← Global Privacy Laws Research Library
12 U.S.C. §§ 3401-3423 (2024 edition)
Right to Financial Privacy Act of 1978
Prepared by Shubhank Suman · Last reviewed
CURRENT / IN FORCE
- Legal character
- Statute
- Region
- North America
What it covers
The Act stops federal government authorities from getting access to a customer's financial records held by a financial institution unless the customer authorises it or the authority uses an administrative subpoena or summons, a search warrant, a judicial subpoena or a formal written request. The customer normally gets notice and may challenge the request in court; notice can be delayed in defined cases. Financial institutions must not release records until the authority certifies compliance. Exceptions, use restrictions and civil penalties follow.
Why it matters
It is the main federal limit on government access to bank records and sets the process banks follow when federal agencies seek customer data.
Refer to it when
Use it when a US federal agency asks a bank or card issuer for an individual customer's records.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: High
- Cyber: Low
AI
LOW RELEVANCE
No AI-specific provisions.
Privacy
HIGH RELEVANCE
Protects financial records against government access.
Cybersecurity
LOW RELEVANCE
No security obligations.
Applicability
US federal government authorities and financial institutions holding customer records.
Current validity
CURRENT. Enacted 1978, as amended. Read the official PDF on this page for the operative text.
Read first
Section 3401 → 3402 → 3405-3408 → 3409-3410 → 3413 (exceptions).
Provisions / sections covered
Section 3401 – Definitions
Financial institution, financial record, customer and Government authority.
Section 3402 – Access prohibited; exceptions
The permitted routes for government access.
Sections 3404-3408 – Authorisation and legal process
Customer authorisation, subpoenas, summons, warrants and formal written requests.
Sections 3409-3410 – Delayed notice and customer challenges
When notice can be delayed and how a customer challenges access.
Section 3417 – Civil penalties
Damages for unlawful access or disclosure.
Subject-matter tags
- Security
- Government data
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- HIPAA: United StatesLaw · Current (amended)Same jurisdiction; assess applicability separately.
- NIST Artificial Intelligence Risk Management Framework (AI RMF 1.0)Framework · Voluntary / non-bindingSame jurisdiction; assess applicability separately.
- Stored Communications Act – 18 U.S.C. Chapter 121Law · CurrentSame jurisdiction; assess applicability separately.
- Video Privacy Protection Act – 18 U.S.C. § 2710Law · CurrentSame jurisdiction; assess applicability separately.
- Cybersecurity Information Sharing Act of 2015Law · CurrentSame jurisdiction; assess applicability separately.
- Federal Information Security Modernization Act of 2014 (FISMA)Law · CurrentSame jurisdiction; assess applicability separately.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.