15 USC 6821: Privacy Protection for Customer Information

15 U.S.C. § 6821, enacted as Section 521 of the Gramm-Leach-Bliley Act, makes it a federal crime to obtain another person’s financial records from a bank or similar institution through deception. The statute targets pretexting: lying to a bank employee, impersonating an account holder, or submitting forged paperwork to trick a financial institution into releasing a customer’s data. It also reaches anyone who hires someone else to do the lying. Violations carry up to five years in prison, and up to ten years when the conduct is aggravated.¹

The Conduct the Statute Forbids

Section 6821(a) lists three ways a person can violate the law. You break it if you obtain, or try to obtain, another person’s customer information from a financial institution by:

Making a false, fictitious, or fraudulent statement to an officer, employee, or agent of the institution;
Making a false, fictitious, or fraudulent statement to a customer of the institution; or
Providing any document to an officer, employee, or agent of the institution knowing that the document is forged, counterfeit, lost, stolen, or contains a false, fictitious, or fraudulent statement.¹

Attempts count. The statute reaches conduct designed to cause disclosure even when the bank refuses to hand anything over.

Subsection (b) closes the obvious loophole. It is separately illegal to ask or arrange for someone else to obtain customer information when you know they will use any of the deceptive methods above.¹ The FTC has used this provision against data brokers who paid others to impersonate account holders and then resold the stolen account balances and transaction histories to their clients.²

What Information and Institutions Are Covered

The law protects “customer information of a financial institution,” defined in 15 U.S.C. § 6827 as any information maintained by or for a financial institution that is derived from the customer relationship and identified with a specific customer.³ Account balances, transaction records, loan files, and similar data all qualify. A “customer” is any person to whom the institution provides a financial product or service, including through a fiduciary relationship. “Document” is defined broadly as any information in any form, so a fake email or fabricated letter can trigger the statute just as a forged ID can.

The statute uses its own definition of “financial institution,” narrower than the one governing GLBA’s privacy rules generally. It covers any business providing financial services to customers who maintain a credit, deposit, trust, or similar account or relationship with it, and specifically names:

Banks, savings associations, and credit unions;
Brokers, dealers, investment advisers, and investment companies;
Insurance companies;
Loan companies, finance companies, credit card issuers, and credit card system operators; and
Nationwide consumer reporting agencies.³

Entities regulated by the Commodity Futures Trading Commission, the Federal Agricultural Mortgage Corporation, and entities operating under the Farm Credit Act are excluded.

Who Is Exempt

Section 6821 carves out several categories of conduct that are not prohibited, even though they involve obtaining customer information indirectly.

Law enforcement agencies and their officers and agents are not restricted when obtaining customer information in the course of their official duties.¹ The exception is written broadly, though warrant and subpoena requirements from other laws still apply.

Financial institutions can test their own security, investigate employee misconduct or negligence, and recover customer data that was obtained by someone else through pretexting. This is what allows banks to run social engineering exercises on their own staff.

Insurance institutions, their agents, and affiliates can obtain customer information in the course of investigating criminal activity, fraud, or material misrepresentation, so long as the investigation is authorized under state law.

Anyone can obtain customer information that is otherwise a matter of public record filed under the securities laws. And a state-licensed private investigator may obtain customer information when reasonably necessary to collect delinquent child support, but only after a court has both declared the person delinquent and authorized the collection action, and only when the conduct is not otherwise illegal.

Prison Time and Fines

Under 15 U.S.C. § 6823, anyone who knowingly and intentionally violates or attempts to violate § 6821 faces a fine under Title 18, imprisonment of up to five years, or both.⁴

The penalties double in aggravated cases. If the pretexting is committed while violating another federal law, or as part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum sentence rises to ten years and the fine doubles.⁴ An ongoing data-broker operation reselling account information will typically cross that threshold quickly.

Who Enforces the Statute

Criminal prosecution is not the only exposure. Section 6822 assigns administrative enforcement to the FTC as the default, with the powers it exercises under the Fair Debt Collection Practices Act.⁵ For institutions with a primary federal banking regulator, enforcement passes to that regulator, whether the Office of the Comptroller of the Currency, the Federal Reserve Board, the FDIC, the appropriate thrift regulator, or the National Credit Union Administration. A pretexting violation is treated as a violation of whatever banking statute the relevant agency ordinarily enforces, and each agency may use its full enforcement toolkit.

Financial institutions themselves face regulatory pressure to prevent pretexting. Section 6825 directs the federal banking agencies, the NCUA, and the SEC to review their rules and ensure that the institutions they oversee have policies and procedures to prevent unauthorized disclosure and to detect pretexting attempts.⁶ For non-bank institutions under FTC jurisdiction, that obligation is implemented through the FTC’s Safeguards Rule.⁷

How Section 6821 Differs From the Rest of GLBA

Section 6821 is often confused with the broader GLBA privacy framework. The general duty of financial institutions to safeguard customer information sits in a different section, 15 U.S.C. § 6801, enacted as Section 501 of the Act. That is the provision the FTC’s Safeguards Rule, the Privacy Rule, and comparable banking regulations grow out of. Section 6821 is narrower and pointed in a different direction: it is a criminal prohibition aimed at the outsiders who try to lie their way into someone else’s financial records, not at the institutions holding the records.

1
Office of the Law Revision Counsel. 15 USC 6821 – Privacy Protection for Customer Information of Financial Institutions
2
Federal Trade Commission. FTC v. Discreet Data Systems – Complaint
3
Office of the Law Revision Counsel. 15 USC 6827 – Definitions
4
Office of the Law Revision Counsel. 15 USC 6823 – Criminal Penalty
5
Office of the Law Revision Counsel. 15 USC 6822 – Administrative Enforcement
6
Office of the Law Revision Counsel. 15 USC 6825 – Agency Guidance
7
Federal Trade Commission. FTC Safeguards Rule – What Your Business Needs to Know