By Ryan Tracy
WASHINGTON -- Financial-data firm Yodlee might be selling consumers' personal financial data without proper consent, three lawmakers said in a Friday letter calling on the Federal Trade Commission to investigate the matter.
The letter opened a new area of potential risk for the company, which is one of many firms that make money by selling information about consumers.
Yodlee, a unit of Envestnet Inc., primarily sells software that aggregates data from consumers' financial accounts. It says the technology is used by popular mobile-phone apps such as Personal Capital and by 15 of the 20 largest U.S. banks, including JPMorgan Chase & Co., reaching more than 25 million users globally.
In a statement, the company said it complies with "law and regulations and in accordance with leading industry practices for data security and privacy."
Personal Capital said it doesn't permit Yodlee "to sell our customer data in any form even if it is anonymized." JPMorgan declined to comment.
The letter from Sen. Ron Wyden (D., Ore.), Sen. Sherrod Brown (D., Ohio) and Rep. Anna Eshoo (D., Calif.) asked the FTC to investigate whether the company's practices constitute unfair, deceptive or abusive behavior.
If the commission determined that was the case, the firm could face financial penalties or other sanctions. The FTC declined to comment.
In addition to collecting data so that consumers can easily view their financial activity in one place, the company also sells transaction and other data to brokers, who in turn sell it to investors looking for trends in consumer purchasing.
"Consumers' credit and debit card transactions can reveal information about their health, sexuality, religion, political views, and many other personal details," the lawmakers' letter said. "Consumers generally have no idea of the risks to their privacy that Envestnet is imposing on them."
Yodlee's website says that "when an investor engages with a fiduciary advisor, the investor permissions the advisor and the supporting institution(s) to see their data." Yodlee "never sells data that identifies individuals" and scrubs data of personally identifiable information before selling it, it says.
The lawmakers noted that anonymous data doesn't always stay that way, even when companies remove names, Social Security numbers, and other identifying information. Mr. Wyden's office cited a paper, published in the journal Science in 2015, in which academics studied supposedly anonymized data on 1.1 million people's credit-card transactions and were able to identify 90% of the individuals.
Write to Ryan Tracy at email@example.com
(END) Dow Jones Newswires
January 17, 2020 14:00 ET (19:00 GMT)Copyright (c) 2020 Dow Jones & Company, Inc.