My question involves a banking matter in the State of: CA

Is it legal for a student loan company (citi bank) to sell a student loan without expressed written permission from the borrower. This seems as if it would be a violation of my privacy unless I signed a written agreement indicating it would be ok for them to sell my loan.

Finally, if it is a violation of my privacy what can I do as re-course?

Please advise.