SEC Cracks Down on Data Protection Rule Violations
The Securities and Exchange Commission last week charged a $4 billion registered investment advisor with failing to comply with agency’s data protection and identity theft prevention rules following a cybersecurity breach that exposed customer information.
Portland, Oregon-based M Holdings Securities agreed to pay a $325,000 civil penalty after the SEC found the firm failed to adopt policies and procedures to protect customer records and information in violation Regulation S-P and Regulation S-ID, according to the SEC’s order.
“The recent enforcement action against M. Holdings under Regulation S-P is a strong indication that we may see more cases of this type across the industry,” Cynthia Kelly, managing director of compliance at STP Investment Services, said in an email. “[F]irms must not only adopt written policies and procedures to safeguard customer data, but also implement robust incident response and customer notification programs, maintain effective oversight of service providers, and ensure that the rule’s expanded definition of customer and consumer information is fully addressed.”
Read more from Cynthia Kelly and others in FundFire.