Consumer Crossroads: Where Financial Services and Litigation Intersect

In a Privacy & Cyber Bytes Alert, we review takeaways from the recently concluded Mortgage Bankers Association's Conference on Legal Issues and Regulatory Compliance. Lenders and servicers with consumer-facing platforms that collect personal information need to initiate cybersecurity compliance efforts immediately.

Having sent a similar letter to New York's domestic and foreign insurance companies, the New York State Department of Financial Services (DFS) issued a letter on October 29, 2020 explicitly calling on its regulated financial institutions to start integrating financial risks associated with climate change into their business strategies, risk management processes, and governance frameworks. DFS' expectations apply to New York-regulated banks, mortgage bankers and servicers (Regulated Organizations), as well as to other New York-regulated non-depositories, including money transmitters, licensed lenders, sales finance companies, and virtual currency firms (Regulated Non-Depositories).

The New York State Department of Financial Services issued a press release on Thursday announcing the publication of its investigative report of the July 2020 Twitter hack. The exhaustive report reviews the facts surrounding the hack, provides a visual timeline, and explores the cybersecurity weaknesses at Twitter that made the hack possible, including a lack of leadership, vulnerability to social engineering, and a failure to address the new vulnerabilities caused by the pandemic-driven shift to mass remote working.

We recently reported on the New York State Department of Financial Services' (DFS) first enforcement action under its 2017 cybersecurity regulation ("Part 500"), which prescribes how financial services companies licensed to operate in New York should construct their cybersecurity programs. DFS' statement of charges provides important insight into the agency's priorities and expectations when assessing how a company has addressed and mitigated a data exposure, and offers a roadmap for how other regulators might interpret similar data security laws being implemented across the country. Given increasing regulatory scrutiny and the fact that inappropriate cybersecurity procedures and practices could result in significant financial liabilities, companies should proactively re-assess where they stand in relation to applicable cyber mandates.

Covered entities received two cybersecurity wake up calls from insurance regulators this month. As we have reported, the New York State Department of Financial Services (DFS) issued its long-awaited first cyber enforcement action pursuant to its groundbreaking and first-in-nation cybersecurity regulation. In addition, the Connecticut Insurance Department issued a Bulletin to all licensees, providing guidance for compliance with the Connecticut Insurance Data Security Law (the Act), which goes into effect on October 1, 2020. The Act was modeled after the National Association of Insurance Commissioners Model Cybersecurity Law, which itself was modeled after the DFS cybersecurity regulation.

After several years of anticipation, the New York State Department of Financial Services (DFS) has filed its first enforcement action under the agency's groundbreaking and first-in-the-nation 2017 cybersecurity regulation (Part 500 of Title 23 of the New York Codes, Rules, and Regulations), which prescribes how financial services companies licensed to operate in New York should construct their cybersecurity programs. This action is a wakeup call to covered entities to fully implement the directives of Part 500.

In support of re-opening and adapting New York to the new economic and social normal caused by COVID-19, New York's Department of Financial Services (DFS) announced the launch of a program called "DFS FastForward" which will support innovators who can deliver novel digital solutions that advance the state's recovery from the pandemic. The program builds on the successful launch in February of an InsurTech pilot program by DFS, and promises to "reduce barriers and speed up" the regulatory process for qualifying services and products.

In response to challenges facing the financial services industry as a result of coronavirus (COVID-19), New York's Department of Financial Services (DFS) has issued a COVID-19 compliance order, along with a series of industry guidance letters related to the organizational preparedness of regulated institutions to manage risks associated with the outbreak.

New York Governor Andrew Cuomo has issued a final regulation that requires credit reporting agencies doing business in New York to register annually with the Department of Financial Services (DFS) and also to comply with accompanying cybersecurity regulations, including the implementation of a cybersecurity program consistent with the requirements already in place for banks, insurance companies and other financial services institutions. The purpose of the new regulation is to protect New Yorkers from data breaches, such as the Equifax breach which exposed the private data of millions of individuals.