A credit union CEO is concerned about the security of her members’ personal information

By Joyce Moed, Reporter

Denver, Colo.–A credit union CEO is concerned about the security of her members’ personal information, after a recent National Credit Union Administration examiner’s visit.

Christine Wiley, CEO of Rocky Mountain Law Enforcement Federal Credit Union, was asked to have a “list of things to have ready,” before the examination, she said, including copies of the credit union’s ledger reports and policies, along with copies of many of her members’ records. The examiner spent more than two weeks in June coming to the CU, before having an exit interview and telling Wiley “I’m wrapped up.”

“I said to her ‘We have gotten back a third or even one-half of what we gave you,’” Wiley said.
Wiley said that the examiner told her that she, as long as other NCUA examiners, take the records with them upon completion of the examination–and store the records at their individual homes. This particular examiner, Wiley said, told her that she stores records in her basement. The reason being that in areas where there is not a regional NCUA office, the examiners work out of their homes.

Wiley said this strongly conflicts with the guidelines the NCUA sets for credit union with regards to storage of members’ records.

“We comply,” Wiley said. “We don’t even allow employees to take stuff home to work on it.”
Wiley said that each year the credit union has a new examiner.

“So every year, the stuff is transferred to the new examiner,” she said.

After questioning the examiner about why they were allowed to take records home when the actual credit union was forbidden to do so, Wiley said it was because of an oath taken by NCUA examiners.

“I told my board about it and my board went through the roof. The board is disgusted,” Wiley said. “It is a big issue. It is a big liability. And if members found out about this, they would close their accounts. The FDIC doesn’t do this. If members knew, they’d be walking. This is not acceptable.”

The next thing that the Rocky Mountain Law Enforcement FCU did was “send a demand letter representing our concerns,” Wiley said, to Melinda Love, regional director of Region V of the NCUA office in Tempe, Ariz. The letter was sign by William Threlkeld, chairman of the board of directors of the CU and JC Tyrus, chairman of the supervisory committee of the CU on Aug. 2.
“This letter represents our concern regarding NCUA’s policy of credit union records’ storage in the home of examiners,” the letter began. “NCUA’s policy of storing sensitive member-related data as part of credit union exam documentation is in gross violation of Gramm-Leach Bliley Act, and NCUA Regulation Parts 748 and 749. As a result, we demand immediate return of all credit union records being stories in the homes of all current and past examiners. Additionally, we demand to see a data destruction log of past records that have been destroyed for our credit union in accordance with regulations.”

The letter also expressed concern about the “NCUA examiner computers lack of encryption.”
“Password protection alone does not meet the standards in the technology environment today, and anyone with computer skills could access member data in a laptop,” the letter read. “It is negligent to practice such poor stands given all the law and regulation that exist. Not to mention the fact that the agency does not even follow the regulations and standards it created and requires for credit unions.”

A few days later at the Director’s Conference, Wiley wrote an anonymous question for Gigi Hyland, NCUA board member and a presenter at the conference, to answer during the question-and-answer period, Wiley said.

The question was “What is the NCUA doing to secure credit union records in homes of examiners?”
“She said, ‘I believe we’re not doing this anymore,’” Wiley said.

After the session, Wiley approached Hyland’s Gary Kohn, Hyland’s adviser to speak to him one-on-one about the matter.

“They were like ‘wow,’ and said “we’ll check into it,’” Wiley said.

Wiley said she didn’t receive any response after that and then at an Outreach Meeting on Aug. 15, “Gary was quick to come over to me,” she said.

Wiley then proceeded to talk about the letter sent to the NCUA, she said, and was told that they didn’t receive the letter.

“But I sent it return receipt requested,” she told Kohn, who then told her a little while later that he received an e-mail on his Blackberry that the letter was received, Wiley said.

One week later, the Rocky Mountain Law Enforcement FCU received a letter from the office of Melinda Love.

“We assure you credit union and credit union member records in the agency’s possession are maintained in accordance with all legal requirement with utmost attention to protecting member privacy,” the letter read. “We have asked of Office of General Counsel and Office of the Chief Information officer to review your letter so we can provide you with additional information about your legal and information security concerns. Please note NCUA is entitled to examine and maintain copies of credit union records, that these records become federal agency records, and, therefore, a credit union is not entitled to demand their return.”

Since receiving this letter, Wiley said she has been in contact with the officially appointed ombudsman.

“I told him what the situation is,” she said. “He asked if we wanted to file a complaint. I said ‘yes.”
As of press time, the Rocky Mountain Law Enforcement FCU was in the process of preparing that complaint.

A former NCUA general counsel member said that 25 years ago, when he was on staff with the NCUA, he does recall examiners storing records in their homes, in secure filing cabinets.

“Their duty station was their home,” he said. “They had a dedicated phone line from NCUA and they had a secure filing cabinet that was fireproof.

“But it’s so different today,” he continued. “Everything is done on the computer today. I imagine 99% is electronic. I don’t know what the current practice is.”

David Marquis, director of examination and insurance for NAFCU said “examiners do not keep any member records at home.”

Instead, the only items that an examiner will take from a credit union is a field file, which includes the exam report of the credit union and other information about the credit union only–such as the CU’s policies–but not member information.”

“The examiner keeps no personal information at home,” Marquis said.

Marquis said that all personal information is stored at the credit union only, or at a third-party vendor the credit union uses if they do not have the space in its own facility. He said that photocopies are taken of ledger reports, policies of the credit unions and about the board members, but not any personal information about the members of the CU.

“The only exception is a very small credit union where the job cannot be done at the institution,” he said.

But Wiley, whose credit union provided a large conference room for the examiner to work, she said, said that’s not true, and that her staff was required to provide copies of member information before the examination, most of which was not returned to them after the completion of the examination.

“We’re like ‘Where is our stuff?’” she said. “We didn’t get one-half of all our stuff back. They took copies of loan information, in addition to the copies we had to provide them. They also had full access to our copy room and could take copies of what they wanted.”

Marquis said that this is so strongly enforced that if any examiner did take member information out of the credit union facility, his or her employment would be terminated.

Neither Gary Kohn, nor John McKechnie, director of congressional and governmental affairs for NAFCU, could be reached for comment.