JP Morgan Chase 2015 Annual Report Download - page 23

2121
We need to protect our customers, their data and
our company.
We necessarily have a huge amount of data
about our customers because of under-
writing, credit card transactions and other
activities, and we use some of this data to
help serve our customers better (I’ll speak
more about big data later in this letter).
And we do extensive work to protect our
customers and their data – think cyber-
security, fraud protection, etc. We always
start from the position that we want to be
customer friendly. One item that I think
warrants special attention is when our
customers want to allow outside parties to
have access to their bank accounts and their
bank account information. Our customers
have done this with payment companies,
aggregators, financial planners and others.
We want to be helpful, but we have a respon-
sibility to each of our customers, and we are
extremely concerned. Let me explain why:
• When we all readily click “I agree” online
or on our mobile devices, allowing third-
party access to our bank accounts and
financial information, it is fairly clear
that most of us have no idea what we
are agreeing to or how that informa-
tion might be used by a third party. We
have analyzed many of the contracts of
these third parties and have come to the
following conclusions:
– Far more information is taken than the
third party needs in order to do its job.
– Many third parties sell or trade infor-
mation in a way customers may not
understand, and the third parties,
quite often, are doing it for their own
economic benefit – not for the custom-
er’s benefit.
– Often this is being done on a daily basis
for years after the customer signed up
for the services, which they may no
longer be using.
We simply are asking third parties to limit
themselves to what they need in order to
serve the customer and to let the customer
know exactly what information is being used
and why and how. In the future, instead
of giving a third party unlimited access to
information in any bank account, we hope to
build systems that allow us to “push” infor-
mation – and only that information agreed to
by the customer – to that third party.
• Pushing specific information has another
benefit: Customers do not need to provide
their bank passcode. When customers
give out their bank passcode, they may
not realize that if a rogue employee at
an aggregator uses this passcode to steal
money from the customer’s account, the
customer, not the bank, is responsible for
any loss. You can rest assured that when
the bank is responsible for the loss, the
customer will be fully reimbursed. That
is not quite clear with many third parties.
This lack of clarity and transparency isn’t
fair or right.
Privacy is of the utmost importance. We
need to protect our customers and their data.
We are now actively working with all third
parties who are willing to work with us to set
up data sharing the right way.
Why are you making such a big deal about protecting customers’ data in your bank?