Lawmakers call for FTC probe into top financial data aggregator

Lawmakers call for FTC probe into top financial data aggregator
© Aaron Schwartz

A group of lawmakers on Friday called on the Federal Trade Commission (FTC) to investigate one of the top financial data aggregators in the U.S., questioning whether it is collecting reams of sensitive information on Americans without adequate consent. 

Sens. Ron WydenRonald (Ron) Lee WydenSenate parliamentarian looms over White House spending bill Democrats push tax credits to bolster clean energy Five reasons for concern about Democrats' drug price control plan MORE (D-Ore.) and Sherrod BrownSherrod Campbell BrownSenate race in Ohio poses crucial test for Democrats Powell says Fed will consider faster taper amid surging inflation Biden faces new pressure from climate groups after Powell pick MORE (D-Ohio), alongside Rep. Anna EshooAnna Georges EshooHillicon Valley — Chinese disinformation accounts removed House passes bipartisan bills to strengthen network security, cyber literacy Democrats to target Section 230 in Haugen hearing MORE (D-Calif.), said the FTC should probe Envestnet, a huge financial services company that owns the largest consumer financial data aggregator in the U.S. The probe comes as Congress has intensified its scrutiny of large corporations collecting personal information on nearly every American. 

“The consumer data that Envestnet collects and sells is highly sensitive," Wyden, Brown and Eshoo wrote in a letter to the FTC. "Consumers’ credit and debit card transactions can reveal information about their health, sexuality, religion, political views, and many other personal details."

ADVERTISEMENT

"And the more often that consumers’ personal information is bought and sold, the greater the risk that it could be the subject of a data breach," they added.

Envestnet said in a statement Friday that it "is dedicated to improving the financial lives of consumers and does so in compliance with law and regulations and in accordance with leading industry practices for data security, regulatory compliance and privacy." 

"We welcome informed discussion about ways to further data privacy as we continue to build on our pioneering work with financial institutions, regulators and other industry experts," the company said, noting that it scrubs any personal identifiers from its financial data.

Envestnet owns Yodlee, a financial data aggregator used by 15 of the 20 largest banks in the country to offer personal finance tools for customers. Lawmakers are raising concerns that customers aren't given proper notice that Envestnet will collect and sell access to their information.

"Envestnet does not inform consumers that it is collecting and selling their personal financial data," they wrote. "Instead, Envestnet only asks its partners, such as banks, to disclose this information to consumers in their terms and conditions or privacy policy. That is not sufficient protection for users."

Democrats are asking the FTC to look into whether Envestnet's practices are unfair, deceptive or abusive.

Yodlee says it anonymizes the financial data it sells, meaning it does not identify individuals associated with their personal information. But studies have shown that it is relatively easy to "de-anonymize" data, drawing back the information to individual people.

Updated at 2:54 p.m.