Consumer complaint received 2024-11-04 00:00:00
Product: Credit reporting or other personal consumer reports — Credit reporting
Issue: Improper use of your report — Reporting company used your report improperly
Company: NAVY FEDERAL CREDIT UNION
State: CO

Complaint narrative:
I have recently become aware of Navy Federal Credit Union 's practices concerning the sharing of my personal nonpublic information with nonaffiliated third parties. I hereby opt out of all current and future disclosures of my personal information to nonaffiliated parties. I am writing to demand an immediate cease and desist in the sharing of my information with any and all such nonaffiliated entities as well as remedy for each unauthorized disclosure. My request is based on Navy Federal Credit Unions apparent failure to comply with both federal consumer privacy protections mandated under the Gramm-Leach-Bliley Act ( GLBA ), specifically under 15 U.S.C. 6802 ( b ), and Navy Federals own published privacy policy.

According to 15 U.S.C. 6802 ( b ), Navy Federal Credit Union is required to : XXXX. Provide a Clear and Conspicuous Disclosure Prior to sharing my personal nonpublic information with any nonaffiliated third parties, Navy Federal Credit Union must issue a clear and conspicuous disclosure regarding its information-sharing practices. Navy Federal has provided personal information sharing policies indicating my non-public information is not shared with non-affiliates but has, in contravention of its stated policy, shared and consumed my non-public information, without my approval, with or from no fewer than XXXX non-affiliated companies over the last XXXX years. 
XXXX. Offer an Opt-Out Opportunity I should have been given the opportunity, prior to any information-sharing activities, to direct Navy Federal Credit Union not to disclose my personal information to non-affiliates. No such notice or opportunity to opt out has been provided to me prior to daily or monthly disclosure violating my privacy and several statutes.

3. Explain the Nondisclosure Option The law requires Navy Federal Credit Union to provide me with clear instructions on how I may exercise my option to opt out of information sharing. No explanation or instructions have been offered to me. 
Furthermore, Navy Federal is operating in a manner that is inconsistent with its own published privacy policy. According to their XXXX  privacy publication, XXXX Navy Federal NFCU 198 ( XXXX ), Navy Federal defines Nonaffiliates as : " Companies not related by common ownership or control. They can be financial and non-financial companies. '' This definition aligns with the definition of nonaffiliates under 15 U.S.C. 6809 ( 5 ), which specifies that a nonaffiliated third party is any entity not related by common ownership or affiliated by corporate control with the financial institution. Under both the Navy Federal policy and federal law, any company without common ownership or control with Navy Federal Credit Union qualifies as a nonaffiliated third party, and disclosures to these entities should be governed by the XXXX opt-out requirements. 
Under this definition, entities such as XXXX, XXXX, XXXX, Early Warning, XXXX, and other similar organizations are considered nonaffiliated companies. Despite this, Navy Federal Credit Union has shared my information with these entities regularly over the course of decadeson both daily and monthly schedules. 
Navy Federal Credit Unions unauthorized sharing of my personal nonpublic information with credit reporting agencies not only violates the XXXX XXXX XXXX XXXX ) but also fails to meet the permissible purpose standards under the Fair Credit Reporting Act ( FCRA ). 
Under XXXX, financial institutions are required to protect the privacy of consumers ' nonpublic personal information by providing clear disclosures and an opportunity to opt out before sharing this information with non-affiliated third parties. Navy Federals failure to obtain my consent or provide me with an opt-out option constitutes a breach of this requirement, rendering these disclosures unauthorized. 
The Fair Credit Reporting Act ( FCRA ) specifies that any disclosure of consumer information to a third party must have a permissible purpose. Given Navy Federals failure to comply with XXXX opt-out and disclosure mandates, these unauthorized transfers to credit reporting agencies do not meet the permissible purpose standard under FCRA ( 15 U.S.C. 1681b ). As a result, each unauthorized disclosure constitutes a FCRA violation. 
Therefore, each unauthorized record transfer, as verifaiable in my credit reports, early warning report and other non-affillate oragniaztions, qualifies as a violation under FCRA, with statutory damages of up to {$1000.00} per violation authorized under 15 U.S.C. 1681n for willful non-compliance. Over the last XXXX years this amounts to thousands of unauthorized disclosures and over $ XXXX in fines. 
As a direct result of Navy Federal Credit Unions failure to acquire my consent and provide an option to opt out of sharing my nonpublic personal information, my data has subsequently been disclosed to third parties without authorization. Specifically, the XXXX major credit reporting agenciesTransUnion, XXXX, and XXXX well as Early Warning, have all accessed and disclosed my nonpublic information without my consent. 

At no time did I provide consent for these agencies to receive or share my personal information with other parties, and Navy Federals initial failure to provide a clear and conspicuous opt-out option has perpetuated ongoing unauthorized disclosures. Each instance of data shared with these agencies has exposed my personal information to further dissemination without proper authorization, in direct violation of my privacy rights. 

Moreover, just as Navy Federal is obligated under the XXXX XXXX XXXX XXXX ) and Fair Credit Reporting Act ( FCRA ) to protect my nonpublic personal information, these agencies are similarly bound to adhere to XXXX and FCRA standards. This includes obtaining a permissible purpose and proper authorization before disclosing consumer data to any third parties. By failing to meet these requirements, the credit reporting agencies and Early Warning have disregarded essential consumer protections, compounding the privacy violations initiated by Navy Federal. 

Without my express consent or opt-out opportunity, both Navy Federal and these agencies have disregarded GLBAs requirements to protect the privacy of my data and FCRAs permissible purpose standard. These collective actions have resulted in multiple unauthorized disclosures of my nonpublic information, extending beyond Navy Federal to include any parties with whom these agencies have further shared my data. This ongoing dissemination of my private information underscores the seriousness of these violations and the need for immediate resolution.

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with explanation