Consumer complaint received 2024-11-04 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Improper use of your report — Reporting company used your report improperly
Company: TRANSUNION INTERMEDIATE HOLDINGS, INC.
State: CO

Complaint narrative:
I have recently become aware of XXXX XXXX XXXX XXXX 's practices concerning the sharing of my personal nonpublic information with nonaffiliated third parties. I hereby opt out of all current and future disclosures of my personal information to nonaffiliated parties. I am writing to demand an immediate cease and desist in the sharing of my information with any and all such nonaffiliated entities as well as remedy for each unauthorized disclosure. My request is based on XXXX XXXX XXXX XXXX apparent failure to comply with both federal consumer privacy protections mandated under the Gramm-Leach-Bliley Act ( GLBA ), specifically under 15 U.S.C. 6802 ( b ), and XXXX XXXX own published privacy policy. 
According to 15 U.S.C. 6802 ( b ), XXXX XXXX XXXX XXXX is required to : XXXX. Provide a Clear and Conspicuous Disclosure Prior to sharing my personal nonpublic information with any nonaffiliated third parties, XXXX XXXX XXXX XXXX must issue a clear and conspicuous disclosure regarding its information-sharing practices. XXXX XXXX has provided personal information sharing policies indicating my non-public information is not shared with non-affiliates but has, in contravention of its stated policy, shared and consumed my non-public information, without my approval, with or from no fewer than XXXX non-affiliated companies over the last XXXX years. 
XXXX. Offer an Opt-Out Opportunity I should have been given the opportunity, prior to any information-sharing activities, to direct XXXX XXXX XXXX XXXX not to disclose my personal information to non-affiliates. No such notice or opportunity to opt out has been provided to me prior to daily or monthly disclosure violating my privacy and several statutes. 
XXXX. Explain the Nondisclosure Option The law requires XXXX XXXX XXXX XXXX to provide me with clear instructions on how I may exercise my option to opt out of information sharing. No explanation or instructions have been offered to me. 
Furthermore, XXXX XXXX is operating in a manner that is inconsistent with its own published privacy policy. According to their 2021 privacy publication, 2021 XXXX XXXX XXXX XXXX ( XXXX ), XXXX XXXX defines Nonaffiliates as : " Companies not related by common ownership or control. They can be financial and non-financial companies. '' This definition aligns with the definition of nonaffiliates under 15 U.S.C. 6809 ( 5 ), which specifies that a nonaffiliated third party is any entity not related by common ownership or affiliated by corporate control with the financial institution. Under both the XXXX XXXX policy and federal law, any company without common ownership or control with XXXX XXXX XXXX XXXX qualifies as a nonaffiliated third party, and disclosures to these entities should be governed by the XXXX opt-out requirements. 
Under this definition, entities such as TransUnion, XXXX, XXXX XXXX XXXX XXXXXXXX, and other similar organizations are considered nonaffiliated companies. Despite this, XXXX XXXX XXXX XXXX has shared my information with these entities regularly over the course of decadeson both daily and monthly schedules. 
XXXX XXXX XXXX XXXX unauthorized sharing of my personal nonpublic information with credit reporting agencies not only violates the XXXX XXXX XXXX XXXX  ) but also fails to meet the permissible purpose standards under the Fair Credit Reporting Act ( FCRA ). 
Under XXXX financial institutions are required to protect the privacy of consumers ' nonpublic personal information by providing clear disclosures and an opportunity to opt out before sharing this information with non-affiliated third parties. XXXX XXXX failure to obtain my consent or provide me with an opt-out option constitutes a breach of this requirement, rendering these disclosures unauthorized. 
The Fair Credit Reporting Act ( FCRA ) specifies that any disclosure of consumer information to a third party must have a permissible purpose. Given XXXX XXXX failure to comply with GLBAs opt-out and disclosure mandates, these unauthorized transfers to credit reporting agencies do not meet the permissible purpose standard under FCRA ( 15 U.S.C. 1681b ). As a result, each unauthorized disclosure constitutes a FCRA violation. 
Therefore, each unauthorized record transfer, as verifaiable in my credit reports, early warning report and other non-affillate oragniaztions, qualifies as a violation under FCRA, with statutory damages of up to {$1000.00} per violation authorized under 15 U.S.C. 1681n for willful non-compliance. Over the last XXXX years this amounts to thousands of unauthorized disclosures and over $ XXXX in fines. 
As a direct result of XXXX XXXX XXXX XXXX failure to acquire my consent and provide an option to opt out of sharing my nonpublic personal information, my data has subsequently been disclosed to third parties without authorization. Specifically, the XXXX major credit reporting agenciesTransUnion, XXXX, and XXXX well as XXXX XXXX  have all accessed and disclosed my nonpublic information without my consent. 

At no time did I provide consent for these agencies to receive or share my personal information with other parties, and XXXX XXXX initial failure to provide a clear and conspicuous opt-out option has perpetuated ongoing unauthorized disclosures. Each instance of data shared with these agencies has exposed my personal information to further dissemination without proper authorization, in direct violation of my privacy rights. 

Moreover, just as XXXX XXXX is obligated under the XXXX XXXX XXXX XXXX ) and Fair Credit Reporting Act ( FCRA ) to protect my nonpublic personal information, these agencies are similarly bound to adhere to XXXX and FCRA standards. This includes obtaining a permissible purpose and proper authorization before disclosing consumer data to any third parties. By failing to meet these requirements, the credit reporting agencies and Early Warning have disregarded essential consumer protections, compounding the privacy violations initiated by XXXX XXXX. 

Without my express consent or opt-out opportunity, both XXXX XXXX and these agencies have disregarded GLBAs requirements to protect the privacy of my data and FCRAs permissible purpose standard. These collective actions have resulted in multiple unauthorized disclosures of my nonpublic information, extending beyond XXXX XXXX to include any parties with whom these agencies have further shared my data. This ongoing dissemination of my private information underscores the seriousness of these violations and the need for immediate resolution.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with non-monetary relief