Documents have come to light exposing the FBI’s practice of secretly demanding information about Americans from Equifax, Experian and TransUnion.

According to a report by TechCrunch, the FBI has been using “legal powers — known as national security letters — to compel credit giants to turn over non-content information, such as records of purchases and locations, that the agency deems necessary in national security investigations. But these letters have no judicial oversight and are typically filed with a gag order, preventing the recipient from disclosing the demand to anyone else — including the target of the letter.”

Tech companies have been dealing with national security letters for some time but, following the Edward Snowden revelations, the laws were changed in 2015 to give companies the right to petition for release from the gag orders. As a result, tech companies routinely publish transparency reports, disclosing how many times the government has requested their assistance.

In the wake of these documents becoming public, at least three senators have expressed concern. Republican senator Rand Paul and Democratic senators Ron Wyden and Elizabeth Warren have written letters to the three credit agencies, questioning why the agencies have never disclosed the FBI’s requests.

“Because your company holds so much potentially sensitive data on so many Americans and collects this information without obtaining consent from these individuals, you have a responsibility to be transparent about how you handle that data,” the letters said. “Unfortunately, your company has not provided information to policymakers or the public about the type or the number of disclosures that you have made to the FBI.”

Senator Wyden, in particular, has been a vocal proponent of privacy protections and an equally vocal critic of questionable and illegal spying on American citizens. With these new revelations, it’s a safe bet there will be more inquiries and possible regulation to govern how the financial and credit information of Americans can be accessed and used.