A group of lawmakers on Friday called on the Federal Trade Commission (FTC) to investigate one of the top financial data aggregators in the U.S., questioning whether it is collecting reams of sensitive information on Americans without adequate consent.
Sens. Ron Wyden (D-Ore.) and Sherrod Brown (D-Ohio), alongside Rep. Anna Eshoo (D-Calif.), said the FTC should probe Envestnet, a huge financial services company that owns the largest consumer financial data aggregator in the U.S. The probe comes as Congress has intensified its scrutiny of large corporations collecting personal information on nearly every American.
“The consumer data that Envestnet collects and sells is highly sensitive,” Wyden, Brown and Eshoo wrote in a letter to the FTC. “Consumers’ credit and debit card transactions can reveal information about their health, sexuality, religion, political views, and many other personal details.”
“And the more often that consumers’ personal information is bought and sold, the greater the risk that it could be the subject of a data breach,” they added.
Envestnet said in a statement Friday that it “is dedicated to improving the financial lives of consumers and does so in compliance with law and regulations and in accordance with leading industry practices for data security, regulatory compliance and privacy.”
Envestnet owns Yodlee, a financial data aggregator used by 15 of the 20 largest banks in the country to offer personal finance tools for customers. Lawmakers are raising concerns that customers aren’t given proper notice that Envestnet will collect and sell access to their information.
“Envestnet does not inform consumers that it is collecting and selling their personal financial data,” they wrote. “Instead, Envestnet only asks its partners, such as banks, to disclose this information to consumers in their terms and conditions or privacy policy. That is not sufficient protection for users.”
Democrats are asking the FTC to look into whether Envestnet’s practices are unfair, deceptive or abusive.
Yodlee says it anonymizes the financial data it sells, meaning it does not identify individuals associated with their personal information. But studies have shown that it is relatively easy to “de-anonymize” data, drawing back the information to individual people.
Updated at 2:54 p.m.