Consumer complaint received 2025-08-29 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Other features, terms, or problems — Privacy issues
Company: BARCLAYS BANK DELAWARE
State: CT

Complaint narrative:
I am filing this complaint because Barclays Bank Delaware has repeatedly mishandled my personal information, in violation of federal data protection obligations under the GrammLeachBliley Act ( GLBA ) and related consumer protection rules.

Background : I previously had an old email address on file with Barclays. I later updated my account to a new email address because the old one had been compromised.

When I applied for a new account using my current, valid email address, Barclays began sending sensitive account-related emails ( including my legal name and product type ) to my old, compromised email address even though that address is no longer associated with my account. 
This disclosure of nonpublic personal information ( NPI ) to an unauthorized channel is a violation of the GLBA Safeguards Rule ( 15 U.S.C. 68016809 ; 16 C.F.R. Part 314 ), which requires financial institutions to implement reasonable measures to protect the confidentiality and integrity of customer information. 

XXXX XXXX ( XX/XX/XXXX ) : I contacted Barclays Security Department after receiving an account email at my old, compromised email address. 
I was told it may be a phishing email, but upon verification it was confirmed to be an authentic Barclays communication. 
The representative admitted the old email was still in Barclays system, and stated it would be removed. 
I also requested a verbal password be added for additional security. The representative confirmed it was set up. 
I was instructed to forward the proof to XXXX, which I did. Barclays has therefore received direct evidence of this breach. 

XXXX XXXX ( XX/XX/XXXX, 3 days later ) : I again received an account email at the old, compromised address. 
I called Barclays Security later in the week. During this call, I was not asked to provide the verbal password I had set up earlier. 
The representative then informed me that no verbal password had been established, contradicting what I was told in the first call. She then set one up at that time.

Violations/ Failures 1. Violation of GLBA Safeguards Rule ( 15 U.S.C. 6801 ( b ) ; 16 C.F.R. Part 314 ) Barclays failed to properly update customer records and continued transmitting nonpublic personal information ( my name and account type ) to an unauthorized, compromised email address. 
Barclays ignored my explicit notification that the old address was unsafe, knowingly disclosing sensitive information to a channel at risk of interception. 
2. Failure to Implement Reasonable Security Procedures Barclays failed to implement a verbal password as requested and confirmed, undermining authentication controls designed to protect against account takeover and fraud. 
The failure to even request the password during subsequent calls shows a lack of consistent enforcement of security protocols. 
3. Potential Violation of State Breach Notification Laws By transmitting customer data to an unauthorized third party after being informed of the risk, Barclays may have triggered obligations under state data breach notification statutes ( e.g., Delaware Code 12B-101 et seq. ). I have never received any formal notice from Barclays acknowledging this as a data breach.

4. Consumer Protection Concerns under CFPB Oversight These failures constitute unfair and unsafe practices by a national bank, exposing me to identity theft, phishing, and fraud.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation