Recent Privacy Law Changes for Advisers a Focus of Cyber Discussion in Scottsdale
Regulators and legislators certainly have been busy in 2019, leaving little breathing room for financial firms. More data privacy laws are on the horizon, particularly at the state level, with some very real implications for SEC-registered investment advisers. That was the key message from the “Regulatory Update on Privacy Regulations and Cybersecurity” panel during the recent CSS Fall 2019 Conference in Scottsdale, Arizona. Lending their expertise on the panel were Joseph Borg, Director of the Alabama Securities Commission and former President of the North American Securities Administrators Association (NASAA); Andrew Hartnett, Deputy Administrator of the Iowa Insurance Division; Cynthia Larose, Partner, CIPP/US and CIPP/EU, and Chair of the Privacy and Cybersecurity Practice at Mintz Levin; and Andras Teleki, Chief Legal Officer for M3Sixty Administration, LLC.
With three cybersecurity risk alerts issued by the SEC within the past year, attendees at the conference were aware that the regulatory focus on cyber has not abated. The panel discussed the implications of recent data privacy regulations at the state level, including the recently amended California Consumer Privacy Act (CCPA) scheduled to take effect in January 2020, New York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act, and other legislation. The regulatory changes include an expansion of the definition of personal information subject to data breach reporting and the inclusion of access alone, even without data acquisition, as sufficient to constitute a data breach. Suspicious activity reporting (SARs) thresholds for reporting phishing and ransomware to FinCEN were also discussed.
Since the state regulators work closely behind the scenes with their federal counterparts, and since federally registered advisers must still abide by applicable state data privacy regulations, the implications are tremendous. Firms who escaped the scope of the General Data Protection Regulation (GDPR) last year are now facing regulations in the U.S. that closely mirror the protections under GDPR. The importance of reasonable vendor due diligence was discussed, and the panel provided a list of eight steps firms can take to revise their information security policies and procedures to align with guidance from the recent SEC risk alerts and examination focus. A sampling of those steps include:
- Incident response plans should take state breach disclosure laws into account
- Data Loss Prevention – policy changes should address encryption, monitoring, use of cloud based apps and electronic communication platforms
- System Hardening – policy changes should mandate default passwords be changed, patches be tested and deployed promptly
If you haven’t looked at your cyber policies in the last year, Ms. Larose cautioned attendees that there have been a lot of changes in the last year worth addressing in your policies, so “it’s time to dust them off.”
- Interested in attending our next conference? Our spring 2020 event is set for the Ritz-Carlton, Sarasota in sunny Florida. Register now using the discount code CSS2020 for $600 savings!
- If you’re part of a private equity firm that needs cyber help, consider joining our free breakfast roundtable in New York on October 24. For more information or to register, click here.