Robert H. Dickman, Esq.
Robert H. Dickman & Associates, P.C.
Suite 1204, Two Penn Center Plaza
1500 J.F. Kennedy Boulevard
Philadelphia, PA 19102-1721
Re: Releasing Consumer Credit Information to Government Employers.
Dear Mr. Dickman:
You have asked whether a federal credit union (FCU) may disclose the names of members with delinquent loans that are employed by the U.S. Department of Defense (DoD) to a DoD officer, either with or without the officer’s request and absent any legal process. You have indicated that these DoD employees must maintain their debts in a non-delinquent status to maintain their security clearance. Your question triggers the Right to Financial Privacy Act, NCUA’s privacy regulations and the Fair Credit Reporting Act. Because your letter does not provide enough detail to answer your question definitively, we have identified the following considerations.
Right to Financial Privacy Act of 1978 (RFPA)
The RFPA provides that “no government authority may have access to . . . information contained in the financial records of any customer from a financial institution” unless, among other exceptions, the customer authorizes the disclosure or the disclosure responds to a formal written request made in compliance with the RFPA. 12 U.S.C. §3402. A “financial record” includes any “information known to have been derived from any record held by a financial institution pertaining to a customer’s relationship with the financial institution.” 12 U.S.C. §3401(2). A list of members with delinquent credit union loans created from the FCU’s records is a financial record. The RFPA defines a “government authority” as “any agency or department of the United States or any officer, employee or agent thereof.” 12 U.S.C §3401(3). An Installation Commander or Base Commander of a DoD Naval Support Station is a government authority under the statute. Therefore, the provisions of the RFPA may apply to a government employer seeking financial records from its employees’ FCU.
The RFPA provides, however, several exceptions and two may apply under the facts you have presented. An FCU may disclose financial records to a government authority if the disclosure is required in accordance with any federal statute or rule. 12 U.S.C. §3413(d). In addition, the RFPA has special procedures for requests from a government authority authorized to conduct foreign counter- or foreign positive-intelligence activities for purposes of conducting such activities. 12 U.S.C. §3414(a)(1)(A). We advise you to research federal law pertaining to the functions of the DoD because it may provide an exception to the general provisions of theRFPA.
12 C.F.R. Part 716 – Privacy of Consumer Financial Information
In accordance with the Gramm-Leach-Bliley Act of 1999 (GLBA), NCUA adopted privacy regulations that restrict a credit union’s ability to disclose nonpublic personal information. 12 C.F.R. Part 716. Our privacy rule generally provides that an FCU, unless otherwise authorized, may not disclose any nonpublic personal information about a consumer to a non-affiliated third party unless four conditions are met. 12 C.F.R. §716.10(a)(1). For an FCU to disclose nonpublic personal information:
- it must provide the consumer with a privacy notice;
- it must provide the consumer an opt-out notice;
- the consumer must have a reasonable opportunity to opt out; and
- the consumer must not have opted out.
Id. “Nonpublic personal information” includes information about a consumer resulting from any transaction involving a financial product or service between the FCU and the consumer, such as account balance information, payment history and overdraft history. 12 C.F.R. § 716.3(q)(1), (r)(1)(ii), (r)(3)(B). Therefore, before disclosing information about a member’s delinquent loan, an FCU must comply with Part 716.
Our privacy regulation, however, does contain exceptions to the notice and opt out requirements that may apply to the facts you have presented. An FCU may disclose nonpublic personal information to a non-affiliated third party, such as the DoD, with the consumer’s unrevoked consent. 12 C.F.R. §716.15(a)(1). An FCU may also disclose this information to the extent specifically permitted or required under the Right to Financial Privacy Act, or in order to comply with federal, state or local laws. 12 C.F.R. §716.15(a)(4), (7).
Fair Credit Reporting Act (FCRA)
The FCRA sets standards for the collection, communication, and use of information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living. 15 U.S.C. §§1681-1681u. An FCU is not subject to the obligations of a consumer reporting agency under the FCRA if the information communicated by the FCU does not constitute a consumer report. The FCRA excludes from the definition of “consumer report” a report containing “information solely as to the transactions or experiences between the consumer and the person making the report.” 15 U.S.C. 1681a(d)(2)(A)(i). “Such ‘transaction or experience’ information includes the length of time the customer has held a credit card issued by the Bank, the number of times the customer has been late in making a payment on such a credit card, and the average monthly balance in the customer’s savings account.”1FTC Informal Staff Opinion Letter from Thomas E. Kane to Michael R. Novak, dated September 9, 1998. The names of members whose FCU loans are delinquent and the details of those delinquencies constitute transaction or experience information derived from the lending relationship between an FCU and its members and, therefore, do not constitute a consumer report under the FCRA.
I hope this will be of assistance to you. Additionally, I would advise you to consult other applicable laws that may require the FCU to provide the information requested by the DoD.
