We allowed a police officer to view our surveillance footage for our parking lot because someone had broken into a car in a nearby parking lot. Now the police are asking us to hand over a copy of the tape. Do we need to require a subpoena before providing a tape of the surveillance footage?

No, we do not believe a subpoena would be required for providing this surveillance tape to law enforcement.

We do not believe that federal or Illinois financial privacy laws would prohibit you from sharing the surveillance tape with law enforcement. Those laws protect “financial records” and “personally identifiable financial information.” These terms are defined broadly, including even the fact that an individual is a customer of your bank. But from what you have told us, it is unlikely that the surveillance tapes include any protected information about your customers — the tapes include only exterior footage in a public area. Because the tapes do not include any personal or financial information, and do not identify your customers (as they would not reveal which individuals using your parking lot are customers, versus merely visitors), we believe that you may share the surveillance tape with law enforcement, without a subpoena.

Additionally, Regulation P permits a bank to share financial information “to comply with a properly authorized civil, criminal, or regulatory investigation.”

For resources related to our guidance, please see:

Illinois Banking Act, 205 ILCS 5/48.1 (“For the purpose of this Section, the term ‘financial records’ means any original, any copy, or any summary of: (1) a document granting signature authority over a deposit or account; (2) a statement, ledger card or other record on any deposit or account, which shows each transaction in or with respect to that account; (3) a check, draft or money order drawn on a bank or issued and payable by a bank; or (4) any other item containing information pertaining to any relationship established in the ordinary course of a bank's business between a bank and its customer, including financial statements or other financial information provided by the customer.”)
Regulation P, 12 CFR 1016.3(q)(1) (“Personally identifiable financial information means any information: (i) A consumer provides to you to obtain a financial product or service from you; (ii) About a consumer resulting from any transaction involving a financial product or service between you and a consumer; or (iii) You otherwise obtain about a consumer in connection with providing a financial product or service to that consumer.”)
Regulation P, 12 CFR 1016.3(q)(2) (“Information included. Personally identifiable financial information includes: . . . (C) The fact that an individual is or has been one of your customers or has obtained a financial product or service from you; [and] (D) Any information about your consumer if it is disclosed in a manner that indicates that the individual is or has been your consumer; . . . Personally identifiable financial information does not include: (B) Information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses.”)
Regulation P, 12 CFR 1016.15(a)(7) (Provides an exception to the privacy requirements for a bank “[t]o comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, state, or local authorities . . . .”)