WEDNESDAY MARCH 10, 2021 VOL. 186 No. 46 AMERICANBANKER.COM Follow us on Twitter @AmerBanker Pandemic has redefined role 5 of bankers: New ICBA chair Protecting privacy “We were already shifting to recruiting more problem solvers than people handling Virginia and California have enacted laws that give consumers transactions,” said Robert Fisher, CEO of more control over their personal data. Both measures: Tioga State Bank in New York and incoming chairman of the Independent Community See story on page 2 Bankers of America. “That pace of change has accelerated.” Page 5 Require companies to give consumers access to their personal information Berkshire Hills reaches 6 truce with activist investor Allow consumers to ask companies to delete their personal HoldCo Asset Management, which gains two information board seats from a standstill agreement, had expressed disappointment that the Boston Allow consumers to correct inaccuracies in their personal data company hired a CEO instead of pursuing a sale. Page 7 Allow consumers to opt out of the processing of their data for advertising or sales purposes PayPal to acquire Curv 7 to further its push into cryptocurrencies Allow consumers to collect copies of data files companies PayPal Holdings Inc. said it will acquire have collected on them the cryptocurrency firm Curv as it seeks to beef up its talent pool for handling digital Require companies to comply with consumer requests within currencies. Page 7 45 days FDIC chair hopes regulators 8 will ‘come together’ on CRA reform: Report dailybriefing Fed will continue supporting The comments by Federal Deposit Insurance 3 PPP loans until June 30 Corp. Chair Jelena McWilliams published in Nonbanks had worried the end of the Politico reinforce optimism that the banking State data privacy laws Paycheck Protection Program Liquidity agencies could settle years of disagreement 1 pose compliance Facility would hurt their ability to lend to about modernizing the Community headaches for banks small businesses. On Monday, the Federal Reinvestment Act. Page 7 New measures in California and Virginia Reserve announced the facility would be give consumers more control over their extended for three months. Page 5 Goldman weighs plan information and may prevent banks from 9 for $29 billion of debt using geolocation services or analyzing Wells Fargo targets set to outlive Libor personal data without obtaining consent first 4 net-zero emissions Goldman Sachs is evaluating what to do with — except when preempted by federal law. after rivals set goals about $29 billion of debt and preferred stock (See chart above.) Page 2 The bank also committed to finance $500 it issued that’s pegged to dollar Libor and billion in sustainable businesses and doesn’t mature until after the discredited SoFi buying small California projects by 2030. Page 5 benchmark expires in mid-2023. Page 8 2 bank for $22.3 million The acquisition of Golden Pacific Bank Disclosure’s great, but will accelerate the online lender’s effort to 10 what consumers really become a full-service bank. Page 4 need is protection In “Democracy Declined,” Duke public policy professor Mallory SoRelle argues that policymakers should be more aggressive in combating unfair lending practices. Page 8 WEDNESDAY MARCH 10, 2021 AMERICANBANKER.COM PAGE 2 Here are answers to key questions and California laws.” CONSUMER BANKING surrounding the new Virginia law and The California law exempts data that updated California law. banks already protect under Gramm- Leach-Bliley. But banks must comply with State data When do the new laws take effect? the California rules for any data that is not Both are effective Jan. 1, 2023. However, covered by the federal law. privacy the California Privacy Rights Act of 2020 Gramm-Leach-Bliley covers all personal has a 12-month look-back period. This data on people who use a bank’s products means that when consumers make a request and services, including their browser history. laws pose for access to their personal information, It does not cover data gathered from people companies are required to provide records who are not customers. So if someone goes compliance covering the year preceding the date of the to a bank’s website and applies for a financial request. education newsletter, the information “Banks are going to have to have their that consumer enters into that form is not headaches for business processes and technical systems in covered by Gramm-Leach-Bliley and could place to manage the data as of January 2022,” be subject to the California law. Marketing banks Reber said. data on prospects who are not yet customers may be subject to California’s rules. Once By Penny Crosman To what extent does each law apply to an individual starts applying for a bank March 08, 2021 banks? product, such as a mortgage or brokerage States are stepping up their efforts to The Virginia law exempts financial account, the information becomes subject protect the privacy of consumer data, and institutions that are subject to the privacy- Gramm-Leach-Bliley. the trend is adding to banks’ compliance protection provisions of the federal Gramm- Banks can take two approaches to this challenges as stewards of vast amounts of Leach-Bliley Act of 1999. But banks could data distinction, Reber said. Some banks personal information. still be on the hook. are going to ignore the Gramm-Leach-Bliley Virginia passed a data privacy law on “If you’re a bank, the Virginia law may exemption in California and follow the March 2, while California strengthened not apply to you directly, but absolutely state’s more stringent rules for all consumer its existing data privacy law on Nov. 3. could apply to some of the vendors and data, she said, because that route is easier These new rules only partially affect banks, third parties that you do business with,” and safer than trying to categorize and label raising plenty of questions and concerns for Whitworth said. “There’s also a debate all data. Others will draw a line between bank employees responsible for handling within the industry about how far the Gramm-Leach-Bliley data and other data consumer data. Vendors and partners may exemption will carry. There is a GLBA entity and apply the California protections only to be subject to the new laws, too. And these exemption, but it remains to be seen how far the latter. new laws are just the beginning: Other states, that exemption will carry. Does it cover all It’s important for financial institutions including Washington, are writing their own activities or just banking activities? These to understand what information is subject data privacy legislation and a national data are some of the questions that a lot of the to the California law and what is not, said privacy law may be coming. industry benchmarking forums are already Boris Segalis, partner in and co-chair of the “The reality for the financial services working on as they wrestle with the Virginia data, privacy and cybersecurity group at industry is that this is going to be somewhat of a national exercise one way or the other within the next few years,” said Ron Established 1836 One State Street Plaza, 27th floor, New York, NY 10004 Whitworth, chief privacy officer at Truist Phone 212-803-8200 AmericanBanker.com Financial in Charlotte, N.C. These state actions are part of a broader Editor in Chief Alan Kline 571.403.3846 Copy Editor Neil Cassidy 212.803.8440 trend of increasing consumer awareness of Managing Editor Dean Anason 770.621.9935 data privacy. Reporters/Producers “Customers care about how you’re Executive Editor Bonnie McGeer 212.803.8430 Laura Alix 860.836.5431, Kate Berry 562.434.5432 handling their personal data anyway,” said Washington Bureau Chief Joe Adler 571.403.3832 Jill Reber, general manager of the data Executive Editor, Technology Miriam Cross 571.403.3834 privacy practice at Logic20/20, a business Penny Crosman 212.803.8673 Jim Dobbs 605.310.7780 and technology consulting company BankThink Editor Rachel Witkowski 571.403.3857 based in Seattle. “Your end game is to keep John Heltman 571.403.3847, Allissa Kline 716.243.2679 Community Banking Editor Paul Davis 336.852.9496 your customer loyalty. And so if you’re Hannah Lang 571.403.3855 mishandling their personal data because Contributing Editor Daniel Wolfe 212.803.8397 John Reosti 571.403.3864, Gary Siegel 212.803.1560 you aren’t worried about these data privacy Digital Managing Editor regulations, that’s going to create a new Christopher Wood 212.803.8437 Kevin Wack 626.486.2341 issue for you.” For up to date and complete coverage go to AmericanBanker.com WEDNESDAY MARCH 10, 2021 AMERICANBANKER.COM PAGE 3 the New York law firm Goodwin. “And that have all their data deleted. California’s law also addresses the new line usually is: A consumer visits a website The updated California law requires concept of “dark patterns,” or user interfaces and signs up for a newsletter — that data is companies to tell consumers why they’re that are designed or manipulated with the subject to the California law. Once they start collecting and using their personal data, and effect of impairing user autonomy. submitting their information to apply for a then not use it for a different purpose. “If a bank has a user interface that leads financial product or inquire about a product “There are no secondary uses allowed somebody into purchasing something or service, that’s covered by GLBA. Even without additional notice and then consent,” because they’re doing targeted advertising if a consumer abandons that application, Reber said. This means covered businesses to them, that could be a dark pattern,” Reber that abandoned application is probably still need to have internal processes and systems said.