[PUBLISH]
IN THE UNITED STATES COURT OF APPEALS FOR THE ELEVENTH CIRCUIT ________________________
No. 96-4931 ________________________
D.C. Docket No. 95-CV-2650-CV-FAM
PATRICIA GONZALES LOPEZ,
Plaintiff-Appellant,
versus
FIRST UNION NATIONAL BANK OF FLORIDA,
Defendant-Appellee.
________________________
No. 97-4238 ________________________ D.C. Docket No. 96-7115-CV-JAG
JOSE DANIEL RUIZ CORONADO,
BANKATLANTIC BANCORP, INC.,
Appeals from the United States District Court for the Southern District of Florida ________________________ (November 21, 1997) Before CARNES, Circuit Judge, and KRAVITCH and REAVLEY*, Senior Circuit Judges.
* Honorable Thomas M. Reavley, Senior U.S. Circuit Judge for the Fifth Circuit, sitting by designation. CARNES, Circuit Judge:
These cases, consolidated for purposes of this appeal, arise
out of plaintiffs' claims that their banks improperly disclosed
information relating to their checking accounts to federal
authorities. The complaint in each case was dismissed on the
ground that the safe harbor provisions of the Annunzio-Wylie Anti-
Money Laundering Act, 31 U.S.C. § 5318(g), immunized the banks from
liability. For the reasons set forth below, we reverse the
judgments dismissing the complaints on that ground. I. THE LOPEZ CASE
We will discuss the two cases separately, beginning with the
one Patricia Lopez brought against First Union National Bank
("First Union").
A. FACTS AND PROCEDURAL HISTORY
Because this case is before us on appeal from a Federal Rules
of Civil Procedure 12(b)(6) dismissal for failure to state a claim,
we limit ourselves to the allegations of the complaint, which we
are required to accept as true. Those allegations may turn out to
be inaccurate, or there may be additional facts which dictate a
different result, but for now the factual boundary of this case is
marked by the metes and bounds of the complaint.
The FedWire Fund Transfer System is an electronic funds
transfer system which permits large dollar fund transfers by
computer-to-computer communications between banks. First Union is
a bank within the FedWire Fund Transfer System and uses "electronic
storage" to maintain the contents of an electronic funds transfer.
2 On September 2, 1993, and November 30, 1993, First Union received
an electronic wire transfer of funds for credit to Lopez's account.
On both occasions, First Union provided United States law
enforcement authorities with access to the contents of those
electronic transfers. First Union made these disclosures based
solely on the "verbal instructions" of federal law enforcement
authorities.
On February 3, 1994, a United States Magistrate Judge issued
a seizure warrant directing First Union to freeze Lopez's account
and conduct an inventory of it. Pursuant to the seizure warrant,
First Union again provided United States law enforcement
authorities access to the contents of the electronic fund transfers
sent to Lopez that were being held in electronic storage. On June
6, 1995, First Union surrendered the $270,887.20 balance of Lopez's
First Union account to the United States. The United States
subsequently filed a civil forfeiture case against Lopez, which was
resolved by a stipulation that $108,359 of Lopez's account was
forfeited to the United States while $162,532.20 was returned to
her.
Following the resolution of the civil forfeiture case, Lopez
filed suit against First Union asserting claims under the
Electronics Communications Act 18 U.S.C. §§ 2501 et seq. (Counts
I and II), the Right to Financial Privacy Act, 12 U.S.C. §§ 3401 et
seq., (Count III), and Florida law. (Count IV).
First Union moved to dismiss the complaint pursuant to Rule
12(b)(6) for failure to state a claim upon which relief can be
3 granted. The district court granted the motion and dismissed
Lopez's complaint with prejudice. The district court's decision to
dismiss the complaint was based exclusively on its conclusion that
the Annunzio-Wylie Anti Money Laundering Act, 31 U.S.C. §
5318(g)(3), immunized First Union from liability. This appeal
followed.
B. STANDARD OF REVIEW
We review de novo the dismissal of a complaint for failure to
state a claim for relief, accepting all allegations in the
complaint as true and construing those allegations in the light
most favorable to the plaintiff. See Harper v. Thomas , 988 F.2d 101, 103 (11th Cir. 1993). A complaint may not be so dismissed
"unless it appears beyond doubt that the plaintiff can prove no set
of facts in support of his claim which would entitle him to
relief." Pataula Elec. Membership Corp. v. Whitworth , 951 F.2d
1238, 1240 (11th Cir.) (quoting Conley v. Gibson, 355 U.S. 41,
45-46, 78 S. Ct. 99, 102 (1957)).
C. ANALYSIS
As a preliminary matter, we first address First Union's
arguments that Lopez's complaint fails to state a claim under
either the Electronic Communication Privacy Act, 18 U.S.C. §§ 2501
et seq ., ("the ECPA") or the Right to Financial Privacy Act, 12 U.S.C. §§ 3401 et seq., ("the RFPA").2 We will then address the
2 Because the district court dismissed Lopez's complaint on the ground that the Annunzio-Wylie Anti-Money Laundering Act immunized First Union from liability, it did not address these issues. However, the parties have briefed them, and in view of our disagreement with the district court's dismissal of the complaint
4 additional issue of whether the Annunzio-Wylie Anti-Money
Laundering Act, 31 U.S.C. § 5318(g)(3) immunizes First Union from
liability.
1. Lopez's Claims Under the ECPA
In 1986, Congress clarified the existence of privacy rights
in electronic communications by enacting the ECPA, which provides
"protect[ion] against the unauthorized interception of electronic
communications." Sen. Rep. No. 99-541 at 3555. Among other things,
the ECPA defines the conditions in which an electronic
communications service may divulge the contents of electronic
communications, see, e.g. , 18 U.S.C. § 2702; 18 U.S.C. 2711, defines the conditions in which the government is entitled to
access an individual's electronic communications, see 18 U.S.C.
2703, and provides a civil cause of action for anyone injured by a
violation of the act's substantive provisions, see 18 U.S.C. 2707.
In counts I and II of her complaint, Lopez alleges that First
Union violated her rights under the ECPA. In count I, she
specifically alleges that First Union violated 18 U.S.C. §
2702(a)(1), which provides that "a person or entity providing an
electronic communication service to the public shall not knowingly
divulge to any person or entity the contents of a communication
while in electronic storage by that service." The complaint
alleges that First Union provided an electronic communication
service and that First Union provided the United States access to
on Annunzio-Wylie grounds, judicial economy counsels in favor of our addressing them.
5 "the contents of information in electronic storage, including the
contents of electronic communications pertaining to . . . Lopez."
First Union contends that count I fails to state a viable
claim under 18 U.S.C. § 2702(a)(1), because it is not an electronic
communication service. We reject that contention which amounts to
nothing more than a denial of the allegations in Lopez's complaint.
Accepting all allegations in the complaint as true as we are
required to do at this stage, we conclude that Count I states a
violation of 18 U.S.C. § 2702(a)(1).3
In count II, Lopez alleges that First Union infringed her
rights under the ECPA by violating 18 U.S.C. § 2703 and 18 U.S.C.
§ 2711(3)(a). Section 2703 defines the conditions in which an
electronic communication service may disclose electronic
communications to the government. If the electronic communication
service has held the contents of an electronic communication in
electronic storage for one hundred eighty days or less, it may
disclose that electronic communication to the government only
pursuant to a federal or state warrant. See 18 U.S.C. 2703(a). In
Count II, Lopez alleges that, on the same day funds were
electronically transferred to her account, First Union disclosed
contents of those electronic funds transfers in electronic storage
pursuant to "verbal instructions" instead of a warrant. She also
3 Nor does the fact that Congress amended the ECPA in 1996 to specifically exclude electronic funds transfers from the definition of an "electronic communication," see 18 U.S.C. § 2510(15) (1996), prevent Count I from stating a claim under § 2702(1)(a). That amendment did not take effect until 1996, well after the events giving rise to this case.
6 alleges that the disclosures were made on the same day that funds
were electronically transferred to her account, which means the
communication disclosed had been held in electronic storage for
less than one hundred eighty days. Those allegations are
sufficient to state a prima facie claim under 18 U.S.C. § 2703.
However, the allegations of Count II of the complaint are not
sufficient to state a claim under 18 U.S.C. § 2711(3)(a). That
section provides that "an electronic communication service . . .
shall not intentionally divulge the contents of any communication
. . . while in transmission on that service to any person or entity
other than an addressee or intended recipient of such
communication." 18 U.S.C. § 2711(3)(a) (emphasis added). That
proscription is not violated unless the communication is divulged
"while in transmission." Neither Count II nor any other part of
the complaint alleges that First Union disclosed Lopez's electronic
communications "while in transmission." Instead, Count II alleges
that First Union disclosed the contents of electronic
communications held in electronic storage.
Alleging that First Union disclosed a communication held in
"electronic storage," which violates § 2702(a)(1), is not
equivalent to alleging that First Union disclosed a communication
in "transmission," which would violate § 2711(3)(a). Because the
complaint does not allege that First Union disclosed communications
while in transmission, it fails to state a claim under §
2711(3)(a).
7 2. Lopez's Claim Under the RFPA
In United States v. Miller, 425 U.S. 435, 443, 96 S.Ct. 1619,
1623 (1976), the Supreme Court held that individuals have no Fourth
Amendment expectation of privacy in their financial records while
those records are in the hands of third parties. That decision
prompted Congress to enact the Right to Financial Privacy Act, 12
U.S.C. §§ 3401 et seq., ("the RFPA"), which provides individuals
with some privacy rights in financial records that are in the
hands of third parties. Among other things, the RFPA defines the
conditions in which financial institutions may disclose an
individual's financial records, see 12 U.S.C. § 3403, defines the conditions in which government officials may access an individual's
financial records, see 12 U.S.C. § 3402, and provides a civil cause
of action for anyone injured by a violation of the act's
substantive provisions, see 12 U.S.C. § 3417.
In count III of her complaint, Lopez alleges First Union
violated her rights under the RFPA by disclosing her financial
records under conditions not authorized by the RFPA. First Union
does not argue that Lopez has failed to allege a prima facie
violation of the RFPA. Instead, it contends that count III should
be dismissed because the alleged disclosures are protected by 12
U.S.C. § 3403(c), another section of the RFPA. Under § 3403(c), a
financial institution possessing information relevant to a possible
violation of law involving one of its accounts is permitted to make
a disclosure of that information to law enforcement. However, the
disclosure permitted is limited to the name of the account holder
8 and "the nature of any suspected illegal activity." 12 U.S.C. §
3403(c). Because the complaint alleges that First Union went
beyond that and disclosed actual financial records pertaining to
Lopez's account (i.e., the electronic funds transfers
communications, the contents of which were held in electronic
storage), First Union's alleged disclosures are not protected by 12
U.S.C. § 3403(c). Accordingly, count III of Lopez's complaint
states a claim under the RFPA.
3. The Annunzio-Wylie Anti-Money Laundering Act
The Annunzio-Wylie Anti-Money Laundering Act of 1992, 31
U.S.C. § 5318(g), provides in relevant part:
g) Reporting of suspicious transactions.--
(1) In general.--The [Treasury] Secretary may require any financial institution, and any director, officer, employee, or agent of any financial institution, to report any suspicious transaction relevant to a possible violation of law or regulation.
(2) Notification prohibited.--A financial institution, and a director, officer, employee, or agent of any financial institution, who voluntarily reports a suspicious transaction, or that reports a suspicious transaction pursuant to this section or any other authority, may not notify any person involved in the transaction that the transaction has been reported.
(3) Liability for disclosures.--Any financial institution that makes [i.] a disclosure of any possible violation of law or regulation or [ii.] a disclosure pursuant to this subsection or [iii.] any other authority, and any director, officer, employee, or agent of such institution, shall not be liable to any person under any law or regulation of the United States or any constitution, law, or regulation of any State or political subdivision thereof, for such disclosure or for any failure to notify the person involved in the transaction or any other person of such disclosure.
9 The three safe harbors provided by § 5318(g)(3) supply an
affirmative defense to claims against a financial institution for
disclosing an individual's financial records or account-related
activity. Financial institutions are granted immunity from
liability for three different types of disclosures:
(i.) A disclosure of any possible violation of law or regulation, (ii.) A disclosure pursuant to § 5318(g) itself, or (iii.) A disclosure pursuant to any other authority.
See 31 U.S.C. § 5318(g)(3).
The district court dismissed Lopez's complaint after
concluding that the safe harbor provisions of § 5318(g)(3)
protected First Union's disclosures of her account activity. Lopez
contends that the district court's holding is erroneous for two
reasons. First, she contends that § 5318(g)(3)'s safe harbor
provisions apply only to disclosures of currency transactions. If
that is true, First Union's disclosure of electronic transfers and
the contents of transfers held in electronic storage are not
protected by any of the safe harbor provisions of § 5318(g)(3).
Second, Lopez contends that even if the Act does cover more than
currency transactions, First Union's disclosures do not fall within
one of the three categories of disclosures for which § 5318(g)(3)
grants immunity. Addressing Lopez's contentions in turn, we
disagree with the first one but agree with the second.
a. Does § 5318(g)(3) Apply to Disclosures of Electronic Transfers and Contents Held in Electronic Storage?
Lopez's contention that § 5318(g)(3) protects disclosures of
currency transactions only is at odds with the text and purpose of
10 the Annunzio-Wylie Act. The text of § 5318(g)(3) neither
explicitly nor implicitly suggests that Congress intended to limit
the safe harbor to disclosures of currency or to any specific kind
of transaction. To the contrary, the text of that subdivision
indicates Congress deliberately did not limit the safe harbor to
disclosure of any specific type of transaction. For example, §
5318(g)(3) provides that a financial institution is entitled to
immunity for a disclosure of "any possible violation of law." 31
U.S.C. § 5318(g)(3) (emphasis added). As we have recently had
occasion to explain, when used in a statute, "the adjective 'any'
is not ambiguous; it has a well-established meaning." Merritt v. Dillard Paper Company, 120 F.3d 1181, 1186 (11th Cir. 1997). "Read
naturally, the word 'any' has an expansive meaning, that is, one or
some indiscriminately of whatever kind." Id., quoting United
States v. Gonzales, 117 S.Ct. 1032, 1035 (1997) (citation and some
quotation marks omitted). Thus § 5318(g)(3) protects disclosure of
a violation of law regardless of whether it involves a cash
transaction, electronic transfers, or any other type of
transaction. Section 5318(g)(3)'s scope is not limited merely to
disclosures of currency transactions.
Moreover, we agree with the district court that the purpose
underlying the Act is inconsistent with Lopez's proposed
construction. The district court reasoned as follows:
[A]ccording to the comments of Congressman Neal regarding the enactment of 31 U.S.C. § 5318(g), banks have long been encouraged to report suspicious transactions to the appropriate authorities. See Cong.Rec. E57-02 (1993). Therefore, to ensure compliance from the banks, the safe harbor provision was added in order to protect a bank
11 when it reports a suspicious transaction. Id. "The goal of this new law is to have banks work with international efforts to stop the global movement of drug money. Money laundering is an international problem. Money knows no borders and flows freely from one country to another. The United States has long recognized that, and has worked hard to ensure cooperation from foreign governments and financial institutions to assure that money launderers have no place to hide." Id.
The Court finds that if Congress intended to limit this statute solely to "currency transactions" as asserted by Plaintiff, it would severely restrict the ability of a bank to report suspicious transactions without the fear of liability. As Plaintiff notes in her response to Defendant's motion, "[i]n 1994, some 72 million fund transfers with a total value of $211 trillion were moved over Fedwire." Plaintiff's Response Memorandum, p. 11 n. 8, citing Fedpoint 43. Thus, the effectiveness of the anti-money laundering act would be substantially limited if it applied only to cash transactions, since electronic fund transfers, the contents of which are held in electronic storage, are the means by which large dollar funds are transferred between the Federal Reserve and the service providers (i.e., originating banks, intermediary banks, and beneficiary banks)
Lopez v. First Union National Bank, 931 F.Supp. 860, 864 (S.D. Fla.
1996).
Accordingly, we hold that electronic fund transfers and
information held in electronic storage are not outside the scope of
the Annunzio-Wylie Anti-Money Laundering Act's safe harbor
provisions, 31 U.S.C. § 5318(g)(3).
b. Are First Union's Disclosures Protected By § 5318(g)(3)'s Safe Harbor Provisions?
The Annunzio-Wylie Act does not provide a financial
institution blanket immunity for any disclosure of an individual's
financial records. Instead, a financial institution is entitled
to immunity only if its disclosure falls within one of the three
safe harbors set forth in § 5318(g)(3). Lopez's complaint alleges
12 that First Union disclosed Lopez's financial records twice in
response to nothing more than "verbal instructions" of government
officials and once pursuant to a seizure warrant. Under the facts
alleged in Lopez's complaint, First Union's two disclosures in
response to "verbal instructions" of government officials do not
fit within any of § 5318(g)(3)'s three safe harbors. However, its
disclosure pursuant to the seizure warrant is protected by §
5318(g)(3)'s third safe harbor.
The first safe harbor provision protects a financial
institution's "disclosure of a possible violation of law or
regulation." 31 U.S.C. § 5318(g)(3). As the use of the adjective
"possible" indicates, a financial institution's disclosure is
protected even if it ultimately turns out there was no violation of
law. In order to be immune from liability, it is sufficient that
a financial institution have a good faith suspicion that a law or
regulation may have been violated, even if it turns out in
hindsight that none was. By extending immunity to a financial
institution's disclosure of a suspected violation of law or
regulation, the first safe harbor encourages financial institutions
to voluntarily play a role in combating money laundering and other
crimes.
The problem for First Union at this stage of the litigation is
that it is stuck with the allegations of the complaint. Those
allegations do not show that First Union had a good faith suspicion
that a law or regulation may have been violated. None of the
allegations indicate that the transactions associated with Lopez's
13 accounts were suspicious enough to suggest a possible violation of
law. First Union contends, however, that the first safe harbor
should protect disclosures made in response to "verbal
instructions" of government officials. It argues that law
enforcement's demand for financial records should, by itself, be
sufficient to give a financial institution a good faith basis to
suspect a possible violation of law or regulation. The hidden
premise of that argument is that Congress intended the first safe
harbor to protect disclosures made pursuant to government
officials' unexplained request or unvarnished instructions for
financial records. That premise is flawed.
As we will discuss below, the second and third safe harbors
protect from liability in situations where the government has and
exercises the legal authority to demand disclosure of financial
records. If we accepted First Union's premise that Congress
intended the first safe harbor to protect disclosures made pursuant
to any and all government demands, it would render the other two
safe harbor provisions superfluous. Following the basic principle
of statutory construction "that a statute should not be construed
in such a way as to render certain provisions superfluous or
insignificant," Woodfork v. Marine Cooks & Stewards Union, 642 F.2d
966, 970 (5th Cir. 1981), we reject First Union's contention that
the first safe harbor protects disclosures made in response to
nothing more than "verbal instructions" of government officials.
Having concluded that the first safe harbor provision does not
protect First Union from liability for the alleged disclosures, we
14 turn now to the second. The second safe harbor provision protects
a financial institution's "disclosure pursuant to this subsection."
31 U.S.C. § 5318(g)(3). Disclosures "pursuant to this subsection"
are disclosures required by the Office of the Treasury Secretary
under the rule-making authority vested in the Treasury Secretary by
31 U.S.C. § 5318(g)(1), which provides:
The [Treasury] Secretary may require any financial institution, and any director, officer, employee, or agent of any financial institution, to report any suspicious transaction relevant to a possible violation of law or regulation.
In February 1996, the Treasury Secretary issued regulations under
this sub-section. See 12 C.F.R. § 21.11 (1996); see also 61 Fed.
Reg. 4326 (1996); 61 Fed. Reg. 4338 (1996); 61 Fed. Reg. 6100
(1996); 61 Fed. Reg. 6095 (1996). The second safe harbor protects
any disclosures required by those regulations.
However, the complaint alleges that First Union's disclosures
occurred in 1993 and 1994. Because the Treasury Secretary's
regulations under § 5318(g)(1) were not in effect at the time those
alleged disclosures were made, the second safe harbor provision
cannot immunize First Union's disclosures.
The third safe harbor provision protects a financial
institution's disclosure pursuant to "any other authority." 31
U.S.C. § 5318(g)(3). Because the second safe harbor protects
disclosures pursuant to the legal authority of the Treasury
Secretary's regulations, "other authority" means authority other
than the Treasury Secretary's regulations. The "other authority"
must be legal authority, because authority means "[r]ight to
15 exercise powers," Black's Law Dictionary 133 (6th Ed. 1991), and
in our system based on rule of law, the right to exercise power is
derived from law, e.g., statutes, regulations, court orders, etc.
Hence, for a financial institution's disclosure to fall within the
confines of the third safe harbor, the financial institution must
be able to point to a statute, regulation, court order, or other
source of law that specifically or impliedly authorized the
disclosure. If it cannot do so, the disclosure is not entitled to
the protection of the safe harbor.
The complaint alleges that First Union disclosed Lopez's
financial records twice in response to "verbal instructions" of
government officials and once in response to a seizure warrant.
Clearly, a disclosure in response to a seizure warrant is protected
by the third safe harbor. The seizure warrant represented a
judicial determination that the government had a legal right to
obtain Lopez's financial records. First Union was neither required
nor permitted to sit in review of the court's legal determination.
It is immune from any liability for any disclosures made pursuant
to the seizure warrant, which was issued on February 3, 1994.
However, First Union's earlier disclosures are a different
matter, because disclosures in response to nothing more than the
"verbal instructions" of government officials are not protected by
the third safe harbor. They are not, because under existing law
and regulations, a government official's verbal instructions do not
constitute legal authority. First Union fails to identify any
statute or regulation which gives a government official's verbal
16 request to access an individual's financial records the force of
law. Nor does First Union point to a statute or regulation
authorizing a financial institution to release an individual's
financial records in response to mere verbal instructions of
government officials. We can find nothing in the Annunzio-Wylie
Act which entitles government officials to gain access to financial
records simply by verbal request. Therefore, because the facts
alleged in the complaint do not show First Union acted pursuant to
any legal authority when it released Lopez's financial records, the
third safe harbor provision does not protect First Union's
disclosures.
We also reject First Union's argument that its disclosures of
Lopez's account activity were made pursuant to "other authority"
because there were regulations, see e.g. 12 C.F.R. § 21.11 (1989),
in effect at the time disclosures were made that required reporting
suspicious transactions. That argument simply overlooks the fact
that on a motion to dismiss, we are bound to consider only the
facts alleged in the complaint. Lopez's complaint does not allege
that Lopez's transactions were suspicious or were viewed as
suspicious by First Union.
In sum, we hold that First Union's disclosures of Lopez's
financial records in response to nothing more than the "verbal
instructions" of government officials are not protected by §
5318(g)(3)'s safe harbors, except that its disclosure pursuant to
the seizure warrant is protected by the third safe harbor. Because
17 the district court erred in dismissing Lopez's complaint, we
reverse its judgment. II. THE CORONADO CASE
We turn now to the case brought by Jose Daniel Ruiz Coronado
and the approximately eleven hundred account holders ("the Account
Holders") he wants to represent in this attempted class action
lawsuit against BankAtlantic Bancorp Inc. ("BankAtlantic").4
This case, like the Lopez case, is here on appeal from a Rule
12(b)(6) dismissal. As we stressed in our discussion of the Lopez case, at this stage the facts are limited to the allegations in
Coronado's complaint, which we must accept as true.
Again, the FedWire Fund Transfer System is an electronic funds
computer-to-computer communications between banks. BankAtlantic is
a bank within the FedWire Fund Transfer System and uses "electronic
storage" to maintain the contents of the electronic funds transfer.
In June 1995, BankAtlantic notified federal agents concerning
the "unusual amounts" and "unusual movements" of money at the bank.
Thereafter, BankAtlantic provided federal agents access to the
"detailed contents of financial information in electronic storage,
including the contents of electronic communications, pertaining to
the Account Holders." Federal agents subsequently "seized the
Account Holders' accounts upon allegations of money laundering."
4 Coronado's complaint was dismissed before a hearing on class status could be held.
18 Eventually, the federal agents released 400 to 600 of the Account
Holders' accounts because they had "no connection with money
laundering."5
Subsequently, Coronado, on behalf of himself and the Account
Holders, filed a class action suit against BankAtlantic, asserting
claims under the Electronics Communications Act 18 U.S.C. §§ 2501
et seq . (Counts I-IV), the Right to Financial Privacy Act, 12
U.S.C. §§ 3401 et seq., (Count V), and Florida law. (Count VI).
BankAtlantic moved to dismiss the complaint for failure to state a
claim upon which relief can be granted pursuant to Rule 12(b)(6).
The district court granted the motion and dismissed Coronado's
complaint with prejudice. The decision to dismiss the complaint
was based exclusively on its conclusion that the Annunzio-Wylie
Anti Money Laundering Act, 31 U.S.C. § 5318(g), immunized
BankAtlantic from liability. This appeal followed.
B. ANALYSIS
The sole issue we must decide is whether BankAtlantic's
disclosure of information pertaining to the Account Holders'
accounts is protected by the safe harbor provisions of §
5318(g)(3).6 BankAtlantic argues that its disclosure falls within §
5318(g)(3)'s first safe harbor -- a "disclosure of any possible
5 The complaint does not specify whether Coronado's account was among those released. 6 BankAtlantic did not contend, either before the district court or on appeal, that the complaint should be dismissed because it failed to state a claim under the ECPA or the RFPA.
19 violation of law." It asserts that the facts alleged in Coronado's
complaint indicate that BankAtlantic suspected a violation of law
based on its detections of "unusual amounts" and "unusual
movements" of money in the bank and that it disclosed the
information from the Account Holders' accounts as a result of those
detections. BankAtlantic maintains that under those facts, its
disclosures are protected by the first safe harbor.
That argument sounds good, but we are required to construe
the complaint in the light most favorable to Coronado and not
dismiss it unless there is no set of facts he could prove that
would entitle him to relief, i.e., which would deny BankAtlantic
the immunity it seeks from the first safe harbor. The complaint
alleges that BankAtlantic disclosed the protected account
information of 1,100 accounts after it detected "unusual amounts of
money in the bank" and "unusual movements of money at the bank"
(emphasis added). Construed in the light most favorable to
Coronado, the allegations that BankAtlantic detected suspicious
activity "in" and "at" the bank could mean that BankAtlantic
detected suspicious activity in only one account or a few accounts.
But if BankAtlantic detected suspicious activity in only one
account, it may well not have had a good faith basis to suspect a
violation of law in the remaining 1,099 accounts, and the same is
true if the suspicious activity was in only a few accounts.
Of course, we could continue this exercise and come up with
any number of hypotheticals in which the complaint's allegations do
not show that BankAtlantic's disclosures of all the accounts are
20 protected by the first safe harbor. But the more important and
generalizable point is this: the allegations in the complaint,
construed in the light most favorable to Coronado, do not show that
BankAtlantic determined in good faith that there was any nexus
between the suspicious activity it detected and the information it
disclosed from more than a thousand accounts. In order for §
5318(g)(3)'s first safe harbor to protect a financial institution's
disclosures, there must be some good faith basis for believing
there is a nexus between the suspicion of illegal activity and the
account or accounts from which information is disclosed. If it
were otherwise, a bank would have free license to disclose
information from any and every account in the entire bank once it
suspected illegal activity in any account at the bank. We do not
think Congress intended such a drastic result which would
needlessly strip away any right or expectation of privacy in
financial records and effectively undo virtually all of what
Congress did when it enacted the Right to Financial Privacy Act and
the Electronic Communications Privacy Act. Therefore,
BankAtlantic's disclosures, as they are described in the complaint
read in the light most favorable to Coronado, are not protected by
§ 5318(g)(3)'s first safe harbor provision.7
7 We note that if the allegations in the complaint specifically identified the accounts in which BankAtlantic detected suspicious activity and any additional accounts with a nexus to them, BankAtlantic would be entitled to partial Rule 12(b)(6) relief because a disclosure of those accounts would be protected by the first safe harbor. However, the complaint does not so identify the accounts, therefore this issue will have to be resolved at a later stage in the proceedings.
21 We caution, however, that our holding should not be read to
mean that the only accounts that can be disclosed are those
actually reflecting the unusual movements of money. There could be
instances in which unusual movements or other suspicious activity
in an account provides a reasonable basis for disclosing other
accounts. We will not attempt to list circumstances in which
there could be a good faith basis for believing that a nexus
existed between the suspicious activity in one account and other
accounts. It is enough for present purposes that no such basis is
apparent in the complaint.
BankAtlantic also argues that its disclosure falls within §
5318(g)(3)'s third safe harbor -- a disclosure pursuant to "any
other authority." Specifically, BankAtlantic claims its
disclosures were authorized by 12 C.F.R. § 563.180 (1994), which
requires banks to "promptly notify appropriate law enforcement
authorities" after discovering "suspected criminal acts." Again,
however, there must be some good faith basis for believing there is
a nexus between the suspicion of illegal activity and the account
or accounts from which information is disclosed. Thus,
BankAtlantic's disclosures, as they are described in the complaint
read in the light most favorable to Coronado, are not clearly
within § 5318(g)(3)'s third safe harbor provision.
Because we conclude that BankAtlantic's disclosures are not
protected by § 5318(g)(3), the district court's dismissal of
Coronado's complaint is due to be reversed.
22 III. CONCLUSION
The district court's dismissal of Lopez's complaint is
REVERSED, and the case is REMANDED for further proceedings
consistent with this opinion.
The district court's dismissal of Coronado's complaint is