Banks and Tech Firms Battle Over Something Akin to Gold: Your Data

SAN FRANCISCO — The big banks and Silicon Valley are waging an escalating battle over your personal financial data: your dinner bill last night, your monthly mortgage payment, the interest rates you pay.

Technology companies like Mint and Betterment have been eager to slurp up this data, mainly by building services that let people link all their various bank-account and credit-card information. The selling point is to make budgeting and bookkeeping easier. But the data is also being used to offer new kinds of loans and investment products.

Now, banks have decided they aren’t letting the data go without a fight.

In recent weeks, several large banks have been pushing to restrict the sharing of this kind of data with technology companies, according to the tech firms. In some cases, they are refusing to pass along information, like the fees and interest rates they charge. Both sides see big money to be made from the reams of highly personal information created by financial transactions.

The struggle over this data points to a growing recognition in the world of finance that personal records rank among the most valuable currencies in the increasingly digital economy.

It is, of course, not just financial data that companies are fighting over. There are numerous legal battles going on over who should have access to your health records and even your web-browsing history. Just this week, in fact, Republicans won a vote to roll back rules that would have stopped internet providers from tracking their customers’ online activities and selling that information to marketers.

Corporations are eager to gain access to the digital trails that people leave behind to determine which products are marketed to whom, and at what prices. The data ultimately affects how much people pay for everything from a home loan to car insurance.

But the law has been slow to keep up with the quickly evolving ways that companies seek to hold on to customer data or share it with others.

Banks like JPMorgan Chase and Wells Fargo say they want to give people access to their data but are seeking new rules in response to the lack of standards for how technology companies handle it.

“When you think about millions of customers handing over their bank-account credentials to third parties, who currently have no real oversight or examination of their security controls, you start to understand why our members get pretty nervous,” said Jason Kratovil, the vice president for government affairs for payments at the Financial Services Roundtable, which represents the largest banks.

The tech companies, in turn, complain that the steps being taken by banks will not lead to better security. They say the banks are motivated simply by a fear that the data will allow the financial upstarts to offer better deals on loans and checking accounts.

William Harris, the founder of Personal Capital, a San Francisco-based start-up, said the problems with getting access to data from banks had grown worse over the last year. To him, it was a sign that the banks fear that it will give customers too much insight into how much they pay (or perhaps overpay) for financial products.

“It’s pretty clear the real intent of the banks is to limit this data because it puts their business model at risk,” he said.

The European authorities have largely decided that people, not companies, own the digital records associated with their accounts. As a result, European banks are generally being forced to make it easy for customers to share their financial data with whomever they choose.

In the United States, the 2010 Dodd-Frank Act broadly directed banks to make electronic records available to people. But there has been little detail on what that means in practice.

The director of the Consumer Financial Protection Bureau, Richard Cordray, has made it clear that he believes banks have not been willing enough to give customers control over their own data. “We recognize that data access makes it possible to realize the many benefits of competition and innovation,” Mr. Cordray said in a speech this month in New York. “We remain concerned about reports of some institutions that may be limiting or restricting access unduly.”

Mr. Cordray has been moving toward writing new rules on this front. But it is uncertain if he and the bureau will survive and push the banks to open up under the Trump administration.

Banks, in the meantime, have taken the initiative by pushing technology companies to accept new agreements on how they use the data they pull from the banks.

One of the primary companies that help move data between the banks and the start-ups is Envestnet Yodlee. The company said that in the last two months, several large banks had told it that it would lose access to at least some data in the near future if it did not agree to new restrictions on the data it is pulling.

Some of the banks have said they do not want to share the interest rates and fees that they charge customers, even when customers ask for that information to be passed along, said Steve Boms, the vice president for government affairs at Yodlee. Mr. Boms said that his company was pushing back against the requests. “With data limitations, you are hindering the ability of millions of consumers to save more and optimize their finances,” he said.

JPMorgan and Wells Fargo, which have been among the most aggressive in seeking new agreements, said they would pass along any information that customers wanted, as long as the customers themselves requested it. JPMorgan is hoping to create a dashboard on its website where people can choose to turn on or off the data flowing from the bank to any outside provider.

The banks say they are pushing for new data agreements in an effort to stop technology companies from getting access to customer data in ways that the customers might not understand, or that could create security risks.

Right now, few rules or standards exist for how technology companies can use the data they collect from customers. It is also not entirely clear who would be held liable if a data breach at a service like Venmo or Mint led to financial losses for a customer.

“It is in everybody’s best interest to come to more robust arrangements, from a security perspective,” said Brett Pitts, the head of digital for Wells Fargo Virtual Channels.

In January, both JPMorgan and Wells Fargo signed agreements with Intuit — the owner of Mint, TurboTax and QuickBooks — that will give Intuit more streamlined access to data from the banks, in exchange for new rules about how Intuit uses the data. The banks have said they want the agreement with Intuit to be a model for similar agreements with other technology companies.

In recent negotiations, including those with Intuit, Wells Fargo has asked to be paid by technology companies that want better access to its data, a sticking point for technology companies that believe data should flow freely. Mr. Pitts said the payments were intended to help the bank cover the additional infrastructure costs involved in providing real-time access to data.

The negotiations with Yodlee are particularly important because it is the largest so-called data aggregator. Yodlee and a few other data aggregators serve as the middlemen between the banks and the start-ups, pulling the data from the banks and putting it into a form that start-ups like Betterment and Digit can use.

In addition to being the biggest aggregator, Yodlee has also been the most controversial because of what it does with the data it collects.

In particular, the company has been criticized for taking the billions of credit card transactions running through its pipes and selling them to hedge funds and other investment firms. Investors want to look through the transactions for trading signals, such as any indication that a particular retailer or product is doing better than expected.

Yodlee has said that it scrubs the data of any personal information before it sells it to third parties.

Other aggregators that compete with Yodlee, including its largest competitor, Plaid, say they do not sell customer data to third parties and do not think it would be right to do so, given that the consumers do not generally know their data is being sold in this way.

JPMorgan has been insisting in negotiations that it will provide easy access to its data only if technology companies agree not to sell the data to third parties. Intuit agreed to those terms in its deal with the bank.

This has not been the only sticking point in negotiations with Yodlee, however. And Yodlee is not the only company that has complained that the banks are making it harder for customers who want access to information about their bank accounts.

Mr. Harris of Personal Capital has been one of the most outspoken critics of the banks. His company allows consumers to look at all their financial accounts on one dashboard, and also provides them with financial advice based on their holdings.

Mr. Harris, who was previously the chief executive at Intuit and PayPal, said that many banks publicly say they are sharing data while making it hard, behind the scenes, for companies like Personal Capital to get access to it. Some companies, he said, will throttle access to data, or shut it down for hours at a time.

“It happens with a frequency that is too often to simply be the result of some technical problems,” Mr. Harris said.

He said that agreements like those Intuit recently struck with the banks would speed up the movement of data but give the banks too much control over the data flowing to companies like Personal Capital.

“We suss out the data and show the customer what they are actually paying,” he said. “From a business model point of view, that is not in the best interest of the banks and brokers. It’s encouraging customers to get smart and get well-priced products.”