Laws protecting financial privacy got a shot in the arm this past summer with the passage of a tougher state bill, but recent efforts in Congress threaten to erode some of these gains.

Gov. Gray Davis signed Senate Bill 1 into law on Aug. 27 after legislators spent four years trying to get the bill passed. SB 1 is the strongest law in the nation to date to protect the private financial information of consumers. The law becomes effective on July 1, 2004, but recent activity in Congress could weaken some provisions.

"I'm deeply troubled by the fact that within two weeks of California passing a law to strengthen privacy laws the federal legislators are now trying to pre-empt states' rights," said Assembly Member Hannah-Beth Jackson, D-Santa Barbara, who is a strong advocate of privacy rights. "We have to remind people that the right of privacy is explicitly written into our state constitution. I'm very disappointed by the efforts in Congress to deny those rights."

Right now, financial companies can and do sell or share customer data to other companies and with their many affiliates. The type of data shared includes names, addresses, phone numbers, Social Security numbers, account balances and types, and details of transactions.

The rampant sharing of personal information has contributed to California having the highest rate in the U.S. for identity fraud, said Tena Friery, research director at the Privacy Rights Clearinghouse, a nonprofit consumer advocacy group based in San Diego.

"Ten million people last year were victims of identity fraud and half of them didn't know how it happened to them," she added. "We believe a lot of it had to do with the fact that it's so easy to get credit. Financial companies are not doing their due diligence when granting credit."

SB 1 has bearing on two federal laws that have been on the books for several years, Ms. Friery said. First, it affects the Gramm-Leach-Bliley Act, passed in 1999, which allowed the merger of banks, insurance companies and brokerage houses. While the consolidation may have helped in simplifying account information and lowering fees, the act permitted financial institutions to share an unprecedented amount of private and personal information about customers with their subsidiaries and others. However, the federal act did allow individual states to enact stronger consumer privacy laws, such as SB 1.

Gramm-Leach-Bliley requires companies to send out notices informing their customers about their privacy rights. Currently, financial firms must tell customers how their personal information is used and how it is shared with outside companies, also called "third parties." Financial firms must give their customers the option to limit the sharing of information with others. This is called an "opt-out." Financial firms currently are allowed to share data with affiliated companies, without the permission of customers.

Unless a customer fills out a form stating they want to opt-out of information sharing with third parties, the companies can freely share their personal information. This puts the burden on the customer to tell companies if they want their privacy protected.

The passage of SB 1 now puts the burden on financial firms to first ask customers for permission, or get an "opt in," before they share their personal information with outside companies. The new law also requires financial firms to allow customers to opt-out when it comes to sharing information with affiliated companies.

Aside from its affect on Gramm-Leach-Bliley, SB 1 also affects another federal law called the Fair Credit Reporting Act. This act, last amended in 1996, created a national credit reporting standard and banned individual states from setting their own rules on how companies use and share customer information.

The Fair Credit Reporting Act is set to expire at the end of this year, but strong lobbying efforts from the financial industry prompted Congress to take action to make it a permanent law.

In September, both the House of Representatives and the Senate approved two separate versions of a bill that would allow the Fair Credit Reporting Act to continue its ban on states setting their own laws.

"The goal was to strike the proper balance between protecting the rights of consumers and the efficient operation of our markets. I believe this bill does this," Sen. Richard Shelby (R-Ala.) said in a Sept. 23 Associated Press story.

A vote of a final version of the bill was expected earlier this month. California Sens. Barbara Boxer and Dianne Feinstein are fighting to amend the Senate's bill to protect portions of SB1.

"Congress has the option right now to reiterate the provisions in Gramm-Leach-Bliley to give states the ability to have control over privacy laws," said Shelly Curran, policy analyst for Consumers Union, a nonprofit consumer advocacy group that publishes Consumer Reports. "Congress should take this opportunity to protect those rights."

If the Fair Credit Reporting Act is allowed to continue, it would give companies the freedom to share information with their affiliates - without permission from customers, said Ms. Friery at the Privacy Rights Clearinghouse.

"It wouldn't affect the opt-in for third party sharing of information, though," she added. "This part of the law (SB 1) would still go into affect next year."

e-mail: mzate@newspress.com