US Consumer Financial Protection Bureau Brings First Data Security Enforcement Action

On March 2, 2016, the Consumer Financial Protection Bureau (Bureau) undertook its first data security enforcement action in a consent order against Dwolla, Inc., a payment network provider that allegedly made deceptive representations about its data security practices. Although in this matter the Bureau relied upon its authority to take action against "deceptive" practices, the consent order raises the prospect that the Bureau intends to provide regulatory oversight regarding the substantive adequacy of data security practices of covered persons in the future.

The Bureau asserted that Dwolla made a number of representations about the quality of its data security, including that it "sets a new precedent for the industry for safety and security," that it was "PCI compliant" (referring to the Payment Card Industry Data Security Standard) and that it "encrypt[ed] data in transit and at rest." The Bureau alleged that these statements were untrue because Dwolla "did not