No Consumer Harm? No Direct Enforcement Authority? No Problem – CFPB Enters into Consent Order with Dwolla

This week, the CFPB made its first foray into the data privacy arena by entering into a Consent Order with online payment processor, Dwolla. Inc. via an administrative proceeding.  The Consent Order sends a clear message across the consumer financial services arena that the CFPB will use its UDAAP umbrella to extend its reach and that no consumer harm is required for the CFPB to flex its muscle.

According to the CFPB, it took action because Dwolla “deceived consumers about its data security practices and the safety of its online payment system.”  Without admitting any wrongdoing, the Consent Order includes findings that Dwolla collected and stored consumers’ private information and provided a platform for financial transactions.  According to the findings, Dwolla represented that it maintained “reasonable and appropriate measures to protect data obtained from consumers from unauthorized access.”  However, the CFPB concluded that Dwolla in fact did not take reasonable and appropriate measured to protect consumer data. Specifically, the Order finds that, among other things:

·        For a significant period of time, Dwolla did not adopt or implement reasonable and appropriate data-security policies and procedures to govern the collection, maintenance or storage of consumers’ personal information;

·        For a significant period of time, Dwolla failed to conduct adequate regular risk assessments to identify reasonably foreseeable internal and external risks to information and to assess the safeguards in place to control these risks;

·        For a significant period of time, Dwolla did not provide adequate employee training as to the handling and protection of consumers’ personal information;

·        For a significant period of time, Dwolla transmitted consumers’ personal information without encrypting it; and

·        For a significant period of time, Dwolla did not adequately manage its vendors as to data security.

Pursuant to the Consent Order, Dwolla is required, to the extent it has not done so already:

·        Accurately represent in its marketing, advertising, promotion or administration of its electronic payment networks the data security practices implemented by Dwolla;

·        Implement a comprehensive Written Information Security Plan which mirrors the requirements of GLBA’s Safeguard Rules and which:

o   Designates a qualified person to coordinate its data security program;

o   Identifies reasonably foreseeable internal and external risks to the security and confidentiality of consumer nonpublic information and assess the sufficiency of the institution’s  safeguard in place to control those risks, including risks in areas of operation specifically:

§  Employee training and management; and

§  Confidentiality and integrity of Dwolla’s network systems or apps and storage systems;

o   Implement safeguards to manage the identified risks and regularly test and monitor risks;

o   Develop, implement and maintain reasonable procedures for the selection and retention of service vendors capable of maintaining security practices consistent with the Consent Order; and

o   Evaluate and adjust the data security program in light of the results of the risk assessments and monitoring.

·        Retain a third party independent auditor to conduct an annual data-security audit of Dwolla’s data security practices; and

·        Pay a civil monetary penalty of $100,000.00.

Several things make this order significant and banks and nonbanks alike should take note:

·        Prior to this action, there had been no indication by the CFPB, either through its website or other publications, that it was focused on data security leading many to assume they would defer to the FTC and other regulators on issues of data privacy;

·        Gramm Leach Bliley and its Safeguard Rules (which provide for the protection of consumer nonpublic information by financial service providers) are not among the enumerated consumer protection statutes over which the CFPB has jurisdiction;

·        The Consent Order reflects the CFPB’s position that its UDAAP (unfair and deceptive acts) umbrella liability is expansive enough to take on data security issues; and

·        The Consent Order makes no finding of a data breach or some other sort of consumer or injury.  

Banks and nonbanks alike should pay close attention to the Dwolla Order and expect to see the CFPB continue take expansive views of its authority to regulate.