Americans are furious at Wells Fargo, as they should be.  Consumers must be able to trust their banks. But by Wells’ own assessment, it breached that trust as many as two million times in four years alone: The bank misused customers’ personal data to open unwanted accounts, failed to tell customers about it, and frequently transferred money without customer knowledge to accounts customers never authorized.

Congress should channel the nation’s outrage over this conduct into much-needed reform. Key lessons from my office’s lawsuit against Wells, which was spurred by a 2013 Los Angeles Times investigation, provide lawmakers a roadmap for how to begin to correct the vast imbalance of power and information between consumers and the mega-institutions ostensibly serving them. To advance critical consumer rights, the public should press Congress to act in at least the following areas:

Compel financial institutions to inform customers immediately when their personal data is used for unauthorized purposes, including by bank employees, and let consumers sue if banks fail to do so.  We found that, time and again, Wells failed to notify customers after the bank took their private, personal information—gleaned from customers’ authorized accounts—to open accounts or issue credit cards customers never requested.  The bank’s behavior, wrong on so many levels, calls for the strengthening of federal law governing banks’ obligations to better protect customers’ personal records.

First, while federal regulations provide that when there has been misuse of consumer information, a bank “should notify the affected customer as soon as possible,” no law requires notification. That must change.  Congress must leave no doubt that financial institutions have a duty to tell customers immediately upon learning that their information was used for an unauthorized purpose, enabling customers to take timely action to protect themselves.

Second, federal law does not authorize private actions against a bank that violates proscriptions against misusing consumers’ personal information.  Wells made this very point in arguing for dismissal of a lawsuit by California customers alleging unfair sales practices by the bank.  Customers must hope the public agencies authorized by the law—federal regulators and state insurance authorities—enforce a bank’s obligations. By allowing customers to sue banks like Wells when their private information is misused, Congress would deter future violations and empower consumers.

Curb arbitration clauses.  Will this be the moment federal lawmakers finally disallow mandatory arbitration clauses in the form contracts consumers must accept when they deal with large institutions?  Wells’ customers are among the millions of consumers required to acquiesce to arbitration clauses when they agreed to open accounts or secure credit cards at their bank.  And Wells continues to enforce these provisions against consumers, even in the wake of the unauthorized accounts scandal.

Allowing mega-financial institutions to impose such clauses on their customers is not sound public policy.  First, such clauses typically include class action waivers (and even if they don’t explicitly, they have the same practical effect), preventing consumers from joining forces to press their cause and lessening the likelihood that legitimate claims will be vindicated.

In addition, in contrast to court proceedings, arbitration is private, not public—leaving everyone else in the dark, and increasing the odds that an egregious institutional practice will remain hidden.  Frequently the institution, not the consumer, chooses the arbitrator.  Arbitration fees can cost the consumer hundreds or even thousands of dollars.  And there are no appeal rights.

Even worse, here Wells has taken the appalling position that a customer has acceded to arbitration of disputes regarding all accounts—irrespective of whether the customer even knew they existed—if that customer knowingly signed up for just one account governed by an arbitration provision.  Even were Congress to continue to allow some mandatory arbitration clauses in consumer contracts, legislators could defeat Wells’ disgraceful effort to suppress consumer rights by making clear that a consumer must affirmatively agree to such a clause in the “contract” at issue before being bound by it.

This is one of those unique moments when a bipartisan consensus could emerge to protect consumers for years to come. Let’s demand that Congress do just that.

Mike Feuer is the City Attorney of Los Angeles. He was the first one in government to take action against Wells Fargo over the opening of unauthorized customer accounts by filing a lawsuit in May 2015.