Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 16 JUNE 2016

BNA INSIGHTS: The CFPB and Data Security Enforcement

WilmerHale
WilmerHale
Contributor
WilmerHale

WilmerHale

WilmerHale's London office was established more than 40 years ago. With lawyers qualified in the...

View firm profile
Explore more from WilmerHale

The authors examine the Consumer Financial Protection Bureau's foray into data security enforcement by assessing how the bureau's data security authority compares with that of other federal regulators.

United StatesConsumer Protection
Michael Gordon
Michael Gordon
Elijah Alper
Elijah Alper
Leah Schloss
Leah Schloss
Author LinkedIn connections

The Consumer Financial Protection Bureau (CFPB) announced its intention to act as a data security regulator by releasing its first unfair, deceptive or abusive acts or practices (UDAAP) enforcement action for allegedly deceptive statements about data security practices after remaining largely silent on the topic for more than four years. The CFPB's March enforcement action, against a small payments company,1 contains only a modest civil money penalty and does not require payments to customers. The language in the bureau's action suggests that it expects regulated companies to implement certain data security processes and that it may take further enforcement action in the area of data security.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

New York City’s Click-to-Cancel Rule: What Businesses Need To Know

New York City has enacted the nation's first municipal click-to-cancel rule, requiring businesses to provide clear disclosures, simple cancellation processes, and advance renewal notices for subscription services. With approximately 30 states already implementing similar regulations and the federal landscape in flux following the FTC's vacated rule, companies now face an increasingly complex patchwork of compliance obligations. The rule takes effect October 1, 2026, and imposes penalties ranging from $525 t
United StatesConsumer Protection
Skadden, Arps, Slate, Meagher & Flom LLP
Skadden, Arps, Slate, Meagher & Flom LLP
Article

FCC Replaces TCPA “Revoke All” Rule: New Category-Specific Opt-Out Rules For Robocalls And Robotexts

The Federal Communications Commission has fundamentally altered how businesses must handle consumer opt-out requests under the Telephone Consumer Protection Act, replacing the broad "revoke all" mandate with a more nuanced, category-specific approach for informational messages. This regulatory shift allows companies to maintain separate consent tracks for different types of non-marketing communications while preserving stricter opt-out requirements for telemarketing messages. The Updated Order introduces ne
United StatesConsumer Protection
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Amway To Pay $225 Million Over Alleged False Earnings Claims And Fabricated Sales

The FTC and Washington state secured a record $225 million settlement from Amway and affiliated groups over allegations they misled recruits about earnings potential while pressuring them to buy products with little retail opportunity. The complaint reveals that over three-quarters of U.S. product volume was sold to IBOs themselves rather than retail customers, with fabricated sales reporting masking the recruitment-driven model. The settlement's injunctive provisions establish new standards for earnings cl
United StatesConsumer Protection
Frankfurt Kurnit Klein & Selz PC
Frankfurt Kurnit Klein & Selz PC
Article

FTC Asks Whether Platform Ad Tools Fuel Impersonation Scams

The Federal Trade Commission is exploring whether digital platforms should bear greater responsibility for preventing impersonation ads that falsely pose as legitimate businesses or government agencies. Through an Advance Notice of Proposed Rulemaking, the agency seeks public input on potential amendments to its existing Impersonation Rule, examining how ad-optimization tools and platform practices...
United StatesConsumer Protection
Greenberg Traurig
Greenberg Traurig
Article

CONGRESS FIRES BACK?: New Bill Seeks To Revive Written Consent Rule Under TCPA

Congress has introduced the Stop Spam Calls Act, directing the FCC to revise the definition of prior express written consent under the TCPA to require one-to-one seller consent and logical relevance between sellers and website content. This legislative move comes as the Fifth Circuit questions whether written consent is even required under the TCPA, creating a fascinating tension between congressional intent and judicial interpretation that could reshape telemarketing compliance.
United StatesConsumer Protection
Troutman Amin LLP
Troutman Amin LLP
Article

The Coming State-Law Litigation Wave Of 2026-27: “Subscription Trap” Class Actions

State-law class actions targeting automatic renewal and subscription practices are accelerating, creating significant litigation risk for companies that rely on recurring revenue models. Recent settlements demonstrate that even technical compliance failures can lead to seven-figure exposure, with California, Illinois, and Virginia statutes driving the most aggressive litigation.
United StatesConsumer Protection
Benesch, Friedlander, Coplan & Aronoff LLP
Benesch, Friedlander, Coplan & Aronoff LLP
Article

NCAA Enjoined From Enforcing New Fifth-Year Eligibility Rule

A federal court has issued a nationwide injunction blocking the NCAA from enforcing its new five-year eligibility rule against Division I athletes who graduated high school in 2022. The ruling creates immediate compliance challenges for athletic departments as they navigate roster management, revenue-sharing caps, and potential penalties while the NCAA appeals the decision.
United StatesConsumer Protection
Buchanan Ingersoll & Rooney
Buchanan Ingersoll & Rooney
Article

PTAB/USPTO Update - October 2026

The USPTO has released new templates and guidance for AIA trial proceedings, announced key appointments including a Chief AI Officer, and published updated procedures for patent applications and subject matter eligibility declarations. Director Squires delivered multiple addresses emphasizing the constitutional importance of intellectual property rights while the agency expanded its community engagement efforts and international collaboration through WIPO's Global IP Assignment Platform pilot program.
United StatesIntellectual Property
WilmerHale
WilmerHale
Article

SEC Approves FINRA’s New “Outside Activities” Rule

The Securities and Exchange Commission has approved FINRA Rule 3290, which will replace existing rules governing outside business activities and private securities transactions for registered persons. This new rule narrows the scope to focus on investment-related activities while maintaining similar supervisory obligations for member firms. Understanding the key changes and implementation requirements will be critical for broker-dealers as they update their compliance policies and procedures.
United StatesFinance and Banking
WilmerHale
WilmerHale
Article

23x5 Trading Comes To US Exchanges: What Firms Should Know Before Launch

US national securities exchanges are preparing to launch 23x5 trading by December 6, 2026, marking the most significant expansion of trading hours in decades. This comprehensive analysis examines the regulatory approvals, operational infrastructure changes, investor protection mechanisms, and issuer considerations necessary to support overnight equity trading from Sunday through Thursday evenings.
United StatesFinance and Banking
WilmerHale
WilmerHale
Article

Lame Duck, High Stakes: Congress’s Postelection Agenda

As Congress prepares for its postelection lame-duck session, lawmakers face critical decisions on government funding, defense authorization, and potential debt-limit increases. The election outcome will determine whether Republicans push through major legislation before potentially surrendering control, or whether both parties defer negotiations into 2027. With permitting reform, tax extenders, and reconciliation packages on the table...
United StatesGovernment, Public Sector
WilmerHale
WilmerHale
Article

SEC 2027 Exam Priorities: Familiar Priorities, Evolving Markets

The SEC Division of Examinations has released its fiscal year 2027 examination priorities, signaling continued focus on investment adviser fiduciary obligations, broker-dealer financial responsibility, and Regulation Best Interest while adapting to evolving market practices. Private credit, artificial intelligence governance, and retail investor protection emerge as prominent areas of scrutiny, with examiners expected to probe valuation practices, conflicts of interest, and technology controls across regula
United StatesFinance and Banking
WilmerHale
WilmerHale
Article

The SEC’s Transfer Agent Modernization Proposal: Implications For Onchain Recordkeeping

The SEC has proposed a comprehensive overhaul of transfer agent regulations that would formally recognize distributed ledger technology and blockchain-based recordkeeping systems within the existing regulatory framework. This modernization effort imposes enhanced operational, safeguarding, and compliance obligations while establishing technology-neutral standards that could significantly impact tokenization initiatives and digital asset market infrastructure.
United StatesFinance and Banking
WilmerHale
WilmerHale
Article

PTAB/USPTO Update - September 2026

The USPTO has released its latest economic impact report on IP-intensive industries, announced a new community engagement office in North Carolina, and issued several administrative updates including relief for Japanese applicants affected by a severe earthquake. The Patent Trial and Appeal Board has also designated new precedential and informative decisions addressing obviousness-type double patenting and Markush groupings.
United StatesIntellectual Property
WilmerHale
WilmerHale