A federal appeals court blocked a portion of California’s landmark financial privacy law, ruling that banks have a right to sell their customers’ private information to affiliated companies.

The 9th U.S. Circuit Court of Appeals ruled Monday that federal law pre-empts a portion of California’s 2003 privacy law, the toughest in the nation, but leaves most of it intact.