Recent Privacy Law Changes for Advisers a Focus of Cyber Discussion in Scottsdale

Regulators and legislators certainly have been busy in 2019, leaving little breathing room for financial firms. More data privacy laws are on the horizon, particularly at the state level, with some very real implications for SEC-registered investment advisers. That was the key message from the “Regulatory Update on Privacy Regulations and Cybersecurity” panel during the recent CSS Fall 2019 Conference in Scottsdale, Arizona. Lending their expertise on the panel were Joseph Borg, Director of the Alabama Securities Commission and former President of the North American Securities Administrators Association (NASAA); Andrew Hartnett, Deputy Administrator of the Iowa Insurance Division; Cynthia Larose, Partner, CIPP/US and CIPP/EU, and Chair of the Privacy and Cybersecurity Practice at Mintz Levin; and Andras Teleki, Chief Legal Officer for M3Sixty Administration, LLC.

With three cybersecurity risk alerts issued by the SEC within the past year, attendees at the conference were aware that the regulatory focus on cyber has not abated. The panel discussed the implications of recent data privacy regulations at the state level, including the recently amended California Consumer Privacy Act (CCPA) scheduled to take effect in January 2020, New York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act, and other legislation. The regulatory changes include an expansion of the definition of personal information subject to data breach reporting and the inclusion of access alone, even without data acquisition, as sufficient to constitute a data breach. Suspicious activity reporting (SARs) thresholds for reporting phishing and ransomware to FinCEN were also discussed.

Since the state regulators work closely behind the scenes with their federal counterparts, and since federally registered advisers must still abide by applicable state data privacy regulations, the implications are tremendous. Firms who escaped the scope of the General Data Protection Regulation (GDPR) last year are now facing regulations in the U.S. that closely mirror the protections under GDPR. The importance of reasonable vendor due diligence was discussed, and the panel provided a list of eight steps firms can take to revise their information security policies and procedures to align with guidance from the recent SEC risk alerts and examination focus. A sampling of those steps include:

  • Incident response plans should take state breach disclosure laws into account
  • Data Loss Prevention – policy changes should address encryption, monitoring, use of cloud based apps and electronic communication platforms
  • System Hardening – policy changes should mandate default passwords be changed, patches be tested and deployed promptly

If you haven’t looked at your cyber policies in the last year, Ms. Larose cautioned attendees that there have been a lot of changes in the last year worth addressing in your policies, so “it’s time to dust them off.”


  • Interested in attending our next conference? Our spring 2020 event is set for the Ritz-Carlton, Sarasota in sunny Florida. Register now using the discount code CSS2020 for $600 savings!
  • If you’re part of a private equity firm that needs cyber help, consider joining our free breakfast roundtable in New York on October 24. For more information or to register, click here.

Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Loading form...

Latest Content

Giving Voice to Values: A New Approach to Ethics

The “Giving Voice to Values” program grew out of Professor Mary Gentile’s frustration of what was going on in both the financial industry and in higher education. She was frustrated and angry about the poor way that ethics was being taught in universities and applied in real-world scenarios. What developed out of her frustration is … Continued

Tips for Developing a Tailored Private Fund Compliance Calendar

As regulatory concerns proliferate and become more complex, developing and monitoring your “to-do” list becomes of paramount importance.  John Gentile, the Director of Private Fund Manager Services for Compliance Solutions Strategies and Michael Emanuel, a Partner at Stroock & Stroock & Lavan LLP provided attendees of the recent CSS 2019 Fall Conference some insight into … Continued

Brexit: Implications for Shareholders with Threshold Interests

As yet another deadline approaches for the United Kingdom to either leave the European Union with a withdrawal agreement in place or else exit effective immediately in a “no-deal” scenario, it is worth examining how this would affect asset managers subject to the UK regimes for major shareholdings, short selling, and dealing disclosures. First, the … Continued