Lawmakers push for FTC probe into Envestnet data sales

Sens. Ron Wyden (D-Ore.) and Sherrod Brown (D-Ohio) and Rep. Anna Eshoo (D-Calif.) seek to determine whether Envestnet is in violation of the FTC Act’s prohibitions against unfair and deceptive practices. Envestnet operates Yodlee, the largest consumer financial data aggregator in the United States.

According to the lawmakers, Envestnet claims it protects consumers’ privacy by anonymizing personal financial data in its sales of data to other companies, which include 15 of the top 20 largest U.S. banks. However, the lawmakers note researchers have been able to identify the individuals the anonymized data is supposed to belong to with just three or four pieces of information.

At issue to the lawmakers is that Envestnet does not inform consumers it is collecting or selling personal data. “Instead, Envestnet only asks its partners, such as banks, to disclose this information to consumers in their terms and conditions or privacy policy,” the letter reads. “That is not sufficient protection for users. Envestnet does not appear to take any steps to ensure that its partners actually provide consumers with such notice.”

The lawmakers request the FTC conduct a broad industry review “to determine whether Envestnet’s sale of consumers’ personal data to third parties without their knowledge or consent is an unfair, deceptive, or abusive act of practice.” They also ask the regulator to probe the technical controls Envestnet has in place for these sales and whether the information is properly being protected.

“Envestnet | Yodlee is dedicated to improving the financial lives of consumers and does so in compliance with law and regulations and in accordance with leading industry practices for data security, regulatory compliance and privacy,” Envestnet said in a statement in response to the lawmakers’ claims. “Importantly, Envestnet | Yodlee never sells data that identifies consumers.

“We welcome informed discussion about ways to further data privacy as we continue to build on our pioneering work with financial institutions, regulators and other industry experts.”

Wyden similarly pushed for the FTC to investigate Amazon and its role in last year’s Capital One data breach in October. He has also introduced a federal data privacy bill to the Senate, the “Mind Your Own Business Act,” that calls for the “strongest-ever protections for Americans’ private data” and threatens to hold accountable the corporate executives responsible for abuses of information. The bill has been referred to the Committee on Finance.