Publications

In a settlement announced April 7, 2011, the Securities and Exchange Commission for the first time assessed financial penalties against individual executives for violating customer privacy rules. The SEC imposed the fines on three former brokerage executives of GunnAllen Financial for violating Regulation S-P, also known as the “Safeguard Rule.” The rule requires, among other things, that broker-dealers adopt written policies and procedures designed to protect customers’ personal information.

GunnAllen’s former president and national sales manager were each fined $20,000 for transferring 16,000 customer accounts, along with confidential, personal information of the customers, to the sales manager’s new employer without providing sufficient notice and an opportunity for the customers to opt-out. Customers were not notified until after the transfer had been made.

The former chief compliance officer was fined $15,000 for failing to ensure that GunnAllen, which experienced a number of serious security breaches, had policies and procedures in place to protect confidential customer information. The firm’s security policy was found deficient in numerous respects, as it:

• was less than one page; “was vague and general”;
• simply “recited the Safeguard Rule verbatim”;
• did not have safeguards tailored specifically to GunnAllen’s operations;
• failed to provide procedures to ensure the protection of customers’ personal information;
• lacked procedures for responding to a data breach; and
• “repeatedly referred to a ‘Designated Principal’ charged with monitoring and annually testing the firm’s safeguards,” without actually appointing someone as the “Designated Principal.”

The SEC found that these deficiencies contributed to repeated losses of customers’ personal information for which GunnAllen did not provide any notice to the affected individuals.

The three former GunnAllen employees did not admit or deny the SEC’s findings, but agreed to the entry of the SEC order of censure and agreed to pay the assessed penalties.

As the SEC’s press release observed, “[t]his is the first time that the SEC has assessed financial penalties against individuals charged solely with violations of Regulation S-P,” demonstrating that the SEC is now monitoring the privacy policies, procedures, and compliance of broker-dealers.

To see the SEC press release and the consent orders, go to
http://www.sec.gov/news/press/2011/2011-86.htm.