Privacy Compliance for SEC-regulated Entities

Transcription

1 Privacy Compliance for SEC-regulated Entities Global Privacy Summit 2011 March 10, 2011 James T. Shreve Goodwin Procter LLP Attorney Anne Marie Duffy Putnam Investments Counsel and Vice President Nancy L. Hansbrough U.S. Securities and Exchange Commission Office of Compliance Inspections and Examinations Assistant Chief Counsel

2 Disclaimer Not Legal Advice All content contained herein is for informational purposes only and may not reflect the most current legal developments. Given the changing nature of laws, rules and regulations, and the inherent hazards of electronic communication, there may be delays, omissions or inaccuracies in information contained in this presentation. The content is not offered as legal or any other advice on any particular matter. The inclusion of any content in this presentation is not intended to create and does not constitute an attorney-client relationship between you and the authors. You should not act or refrain from acting on the basis of any content included in this presentation without seeking the appropriate legal or professional advice based on the particular facts and circumstances at issue in your situation. Not Our Employers Opinions The opinions contained herein do not reflect the opinions or beliefs of the authors employers or governmental jurisdictions. 2

3 Purpose & Themes Covered To examine privacy and data security requirements applicable to SEC-regulated entities, and Address compliance issues relating to those requirements 3

4 Statutory Overview - Gramm-Leach-Bliley Act Title V contains several privacy and data security requirements Grants rulemaking authority to various agencies, including the SEC Grants enforcement authority to the SEC for: Broker/dealers Investment companies Investment advisors But not transfer agents 4

5 Statutory Overview Mandates practices relating to consumer reports Generally enforced by the FTC unless specific enforcement authority is granted to another agency Carve-outs for banks, but not SEC-regulated entities Disposal requirements (15 USC 1681(w)) require several agencies, including the SEC, to issues rules on disposal of information from consumer reports SEC rule included in Regulation S-P 5

6 Regulations Current Regulation S-P Issued in 2001 Safeguards Disposal Notice and opt-out requirements 6

7 Regulations - Proposed Regulation S-P Issued in March 2008 Stronger safeguarding requirements Breach notice Changes the scope of information covered by the safeguards and disposal rules and subjects more entities to these requirements Requires written records of disposal and safeguards requirements compliance Allows representatives to take some client information when changing employers 7

8 Regulations Regulation S-AM Final rule issued November 2009 Governs the use of eligibility information for marketing purposes 8

9 Regulations - Recent CFTC Rules Dodd Frank Act added swap dealers and major swap participants to CFTC jurisdiction In October, CFTC issued proposed rules on expansion of GLBA and FCRA rules to newly regulated entities Effective date July 21,

10 Compliance Issues Issues in compliance may differ from other financial institutions 10

11 Compliance Issues - Structure Corporate entities will likely be subject to different regulations Compliance policies cover most highly regulated entity s requirements (highest common denominator) 11

12 Compliance Issues Breach Notice No breach notice requirement in current Regulation S-P Proposed revision would require regulatory and consumer notice SEC-regulated financial institutions not exempted from most state notice laws Differs from banks Still exempt under some state laws Under proposed Regulation S-P, would be exempted from majority of state law requirements 12

13 Compliance Issues Proposed Regulation S-P No word on timing or content of final rules Most of these provisions attracted few comments 13

14 Compliance Issues Movement of Representatives Part of proposed revision to Regulation S-P New exception to notice and opt-out requirements allowing representatives to take some client information when changing employers Subject of the vast majority of comments to the proposal 14

15 Compliance Issues Transfer Agents Status is somewhat unclear Are they a financial institution? Who governs? 15

16 Compliance Issues Bank Affiliates Entities subject to regulation by the banking agencies are generally more highly regulated than their affiliates Compliance with state statutes may be simplified Preemption Exemptions 16

17 Regulation S-AM: S Affiliate Marketing Nancy Hansbrough Securities and Exchange Commission Office of Compliance Inspections and Examinations March 10,

18 Disclaimer The Securities and Exchange Commission disclaims responsibility for any private publication or statement of any SEC employee or Commissioner. This presentation expresses the authors views and does not necessarily reflect those of the Commission, the Commissioners, or other members of the staff. 18

19 Which Hat? Exams of compliance with Reg. S- AM can vary, depending on which hat the registrant is wearing Communication/coordination with affiliates is important. 19

20 Review for Compliance Policies and procedures Opt out notice Caution: Affiliate communication/coordination is critical! 20

21 Review for Compliance (continued) Reasonable opportunity and reasonable and simple method for opting out Again, affiliate communication/coordination is critical! Reasonable expectation that consumers will receive actual notice. 21

22 Review for Compliance (continued) Interviews Internal controls Training Possible demonstration of systems for compliance, if any 22

23 Outsourcing Nancy Hansbrough Securities and Exchange Commission Office of Compliance Inspections and Examinations March 10,

24 Disclaimer The Securities and Exchange Commission disclaims responsibility for any private publication or statement of any SEC employee or Commissioner. This presentation expresses the authors views and does not necessarily reflect those of the Commission, the Commissioners, or other members of the staff. 24

25 Outsourcing Currently, outsourcing to third parties could implicate provisions of Regulation S-P (the SEC s privacy regulation). Section (Safeguards Rule) is key 25

26 Review of Outsourcing Activities Policies and procedures governing outsourcing Due diligence in selecting service providers (SPs) Country due diligence, if applicable Negotiation and review of contractual provisions relating to privacy and security of customer information 26

27 Review of Outsourcing Activities (continued) How the registrant manages its outsourcing to selected SPs: Specific due diligence conducted by the firm Stages of the negotiation and review of contracts Contractual provisions relating to protection of customer information SP s actual safeguarding of customer information SP s business continuity and disaster recovery plans Firm s oversight/monitoring of SP 27

28 Regulation S-PS SEC Enforcement Cases SEC v. Sidney Mondschein, Lit. Rel. No , 2008 SEC LEXIS 867 (Apr. 17, 2008) (settled action). NEXT Financial Group, Inc., Initial Decision Rel. No. 349, Admin. Proc. File No (June 18, 2008); Exch. Act Rel. No , Admin. Proc. File No (July 18, 2008) (notice that initial decision has become final). LPL Financial Corporation, Exch. Act Rel. No , Admin. Proc. File No (Sept. 11, 2008) (settled action). Woodbury Financial Services, Inc., Exch. Act Rel. No , Admin. Proc. File No (Apr. 9, 2009) (settled action). Stephen Cheryl Bauman, Exch. Act Rel. No , Admin. Proc. File No (July 17, 2009) (settled action). 28

29 Regulation S-PS SEC Enforcement Cases (continued) Merriman Curhan Ford & Co., D. Jonathan Merriman, and Christopher Aguilar, Exch. Act Rel. No , Admin. Proc. File No (Nov. 10, 2009) (settled action). Commonwealth Equity Services, LLP d/b/a Commonwealth Financial Network, Exch. Act Rel. No , Inv. Adv. Act Rel. No. 2929, Admin. Proc. File No (Sep. 29, 2009) (settled action). J.P. Turner & Company, LLC, Initial Decision Rel. No. 395, Admin. Proc. File No (May 19, 2010); Exch. Act Rel. No , Admin. Proc. File No (June 17, 2010) (notice that initial decision has become final). 29

30 Contact Us James T. Shreve (CIPP) Goodwin Procter LLP Attorney Anne Marie Duffy Putnam Investments Counsel and Vice President Nancy L. Hansbrough U.S. Securities and Exchange Commission Office of Compliance Inspections and Examinations Assistant Chief Counsel