Banks, tech firms battle for access to your data
Information on customers is crucial as digital financial practices evolve
SAN FRANCISCO — The big banks and Silicon Valley are waging an escalating battle over your personal financial data, including the amount you spent on dinner last week and how much you are paying for your mortgage.
Technology startups like Mint and Betterment have been building services that pull together your bank account and credit card records — after you supply the passwords.
But now big banks are making a concerted push to set new restrictions on how technology companies can get access to this personal financial data, in some cases refusing to pass along information like the fees and interest rates they charge.
Banks like JPMorgan Chase and Wells Fargo say they want to give consumers access to their data, but are seeking new rules in response to a lack of standards for how technology companies handle personal financial data.
“When you think about millions of customers handing over their bank account credentials to third parties, who currently have no real oversight or examination of their security controls, you start to understand why our members get pretty nervous,” said Jason Kratovil, vice president for government affairs for payments at the Financial Services Roundtable, which represents the largest banks.
The tech companies, in turn, complain that the steps being taken by banks will
not lead to better security and are motivated, instead, by a fear that the data will allow the financial upstarts to offer better deals on loans and checking accounts.
William Harris, founder of Personal Capital, a San Francisco-based startup, said the problems with getting access to data from banks had grown worse over the last year. To him, it was a sign that the banks viewed open access to data as a threat to their business, given that it would allow customers to see how much they pay for financial products.
“It’s pretty clear the real intent of the banks is to limit this data because it puts their business model at risk,” he said.
The clash over personal financial data points to a broader recognition that personal digital records are among the most valuable currencies in the increasingly digital economy.
Corporations are eager to gain access to the digital trails that people leave behind to determine which products are marketed to what consumers and at what prices. The data — and who can have access to it — ultimately affects how much people pay for everything from home loans to car insurance.
But the law has been slow to keep up with the quickly evolving ways that companies seek to hold onto customer data or share it with other companies.
In the United States, the 2010 Dodd-Frank Act broadly directed banks to make electronic records available to consumers, but there has been little detail on what that means in practice.
Banks, in the meantime, have taken the initiative by pushing technology companies to accept new agreements on how they use the data they pull from the banks.
New restrictions
One of the primary companies that help move data between the banks and the startups is Envestnet Yodlee. The company said that in the last two months, several large banks had told it that it would lose access to at least some data in the near future if it did not agree to new restrictions on the data it is pulling.
Some of the banks have said they do not want to share the interest rates and fees that they charge customers, even when customers ask for that information to be passed along, said Steve Boms, vice president for government affairs at Yodlee.
Boms said that his company was pushing back against the requests because “with data limitations you are hindering the ability of millions of consumers to save more and optimize their finances.”
JPMorgan and Wells Fargo, which have been among the most aggressive in seeking new agreements, said they would pass along any information that customers wanted, as long as the customers themselves requested it.
JPMorgan is hoping to create a dashboard on its website where customers can choose to turn on or off the data flowing from the bank to any outside provider.
Security risks
The banks say they are pushing for new data agreements in an effort to stop technology companies from getting access to customer data in ways that the customers might not understand, or that could create security risks.
Right now, few rules or standards exist for how technology companies can use the data they collect from customers. It is also not entirely clear who would be held liable if a data breach at a service like Venmo or Mint led to financial losses for a customer.
In January, both JPMorgan and Wells Fargo signed agreements with Intuit — the owner of Mint, TurboTax and QuickBooks — that will give Intuit more streamlined access to data from the banks, in exchange for new rules about how Intuit uses the data.
The banks have said they want the agreement with Intuit to be a model for similar agreements with other technology companies.
In negotiations, including those with Intuit, Wells Fargo has asked to be paid by tech companies that want better access to its data, a sticking point for technology companies that believe data should flow freely.
Yodlee is the biggest aggregator, but it has also been the most controversial because of what it does with the data it collects.
In particular, the company has been criticized for taking the billions of credit card transactions running through its pipes and selling them to hedge funds and other investment firms. Investors want to look through the transactions for trading signals, such as any indication that a particular retailer or product is doing better than expected.
Yodlee has said that it scrubs the data of any personal information before it sells it to third parties.