Lawmakers call for FTC investigation of Envestnet | Yodlee
Lawmakers are calling for an investigation of Envestnet's sale of clients' sensitive financial transaction data, questioning whether company practices violate federal law.
The move puts one of the country’s leading consumer financial data aggregators under new public scrutiny.
Senators Ron Wyden (D., Ore.), Sherrod Brown (D., Ohio) and Rep. Anna Eshoo (D., Calif.). urged the Federal Trade Commission to investigate whether Envestnet's sale of clients' data to third parties without their consent represents "an unfair, deceptive or abusive" practice.
“Consumers generally have no idea of the risks to their privacy that Envestnet is imposing on them,” the lawmakers wrote in a letter made public Friday.
The FTC confirmed it received the letter and declined to comment further.
The turnkey asset management platform is able to deliver data from more than 21,000 financial institutions lawmakers wrote in the letter.
The company sells this data to third-party data brokers, which then resells it to hedge funds and other investors. These parties scan the information for consumer purchasing trends, helping them make inferences about broad market conditions and giving them a leg up on investment decisions, according to the lawmakers’ letter.
“That is not sufficient protection for users,” the lawmakers wrote. Envestnet, “should not put the burden on consumers to locate a notice buried in small print … and then find a way to opt out — if that is even possible — in order to protect their privacy.”
In October, Sen. Wyden introduced the Mind Your Own Business Act, which requires transparency about how corporations share, sell and use consumer data.
Wells Fargo, Citigroup and Silicon Valley Bank are among institutions that have signed agreements with data aggregators to share customer data through application programming interfaces. JPMorgan Chase signed a data sharing agreement with Envestnet in December which opened up more than 1,200 financial applications to JPMorgan customers.
In a statement, the company said it is in compliance with law and regulations and in accordance with industry practices for data security and privacy. “Importantly, Envestnet | Yodlee never sells data that identifies consumers,” according to the statement.
The leading TAMP by assets, managing more than $1.2 trillion, says it employs proprietary and third-party technical controls — such as encryption — to protect data on its systems, according to its statement. The company provides services to almost 100,000 advisors and over 4,700 companies including over 500 RIAs as well as almost all of the top 20 U.S. banks, according to the company.
Yodlee has sold at least some of the consumer financial data it gathers to investors, research firms and hedge funds including Steven A. Cohen’s Point72, according to a Wall Street Journal report.
“The consumer data that Envestnet collects and sells is highly sensitive,” according to the letter, adding that credit and debit card transactions can reveal information about health, sexuality, religious and political preferences.
Envestnet has been proactive in the push to develop industry-wide data sharing legislation. The company is a founding member of Consumer Financial Data Rights, an industry group formed to advocate for consumer protections and open access to financial data. Other members include, Betterment, Digit, Personal Capital, Ripple and Varo Money.
Interim CEO Bill Crager told Financial Planning in June his firm collaborates with the industry group on policy reform that would strengthen regulation around practices of selling consumer data.
Envestnet is also a board member of the Financial Data Exchange, a technical standards body. The exchange declined to commnet.
Envestnet has risen to become one of the largest TAMPs in large part because of its $660 million acquisition of data aggregator Yodlee in 2015. Other major acquisitions — including Tamarac and MoneyGuidePro — have been a hallmark of Envestnet’s expansive growth over the past decade.