California’s Financial Information Privacy Act Preempted by Federal Law

Through the Financial Information Privacy Act (“SB1”), the California Legislature was seeking to offer the citizens of California more stringent privacy protections than those afforded under federal law (namely the Fair Credit Reporting Act (“FCRA”), as amended by the Fair and Accurate Credit Transactions Act of 2003, Title V of the Gramm Leach Bliley Act) (see 15 U.S.C. § 1681 et seq.).The American Bankers Association sued the Attorney General of California and other California state officials to challenge SB1’s affiliate sharing provisions on the ground that they are preempted by federal law. The District Court granted their motion for summary judgment. On appeal, the Ninth Circuit held that SB1’s affiliate sharing provision was preempted, but only to the extent that it applies to information covered by the FCRA (i.e. information shared between affiliates concerning consumers’ “credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used, expected to be used, or collected for the purpose of establishing eligibility for credit or insurance, employment, or other authorized purposes.”) (see Am. Bankers Ass'n v. Gould, 412 F.3d 1081, 1087).

In this case, the District Court found that there might in theory be some information that does not meet the definition under FCRA, and would thus not be preempted by federal law. However, the Court found that a financial institution might gather and share information with its affiliates “believing in good faith that it is not required to comply with SB1 because the information will be used for an FCRA authorized purpose.” Subsequently, if the information is not so used, the financial institution would have violated SB1. This, according to the Court, would place the financial institutions in an “untenable situation.” Furthermore, if SB1’s requirements must be respected when information is collected for both authorized and non-authorized purposes under FCRA, FCRA’s preemption clause would necessarily be violated. The Court thus held that the scope of the FCRA did not “in practice” allow financial institutions to delineate in advance what information enjoys federal protection and which does not.

Even if there were any part of SB1's affiliate sharing provision spared from unconstitutionality, the District Court found that the only means of severing those from the unconstitutional portions would be to “rewrite SB1”. Accordingly, no portion of SB1’s affiliate sharing provision could survive.

The Court held that the standard for declaratory relief is met, and issued a permanent injunction against the California state officials from enforcing SB1’s affiliate sharing provisions.

Add new comment