Over the past few months, the Securities and Exchange Commission
(the "SEC") has taken a number of enforcement actions
related to cybersecurity issues broadly, and to data security and
privacy issues in particular, adding muscle to Chair Gensler's
commitment to policing financial markets for cybersecurity
vulnerabilities. Most recently, last month the SEC announced three
settlements stemming from financial firms' failures to
implement appropriate data security policies and procedures as
required by Rule 30(a) of Regulation S-P (the "Safeguards
Rule"), and earlier in the month announced a settlement with a
publicly traded company for failure to disclose adequately the
known effects of a data security breach involving personal
information. For companies that fall within the SEC's broad
ambit, the key takeaway is that the SEC is approaching
cybersecurity, data security, and privacy issues in a manner that
could have significant implications for the ways that
