXXXX and any affected consumers, regulators and law enforcement to assist in regaining possession of the information and prevent its further unauthorized use and to notify affected consumers if required by applicable laws ; ( XXXX ) promptly take the corrective actions identified in ( iv ) above ; and ( f ) promptly take measures to restore and enhance its security policies and procedures to avoid further breaches. 
The problem is that EWS having any banking information is a Breach of not only my own security, but the public in an of itself. 

1. Unauthorized Reporting of Nonpublic Personal Information According to 16 CFR 313.3 ( 1 ), nonpublic personal information includes personally identifiable financial information, as well as any consumer information derived from it. XXXX has been specifically asked to remove all loans and financial data from my credit report due to the lack of written consent, yet this information remains on record. This failure to remove the information constitutes knowing and willful misconduct, with the intent to cause continuous harm. Their ongoing actions violate my rights under privacy regulations. 
XXXX. Violation of the Gramm-Leach-Bliley Act ( GLBA ) EWSs actions violate the Gramm-Leach-Bliley Act by disseminating nonpublic personal information ( NPI ) without my explicit consent. Under XXXX USC 6821 ( b ), sharing this type of data without providing the necessary opt-out notices constitutes a violation of privacy regulations. Nonpublic personal information includes : Names Addresses Phone numbers Social Security numbers Income Credit score Account numbers Payment history Loan or deposit balances Credit or debit card purchases I demand the immediate cessation of these unauthorized practices and require the correction of all unauthorized information sharing.

Violation of Consumer Rights : The Credit Bureaus appear to exploit consumer data without proper consent or transparency, which contradicts their legal obligations under 15 USC 1681. Specifically : Consumer Report Accuracy : Under 15 USC 1681 ( d ), a consumer report must accurately reflect a consumer 's creditworthiness, credit standing, and other personal characteristics used to determine eligibility for credit or insurance. However, EWS frequently provides a peak into your bank accounts affecting consumers ' financial lives adversely.

Disclosure and Consent : According to 5 USC 552a ( 8 ) ( a ) ( B ) ( ii ), matching programs must not use data to make decisions about individuals ' rights, benefits, or privileges EWS provides accurate and verified banking information so that their affiliates can make adverse decisions about consumers ' credit which is a direct violation of this regulation. What else would EWS collect and maintain this information for?

Penalties for Non-Compliance : Both 15 USC 1681m ( a ) ( b ) and 5 USC 552a ( i ) ( 1 ) outline penalties for willfully disclosing or maintaining records without proper consent. Given the practices of the Credit Bureaus, including unauthorized data sharing and lack of transparency, they appear to be in violation of these provisions.

Consumer Report and Information Sharing Section 603 ( d ) ; 15 U.S.C. 1681a ( d ) Section 603 ( d ) defines a consumer report to include information about a consumer such as that which bears on a consumers creditworthiness, character, and capacity among other factors. Communication of this information may cause a person, including a financial institution, to become a consumer reporting agency. The statutory definition contains key exceptions to this definition that enable persons to share this type of information under certain circumstances, without becoming consumer reporting agencies. Specifically, the term consumer report does not include : 1. A report containing information solely as to transactions or experiences between the consumer and the person making the report. A person, including a financial institution, may share information strictly related to its own transactions or experiences with a consumer ( such as the consumers payment history, or an account with the institution ) with any third party, without regard to affiliation, without becoming a consumer reporting agency. The Privacy of Consumer Financial Information regulations that implement the Gramm-Leach-Bliley Act ( GLBA ) may restrict this type of information sharing because it meets the definition of nonpublic personal information under the Privacy regulations. Therefore, sharing it with nonaffiliated third parties may be subject to an opt-out notice under the privacy regulations.

I have a question for the CFPB. How do you opt out of a company if you are unaware of its existence?

Per 15 USC 1681 604 ( a ) ( 2 ) : " In general Subject to subsection ( c ), any consumer reporting agency may furnish a consumer report under the following circumstances and no other : in accordance with the written instructions of the consumer to whom it relates Again, EWSs prospectus states the following : WHEREAS, Early Warning offers a suite of services to help prevent fraud, reduce losses, and protect consumers, including without limitation the Alert Services ( as defined below ) ( EWS Services ) ; WHEREAS, Service Provider provides consumer identity protection and credit monitoring services to help protect consumers ; Nowhere does it state it offers your banking information to their affiliates. Wouldnt that make EWS a consumer reporting agency of maintaining records full of unlawful information for their affiliates? What would constitute the Security Exchange Commission becoming involved in the malicious actions of EWS? The fact that their prospectus exists means they are very much aware of the Privacy Act laws but disregarded them anyway.

Noncompliance with 5 USC 552a ( e ) : According to 5 USC 552a ( e ), agencies maintaining records must : Maintain only relevant and necessary information about individuals.

Publish notices in the Federal Register detailing the system of records, including the categories of records and routine uses.

Ensure records used in decision-making are accurate, timely, and complete.

Can someone please point me to the section where your daily account balance being reported is not an invasion of privacy? Especially if you have never done any business or signed contracts with them?

Requests for Immediate Action : Cease Unauthorized Reporting : EWS must immediately halt the reporting of any nonpublic personal information or personally identifiable financial information without explicit written consent from the affected consumers. I require assurance that my banking information has been deleted from their files. EWS having maintaining the daily account balances of consumers shows they are willfully and knowingly causing harm with the intent to sell/furnish it to their affiliates who also should not have the record. How does a so called credit monitoring company have banking information? This is a huge violation of privacy and they need to be held accountable.

Please address these issues promptly to ensure compliance with federal privacy regulations and protect consumer rights. Failure to rectify these violations will compel me to explore further legal avenues to ensure my rights and those of other consumers are upheld.

Company response to consumer: Closed with explanation