On September 4 , 2008, a divided panel of the US Court of Appeals for the Ninth Circuit reinstated part of California's financial privacy law, allowing consumers to prevent banks from sharing certain financial information with affiliated companies.1 While the statute was previously held to be preempted by the federal Fair Credit Reporting Act (FCRA) with respect to affiliate sharing of consumer credit report information, on remand the district court struck all of the affiliate sharing provisions from the law. The appeals court has now reversed that ruling and has directed the district court to reinstate the California law with respect to affiliate sharing of information not covered by FCRA. As a result, it is likely the district court will issue a ruling requiring banks and other financial institutions to afford customers a chance to object before sharing any non-credit information with affiliates. It will not, however, always be clear what types of information this covers.
The California Financial Information Privacy Act (SB1), enacted in 2003, included a broad restriction on the sharing of consumer information with affiliates:
A financial institution shall not disclose to, or share a consumer's nonpublic personal information with, an affiliate unless the financial institution has clearly and conspicuously notified the consumer annually in writing ... that the nonpublic personal information may be disclosed to an affiliate of the financial institution and the consumer has not directed that the nonpublic personal information not be disclosed.
Cal. Fin. Code § 4053(b)(1). In addition, the statute directed that "consumer[s] shall be provided a reasonable opportunity prior to disclosure of nonpublic personal information to direct that nonpublic personal information not be disclosed." Id. § 4053(d)(3). Certain closely affiliated institutions are exempt from these requirements. Id. § 4053(c)(1)-(3).
In 2005, the Ninth Circuit held that, to the extent that California's law restricted the sharing of consumer credit report information with affiliates, i.e., information used for credit, employment, or insurance purposes, the statute was preempted by FCRA. Am. Bankers Ass'n v. Gould, 412 F.3d 1081 (9th Cir. 2005). The court remanded the case for determination of whether any portion of SB1's restriction on affiliate-sharing survived preemption, and if so, whether it was severable from the portion that does not. On remand, the lower court agreed with the American Bankers Association that the affiliate-sharing provision was preempted in its entirety.2
In last week's decision, a different panel of the Ninth Circuit reversed the lower court, finding it permissible to confine the statute to its non-preempted applications by excluding consumer credit report information from its reach. Relying on California Supreme Court precedent, the court held that this outcome would best effectuate the intent of the California Legislature and would give proper effect to the statute's severability clause. The dissent argued that the court lacked power to reform the statute and that it should defer to the Legislature to bring California's law into conformity with federal law.
1Am. Bankers Ass'n v. Lockyer, No. 05-17206 (9th Cir.) (opinion filed Sept. 4, 2008).
2 2005 WL 2452798 (E.D.Cal. 2005).