Lawmakers demand FTC investigate Envestnet Yodlee for selling consumer financial data

Three members of Congress are demanding the Federal Trade Commission investigate Envestnet Yodlee to determine if the way the data aggregation firm sells consumers’ personal financial data is breaking the law.

Yodlee is arguably the largest aggregator of consumer financial data in the country. Banks, brokerages, independent advisers and financial technology startups rely on Yodlee to access, collect and analyze information from various financial accounts. It was acquired by Envestnet in 2015 for $590 million.

According to the company’s website, Yodlee partners with more than 1,200 companies, including 15 of the top 20 U.S. banks.

Yodlee said its data aggregation reaches 25 million people globally. According to the letter from Sen. Ron Wyden, D-Ore.; Sen. Sherrod Brown, D-Ohio and Rep. Anna Eshoo, D-Calif. Yodlee also sells access to this data.

“The consumer data that Envestnet collects and sells is highly sensitive,” the lawmakers wrote in the letter. “Consumers’ credit and debit card transactions can reveal information about their health, sexuality, religion, political views, and many other personal details. And the more often that consumers’ personal information is bought and sold, the greater the risk that it could be the subject of a data breach, like the recent breaches at Equifax and Capital One.”

[More: Former Trump lawyer suing Envestnet Yodlee]

Envestnet Yodlee published a statement on its website saying it complies with laws and regulations, and follows industry best practices for data security, regulatory compliance and privacy.

“Importantly, Envestnet Yodlee never sells data that identifies consumers,” the statement reads.

The company acknowledges that it does provide de-identified data analytics and insights to institutional investors and investment research providers to “better manage investments on behalf of their customers.”

“Envestnet Yodlee does not offer raw data that includes personally identifiable transaction information,” the company said in the statement.

But the lawmakers’ concern is that Envestnet is not doing enough to notify consumers that their data is being sold to third parties, even if it is anonymized. This could be in violation of the FTC Act’s prohibitions against unfair and deceptive practices.

“Consumers generally have no idea of the risks to their privacy that Envestnet is imposing on them,” the legislators said in the letter. “Envestnet does not inform consumers that it is collecting and selling their personal financial data. Instead, Envestnet only asks its partners, such as banks, to disclose this information to consumers in their terms and conditions or privacy policy. That is not sufficient protection for users.”

The company said it is not an information broker, but rather a “data steward” that adheres to privacy standards and all applicable laws. In August, former Envestnet CEO Judson Bergman, who was killed in a car crash in October, wrote a column for InvestmentNews defining what exactly it means to be a data steward.

[More: Effusive praise for a fallen captain]

“As a financial technology platform, Envestnet has a responsibility to ensure the highest levels of safety and security for anyone sharing information on our platform,” Mr. Bergman wrote. A data steward, he added, is held to the same standard as fiduciary advisers to work in the best interests of their clients. “Data stewards also treat consumers and their information with the utmost respect. They are held to a more rigorous and higher standard than data brokers, who exist to gather and sell personally identifying information that can be used to target individual consumers.”

A spokeswoman for the FTC said the agency has no comment on the letter. 

Financial data aggregation is a rapidly growing business. Last week, Visa paid $5.3 billion to acquire Yodlee competitor Plaid.

Aaron Klein, CEO of adviser technology vendor Riskalyze, said his company does not currently use Yodlee for data aggregation, but would consider it in the future.

“They are a high-quality provider of aggregation and I believe in Envestnet’s integrity as a company,” Mr. Klein said.

To him, the letter is an example of lawmakers not understanding how trend data works.

“[There is] zero evidence Yodlee is selling personalized data profiles, or any kind of data that could even be theoretically matched to real people,” Mr. Klein said on Twitter. “I think there’s a difference between selling someone’s data, and selling trend data that is made from a conglomeration of individual data points. But there are a lot of interesting discussions here for sure.”

Related Topics: Envestnet