Privacy Matters: Who Has Access to Your Financial Information?

I just received a cold call from a representative at TD Waterhouse (TWE Quote), my online broker. The person was trying to sell me something. She said she'd been looking over my portfolio. My question is: Just who at an online broker has that kind of access to my account? What gives Waterhouse the right to let strangers look at my holdings? Isn't this private information?

-- Margo Needle

Margo,

You wouldn't want a stream of strangers digging through your file cabinet at home. Unfortunately, due to advances in technology and stepped-up merger activity across the financial-services industry, strangers may have free rein to comb through your personal financial information.

Privacy in the digital age has become an incendiary issue that would have made George Orwell smile. More and more, consumers want to know: Who has access to my personal information? Who is selling it to other business to make a buck? What rights do I have to prevent the spread of my personal data?

An online broker, just like a broker of the bricks-and-mortar variety, has the right to share your personal information freely within its own walls. Furthermore, brokers may share your personal information with banks, insurers and other financial-services companies with whom it is affiliated or has joint-marketing agreements. A broker may also sell your information to outside parties, but thanks to newly adopted rules, they will have to inform you of the policy and you have the right to block them from doing so.

These answers were laid out in the sweeping financial-services overhaul that passed Congress last year. The measure granted banks, brokers and insurers their long-desired wish to merge into conglomerates that offer a range of financial services under one roof. The privacy provisions were aimed at addressing growing concerns about what would happen to a customer's information in this new landscape.

But a host of consumer-privacy issues still linger, such as: Can an insurer that is privy to a person's medical information share that with a bank or broker? President Clinton, amid calls by consumer groups pressing for greater restrictions, recently proposed that consumers should be able to block financial-services firms from sharing personal information with affiliated companies. Firms, naturally, aren't eager to sign off on this proposal, claiming that the need to share information to offer customers a host of services is the whole reason behind the merger boom.

Privacy has become a hot-button issue, and Clinton's proposal isn't likely to be taken up until next year, after election season.

In the meantime, the rules -- and the standard practices that predate them -- are firmly established. In the brokerage business, you'll find that most reputable firms don't sell your information to outside third parties. But they will use your information internally to market and sell additional products to you. Firms will mine your data to figure out if you're an excellent candidate for, say, the next technology fund coming down the pipeline.

"Most of the protections that exist in these areas are aimed at the flow of information to other firms. In general, it's been pretty open within an organization," says Lauren Weinstein, co-founder of People for Internet Responsibility. "The protections against the internal use of such data tend to be pretty lax. That's with practically any business. At the phone company, it's the same."

New rules recently adopted by the Securities and Exchange Commission will formalize privacy standards for the industry and force firms to disclose their privacy policies to their customers. The disclosure required is "probably more detailed than what firms have been doing," says Alan Sorcher, assistant general counsel at the Securities Industry Association, the brokerage industry's trade group.

But the rules, which stemmed from the previously mentioned Gramm-Leach-Bliley Act of 1999, will not really change the status quo. They don't become effective until Nov. 13 and mandatory compliance isn't required until July 1, 2001.

If a firm is planning to sell your information to an unaffiliated third party, you will be able to tell your broker not to share that information with outsiders. Privacy advocates argue that you shouldn't have to opt out of such arrangements, but instead the companies should have to solicit your consent before they can enter into such deals. Furthermore, you won't be able to block your firm from sharing your information with outside firms with whom they have joint-marketing or service relationships.

A firm also will have the freedom to use your information internally and share it among its affiliates, a particularly important point with the number of giant financial services firms being formed through mergers and acquisitions. A brokerage firm will be able to share your financial information with the bank owned by the same parent company or an insurance-company sibling.

"They have to tell you about their policies but you don't have that opt-out option," says Christine Bruenn, chairman of the privacy project group at the North American Securities Administrators Association, the national organization of state securities agencies. "Your only choice is to vote with your feet and go with someone whose privacy policy you approve of," says Bruenn, who is also the securities administrator for the state of Maine.

Before the new rules, "brokerage firms were constrained by ethical standards," adds Bruenn. Each firm likely had its own policy on privacy, but no uniform rules existed for the industry as a whole.

Even before these new regulations, the brokerage industry's practice has been to keep information out of the hands of outsiders. "They do not sell customer lists," says the SIA's Sorcher. "The industry is based on developing customer relationships."

True. It's in the best interest of a brokerage firm to keep your information to itself and keep it out of any potential competitor's hands. They'll also be vigilant in protecting this data. No reputable brokerage firm is going to sell your information to an outsider to make a few bucks, and if your broker informs you of plans to do so, that may be a clue to start shopping for a new broker.

In its privacy policy available on its Web site, Charles Schwab (SCH Quote) clearly states that the firm doesn't sell any personal information to anyone and protects the confidentiality of that information. But the firm's policy does state: "We limit the collection and use of personal information to what is necessary to administer our business and to deliver superior service to you. This may include advising you about our products or services, those of our affiliates, and other opportunities that we believe may interest you."

TD Waterhouse's policy sounds very similar. "We don't believe in selling that information. We believe it's a private relationship. We don't share our customer information with outside third parties," says firm spokeswoman Melissa Gitter. But the firm will use your data to make you aware of products and services.

Frankly, a number of people are going to be able to see your information at any given time. It could be some folks in marketing, people in supervisory roles or those in customer service also needing access to your personal records. Think about it: When you call a firm's toll-free number, the representative on the other end of the line is going to look at your account information. That person may work for an outside company that your broker has hired and could be anywhere in the country.

If you don't want to get phone calls from your broker anymore, you can tell that the person who calls you put you on the firm's do-not call list. But that won't prevent them from looking at your data to figure out if you'd be a prime candidate for some coming bond offering.

Complicating matters are the great strides in technology that enable financial-services companies to more easily share your data. "As long as data was sitting on 3 x 5 index cards, it wasn't subject to widespread dissemination and abuse," says Weinstein.

If you disagree with your broker's privacy policy, you can take your money elsewhere. But ultimately, you'll never really know who is looking at your personal information.

Of course, there's always the mattress.

---

Send your questions and comments to [e-mail], and please include your full name.