Legal options for unauthorized access to bank account (and how to prove it) I've run into an unpleasant situation: https://money.stackexchange.com/questions/75965/mom-keeps-illegally-monitoring-my-bank-account-what-to-do. I was advised to move this question to legal. Could anyone please advise me on my legal options in this case, and how I can gather evidence to prove the transgressions and legally punish them? tl;dr: An employee at a large national bank chain has been accessing and giving out confidential information about my bank account to my mother, with whom he/she is friends. I reported this unauthorized access to the bank's manager directly, who said that he would put an alert on my account to make sure that it does not happen again and that he would get back to me after an internal investigation was carried out. However, he never got back to me and never returned any of my calls again. A few months later, I opened a new bank account at another bank and transferred most of my funds to it. My mother then asked me shortly thereafter why I withdrew most of my money from my original bank account. Hence, the problem was not solved -- my bank account information is still being accessed without my permission and my privacy is being violated. Since I already reported this info to the bank's manager, I do not know what else to do to pursue any legal action towards the rogue employee who has been accessing (and releasing information) about my bank account to my mother. I want to know if I can pursue any legal options against the bank, my mother, or both. I do not want to close my original bank account because this would constitute a major inconvenience (since my wife, kids, and I bank there). I know with 100% certainty that it is coming from an employee friend at the bank, because my mom told me about it directly.
As a general rule, if a business, like a bank, is legally required to keep information confidential, and an employee breeches confidentiality, then your recourse is to sue the business for damages. See for example ch. 35 of Title 12. The bank cannot claim "It's not our fault, an employee did it" (the Latin for this is "respondeat superior", whereby a part is also responsible for the acts of their agents). As far as I know, there is no law against asking for information that can't be given. This does assume, however, that your mother does not have a legal right to the information (which could arise from some form of co-signing). Also, would assume that they have a normal privacy policy, and not one where they say "We will tell your mother if she asks" (they would have informed you of that, so read the privacy policy). This is a question best answered by your own attorney, to whom you would reveal all of the details.
FDIC Regulation 500 prohibits discrimination in making loans on the basis of "National origin" but not on the basis of immigration status. This story from The Nation says that Bank of America is denying accounts to non-citizens, and arguing that it is legal because of increased risks, although there are current court challenges to this. Perez v. Wells Fargo Bank, N.A is a case now pending challenging loan denials based on immigration status. This has particularly come up in regard to DACA recipients, rather than people with LPR status. The US "public accommodation" laws probably do not apply, as a bank is not usually considered a place of public accommodation. Any specific state laws prohibiting discrimination on the basis of immigration status might apply. In short, this is an issue still not clearly settled. There seems to be no law or regulation requiring banks to ask for citizenship information, much less to deny accounts based on it, and it would be well to seek a bank with a different policy if possible. The above is very US-specific. Many countries do limit banking access based on citizenship, i understand. I am not a lawyer, and this is not legal advice. Before challenging any bank action, you may well wish to seek advice from a lawyer.
I guess you are interpreting the answer of the officer the wrong way. Minors do have rights. Plenty of them. But using a phone to contact people their legal guardian does not approve, or to consume media their legal guardian does not approve, is usually not a right minors have. And to make those restrictions stick, your mother took your phone away. Ask for it on your 18th birthday. But when one of you has called the police on a family situation like this, both of you have a problem that goes way beyond property rights. Do you have an adult you can talk to? A teacher? An uncle or aunt? A coach? Try talking to them. If they all side with your mother, consider that she might be right and you are wrong. But often both sides talk themselves into a corner, and a neutral viewpoint helps. If you are truly desperate about your situation, call Child Protective Services. But that could backfire if they believe your mother, and make the family situation worse. Taking a phone away is not neglect or abuse.
Yes, your transaction history is your personal data. Personal data is any information relating to an identifiable person. Your transaction history relates to you, and you're definitely identifiable for the bank. You have access to the transaction history to the app, which would probably satisfy Art 15 GDPR. You do also have a right to data portability under Art 20 GDPR which allows you to get your data in a machine-readable format – but strictly speaking this right only applies to data you provided yourself. You could try to explicitly invoke this right. Your GDPR rights must be satisfied without cost. Your bank almost certainly does provide machine-readable API access, in conformance with the open banking mandate from the Revised Payment Services Directive (PSD2, Directive (EU) 2015/2366). The Directive requires your EU member state to have passed a law that gives you “the right to make use of services enabling access to account information”, if you're already using online banking. However, the exact details of that right will depend on the laws in your EU member state. You might already be able to connect to your transaction history via Open Banking software such as GNU Cash.
It isn't necessarily "illegal" (in the sense you are committing a crime) but you may be in violation of a verbal contract (which would fall under tort law). Let's take this a bit further. Perhaps Joe Schmoe gave you his debit card information so that you could make deposits for him and he said you could take $5 out for yourself for the trouble. This is a contract between you and Joe for a service. You can't extend Joe's offer to Jane Doe by saying "here is some debit card information, take $2.50 out for yourself". You have no right to extend your contract with Joe to somebody else. Now specifically for passwords it basically boils down to the same thing. Unless Joe gives you explicit permission to give that to somebody else, you can't just decide to unilaterally give what Joe gave you to somebody else. This may be different if Joe said "here, I'm buying you a subscription to service XYZ because you are a nice guy", this may be construed as a gift which transfers ownership. At that point you have control over what is or isn't done with the account. As another example let's say Joe let you borrow his car. You can't turn around and say to Jane, "here's a car you can use", Joe did not extend the offer to Jane, nor did Joe give you the right to extend the offer to another person. It's a moot point though, in the original context of this question, Netflix does restrict you from sharing your passwords "outside your household". Almost every paid service has some restriction against sharing with others. In the end Netflix may shut off Joe's account and Joe may sue you for damages, but you aren't going to be thrown in jail for this. This would be a civil case (tort) which you may be liable for monetary damages.
If they really ordered it, they entered into a contract, and you have a claim against them for damages suffered because the contract was breached. This would be a civil claim, not a criminal claim, in the Netherlands. However, if you're delivering an order that was sent anonymously, you have no way to prove that the person at the door is the one who ordered the food - and the onus would be on your to prove that it was. It could become a criminal act under a number of laws ("oplichting", "fraude", etc.) if intent can be proven but that's not easy - and you first have to get the police/public prosecutor interested in the case. It's quite comparable to someone ordering in a restaurant and not paying the bill, which is notoriously hard to prosecute criminally in the Netherlands. (Search for "eetpiraat" - dinner pirates) As a restaurant, you usually can only try to enforce a civil claim through the civil courts.
You have a contract - they have fulfilled their obligation (they paid you), if you do not fulfil their obligation (not to post it online) then you are in breach of the contract. Your obligation continues even if you gift the money back to them. If you breach the contract then they can sue you for the damage that they suffer. Presumably this would be damage to their reputation and for a public figure this could run into millions of dollars. In demanding additional money from them beyond what you are legally entitled to you are, at least, flirting with the crime of extortion/blackmail. This would not be a matter for them to sue you for, it would be a matter for the DA to prosecute if they chose to make a complaint. There doesn't seem to be a defamation issue here because you are not stating anything that isn't true. Now, the extent of the agreement appears to prohibit you posting it on the internet, however, the spirit of the agreement is that you will keep the information secret in all respects - that is likely how a court would look at it. Of course, if someone does steal the information from you then you haven't broken the agreement but you would probably have to prove that it was stolen when they sue you.
You can't own a database; you might, however, own (have) the copyright to a database if you created it or the creator transferred that right to you. You can also possess a copy of a database: the question is whether it is legal. "Leaked" implies that it is taken without permission, so you might be in violation of copyright law by possessing a copy. The only databases that would escape copyright protection would be those US government works, things put in the public domain, and things publically licensed to allow copying. Plus, any database whose content fails to exhibit a modicum of creativity (Feist). A database might be inherently illegal (at least in your hands), so it would depend on what the content is. The first thing that comes to mind is a database from a child-porn website, which contains numerous illegal images: see section 110 of Title 18. "Leaked" information might involve violation of 18 USC 1030 (Computer Fraud and Abuse Act), which prohibits unauthorized hacking. It does not directly prohibit being in possession of a hacked database: but you might still be prosecuted as an accessory after the fact. (That is one of those ad libitum areas of the law where there's no way to know for sure what is and is not "okay"). If they do prosecute you, you might rely on Bartnicki v. Vopper, 532 U.S. 514, where because it was a matter of "public interest", propagation of illegally obtained material was held to be protected by the First Amendment. Also there is the case of the Pentagon Papers. At the federal level, there are no controls over storing credit card information so if you get a copy of the Target or Home Depot hacked database, there's no federal law against that (if we discount "accessory after the fact"), but there are circumstances in Minnesota where retaining such information could be illegal.