May 28, 2018

May 25, 2018

Subscribe to Latest Legal News and Analysis

The Fiduciary Duty for Cybersecurity

Computer hacking seems to be a daily fact of life. Since most plan information is stored electronically, hacking presents a vulnerability that fiduciaries can’t ignore. For example, if hackers were to gain access to participant social security numbers or account balances, they could steal the money or a participant’s identity. And the plan would be liable.

This is a fiduciary issue because of a DOL regulation that says fiduciaries need to protect participant information by taking

“[A]ppropriate and necessary measures reasonably calculated to ensure that the system for furnishing documents … protects the confidentiality of personal information relating to the individual's accounts and benefits (e.g., incorporating into the system measures designed to preclude unauthorized receipt of or access to such information by individuals other than the individual for whom the information is intended).” (ERISA Regulation Section 2520.104b-1(c)(1)(i)).

In other words, plan fiduciaries have to take steps to protect participant information; the steps must be “appropriate and necessary”; and the protections need to be incorporated into the “system” being used to communicate with the participants. The regulation says the steps must only be “reasonably calculated” to protect the data. So, while fiduciaries need to take cyber protection seriously, the DOL recognizes that they probably can’t achieve perfection.

This is all well and good, but the “system” where the data is maintained is most likely the plan recordkeeper’s. What can a plan fiduciary do? Remember that another important duty is the fiduciary obligation to prudently select and monitor service providers. In selecting or deciding to retain the recordkeeper (and others that either have, or have access to, participant data), fiduciaries need to find out how they protect the data. Make sure the recordkeeper (or other service provider) has cybersecurity policies in place, then review these cybersecurity policies for comprehensiveness and periodically monitor whether the service provider is complying with the policies. 

©2018 Drinker Biddle & Reath LLP. All Rights Reserved

TRENDING LEGAL ANALYSIS


About this Author

Bruce Ashton, Drinker Biddle Law Firm, Los Angeles, Employment Benefits Attorney
Partner

Bruce L. Ashton has more than 35 years of experience handling employee benefits matters. His practice concentrates on representing plan service providers (including RIAs, independent record-keepers, third-party administrators, broker-dealers and insurance companies) in fulfilling their obligations under ERISA. His experience includes representing public and private sector plans and their sponsors, negotiating the resolution of plan qualification issues under IRS remedial correction programs, advising and defending fiduciaries on their obligations and...

310-203-4048