San Francisco: The big banks and Silicon Valley are waging an escalating battle over your personal financial data, including the amount you spent on dinner last week and how much you are paying for your mortgage.
Technology startups like Mint and Betterment have been building services that pull together your bank account and credit card records – after you supply the passwords.
But now big banks are making a concerted push to set new restrictions on how technology companies can get access to this personal financial data, in some cases refusing to pass along information like the fees and interest rates they charge.
Banks like JPMorgan Chase and Wells Fargo say they want to give consumers access to their data, but are seeking new rules in response to a lack of standards for how technology companies handle personal financial data.
"When you think about millions of customers handing over their bank account credentials to third parties, who currently have no real oversight or examination of their security controls, you start to understand why our members get pretty nervous," said Jason Kratovil, vice president for government affairs for payments at the Financial Services Roundtable, which represents the largest banks.
The tech companies, in turn, complain that the steps being taken by banks will not lead to better security and are motivated, instead, by a fear that the data will allow the financial upstarts to offer better deals on loans and checking accounts.
William Harris, founder of Personal Capital, a San Francisco-based start-up, said the problems with getting access to data from banks had grown worse over the last year. To him, it was a sign that the banks viewed open access to data as a threat to their business, given that it would allow customers to see how much they pay for financial products.
"It's pretty clear the real intent of the banks is to limit this data because it puts their business model at risk," he said.
The clash over personal financial data points to a broader recognition that personal digital records are among the most valuable currencies in the increasingly digital economy.
Corporations are eager to gain access to the digital trails that people leave behind to determine which products are marketed to what consumers and at what prices. The data – and who can have access to it – ultimately affects how much people pay for everything from a home loan to car insurance.
But the law has been slow to keep up with the quickly evolving ways that companies seek to hold onto customer data or share it with other companies.
One of the primary companies that help move data between the banks and the start-ups is Envestnet Yodlee. The company said that in the last two months, several large banks had told it that it would lose access to at least some data in the near future if it did not agree to new restrictions on the data it is pulling.
Some of the banks have said they do not want to share the interest rates and fees that they charge customers, even when customers ask for that information to be passed along, said Steve Boms, vice-president for government affairs at Yodlee.
Boms said that his company was pushing back against the requests because "with data limitations you are hindering the ability of millions of consumers to save more and optimize their finances".
JPMorgan and Wells Fargo, which have been among the most aggressive in seeking new agreements, said they would pass along any information that customers wanted, as long as the customers themselves requested it.
JPMorgan is hoping to create a dashboard on its website where customers can choose to turn on or off the data flowing from the bank to any outside provider.
The banks say they are pushing for new data agreements in an effort to stop technology companies from getting access to customer data in ways that the customers might not understand, or that could create security risks.
Right now, few rules or standards exist for how technology companies can use the data they collect from customers. It is also not entirely clear who would be held liable if a data breach at a service like Venmo or Mint led to financial losses for a customer.
"It is in everybody's best interest to come to more robust arrangements, from a security perspective," said Brett Pitts, head of digital for Wells Fargo Virtual Channels.
In January, both JPMorgan and Wells Fargo signed agreements with Intuit – the owner of Mint, TurboTax and QuickBooks – that will give Intuit more streamlined access to data from the banks, in exchange for new rules about how Intuit uses the data.
The banks have said they want the agreement with Intuit to be a model for similar agreements with other technology companies.
In recent negotiations, including those with Intuit, Wells Fargo has asked to be paid by technology companies that want better access to its data, a sticking point for technology companies that believe data should flow freely.
Pitts said the payments were intended to help the bank cover the additional infrastructure costs involved in providing real-time access to data.
The negotiations with Yodlee are particularly important because it is the largest data aggregator. Yodlee and a few other data aggregators serve as the middlemen between the banks and the start-ups, pulling the data from the banks and putting it into a form that start-ups like Betterment and Digit can use.
Yodlee is the biggest aggregator, but it has also been the most controversial because of what it does with the data it collects.
In particular, the company has been criticized for taking the billions of credit card transactions running through its pipes and selling them to hedge funds and other investment firms. Investors want to look through the transactions for trading signals, such as any indication that a particular retailer or product is doing better than expected.
Yodlee has said that it scrubs the data of any personal information before it sells it to third parties.
But other aggregators that compete with Yodlee, including its largest competitor, Plaid, say they do not sell customer data to third parties and do not think it would be right to do so, given that the consumers do not generally know their data is being sold in this way.
JPMorgan has been insisting in negotiations that it will provide easy access to its data only if technology companies agree not to sell the data to third parties. Intuit agreed to those terms in its deal with the bank.
New York Times