## Facts

- The Department of Labor opened an investigation into potential ERISA fiduciary violations involving the Regional Employers’ Assurance Leagues’ Voluntary Employees’ Beneficiary Association (REAL VEBA), a multiple-employer welfare benefit trust providing benefits (including life insurance) to participating employees.
- REAL VEBA paid premiums on participants’ individual insurance policies but did not maintain separate bank accounts in each participant’s name.
- Employees executed limited powers of attorney authorizing REAL VEBA to act on their behalf concerning the trust.
- After prior resistance from the plan administrator and its counsel, the Secretary of Labor issued an administrative subpoena duces tecum to Community Trust Company (CTC), a Pennsylvania financial institution holding REAL VEBA-related accounts.
- The subpoena sought documents concerning REAL VEBA, including account statements, wire transfers, and correspondence.
- CTC refused, asserting the requested materials were protected “financial records” of “customers” under the Right to Financial Privacy Act (RFPA) and that the Gramm–Leach–Bliley Act (GLBA) barred disclosure unless the Secretary first established jurisdiction over the investigation.
- The district court enforced the subpoena, concluding the RFPA did not apply to REAL VEBA and the GLBA did not require a jurisdictional showing before enforcement.
- CTC appealed.

## Issues

1. Whether the RFPA barred enforcement of the Secretary of Labor’s subpoena to a bank because the subpoena sought protected “financial records” of RFPA “customers.”
2. Whether the GLBA required the Secretary of Labor to establish investigative jurisdiction before a court could enforce a subpoena compelling a financial institution to disclose nonpublic personal information.

## Decision

- The Third Circuit agreed the RFPA did not bar enforcement because REAL VEBA did not qualify as an RFPA “customer.”
- The court rejected treating the trust’s account records as the individual participants’ records for RFPA purposes where the accounts were held in the trust’s name.
- The Third Circuit held the GLBA required the Secretary to demonstrate jurisdiction to conduct the investigation before a financial institution could be compelled to release covered nonpublic personal information.
- Because the record did not sufficiently show jurisdiction over ERISA-covered plans implicated by REAL VEBA, the enforcement order could not stand on the existing record and further proceedings were required.

## Legal Principles

- RFPA protections apply only to financial records of a “customer,” defined as an “individual or a partnership of five or fewer individuals”; a large multi-employer welfare benefit trust does not qualify.
- For RFPA purposes, the relevant “customer” is the account holder at the financial institution; beneficiaries of a trust are not treated as customers merely because the trust holds funds for their benefit.
- GLBA privacy protections for nonpublic personal information are not satisfied by the existence of a subpoena alone; to compel disclosure from a financial institution, the agency must first show it has jurisdiction over the investigation.
- In an ERISA investigation, a jurisdictional showing requires evidence that at least some investigated arrangements fall within ERISA (e.g., involve ERISA-covered employee benefit plans), so that compelled disclosure is within the agency’s statutory authority.

## Conclusion

The Third Circuit held that the RFPA did not prevent the Department of Labor from subpoenaing bank records held in the name of a multi-employer VEBA trust, but the GLBA required the Department to first establish investigative jurisdiction before a court could compel a financial institution to disclose protected nonpublic personal financial information.


Chao v. Cmty. Tr. Co., 474 F.3d 75 (3d Cir. 2007)