Compliance Trends – Data Privacy, ESG and Risks

Data Privacy and Risks

The FTC recently entered into a settlement with Everalbum concerning its use of AI for facial recognition. The FTC ordered Everalbum to delete any facial recognition models and algorithms it developed using photos or videos uploaded by its users without their consent. Previously FTC commissioners had allowed violators to retain their algorithms and technologies, and just delete the illegally gained data. This case raises new concerns about use of biometric technology, privacy considerations and trends to watch. Consider covering this case in training to show the evolving standards for use of customer’s data. The concerns involve more than protecting personally identifiable information (PII).  Remedy of Destruction.

January 28, 2021 was Data Privacy Day, an annual global effort that generated awareness about the importance of privacy. Pew Research Center reported that 79% of Americans feel an increasing lack of control of their personal data. CSIAC recommends businesses follow many of the best practices and requirements financial services companies have built in to their internal controls:

• Follow reasonable security measures to keep individuals & data protected and save from unauthorized use;
• Consider adopting a privacy framework;
• Conduct an assessment of data collection practices including the privacy lase and regs that apply to your business;
• Maintain oversight of partners and businesses and their collection and use of your client’s personal data; and
• Be open and honest about collection, use and sharing of consumers’ personal information.

Consider calendaring awareness training on January 28 each year.

Cyber risks and ransomware attacks are on the rise as is indirect funding of organized crime by insurance companies processing claims to those who paid ransoms to regain access to data and systems after hacking attacks. UK National Cyber Security expert,  Ciaran Martin calls the situation “close to getting out of control” due to the lack of legislation preventing insurance claim payouts for such ransom demands. This is a good reminder to discuss the topic with your board and/or senior management to consider options before there is a crisis.

Cyber Risks in Asia: The Monetary Authority of Singapore issued revised its Technology Risk and Management Guidelines.

Regulatory Developments

In December, the SEC adopted a new Marketing Rule. The new rule is not effective until 18 months after it is published in the Federal Register. Further guidance is expected this year; however, the rule release includes advice based on existing SEC no-action letters. So it pays to review your program in the event you are subject to an exam and/or changes in market conditions. See the article in the Resources section for an overview of the potential impact on investment advisory business development.

On January 1, 2021, Congress overrode President Trump’s veto of the National Defense Authorization Act (NDAA) for the 2021 fiscal year. The NDAA includes the Anti-Money Laundering Act of 2020 (AMLA), the first major reform of the U.S. anti-money laundering (AML) since the 2001 USA PATRIOT Act. The updates to the AMLA include:

• Creating a non-public registry that tracks the beneficial owners of certain corporations
• Enhancing the AML Whistleblower Program similar to the Dodd-Frank Act’s SEC Whistleblower Program
• Expanding US regulators’ statutory authority to seek documents from foreign financial institutions
• Increasing penalties for BSA and AML violations
• Allowing Suspicious Activity Report (SAR) sharing with foreign affiliates
• Establishing priorities to govern AML/CFT policy
• Creating an annual reporting requirement to Congress of all Department of Justice (DOJ) settlements involving the Bank Secrecy Act (BSA)

Corporate Governance