Recent Privacy Law Changes for Advisers a Focus of Cyber Discussion in Scottsdale

Regulators and legislators certainly have been busy in 2019, leaving little breathing room for financial firms. More data privacy laws are on the horizon, particularly at the state level, with some very real implications for SEC-registered investment advisers. That was the key message from the “Regulatory Update on Privacy Regulations and Cybersecurity” panel during the recent CSS Fall 2019 Conference in Scottsdale, Arizona. Lending their expertise on the panel were Joseph Borg, Director of the Alabama Securities Commission and former President of the North American Securities Administrators Association (NASAA); Andrew Hartnett, Deputy Administrator of the Iowa Insurance Division; Cynthia Larose, Partner, CIPP/US and CIPP/EU, and Chair of the Privacy and Cybersecurity Practice at Mintz Levin; and Andras Teleki, Chief Legal Officer for M3Sixty Administration, LLC.

With three cybersecurity risk alerts issued by the SEC within the past year, attendees at the conference were aware that the regulatory focus on cyber has not abated. The panel discussed the implications of recent data privacy regulations at the state level, including the recently amended California Consumer Privacy Act (CCPA) scheduled to take effect in January 2020, New York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act, and other legislation. The regulatory changes include an expansion of the definition of personal information subject to data breach reporting and the inclusion of access alone, even without data acquisition, as sufficient to constitute a data breach. Suspicious activity reporting (SARs) thresholds for reporting phishing and ransomware to FinCEN were also discussed.

Since the state regulators work closely behind the scenes with their federal counterparts, and since federally registered advisers must still abide by applicable state data privacy regulations, the implications are tremendous. Firms who escaped the scope of the General Data Protection Regulation (GDPR) last year are now facing regulations in the U.S. that closely mirror the protections under GDPR. The importance of reasonable vendor due diligence was discussed, and the panel provided a list of eight steps firms can take to revise their information security policies and procedures to align with guidance from the recent SEC risk alerts and examination focus. A sampling of those steps include:

  • Incident response plans should take state breach disclosure laws into account
  • Data Loss Prevention – policy changes should address encryption, monitoring, use of cloud based apps and electronic communication platforms
  • System Hardening – policy changes should mandate default passwords be changed, patches be tested and deployed promptly

If you haven’t looked at your cyber policies in the last year, Ms. Larose cautioned attendees that there have been a lot of changes in the last year worth addressing in your policies, so “it’s time to dust them off.”


  • Interested in attending our next conference? Our spring 2020 event is set for the Ritz-Carlton, Sarasota in sunny Florida. Register now using the discount code CSS2020 for $600 savings!
  • If you’re part of a private equity firm that needs cyber help, consider joining our free breakfast roundtable in New York on October 24. For more information or to register, click here.

Subscribe to CSS Blog

CSS frequently publishes blog posts which are written by our team from their observations in the field, at conferences and through experiences with compliance professionals. These posts are designed to further knowledge and share industry best practices. Topics run the gamut, including Form ADV, cybersecurity, MiFID II, position limit monitoring, technology challenges and more. Complete and submit the brief form below to receive notifications when we publish new content.

Loading form...

Latest Content

Countdown to CCPA: Are You Ready to Comply with New Data Privacy Requirements?

With less than one month before the California Consumer Privacy Act (CCPA) is effective, companies are preparing to update their cybersecurity programs. Many must address the regulation’s new data privacy requirements, which have caught some financial institutions off guard. Modeled to some extent after the European Union’s General Data Protection Regulation (GDPR), the CCPA provides … Continued

ESMA Updates AIFMD Q&A on Reporting to National Competent Authorities

The European Securities and Markets Authority (ESMA) has updated its Questions and Answers on the Alternative Investment Fund Managers Directive (AIFMD). One new Q&A has been added with regard to reporting to National Competent Authorities. ESMA has provided clarification on reporting on liquidity stress tests for closed-ended unleveraged Alternative Investment Funds (AIFs). These AIFs are exempt from the … Continued

CSS Named to RegTech 100 List of World’s Most Innovative RegTech Companies

NEW YORK – Compliance Solutions Strategies (CSS) is proud to announce its inclusion in the RegTech 100 for 2020, a list recognizing the world’s most innovative RegTech companies compiled by RegTech Analyst, a specialist research firm. “We are honored to be selected as one of the most innovative companies within such a competitive and evolving … Continued