An irreverent Wall Street Blog
FINRA Protective Order Addresses Private Confidential Information (PCI)
August 25, 2016
The Financial Industry Regulatory Authority's ("FINRA's") rules consist of lots of things that a registered representative or member firm can't do subject to the penalty of being named a Respondent in a disciplinary proceeding and, thereafter, subject to the imposition of a fine, suspension, and/or bar. On top of those substantive rules governing the industry's day-to-day conduct, there are procedural rules explaining how the regulator is supposed to conduct its investigations and proceedings, which are set forth in the self-regulatory organization's 9000 Series of rules. Yeah, 9000, as in a 9 with three zeros after it. As in if we're looking up the 9000 Series of rules of any organization, that's sort of warning us that we got a large rulebook. A Moving Experience For example, consider what is involved should you or your lawyer want to make a Motion or if you seek redress in response to a Motion made against you:
FINRA Code of Procedure Rule 9146: Motions (a) General Requirement for Motions A Party may make a written or oral motion, subject to limitations set forth below. A Party or other person may make a motion under Rule 9146(k), subject to limitations set forth below. (b) Adjudicator May Require a Written Motion If a Party makes an oral motion, an Adjudicator may order that such motion be set forth in writing, after considering the facts and circumstances, including whether:Case In Point Now that you have had a chance to try and decipher FINRA's procedural rule involving Motions, consider an issue that arose in FINRA Department Of Enforcement, Complainant, v. Richard William Lunn Martin, Respondent (OHO Order 16-19 (2013035817701)(Protective Order Governing Personal Confidential Information) Disciplinary Proc. No. 2013035817701 / July 28, 2016).(1) the hearing or conference in which the Party makes such motion is being recorded; and(2) the opposing Parties shall be fully informed and shall have adequate notice and opportunity to respond to such motion.(c) Specificity All motions shall state the specific relief requested and the basis therefor. (d) Time For Filing Opposition or Other Response to Motion Unless otherwise ordered by an Adjudicator, any Party may file an opposition or other response to a written motion and the opposition or response shall be filed within 14 days after service of the motion. If no response is filed within the response period, the Party failing to respond shall be deemed to have waived any objection to the granting of the motion. A Party shall be afforded an opportunity to respond to an oral motion at the time the oral motion is made, unless the Adjudicator orders that the Party shall be granted additional time to respond. (e) Oral Argument An Adjudicator may allow oral argument on motions. Oral argument may take place in person or by telephone. (f) Frivolous Motions An Adjudicator may deny dilatory, repetitive, or frivolous motions without awaiting a response. (g) No Stay Unless otherwise ordered by an Adjudicator, the filing of a motion does not stay a proceeding. (h) Reply The moving Party shall have no right to reply to the opposition or other response of the other Parties unless an Adjudicator permits a reply to be filed. Unless otherwise ordered by an Adjudicator, a movant's reply submission shall be filed within five days after the Adjudicator serves the order granting the motion to file a reply or a Party serves the opposition or other response to which the Adjudicator previously ordered that a reply could be filed. (i) Page Limit, Format Requirements Unless otherwise ordered by an Adjudicator, submissions in support of or in opposition to motions shall not exceed ten double-spaced pages, including double-spaced footnotes, exclusive of pages containing any table of contents, table of authorities, or addenda. (j) Disposition of Procedural Motions; Disposition of Motions for Summary Disposition(1) In the Rule 9200 Series, a motion on a procedural matter may be decided by a Hearing Officer. A motion for summary disposition of a cause of action set forth in a complaint shall be decided by a majority vote of the Hearing Panel or, if applicable, the Extended Hearing Panel.(2) In the Rule 9300 Series, a motion on a procedural matter may be decided by Counsel to the National Adjudicatory Council, the Review Subcommittee, a Subcommittee or, if applicable, an Extended Proceeding Committee, or the National Adjudicatory Council. A motion for disposition of a cause of action shall be decided by the National Adjudicatory Council, except that a motion to dismiss a case for abandonment made under Rule 9344 may be decided by the Review Subcommittee.(3) In the Rule 9500 Series, a motion shall be decided by an Adjudicator, except that a procedural motion made pursuant to the Rule 9520 Series or Rule 9559(q)(3) may be decided by Counsel to the National Adjudicatory Council.(k) Motion For Protective Order(1) A Party, a person who is the owner, subject, or creator of a Document subject to production under Rule 8210 or any other Rule which may be introduced as evidence in a disciplinary proceeding, or a witness who testifies at a hearing in a disciplinary proceeding may file a motion requesting a protective order to limit disclosure or prohibit from disclosure to other Parties, witnesses or other persons, except the Department of Enforcement and the Department of Market Regulation and other FINRA staff, Documents or testimony that contain confidential information. The motion shall include a general summary or extract of the Documents or testimony without revealing confidential details. If the movant seeks a protective order against disclosure to other Parties, copies of the Documents shall not be served on the other Parties. Unless the Documents are unavailable, the movant shall file for in camera inspection a sealed copy of the Documents for which the order is sought. If the movant is not a Party, the motion shall be served on each Party by the movant using a method in Rule 9134(a) and filed with the Adjudicator. A motion for a protective order shall be granted only upon a finding that disclosure of the Document or testimony would have a demonstrated adverse business effect on the movant or would involve an unreasonable breach of the movant's personal privacy.(2) If a protective order is granted, the order shall set forth the restrictions on use and disclosure of such Document or testimony. An Adjudicator does not have the authority to issue a protective order that would limit in any manner the use by FINRA staff of such Documents or testimony in FINRA staff's performance of their regulatory and self-regulatory responsibilities and functions, including the transmittal, without restriction to the recipient, of such Documents or testimony to state, federal, or foreign regulatory authorities or other self-regulatory organizations. An Adjudicator does not have the authority to issue a protective order that purports to protect from production such Documents or testimony in the event that FINRA is subject to a subpoena requiring that the Documents or testimony be produced.(l) General All motions, oppositions or responses, replies, and any other filings made in a proceeding shall comply with Rules 9133, 9134, 9135, 9136 and 9137.
Personal Confidential Information (PCI) In FINRA v. Martin, it became necessary to produce Personal Confidential Information ("PCI"), which is data that is statutorily protected to ensure that individuals are not exposed to identity theft or other misuse. See: FINRA Procedural Rule 9146(k)(2) above for a provision that addresses how PCI may come into play during a disciplinary hearing. In FINRA v. Martin, certain documents involved in that proceeding may have contained social security numbers, taxpayer ID numbers, driver's licenses, state-issued ID cards, passport numbers, and financial account numbers referencing, for example, checking/savings accounts, credit/debit cards, etc. The FINRA Hearing Officer ordered:
2. Limited Third-Party Disclosures of Confidential Information. The parties and their attorneys shall take reasonable and appropriate measures to prevent the inadvertent disclosure of PCI. The parties and their attorneys shall limit the use of PCI to the litigation of this Proceeding and shall not share or otherwise disseminate PCI to any person or entity other than the following categories of persons: a. The parties to this Proceeding. b. The parties' attorneys who have entered an appearance in this Proceeding and their staff. c. Court reporters and videographers employed for any on-the-record interview or hearing in this Proceeding. d. Persons providing copying or exhibit preparation services (including outside vendors hired to process electronically stored Documents). e. Consultants, experts, and their staff to the extent they are deemed to be reasonably necessary for the prosecution or defense of this Proceeding. f. Non-party witnesses who testify or are reasonably expected to testify at the hearing or at an on-the-record interview in this proceeding and their attorneys, on the condition that they are prohibited from disclosing or making use of any protected PCI that may be disclosed to them in the course of this Proceeding. Such witnesses and their attorneys may not retain Documents that contain PCI. g. The authors, originators, and addressees of Documents containing the PCI. h. The Office of Hearing Officers, its personnel and staff; the hearing panelists appointed in this disciplinary proceeding; FINRA's Office of General Counsel, its personnel and staff; and members of FINRA's National Adjudicatory Council. i. Other persons upon order of the presiding hearing officer or FINRA's Chief Hearing Officer. Before providing PCI to persons identified in categories d, e, or f above, a party (or a party's attorney) shall provide a copy of this Protective Order to the intended recipients, and shall caution them that they must comply with this Protective Order. This Protective Order shall not restrict the use or disclosure by a party or a party's attorney of PCI such party or attorneys obtained independently of discovery in this Proceeding (whether or not such Documents or portions of Documents were also obtained through discovery in this Proceeding) or from disclosing their own PCI as they deem appropriate.The Hearing Officer further ordered that within 60 days after the conclusion of the proceeding that Respondent or his attorneys must return to FINRA's Department of Enforcement:
all Documents and copies of Documents that contain PCI that the Department of Enforcement produced in this Proceeding, or certify to the Department of Enforcement that all such Documents and copies of such Documents have been destroyed. Notwithstanding the foregoing, Respondent's attorneys may retain one copy of pleadings, briefs, motions, memoranda, correspondence exchanged in this Proceeding, hearing transcripts, admitted exhibits, and attorney work product created in the course of this Proceeding. All retained Documents containing PCI shall continue to be protected under this Protective Order.Bill Singer's Comment
Welcome to my world as a regulatory lawyer. For over three decades I have had the fun of trying to decipher FINRA's substantive and procedural rules and trying to figure out whether they are being fairly applied. As you can see, practicing law before FINRA is no easy matter.
Frequently, I am contacted by a public customer who gets a letter from FINRA asking for information, corroboration, or an interview. Unfortunately for FINRA, it usually lacks jurisdiction over a public customer and can't force that individual to cooperate. Unlike the Securities and Exchange Commission or the Department of Justice, FINRA doesn't have subpoena power in its regulatory investigations and proceedings and can't issue a search warrant.
Similarly, I am often contacted by registered representatives or broker firms concerned about the ramifications of FINRA contacting a customer about a regulatory investigation or disciplinary proceeding. First and foremost, I warn such industry folks to NOT advise the public customer against cooperating because that makes you look guilty, and, worse, it may be seen as a violation of FINRA rules.
Be it an inquiring pubic customer or industry participant, I generally explain that it is not unusual for FINRA to contact a public customer and ask for PCI. On the other hand, it's more likely that FINRA will demand that a registered rep or member firm provide PCI information in their possession and control pursuant to various demands by the regulator. Regardless of whether FINRA asks the customer to voluntarily produce PCI or the regulator demands the production of the customer's PCI from the registered rep or member firm, the customer may get spooked when he or she learns that what was thought to be somewhat sacrosanct private information is being sent to something called a self-regulatory organization, which isn't a government agency and isn't a federal/state prosecutor . As I have long noted, many self-regulatory organizations seems little more than a private trade group; and, frankly, at times, many SROs act like a biased, conflicted, private trade group.
Why does any of this PCI stuff matter? Why should any public customer be concerned about his or her PCI and a regulatory investigation? For starters, carefully read the FINRA Hearing Officer's Order as set forth under "2. Limited Third-Party Disclosures of Confidential Information":
Before providing PCI to persons identified in categories d, e, or f above, a party (or a party's attorney) shall provide a copy of this Protective Order to the intended recipients, and shall caution them that they must comply with this Protective Order.
No . . . you're not misreading or misunderstanding anything. The Order requires that a copy of the Protective Order be provided to three categories of third parties, who are supposed to be cautioned that the "must comply with this Protective Order." Missing from that caution is the "or else." If I were a public customer and my PCI were being produced within the context of a FINRA investigation or hearing, I'm not sure that I would be all that thrilled to learn that the mechanism to protect my confidentiality is little more than a copy of a Protective Order and a caution to comply. All of which comes off as somewhat dubious paper and words.
More troubling is the purportedly "limited" group of third parties set forth in Protective Order's reference to the "d, e, and f " categories of folks, which include persons copying exhibit, consultants, experts, and witnesses. Okay, sure, all of those folks are supposed to take some kind of Scout's pledge to honor the confidentiality of the PCI but what customer is going to sleep well knowing that it's only some non-governmental honor system that is protecting his or her private information. On top of that fear, how comforting is it to realize that your PCI is being sent to a commercial copying service where some minimum wage worker is making multiple hard and digital copies that are then sent to any number of consultants and witnesses? It doesn't take a genius to see what's being copied and realize the value of that information in the wrong hands. We have all heard the scary stories about waiters stealing credit card information with an illegal skimmer. One can only imagine what could transpire when your confidential financial information is in the hands of a bad guy.
I often find myself advising clients who are public customers not to cooperate with FINRA because it's a non-governmental actor and it has no jurisdiction over them. Frankly, I'm not all that big a fan of "voluntary" compliance when it comes to most things. If the Securities and Exchange Commission or the Department of Justice want to serve a subpoena on my public customer client and the production is then subject to many laws imposing confidentiality (during Grand Jury proceedings, for example) or pursuant to a federal law such as Dodd-Frank, then that's great. But FINRA ain't the SEC or DOJ, and the good folks at Kinko's are not subject to FINRA's jurisdiction.
Notwithstanding my reservations and concerns, the Protective Order in FINRA v. Martin is very well drafted and serves as an incredibly instructive tool to illustrate the issues noted above. All industry participants should fully understand the ramifications of this document and prepare for having to deal with such privacy issues in the future.