February 17, 2018

February 16, 2018

Subscribe to Latest Legal News and Analysis

February 15, 2018

Subscribe to Latest Legal News and Analysis

The Fiduciary Duty for Cybersecurity

Computer hacking seems to be a daily fact of life. Since most plan information is stored electronically, hacking presents a vulnerability that fiduciaries can’t ignore. For example, if hackers were to gain access to participant social security numbers or account balances, they could steal the money or a participant’s identity. And the plan would be liable.

This is a fiduciary issue because of a DOL regulation that says fiduciaries need to protect participant information by taking

“[A]ppropriate and necessary measures reasonably calculated to ensure that the system for furnishing documents … protects the confidentiality of personal information relating to the individual's accounts and benefits (e.g., incorporating into the system measures designed to preclude unauthorized receipt of or access to such information by individuals other than the individual for whom the information is intended).” (ERISA Regulation Section 2520.104b-1(c)(1)(i)).

In other words, plan fiduciaries have to take steps to protect participant information; the steps must be “appropriate and necessary”; and the protections need to be incorporated into the “system” being used to communicate with the participants. The regulation says the steps must only be “reasonably calculated” to protect the data. So, while fiduciaries need to take cyber protection seriously, the DOL recognizes that they probably can’t achieve perfection.

This is all well and good, but the “system” where the data is maintained is most likely the plan recordkeeper’s. What can a plan fiduciary do? Remember that another important duty is the fiduciary obligation to prudently select and monitor service providers. In selecting or deciding to retain the recordkeeper (and others that either have, or have access to, participant data), fiduciaries need to find out how they protect the data. Make sure the recordkeeper (or other service provider) has cybersecurity policies in place, then review these cybersecurity policies for comprehensiveness and periodically monitor whether the service provider is complying with the policies. 

©2018 Drinker Biddle & Reath LLP. All Rights Reserved


About this Author

Bruce L. Ashton, Employee Benefits, Attorney, Drinker Biddle, Law firm

Bruce L. Ashton is a partner in the firm's Employee Benefits & Executive Compensation Practice Group. With more than 35 years of practice, Bruce has gained wide experience representing businesses in sophisticated business transactions and employee benefits matters. Bruce's practice focuses on all aspects of employee benefits issues, including representing public and private sector plans and their sponsors, negotiating the resolution of plan qualification issues under IRS remedial correction programs, advising and defending fiduciaries on their obligations and...