The SEC's Data Dilemma

Though the SEC's primary purpose is to regulate transactions involving securities, the Gramm–Leach–Bliley Act gave it authority to oversee the data security practices of investment intermediaries (brokers, dealers, investment companies, and investment advisers). It used this authority to promulgate the Safeguards Rule (15 C.F.R. § 248.30) in 2000, which requires companies to adopt policies and procedures "reasonably designed" to protect sensitive data. Since then, the few actions it has brought under the Safeguards Rule have been inconsistent and, in several cases, overly harsh against companies that seemingly made good-faith efforts to protect their customers' sensitive data. This Paper argues that the SEC should amend the Safeguards Rule to focus on the procedures by which investment intermediaries develop their data security policies, rather than merely engaging in after-the-breach assessments of the "reasonableness" of the policies. Doing so would provide greater clarity and fairness to investment intermediaries, encourage investment intermediaries to work within their means to protect sensitive data, and make the SEC's enforcement role easier