Wells Fargo’s Envestnet data-sharing deal raises murky questions

The debate over data privacy is far from over — but that’s not stopping major financial services firms from inking data-sharing deals.

Most recently Wells Fargo hooked up with Envestnet to link consumer accounts and bring more than 1,400 financial apps to its banking customers. The partnership brings consumers better and more reliable tools to manage their financial lives including apps for spending, saving and planning, according to a spokesperson.

But even as the deal opens up access to important tools for consumers, a government watchdog is asking pointed questions of Envestnet to determine if its sale of consumer data is breaking the law. 

The turnkey asset management platform sells its data to third-party brokers — a common practice in many industries — who then resell the data to hedge funds and other investors. These parties analyze the information for wide-reaching purchasing trends, and use inferences about market conditions to give them an edge on the trading floor, according to a January letter from Ron Wyden, D-Ore., Sherrod Brown, D-Ohio, and Anna G. Eshoo, D-Calif., addressed to the FTC.

In the letter, the legislators asked for an investigation and expressed concern that Envestnet is violating the FTC Act’s prohibitions against unfair and deceptive practices. The data, including credit and debit card transactions, can reveal “highly sensitive” information about health, sexuality and religion, according to the lawmakers.

Envestnet has entered into a handful of data-sharing partnerships with major financial institutions in the past 18 months — including Citi, JPMorgan Chase, and Charles Schwab — potentially reaching millions of consumers. The terms of the Wells Fargo partnership were not disclosed and it's unclear exactly how Envestnet will use the data it collects.

Still, the Federal Trade Commission has launched an inquiry. During a company earnings call in May, Envestnet CEO Bill Crager confirmed the regulator wants to better understand its underlying data-sharing practices. “The Federal Trade Commission requested information from Envestnet Yodlee,” according to a spokesperson. “We are fully cooperating with this request and look forward to resolving this matter with the FTC soon.”

The problem is data-sharing agreements bring up murky questions — like how and when consumers should be notified or for how long a data aggregator can track consumer data. A proposed class-action suit against Envestnet, for example, alleges a consumer synced her PNC Bank account to PayPal using a Yodlee powered portal, but at no time was it disclosed that her bank account would be continuously assessed by Envestnet to extract and sell data, according to the Aug. 25 complaint filed in the U.S. District Court for the Northern District of California. 

The industry needs to determine sooner than later the best ways to ensure sensitive consumer information remains protected and that consumers are aware of how data is being used and sold. These partnerships ultimately open up access to new tools for consumers to help manage their financial lives — but also open doorways for potential data leaks. 

The Wells Fargo deal may actually help keep data safe. Customers can pick and choose what financial information is shared with Envestnet Yodlee-supported apps, and customers get a “turn on and off” option for data sharing, according to a release. It will also do away with screen scraping tools that are less safe than data-sharing connections backed by APIs.

The balance between sharing sensitive data and providing important financial tools to customers is a fine line the industry must walk. With the speed and scope of new data-sharing deals, it needs to be sorted out sooner than later.