Banks and Tech Firms Battle Over Something Akin to Gold: Your Data
By Nathaniel Popper for CNBC,
The big banks and Silicon Valley are waging an escalating battle over your personal financial data, including the amount you spent on dinner last week and how much you are paying for your mortgage.
Technology start-ups like Mint and Betterment have been building services that pull together your bank account and credit card records — after you supply the passwords.
But now big banks are making a concerted push to set new restrictions on how technology companies can get access to this personal financial data, in some cases refusing to pass along information like the fees and interest rates they charge.
“When you think about millions of customers handing over their bank account credentials to third parties, who currently have no real oversight or examination of their security controls, you start to understand why our members get pretty nervous,” said Jason Kratovil, the vice president for government affairs for payments at the Financial Services Roundtable, which represents the largest banks.
The tech companies, in turn, complain that the steps being taken by banks will not lead to better security and are motivated, instead, by a fear that the data will allow the financial upstarts to offer better deals on loans and checking accounts.
William Harris, the founder of Personal Capital, a San Francisco-based start-up, said the problems with getting access to data from banks had grown worse over the last year. To him, it was a sign that the banks viewed open access to data as a threat to their business, given that it would allow customers to see how much they pay for financial products.
“It’s pretty clear the real intent of the banks is to limit this data because it puts their business model at risk,” he said.
The clash over personal financial data points to a broader recognition that personal digital records are among the most valuable currencies in the increasingly digital economy.
Corporations are eager to gain access to the digital trails that people leave behind to determine which products are marketed to what consumers and at what prices. The data — and who can have access to it — ultimately affects how much people pay for everything from a home loan to car insurance.
But the law has been slow to keep up with the quickly evolving ways that companies seek to hold onto customer data or share it with other companies.
The European authorities have largely decided that consumers, not companies, own the digital records associated with their accounts. As a result, European banks are generally being forced to make it easy for their customers to share their financial data with whomever they choose.
In the United States, the 2010 Dodd-Frank Act broadly directed banks to make electronic records available to consumers, but there has been little detail on what that means in practice.
The director of the Consumer Financial Protection Bureau, Richard Cordray, has made it clear that he believes banks have not been willing enough to give customers control over their own data.
“We recognize that data access makes it possible to realize the many benefits of competition and innovation,” Mr. Cordray said in a speech this month in New York. “We remain concerned about reports of some institutions that may be limiting or restricting access unduly.”
Mr. Cordray has been moving toward writing new rules on this front, but it is uncertain if he and the bureau will survive and push the banks to open up under the Trump administration.
Banks, in the meantime, have taken the initiative by pushing technology companies to accept new agreements on how they use the data they pull from the banks.
One of the primary companies that help move data between the banks and the start-ups is Envestnet Yodlee. The company said that in the last two months, several large banks had told it that it would lose access to at least some data in the near future if it did not agree to new restrictions on the data it is pulling.
Some of the banks have said they do not want to share the interest rates and fees that they charge customers, even when customers ask for that information to be passed along, said Steve Boms, the vice president for government affairs at Yodlee.
Mr. Boms said that his company was pushing back against the requests because “with data limitations you are hindering the ability of millions of consumers to save more and optimize their finances.”
JPMorgan and Wells Fargo, which have been among the most aggressive in seeking new agreements, said they would pass along any information that customers wanted, as long as the customers themselves requested it.
JPMorgan is hoping to create a dashboard on its website where customers can choose to turn on or off the data flowing from the bank to any outside provider.
The banks say they are pushing for new data agreements in an effort to stop technology companies from getting access to customer data in ways that the customers might not understand, or that could create security risks.
Right now, few rules or standards exist for how technology companies can use the data they collect from customers. It is also not entirely clear who would be held liable if a data breach at a service like Venmo or Mint led to financial losses for a customer.
“It is in everybody’s best interest to come to more robust arrangements, from a security perspective,” said Brett Pitts, the head of digital for Wells Fargo Virtual Channels.
In January, both JPMorgan and Wells Fargo signed agreements with Intuit — the owner of Mint, TurboTax and QuickBooks — that will give Intuit more streamlined access to data from the banks, in exchange for new rules about how Intuit uses the data.
The banks have said they want the agreement with Intuit to be a model for similar agreements with other technology companies.
In recent negotiations, including those with Intuit, Wells Fargo has asked to be paid by technology companies that want better access to its data, a sticking point for technology companies that believe data should flow freely.
Mr. Pitts said the payments were intended to help the bank cover the additional infrastructure costs involved in providing real-time access to data.
The negotiations with Yodlee are particularly important because it is the largest so-called data aggregator. Yodlee and a few other data aggregators serve as the middlemen between the banks and the start-ups, pulling the data from the banks and putting it into a form that start-ups like Betterment and Digit can use.
Yodlee is the biggest aggregator, but it has also been the most controversial because of what it does with the data it collects.
In particular, the company has been criticized for taking the billions of credit card transactions running through its pipes and selling them to hedge funds and other investment firms. Investors want to look through the transactions for trading signals, such as any indication that a particular retailer or product is doing better than expected.
Yodlee has said that it scrubs the data of any personal information before it sells it to third parties.
But other aggregators that compete with Yodlee, including its largest competitor, Plaid, say they do not sell customer data to third parties and do not think it would be right to do so, given that the consumers do not generally know their data is being sold in this way.
JPMorgan has been insisting in negotiations that it will provide easy access to its data only if technology companies agree not to sell the data to third parties. Intuit agreed to those terms in its deal with the bank.
This has not been the only sticking point in negotiations with Yodlee, however, and Yodlee is not the only company that has complained that the banks are making it harder for customers who want access to information about their bank accounts.
Mr. Harris of Personal Capital has been one of the most outspoken critics of the banks. His company allows consumers to look at all their financial accounts on one dashboard, and also provides them with financial advice based on their holdings.
Mr. Harris, who was previously the chief executive at Intuit and PayPal, said that many banks publicly say they are sharing data while making it hard, behind the scenes, for companies like Personal Capital to get access to it. Some companies, he said, will throttle access to data, or shut it down for hours at a time.
“It happens with a frequency that is too often to simply be the result of some technical problems,” Mr. Harris said.
He said that agreements like those Intuit recently struck with the banks would speed up the movement of data, but give the banks too much control over the data flowing to companies like Personal Capital.
“We suss out the data and show the customer what they are actually paying,” he said. “From a business model point of view that is not in the best interest of the banks and brokers. It’s encouraging customers to get smart and get well-priced products.”
