Consumer Financial Protection Bureau Brings Its First Data Security Enforcement Action

On March 2, the Consumer Financial Protection Bureau ("CFPB") issued its first ever consent order in a data security matter. According to the order, Dwolla, Inc. settled allegations that it misrepresented that the company had reasonable and appropriate data security practices when, according to the CFPB, its practices failed to employ reasonable and appropriate measures to protect user data from unauthorized access. While Dwolla did not admit or deny any allegation, the consent order requires Dwolla to pay a $100,000 civil penalty and take other specified actions for a five-year period, such as conducting semi-annual data security risk assessments and developing, with direct input from the board of directors, a compliance plan.