WA Sup Ct Upholds Ruling Protecting Lender Files Obtained by AG from Release to Consumer Attorney

The Supreme Court for the State of Washington recently affirmed a Court of Appeals decision holding that federal privacy laws apply to a request for information brought by a consumer lawyer under Washington's State Public Records Act (PRA), chapter 42.56 RCW, as to documents received by the state attorney general during an investigation of Ameriquest.


A copy of the opinion is available online at: http://www.courts.wa.gov/opinions/pdf/826901.opn.pdf

This case concerns documents obtained by the Washington State Office of the Attorney General from Ameriquest Mortgage Company (Ameriquest) during an investigation of Ameriquest's lending practices. These documents included loan files, e-mails, and "other papers." The AG received other information from consumers who filed complaints against Ameriquest, and also generated their own documents in relation to the investigation.

Melissa A. Huelsman (Huelsman), a "member of the public", made a request for records from the investigation referencing the PRA. The AG intended to disclose some of the information collected, but Ameriquest objected to the release of any information received from Ameriquest itself. The issue before the Supreme Court is "whether, and to what extent the federal Gramm-Leach-Bliley Act (GLBA) . . . and the relevant Federal Trade Commission (FTC) rule" either preempt the PRA or otherwise prevent the AG from disclosing the information it received directly from Ameriquest.

The Washington Supreme Court described the GLBA as intended to protect customers' privacy, and to "protect the security and confidentiality of those customers' nonpublic personal information." Under the rule-making authority contained in the GLBA, the FTC adopted the "Privacy of Consumer Financial Information." These federal regulations prohibit a "financial institution" from releasing a consumer's "nonpublic personal information to a nonaffiliated third party", unless the consumer is given the chance to opt out of such release by receiving prior notice. Relevant exceptions to this notice and disclosure requirement include when the release is done "with the consent or at the direction of the consumer", or to "comply with a properly authorized civil, criminal, or regulatory investigation." The Court also noted that the federal regulations prevent a nonaffiliated third party from re-using or re-releasing any protected information received from a financial institution, and the nonaffiliated third party can share nonpublic personal information so received to its affiliates, but cannot share this information to a nonaffiliated third party unless the financial institution in question could lawfully do so.

Huelsman, an attorney representing former customers of Ameriquest, placed a request for documents which contained borrowers' "names, addresses, and loan terms and costs" but not other information such as their social security numbers. Ameriquest objected to such disclosure specifically in relation to Ameriquest's customer loan files, internal customer complaint files, employee e-mails, trade secrets and proprietary information, and the AG generated documents. The trial court denied Ameriquest's motion, while leaving in place a temporary restraining order, finding that the GLBA did not preempt state laws governing public disclosure of documents. The Appellate Court reversed this decision, holding that if the PRA conflicted with GLBA concerning disclosure, then the GLBA preempted the PRA and prohibited such disclosure. The Appellate Court held that as the AG is a nonaffiliated third party under GLBA, and Huelsman is not an affiliate of the AG, the GLBA therefore prohibited the AG's contemplated disclosure to Huelsman.

The Supreme Court affirmed the Appellate Court's ruling. The Appellate Court had remanded the case to the trial court stating, "[w]hat information in loan customers' files is public is a factual question that the trial court will need to address." The Supreme Court held that GLBA and FTC restrictions apply to the AG's proposed release of "nonpublic personal information to Huelsman." Information which meets the definition of "personally identifiable financial information", is non-public and may not be disclosed, regardless of the form it comes in, i.e.; loan files, emails, etc.

The Supreme Court further held that "the circumstances of the case" dictated that names, cases, addresses, and phone numbers of Ameriquest customers fit this definition as they were not only "personal identifiers", but would also disclose that the person in question "is or has been Ameriquest's customer." The Court further held that "[a]ny information" that constitutes "'nonpublic personal information' cannot be recast as publicly available information by the AG."

Finally, the Court held that only "aggregate information or blind data" that does not contain "personal identifiers" is exempt from the federal nondisclosure rules. The Court held that both the GLBA and FTC do not allow the AG to "newly redact or repackage the information" it already has to transform it into "blind data." Such data can only be disclosed if it is already in a "blind" or identifier-free state as delivered to the AG.