A Director Asks for a Neighbor's Account History

No. A director is not a super-user. Directors govern as a body; an individual director has no standing right to inspect an individual member's account, and Hank had no documented business purpose, no member authorization, and no authority to direct staff. The confidentiality obligation comes from the credit union's privacy rule, substantively Regulation P as implemented for credit unions at 12 CFR Part 716, and from the security program requirements at 12 CFR Part 748, which treat member records as sensitive customer information. Obtaining member information by false pretenses is separately prohibited under the pretexting provisions of the Gramm-Leach-Bliley Act. Dana also failed the basic control: verifying the requester's authority and escalating. Note what is not the issue. The Right to Financial Privacy Act governs government requests, not directors, so citing it here would be a distraction in the corrective memo. The board may receive aggregate reporting about the member's accounts only through an approved process, such as a supervisory committee inquiry with a documented purpose.

Work through the definitions rather than assuming the worst or the best. A computer-security incident under the NCUA rules means an occurrence that results in actual harm to the confidentiality, integrity, or availability of information or systems; a director talking an employee into reading a screen produces harm to confidentiality, so assess whether it is reasonably likely to cause substantial harm and document the conclusion. The 72-hour notification duty to NCUA applies only to incidents meeting that standard, and misclassifying a verbal disclosure as one inflates the record. State breach notification laws generally require notice when personal information such as name plus account number with access credentials is acquired by an unauthorized person; here names, balances, and transactions were disclosed but likely no credentials, so the state analysis may not be triggered, but it must be run and the result recorded. Independently of any statute, notify the member, explain what was said, apologize, and offer to place alerts on the account. Log the incident, retain the core system audit trail of Dana's inquiry, and preserve Hank's call record.

Treat them differently because the duties differ. Dana is six weeks in, was deceived by someone with apparent authority, and was never trained on director requests; the appropriate response is documented coaching, retraining, and a check that onboarding covered confidentiality and social engineering, with progressive discipline only if it recurs. Hank held a fiduciary duty and used his position to obtain records he had no right to see; his conduct belongs with the supervisory committee, which exists to investigate and report on exactly this kind of question, and with the board chair and counsel for review under the bylaws and removal-for-cause provisions. Do not let the matter be handled informally between Hank and the CEO. Systemic fixes: a written rule that individual directors route any member record request through the CEO or board chair with a stated purpose, a prompt in the core system that logs the requester and reason for lookups, annual confidentiality training for the board with signatures, and a standing agenda item so staff know the answer when a director says they can see anything.