By Ryan Tracy 

WASHINGTON -- Financial-data firm Yodlee might be selling consumers' personal financial data without proper consent, three lawmakers said in a Friday letter calling on the Federal Trade Commission to investigate the matter.

The letter opened a new area of potential risk for the company, which is one of many firms that make money by selling information about consumers.

Yodlee, a unit of Envestnet Inc., primarily sells software that aggregates data from consumers' financial accounts. It says the technology is used by popular mobile-phone apps such as Personal Capital and by 15 of the 20 largest U.S. banks, including JPMorgan Chase & Co., reaching more than 25 million users globally.

In a statement, the company said it complies with "law and regulations and in accordance with leading industry practices for data security and privacy."

Personal Capital said it doesn't permit Yodlee "to sell our customer data in any form even if it is anonymized." JPMorgan declined to comment.

The letter from Sen. Ron Wyden (D., Ore.), Sen. Sherrod Brown (D., Ohio) and Rep. Anna Eshoo (D., Calif.) asked the FTC to investigate whether the company's practices constitute unfair, deceptive or abusive behavior.

If the commission determined that was the case, the firm could face financial penalties or other sanctions. The FTC declined to comment.

In addition to collecting data so that consumers can easily view their financial activity in one place, the company also sells transaction and other data to brokers, who in turn sell it to investors looking for trends in consumer purchasing.

"Consumers' credit and debit card transactions can reveal information about their health, sexuality, religion, political views, and many other personal details," the lawmakers' letter said. "Consumers generally have no idea of the risks to their privacy that Envestnet is imposing on them."

Yodlee's website says that "when an investor engages with a fiduciary advisor, the investor permissions the advisor and the supporting institution(s) to see their data." Yodlee "never sells data that identifies individuals" and scrubs data of personally identifiable information before selling it, it says.

Even if banks or personal-finance apps are notifying consumers that their data may be sold in this way, Yodlee "should not put the burden on consumers to locate a notice buried in small print," the lawmakers said. "The FTC has made it clear that companies may not hide important facts about how consumer data is collected or shared in the small print of a privacy policy."

The lawmakers noted that anonymous data doesn't always stay that way, even when companies remove names, Social Security numbers, and other identifying information. Mr. Wyden's office cited a paper, published in the journal Science in 2015, in which academics studied supposedly anonymized data on 1.1 million people's credit-card transactions and were able to identify 90% of the individuals.

Write to Ryan Tracy at ryan.tracy@wsj.com

 

(END) Dow Jones Newswires

January 17, 2020 14:00 ET (19:00 GMT)

Copyright (c) 2020 Dow Jones & Company, Inc.
JP Morgan Chase (NYSE:JPM)
Historical Stock Chart
From Feb 2024 to Mar 2024 Click Here for more JP Morgan Chase Charts.
JP Morgan Chase (NYSE:JPM)
Historical Stock Chart
From Mar 2023 to Mar 2024 Click Here for more JP Morgan Chase Charts.