U.S. Online Payment Processor Dwolla Fined $100,000 For Misrepresenting Data Security Practices: Lessons For Canadian Companies

In March, 2016 the U.S. Consumer Financial Protection Bureau ("CFPB") issued a Consent Order against Dwolla Inc., an online payment platform, for deceiving consumers about its information security practices. The CFPB levied a $100,000 civil monetary penalty against the company, a first for the CFPB. What is particularly notable is that there was no evidence that the payment processor had experienced a breach or data security incident of any kind. Also notable were the significant new compliance obligations, including requiring Dwolla to perform regular risk assessments and annual third-party cybersecurity audits for the next five years. While Canada has different privacy and consumer protection regimes, the lessons from the Dwolla case point to a new direction in enforcement approaches.