SEC Fires Off Warning on Privacy Regulation

Examiners observed registrants that did not provide Initial Privacy Notices, Annual Privacy Notices and Opt-Out Notices to their customers. "When such notices were provided to customers, the notices did not accurately reflect firms' policies and procedures," the alert states.

Also, advisors and broker-dealers also did not have written policies and procedures as required under the Safeguards Rule.

For instance, policies and procedures were cited that did not appear to be reasonably designed to safeguard customer information on personal devices.

OCIE staff observed "registrants' employees who regularly stored and maintained customer information on their personal laptops, but the registrants' policies and procedures did not address how these devices were to be properly configured to safeguard the customer information," the alert states.

Policies and procedures were also found that did not address the inclusion of customer personally identifiable information ("PII") in electronic communications.

OCIE examiners observed registrants that did not appear to have policies and procedures reasonably designed to prevent employees from regularly sending unencrypted emails to customers containing PII, according to the alert.

Inadequate training was also observed. Firms' policies and procedures that required customer information to be encrypted, password-protected, and transmitted using only registrant-approved methods "were not reasonably designed because employees were not provided adequate training on these methods and the firm failed to monitor if the policies were being followed by employees."

— Related on ThinkAdvisor:

• Will Trump Memo Slow Down SEC's Reg BI?
• New Jersey Unveils Proposed Fiduciary Rule