A federal district court in Sacramento (England, J.) has found the "affiliate-sharing" provisions of "SB-1" preempted by the FACT Act. Better known as SB-1, California’s Financial Information Privacy Act (Fin. Code §4050) marked a sharp departure from federal privacy laws by requiring customer "opt-in" consent when financial institutions share nonpublic customer information with non-affiliates, and "opt-out" consent even when sharing such information with affiliates. This created compliance headaches, because an institution might have different "bundles" of customer information, each subject to a different privacy regime.
In June, in a suit brought by the American Bankers Association, the Financial Services Roundtable, and the Consumer Bankers Association, the Ninth Circuit held that SB-1 was preempted by the FACT Act’s "affiliate-sharing" preemption clause (15 U.S.C. § 1681a(d)(1). However, it remanded back to the district court to determine exactly which provisions of SB-1 were, and were not, preempted. (American Bankers Association v. Gould, 412 F.3d 1081 (9th Cir. 2005).)
On October 4th, the district court ruled. It found that all of SB-1’s "affiliate-sharing" provisions were preempted in their entirety:
"Plaintiffs argue ... that it would be virtually impossible to ascertain in advance whether or not information collected and shared by a financial institution would satisfy an FCRA authorized purpose. Plaintiffs contend that parsing what information meets the purpose prong of information as defined by FCRA versus that which does not would cast a cloud of uncertainty over the preemption that Congress has decreed in the FCRA. This Court agrees."
The court went on to discuss whether the unconstitutional affiliate sharing provisions could be severed, thus leaving other parts of SB-1 intact. The defendants—state regulators and the California Attorney General—argued that because some portions of the SB-1affiliate sharing provisions were not preempted, the court should strike only the tainted provisions and leave the rest. For example, defendants argued that information a financial institution collects solely to determine whether an individual is likely to purchase a product is not "information" as defined by Section 1681a(d)(1) and, therefore, should be "saved" from preemption. Judge England declined, noting that this would be tantamount to having a federal judge rewrite state law. He thought that was a legislative and not a judicial function, and would be particularly inappropriate given that this was a state enactment.
The court entered judgment for declaratory relief in favor of the plaintiffs, holding that all of SB-1’s "affiliate-sharing" provisions are preempted. It also issued a permanent injunction against enforcement of SB-1’s affiliate-sharing provisions by the defendant-regulators.
Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.
© Morrison & Foerster LLP. All rights reserved
