Europe data privacy a problem for U.S.

Data privacy concerns that spurred tough new regulations in Europe could soon be spreading to the U.S., with California making the first move. In the meantime, plan sponsors and asset managers need to pay attention as U.S. regulators figure out how to react.

Two years ago, the European Union enacted the sweeping General Data Protection Regulation to protect citizens' data and privacy rights. GDPR applies to multinational companies — including asset managers and advisers — if their principal base is in the EU, or they provide goods, services or employment to EU residents.

The restrictions, which became effective in May 2018, place a significant burden on companies to manage their employees' and customers' data, or risk dramatic fines up to €20 million ($22 million) or 4% of annual income, whichever is higher.

Any doubts about how seriously European regulators take the new data privacy law were quickly erased in January when France's data protection regulator, Commission nationale de l'informatique et des libertes, or CNIL, fined Google LLC €50 million for not doing enough to get consent from users before processing their data.

Europe-based asset managers and advisers applying for Securities and Exchange Commission registration are painfully aware of GDPR, as SEC officials sit on their applications while they figure out how to get typically requested information from managers such as financial statements, client profiles, trade records and even investment research involving personal data, without running afoul of GDPR.

Until that roadblock is cleared and they are allowed to register, EU-based asset managers including private fund advisers cannot raise money from U.S. investors, even if they are already registered for other investment vehicles.

"Right now, the status quo is, if you are based in the U.K. or EU, you will not get approved," said Michael Sherman, a partner in Dechert LLP's Washington office who counsels investment advisers and firms that have encountered similar data protection law issues in other countries.

Even firms already registered before GDPR could get caught in that limbo if they get on the SEC's examination radar, which legal experts worry could harm not just the fund advisers but their clients. Registered asset managers have to annually update their Form ADVs, affirming that they can comply with securities laws and will produce records in the event of an SEC exam, and if some of that information is covered by the GDPR, their existing registrations could also be put on hold.

SEC officials say that they appreciate European asset managers' frustrations, and do not relish being in this position themselves, but they also feel it is imperative to be able to examine firms under the same standards, whether the manager is based in the U.S. or Europe.

In some cases, a European firm might be able to form a U.S. subsidiary or go through a U.S.-based affiliate when seeking to be registered by the SEC, "but in other cases, you are stuck," Mr. Sherman said. "It would seem that the best hope for a long-term solution would be for the EU to provide an exception (to GDPR) that would allow firms to provide records to the U.S. regulator."

That would require U.S. and EU regulators to figure out some sort of compromise, which is not likely to happen soon, observers say, with European regulators wary of blanket exemptions for U.S. regulators following some high-profile data breaches in the U.S., including federal government personnel records.

SEC officials are continuing to have good-faith discussions with their European counterparts, but concede that a solution has yet to emerge. And, even if it somehow does, the registration delay that has already been around for a year could drag on even longer, because it will take time for the SEC to get clarity first from the European Union itself, and then from each EU country.

The topic is expected to come up at the SEC's regularly scheduled EU-U.S. forum in February but groups like the Alternative Investment Management Association, the London-based advocate for alternative investment managers, are pressing SEC Chairman Jay Clayton to deal with it aggressively before more private fund managers seeking registration in the U.S. are left in limbo.

With no signs of the regulator stalemate ending soon, observers say it might fall to European firms and their trade associations to persuade EU regulators to grant an exception so the SEC can collect the data it requires and end the regulatory logjam.

In the meantime, AIMA is urging its members to be able to demonstrate a clear understanding of the personal data they have and how it is used, and to implement systems and processes to meet the GDPR requirements.

While federal regulators figure out how to proceed with the EU's news data privacy reality, some states are also considering similar data privacy measures. California is leading the way with the California Consumer Privacy Act that goes into effect Jan. 1, and as many as 10 states are now considering their own consumer privacy acts.

"Data security is so important that states are saying, 'we should take this on,'" said Peg Knox, chief operating officer of the Defined Contribution Institutional Investment Association in Washington, who sees GDPR compliance as "a good primer as the U.S. deals with data privacy."

David Levine, a principal with Groom Law Group in Washington who chairs DCIIA's public policy committee, thinks U.S. plan sponsors should be focusing on the California Consumer Privacy Act, "which goes way beyond benefits. There are many different layers to CCPA," which applies to companies with at least $25 million in annual revenue and employees in California or that have personal data on at least 50,000 people.

With the new law, California consumers can demand to see all information a company has saved on them as well as all the third parties with which it shares data.

Fines up to $7,500 per incident are less drastic than GDPR, but the bigger risk is that consumers can sue a company even without a breach if its privacy guidelines are violated.

One worry Mr. Levine has with CCPA is the lack of clear guidance for plan sponsors and service providers, Mr. Levine said. "The question is, what is covered by CCPA and what is not? I am hopeful it will be more guidance than enforcement."

As states and other countries move aggressively to protect individuals' personal data, another issue is which federal or state regulator is in charge. "The Department of Labor is starting to do enforcement on cybersecurity (but) it is not clear who the right rule-maker is on this," Mr. Levine said.

If more state data privacy laws crop up, Congress might have to step in with a federal approach. Either way, "I'm highly confident that 2020 will be a year of regulatory activity in many ways," he said.