Disclaimer

The information on this website is presented as a service for our clients and Internet users and is not intended to be legal advice, nor should you consider it as such. Although we welcome your inquiries, please keep in mind that merely contacting us will not establish an attorney-client relationship between us. Consequently, you should not convey any confidential information to us until a formal attorney-client relationship has been established. Please remember that electronic correspondence on the internet is not secure and that you should not include sensitive or confidential information in messages. With that in mind, we look forward to hearing from you.

 Skip to Content

Continuing Data Security Lessons from the SEC
May 05, 2016

Computer Lock

In September, we reported that the Securities and Exchange Commission (SEC) settled charges against a registered investment adviser for a violation of Rule 30(a) of Regulation S-P (17 C.F.R. 248.30(a))(“Safeguards Rule”) for failing to adopt written policies and procedures reasonably designed to insure the security and confidentiality of customer records and information. In January, the SEC reaffirmed its intent to enforce such violations in its release, Examination Priorities for 2016, which details this year’s examination focus for the Office of Compliance Inspections and Examinations (OCIE).  Most recently, in April, the SEC charged a broker-dealer and principals with violating the Safeguards Rule as well as failure to preserve email and eFax business communications. This Administrative Proceeding highlights the SEC’s continued determination to ensure the security and confidentiality of customer information and records, and its intent to pursue any breach in internal procedures regarding the protection of such information.

According to the SEC Order resulting from the above Administrative Proceeding, Craig Scott Capital, LLC (CSC), its chief executive officer and president, who also served as chief compliance officer (CCO), and its chief operating officer (COO) routinely failed to adopt and enforce CSC’s own policies and procedures regarding the use of company email and eFax for sensitive customer information. Upon registering in 2012, CSC provided firm email addresses for all employees. Shortly thereafter, an eFax system was created that automatically converted the contents of all email messages sent to CSC’s fax number into an electronic file. The eFax files were subsequently routed by email to designated email addresses, two of which did not contain the @craigscottcapital.com domain name. CSC concurrently established written supervisory procedures (WSPs), which prohibited using personal email accounts for business communications.

Throughout this period, however, CSC employees routinely used eFaxes and personal email accounts to effect business transactions on behalf CSC, including receiving clients’ sensitive and confidential information. Records such as opening documents, asset transfer forms, and other agreements between CSC and its customers containing social security numbers, birthdates, and account numbers were shared outside of CSC’s internal controls. Furthermore, an administrative assistant’s personal email was routinely used to receive eFaxes sent to CSC containing customer information and records.

The SEC found that during this period, the WSPs implemented by CSC were deficient due to the lack of a “designated supervisor,” failure to identify a “designated information officer,” failure to ensure compliance with the CSC’s own safeguards policy, that CSC’s safeguards policies were inadequately tailored to the systems the broker used to collect sensitive and confidential information, and that CSC’s policies and systems were inadequate to protect the information collected.

The SEC ordered that CSC cease and desist from committing or causing these violations and imposed a civil money penalty of $100,000 against CSC and $25,000 against both of CSC’s individual corporate officers named in the Administrative Proceeding.

Takeaways from this Administrative Proceeding and our September article include:

  • Both firms and individual officers could be sanctioned even if no one is financially harmed.
  • Written supervisory procedures (WSPs) should not be boilerplate. Policies and procedures should reflect significant thought to ensure they are actually tailored to the firm.
  • Never use personal email to conduct business.
  • Domain names should clearly relate the firm to its email address.
  • Designated personnel responsible for ensuring data compliance and managing information security must be identified by name in firm policies.
  • Personally identifiable information (PII) should be encrypted.
  • Develop, implement, and maintain a written security information plan (WISP).
  • Systems should be put in place to prevent and detect breaches.
  • Ongoing systems monitoring and regular reporting to management on the effectiveness of security systems should be instituted.
  • Know what information your outside vendors and suppliers are collecting and maintaining, and what they are doing to protect it. 
  • Collect the minimum amount of PII needed for your business purposes.

This is not an exhaustive list of all steps registered broker-dealers should take, but serves as a reminder that the SEC is serious about ensuring broker-dealers act to mitigate cyber risks.
Related Practices
Cybersecurity and Privacy Securities Litigation and Enforcement Securities Transactions and Compliance Technology
Related Industries
Technology
©2024 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.