FP 37503689.3

IN THE UNITED STATES DISTRICT COURT FOR

THE NORTHERN DISTRICT OF ILLINOIS

EASTERN DIVISION

__________________________________________

:

FIDELITY BROKERAGE SERVICES LLC, :

:

Plaintiff, :

:

v. : CASE NO.

:

JENNIFER TAYLOR, :

:

Defendant. :

DECLARATION OF SCOTT MARSHALL

I, Scott Marshall, declare pursuant to 28 U.S.C. §1746:

1. I am over the age of 18. All statements in this declaration are based on my personal 

knowledge, or, where indicated, based on my investigation. I submit this Declaration on behalf of 

Plaintiff Fidelity Brokerage Services LLC (“Fidelity”) in support of its Motion for a Preliminary 

Injunction.

2. I am a Vice President/Branch Office Manager for the Oak Brook, Illinois Branch 

Office of Fidelity Brokerage Services LLC (“Fidelity”). 

3. I have been employed by Fidelity for over twenty years. I began my employment 

with Fidelity in February of 2000 and have been the Branch Office Manager for the Oak Brook, 

Illinois Branch Office since 2018. 

4. Prior to her resignation from Fidelity, Defendant Jennifer Taylor (“Taylor”) worked 

as a Vice President, Financial Consultant in Fidelity’s Oak Brook, Illinois Branch Office. In my 

capacity as the Branch Office Manager, I supervise Financial Consultants in the Branch. 

5. As a Financial Consultant at Fidelity, Taylor was assigned to service and manage 

Fidelity’s relationship with a select group of Fidelity’s customers. The customers serviced by 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 1 of 40 PageID #:57
FP 37503689.3

Taylor were primarily high net worth households with, on average, over a million dollars in assets 

under management at Fidelity. By the time of her resignation, Taylor had daily access to and had 

gained knowledge of confidential Fidelity information relating to approximately 425 households, 

representing over $1.1 billion in customer assets under Fidelity management.

6. Fidelity vigilantly preserves its trade secret customer data so that it does not become 

available to competitors who could use the data to divert customers, without the investment of 

time, labor, and capital that Fidelity made to compile the information. Fidelity does not provide 

its trade secret customer data to competitors. Fidelity maintains its trade secret customer data on 

password-protected computers, and only employees whose jobs require access to the customer 

data are provided with such access. 

7. Fidelity also maintains and advises its employees of a Global Policy on Information 

Protection that is displayed on Fidelity’s intranet. A true and correct copy of Fidelity’s Global 

Policy on Information Protection is attached hereto as Exhibit A. Fidelity periodically reminds its 

employees of this policy and provides employees with a Quick Reference Card (“QRC”) 

explaining how to protect specific types of Fidelity confidential information. A true and correct 

copy of Fidelity’s QRC is attached hereto as Exhibit B. 

8. Fidelity further protects this confidential information by using various safeguards 

for its computer system on which the information is stored and through which it is constantly 

updated. Employees such as the Defendant require passwords to access the Fidelity computer 

system. 

9. Fidelity additionally preserves trade secret customer data by requiring each 

employee to execute a standard Fidelity Employee Agreement. Fidelity records indicate that 

Defendant Taylor executed Fidelity’s Employee Agreement in September of 1999. A copy of 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 2 of 40 PageID #:58
FP 37503689.3

Taylor’s September 1999 Agreement is attached as Exhibit C. Taylor renewed her promises by 

signing off on the Employee Agreement again on June 30, 2011. A copy of Taylor’s June 30, 

2011 Agreement is attached as Exhibit D. 

10. In her Employee Agreements, Taylor acknowledged the confidentiality of 

Fidelity’s records, including Fidelity’s customer lists and customer information, promised that she 

would not use or disclose that information for any reason other than performing her duties on 

behalf of Fidelity, and promised that he would “upon termination ... return all company property 

... including but not limited to Confidential Information.” Exhibits C-D, paragraphs 1, 3.

11. As consideration for these agreements Defendant executed, Fidelity hired, 

employed and promoted Defendant, compensated her throughout her employment, provided her

with introductory and continuing on-the-job training and education, and allowed her to access 

confidential customer information. In addition to assigning customers to Defendant to service, 

Fidelity also provides Financial Consultants, including the Defendant, with the resources to enable 

them to service customers at Fidelity, including support services, market reporting services, 

research, sales assistance, access to and use of experts in asset management, tax, estate planning 

and insurance, and all other requirements necessary to best perform their job for Fidelity’s 

customers. Fidelity also registered the Defendant with the New York Stock Exchange and 

Financial Industry Regulatory Authority (“FINRA”).

12. On Fidelity’s behalf, Taylor had repeated, regular communications with customers. 

As such, like all Financial Consultants, Taylor became the face of Fidelity to the customers she 

was assigned to service and, because of the nature of the interactions, became Fidelity’s direct link 

to these customers. Taylor’s misuse of Fidelity confidential customer information to unfairly 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 3 of 40 PageID #:59
FP 37503689.3

compete with Fidelity poses a serious risk to Fidelity’s retention of its business, as well as the 

confidence of its customers. 

13. On March 6, 2020, Taylor resigned from Fidelity, effective immediately, to join 

Fairhaven Wealth Management, LLC (“Fairhaven”), a direct competitor of Fidelity. A true and 

correct copy of her resignation letter is attached hereto as Exhibit E. 

14. At the time that Taylor resigned, she was sent a letter from Fidelity’s HR 

department reminding her of her post-employment obligations pursuant to her Employee 

Agreement and enclosing a copy of the Agreement. A copy of the March 14, 2020 letter is attached 

hereto as Exhibit F. 

15. Since Taylor resigned from Fidelity, we have been receiving reports that she – and 

representatives from her new firm acting on her behalf - have been soliciting Fidelity customers to 

transfer their business to Fairhaven. 

16. In fact, one client reported that Taylor solicited him, and set up an appointment for 

him to come meet with her at her new firm, before she even resigned. After Taylor resigned, 

Fidelity representatives were assigned to service the customers that were previously serviced by 

Taylor. In a meeting with the new Financial Consultant, the customer reported that during his last 

meeting with Taylor, while she was employed at Fidelity, she set up a meeting for him at her new 

firm. Taylor also told the client that he would be able to leave his assets at Fidelity but Taylor 

would be able to add her name to their account and provide financial advice. 

17. Another client reported to her new Financial Consultant that she received a call 

from the firm that Taylor joined and the person said that she was calling on Taylor’s behalf. The 

employee from Taylor’s new firm, Fairhaven, then asked the Fidelity client to consolidate her 

assets and transfer them to Taylor at her new firm. The client was not happy that someone called 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 4 of 40 PageID #:60
FP 37503689.3

her and wanted to make sure that Fidelity was aware that this was being done by Taylor and her 

new firm.

18. Other clients also reported to Fidelity that Taylor had been contacting them about 

doing business with her at her new firm. 

19. Accordingly, Fidelity’s in-house counsel sent Taylor a letter reminding her of her 

contractual obligations, enclosing a copy of her Employee Agreement, and demanding that she 

cease any further solicitation of Fidelity customers. Fidelity also enclosed an affidavit for her to 

sign attesting that she did not have, or had returned, any of its customer information. A copy of 

Fidelity’s March 20, 2020 letter to Taylor is attached as Exhibit G. 

20. Taylor never responded to the letter and never returned the signed affidavit. 

21. Fidelity has since learned that Taylor has continued to use Fidelity’s trade secret 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 5 of 40 PageID #:61
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 6 of 40 PageID #:62
EXHIBIT A

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 7 of 40 PageID #:63
Fidelity Enterprise Cybersecurity

Corporate Information Protection Policy

Securing Private and Proprietary Information (SP2I)

Published Date: 3/20/2020

Version: 9.4

Owners: Scott Sabens / Jim Robert / Michele Pittman

Last Review Date: 9/30/2019

Next Review Date: 9/30/2020

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 8 of 40 PageID #:64
Corporate Information Protection Policy

Fidelity Internal Information Page 2

Contents

I. Summary..................................................................................................................................................................1

Purpose...................................................................................................................................................................1

Scope ......................................................................................................................................................................1

II. Classifying Fidelity Information ..............................................................................................................................1

Fidelity Public Information (Public) ........................................................................................................................1

Fidelity Internal Information (Internal) ..................................................................................................................1

Fidelity Confidential Information (FC) ....................................................................................................................2

Fidelity Highly Confidential Information (FHC).......................................................................................................2

Changing Classification Levels................................................................................................................................2

Reviewing Assigned Classifications.........................................................................................................................2

III. Labeling Fidelity Information.................................................................................................................................2

Forms and Documents............................................................................................................................................2

Websites.................................................................................................................................................................2

Special Circumstances............................................................................................................................................2

Legally Privileged Communications....................................................................................................................2

Information with Mixed Classifications..............................................................................................................2

Unlabeled Information.......................................................................................................................................3

No Label Required..............................................................................................................................................3

Out of Scope Information...................................................................................................................................3

IV. Handling Fidelity Information ...............................................................................................................................3

Avoid Accidental Information Disclosure ...............................................................................................................3

Protect Information on Electronic Media and Portable Devices............................................................................4

Store Information Securely.....................................................................................................................................4

Confidential and Highly Confidential Information Only.....................................................................................4

Additional Precautions When Working Outside the Office................................................................................4

Encrypt Fidelity Information...................................................................................................................................5

Report Known or Suspected Information Loss or Disclosure.................................................................................5

Protect Personal Information.................................................................................................................................5

Secure Physical Devices Outside the Office............................................................................................................6

Hotel Rooms.......................................................................................................................................................6

While Traveling...................................................................................................................................................6

Personal Workspaces.........................................................................................................................................6

V. Disposing of Fidelity Information...........................................................................................................................6

VI. Vendor Use of Personal Information ....................................................................................................................6

VII. Information Protection Roles and Responsibilities..............................................................................................6

Managers................................................................................................................................................................6

Information Security Officers (ISOs).......................................................................................................................7

Information Owners...............................................................................................................................................7

VIII. Additional Resources...........................................................................................................................................7

IX. Contacts.................................................................................................................................................................7

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 9 of 40 PageID #:65
Corporate Information Protection Policy

Fidelity Internal Information Page 1

I. Summary

Purpose

You are responsible for classifying and labeling the Fidelity information you use or encounter. Proper 

information classification, labeling, and handling are integral to Fidelity's business. By following this policy, you 

help protect Fidelity from legal and financial liability as well as regulatory and reputational risk. 

Assigning the right classification is essential. A too-low classification puts sensitive information at risk. A too-high 

classification, while generally less damaging, can still be harmful since it restricts access and forces you and 

others to take excessive security precautions. If you think something is classified incorrectly, notify the person or 

office from whom you received the information. 

Applying this policy requires both knowledge and judgment on your part. In some cases, it may be appropriate 

to assign a higher classification than a document would otherwise receive. 

Fidelity Enterprise Cybersecurity (ECS) policy is intended to protect the firm in an evolving threat landscape, 

regardless of changes in technology or business practices. Even if specific terminology or scenarios are not part 

of the text, it is expected that you will exercise sound reasoning and judgment to adhere to the intent of stated 

requirements, practices, and implementations in both letter and spirit.

Your business unit (BU) may have additional requirements concerning information security. Understanding and 

following them is your responsibility. Ask your manager or your BU's Information Security Officer (ISO). Some 

non-U.S. companies may have their own versions of this policy; be aware of potential policy differences when 

working with companies in other countries.

Scope

This policy applies to the Fidelity workforce as defined in the Employee Classification Definitions document.

II. Classifying Fidelity Information

You are responsible for making sure that Fidelity Information is accurately labeled with the correct classification. 

Even if a document is already labeled, make sure the classification is correct. Fidelity information must be 

assigned one of the four classifications described below. Classification levels are based on risks to business 

operations and business reputation and the potential for financial loss to Fidelity, associates and customers. For 

examples of each classification, see the Information Protection (SP2I) Policy Quick Reference. 

Fidelity Public Information (Public) 

Public information is intended for general circulation inside and outside Fidelity. Public circulation of the 

information would not expose Fidelity to any reputational risk, financial loss, or competitive disadvantage.

Items classified as Public do not require a SP2I label (although they can be labeled if desired) and they do not 

require any special handling. You must get approval before classifying any information as Public. 

• For marketing materials and items distributed to customers, use the process approved for your BU (e.g., 

eReview) 

• For presentations, publications, and speeches, consult the Global External Communications Policy

• For other items, contact Corporate Legal

Fidelity Internal Information (Internal) 

Fidelity internal information is intended for relatively unrestricted circulation inside Fidelity during the normal 

course of business, including, as appropriate, consultants, vendors, or temporary workers.

Unauthorized access, disclosure, use, or tampering could have a minor adverse effect on the confidentiality or 

integrity of the information, or could otherwise cause minor impact to Fidelity, Fidelity associates or customers.

Within the Internal Information category, computer source code may require more protective measures than 

other types of information. See Protection of Source Code in the Secure Software Development Lifecycle (SSDLC) 

Standard.

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 10 of 40 PageID #:66
Corporate Information Protection Policy

Fidelity Internal Information Page 2

Fidelity Confidential Information (FC) 

Fidelity confidential information is Intended for individuals and groups with a business need to know. 

Unauthorized access, disclosure, use, or tampering could have a moderate adverse effect on information 

confidentiality or integrity, or could otherwise moderately impact Fidelity, our associates, or our customers.

Fidelity Highly Confidential Information (FHC) 

Fidelity highly confidential information is data that, if compromised, may have a severe impact on Fidelity, its 

customers, vendors or employees. Unauthorized access, disclosure, use, or tampering could have a severe

adverse effect on information confidentiality or integrity or could otherwise severely impact Fidelity, our 

associates, or our customers.

Within the Highly Confidential category, some types of information require more protective measures than 

others. 

Changing Classification Levels

Sometimes information needs to be reclassified. For example, a product announcement might be Highly 

Confidential while in development, but Public once it is released. Make sure the information owner approves 

any reduction in classification level. Anything classified as Public requires necessary approvals described in this 

policy. 

Reviewing Assigned Classifications

Information owners should periodically review the risk classifications of resources for which they are 

responsible, to ensure that the assigned classification levels are still appropriate. 

III. Labeling Fidelity Information

Label Fidelity information under your control. Use the full label text for the classification: 

• Fidelity Internal Information 

• Fidelity Confidential Information 

• Fidelity Highly Confidential Information 

If you are in doubt as to the correct label text, contact your ISO. Except as noted, Fidelity information must be 

clearly labeled with an SP2I classification, as follows: 

Forms and Documents 

These requirements apply to both hardcopy and electronic formats:

• Frequency: every page or slide, including cover/title page 

• Preferred location: header or footer 

• Forms are labeled according to the contents included in the completed form. 

Websites

• Frequency: every page, including home page 

• Preferred location: header or footer 

Special Circumstances

Legally Privileged Communications 

Any print and electronic materials with information that may be protected by attorney-client privilege must be 

labeled “Attorney-Client Communication” in addition to the SP2I classification label. 

Information with Mixed Classifications

When information of different classifications is combined, the resulting materials must be classified and handled 

according to the most restrictive classification.

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 11 of 40 PageID #:67
Corporate Information Protection Policy

Fidelity Internal Information Page 3

Unlabeled Information 

If you encounter Fidelity information that appears to require an SP2I label but does not have one, add the 

correct label or contact the information owner and request them to do so. 1

No Label Required

No SP2I label is required on the following: 

• Materials approved for classification as Public 

• Materials intended for end customer use (such as account statements) 

• Participant reports and other client data requested by clients or intended for their use; however, 

alternative labeling may be required if a client has requested it 

• Materials received from end customers

• Vendor or other third-party information already labeled by the vendor or other source 

• Information stored or handled by legacy applications and systems that lack the capacity for SP2I labeling 

• Non-business information 

Out of Scope Information

Information that does not concern Fidelity business in any way (e.g., an email to a family member about 

childcare arrangements) is considered non-Fidelity information and falls outside the scope of this policy. 

IV. Handling Fidelity Information

Proper handling depends on the information’s classification and labeling. The following rules outline both 

general and specific methods for using, storing, transmitting, and reproducing information. Rules in this section 

that apply only to Confidential and Highly Confidential Information are identified as such. 

Avoid Accidental Information Disclosure

With every Fidelity information classification other than Public, follow these precautions: 

• Keep discussions behind closed doors when possible. Use caution when discussing information in public 

places such as restaurants or elevators.

• Be aware of who or what is within earshot. Unauthorized listeners or devices (e.g., Amazon Echo, Google 

Home, and cell phones) may be present at any given time, even in an office environment. 

• Erase whiteboards when leaving conference rooms or open spaces.

• Limit distribution to those who need to know. Keep access and distribution to the smallest set of recipients 

possible without eliminating necessary or appropriate recipients. Review addressees (both on email and 

physical mail) prior to distributing information. The more sensitive the information, the more restricted the 

distribution list should be.

• Outside Fidelity, share information with qualified parties only. Do not share information with vendors or 

other external parties unless you are sure that they already have an established relationship with Fidelity 

and are subject to a non-disclosure agreement (NDA) or are otherwise restricted from disclosing the 

information to others. An NDA is required2 if sharing data for contract negotiation purposes, proof of 

1 Any Fidelity company that is not known to a customer as “Fidelity” (e.g., Devonshire Investors – Diversified Investments) 

may substitute its company name in place of Fidelity in the label. 2 The requirement regarding being bound by an NDA, contract, or other obligation of confidentiality may not apply in 

certain cases: 

(a) if Fidelity is legally obligated to provide non-public Fidelity information to an external party –in these situations, 

consult with Legal; 

(b) for Corporate Policies and similar non-public Fidelity information, if reasonable assurance exists that the recipient will 

restrict distribution to those with a business–related or legal “need to know” (e.g., applicable corporate policies may be 

provided in response to a request from a former employee, or requests from or proposals to business partners, clients, or 

prospects). Contact HR Solutions/Employee Relations at (800) 835-5099, Option 2 for questions on external party access 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 12 of 40 PageID #:68
Corporate Information Protection Policy

Fidelity Internal Information Page 4

concept demonstrations based on a request for proposal (RFP), source code sharing for pilot projects, and 

pre-contract due diligence reviews. If a vendor will have access to personal information, make sure that a 

Fidelity Vendor Technology Risk (VTR) assessment has been performed and that the vendor has a contract 

(not just an NDA) in place with appropriate confidentiality and data security obligations. See the Corporate 

Policy on Vendor Privacy Oversight. 

• Never share passwords and never store passwords (on paper or electronically) where someone could find 

and use them.

• Be careful when printing or copying. Use one of the following: 

o Internal printer 

o Approved print service (internal or external) 

o Personally, supervise printing on other printers (such as at home or while traveling) 

Don’t let sensitive information lie unattended in fax machines, printers, or copier trays and don’t forget to take 

your originals with you. Securely dispose of any unwanted copies. 

Don’t print Highly Confidential information unless you have a business need and are authorized to do so.

Note: Incidental and occasional use of Fidelity resources to print your own personal information, such as tax 

statements or performance reviews, is acceptable. 

Don’t leave Fidelity Information, including Confidential or Highly Confidential Information, unsecured in your 

workspace. This includes your assigned desk, unassigned desk, common/shared areas, and conference rooms. 

Don’t photograph or make video recordings of Confidential or Highly Confidential information displayed on 

computer screens. 

Protect Information on Electronic Media and Portable Devices

Employees who use electronic media (such as CDs and USB devices) or portable electronic devices (such as 

laptops and PDAs) are responsible for the security of the Confidential and Highly Confidential Information 

contained on them. Because it can be difficult to know whether electronic media or devices contain such 

Information, always treat electronic media and devices as if they contain Highly Confidential Information. Make 

these steps part of your routine: 

• Keep electronic media on your person or in sight while traveling or any other time they cannot be 

physically secured.

• Secure electronic media in a locked drawer or locked office when they are not in your immediate 

possession.

• Secure laptops outside Fidelity facilities. 

Related requirements for Fidelity mobile devices are detailed in the Global Policy on Electronic Communications, 

Social Media, and Systems Usage. 

Store Information Securely 

Confidential and Highly Confidential Information Only

For Confidential and Highly Confidential Information, store hard copies in a locked office, filing cabinet, or other 

facility accessible only to authorized individuals. Information on websites, file servers, or approved document 

repository services (e.g., EDMS, SharePoint) must be protected by access controls. 

Highly Confidential Information must remain within Fidelity premises unless there is a specific business reason 

for it to circulate or be transported outside Fidelity.

Additional Precautions When Working Outside the Office 

When working at home or at another remote location, safeguard Fidelity media as carefully as you would in the 

office or when traveling. Make sure no one else in your location can access Fidelity information. Use security 

to Corporate Policies. Contact Procurement for NDAs and questions on external party access for business purposes at 

http://spendsmart.fmr.com

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 13 of 40 PageID #:69
Corporate Information Protection Policy

Fidelity Internal Information Page 5

controls outlined in the Flexible Work Options Policy for guidance. Save non-public Fidelity information only to 

approved media, devices and systems in accordance with the Global Policy on Electronic Communications, Social 

Media, and Systems Usage. 

Local Administrator rights on Fidelity devices and systems are restricted to reduce the likelihood of introducing 

viruses or malware into the Fidelity network. Downloading software and adding printers or other peripheral 

devices outside the office must be coordinated with Techworks or a local IT contact. 

Encrypt Fidelity Information

Refer to the encryption information on the Email Security page or consult with your BU’s ISO for current 

supported email and file encryption tools. For system-to-system communications, data storage, and password

administration, system administrators should consult applicable ECS policy on the ECS Policy Website.

Encryption Guidelines for Confidential and Highly Confidential Information 

Where BUs have determined a technology solution to be effective and acceptable to external entities with which 

Fidelity information is shared, use encryption for:

• PINs and passwords that are being transmitted or stored

• Confidential or Highly Confidential Information stored on removable media

• Any transmission, including email, of Confidential or Highly Confidential Information outside the Fidelity 

network

• Fidelity employee compensation and performance data that is being emailed, whether within Fidelity or 

externally

You must use only Fidelity-approved encryption methods. To select an appropriate encryption tool, see the list 

of approved encryption technologies in the Encryption Standard.

Encryption Guidelines for Cloud (IaaS/PaaS/CaaS) Information

Where BUs have determined an IaaS/PaaS/CaaS solution to be effective and acceptable for external entities 

with which Fidelity information is shared, comply with the following encryption requirements:

• Data-in-transit – Encrypt at all times in the IaaS/PaaS/CaaS using Fidelity-managed or approved third-partyissued certificates (e.g., Akamai or Entrust)

• Data-at-rest – Encrypt at all times in the IaaS/PaaS/CaaS using Fidelity-managed keys 

• BU’s must work within defined encryption guardrails for certified services depending on the data 

classification. Data protection requirements for each service can be found in the configuration guide for 

that service.

Where IaaS/PaaS/CaaS encryption services provided are not adequate, BU’s must use client-side encryption.

Report Known or Suspected Information Loss or Disclosure

Notify your ISO or Corporate Security of any known or suspected information loss or disclosure. This includes 

cases of access by unauthorized parties as well as circumstances that might have allowed such access (e.g., 

sending an unencrypted email containing Confidential or Highly Confidential Information). Report incidents 

immediately. 

Protect Personal Information 

The Fidelity workforce has a duty to protect personal information. For this policy, personal information is 

considered Highly Confidential. This includes lists containing customer information. Exceptions to some handling 

requirements for personal information may be warranted by context or circumstance. Consult with the 

information owner, your manager, and ISO for guidance regarding appropriate handling, disposal, and other 

controls. Use sound judgment and assess risk when working with personal information. 

Some employee personal information, such as business contact information and employee photos, is considered 

Internal. To find out which employee personal information is considered Internal Information, see the Global 

Employee Personal Information Privacy Notice & Policy.

Additional legal requirements may apply to personal information transmitted to or from other countries or 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 14 of 40 PageID #:70
Corporate Information Protection Policy

Fidelity Internal Information Page 6

global regions (such as the European Union). Check with Compliance or Corporate Legal.

For logging and masking personal information before use in a test environment, see the Database Standard and 

Secure Software Development Lifecycle (SSDLC) Standard.

Secure Physical Devices Outside the Office

Hotel Rooms

When travel includes a hotel stay, Fidelity associates must take reasonable precautions to prevent theft or loss, 

such as cable-locking devices or storing them in room safes. 

While Traveling

Fidelity associates must take reasonable precautions to prevent theft or loss of devices and data while traveling: 

• Keep laptops or devices securely in hand or within sight when they cannot be physically secured.

• Do not check mobile devices as luggage unless directed to do so by the airline and/or as a result of a 

government directive. If not required to check an item, it should remain in your possession as hand 

luggage.

• If you are not allowed to keep the device in your possession, power it off before checking it through to your 

destination. See the section on Encryption on Mobile Devices and Portable Media in the Encryption 

Standard for additional guidance.

• If you must leave a laptop or device in a vehicle, shield the device from view (e.g., stow it in the trunk) and 

lock the vehicle.

Personal Workspaces

Access to Fidelity-owned devices at your home office or other personal workspace must be limited to yourself. 

Family members, friends, and other non-Fidelity personnel are not allowed to use your Fidelity devices.

V. Disposing of Fidelity Information

Fidelity information must be disposed of at the right time and in the right way with the following in mind: 

• Applicable record retention requirements 

• Whether the information is subject to a legal hold (documents subject to a legal hold must not be altered 

or destroyed) 

• SP2I classification 

• Type of media or device involved

• BU-specific processes

For more information about disposal practices at Fidelity, see the Information and Device Disposal TIG.

VI. Vendor Use of Personal Information 

Fidelity vendors with access to personal information must meet Fidelity’s standards for protecting such 

information. Providing such information to a new vendor or vendor not currently receiving personal data prior 

to a completed Vendor Technology Review (VTR) (based on requirements and permissible exclusions as 

established in VTRs) is not allowed. A contract that obligates a vendor to maintain personal information 

confidentiality and security must be in place prior to providing such information to the vendor, including 

employee information classified as internal. 

VII. Information Protection Roles and Responsibilities

Managers

Managers communicate, support, and help enforce the policy. Managers are responsible for understanding this 

policy and helping communicate and enforce its terms. Managers should contact HR Solutions (or their local 

equivalent) to determine how best to address violations. 

Managers take responsibility for proper information handling by departing employees. When an employee 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 15 of 40 PageID #:71
Corporate Information Protection Policy

Fidelity Internal Information Page 7

terminates, transfers, or relocates, their manager ensures that the employee disposes of documents and 

materials in accordance with this policy. Any tasks left undone by the departing employee are the manager’s 

responsibility to rectify.

Information Security Officers (ISOs)

ISOs interpret and administer the policy at the BU level. They are responsible for translating policy into specific 

controls that are appropriate and effective for their respective BU’s. 

ISOs are responsible for helping their assigned BU implement enterprise security programs related to this policy. 

They are also expected to guide and assist individual employees with policy understanding and compliance. 

Information Owners 

Information owners periodically review data classifications. Information and application owners periodically 

review risk classifications of resources for which they are responsible to ensure appropriateness of the assigned 

classification level. 

Information owners may delegate their responsibilities; however, accountability remains with the information 

owner. Information owner responsibilities include: 

• Mandating information security policy and control implementation

• Authorizing and periodically reviewing access entitlements 

• Ensuring resolution of information security-related audit issues 

• Delegating authority as required within their business area to complete tasks 

• Periodically reviewing information classifications of resources under their control 

• Maintaining an inventory of information resources (e.g., data, hardware, software) under their control 

VIII. Additional Resources

Fidelity offers information protection training courses for new associates as well as a refresher course that all 

associates must take each year.

Information Protection eLearning Course for New Associates

Information Protection eLearning Annual Assessment

IX. Contacts

Please contact the document owner, your manager, or your ISO with any questions related to this policy. 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 16 of 40 PageID #:72
EXHIBIT B

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 17 of 40 PageID #:73
Information Protection Policy (SP2I) Quick Reference

Classify and Label

CLASSIFICATION

Public

Information released for public use.1 

Explicit approval is needed before 

assigning this classification.

Fidelity Internal

Information that is typically available 

to all Fidelity employees.

Fidelity Confidential

Sensitive information, available only 

to those with a business “need-toknow.”

Fidelity Highly Confidential (HC)

High-risk information that requires 

strict controls.

Label Optional. Examples include: Label Required. Examples include: Label Required. Examples include Label Required. Examples include:

• Brochures, published marketing 

materials

• Press releases

• Articles in the press

• Public websites

• Stock quotes

• Regulatory and legal filings

• Published annual reports

• Published fund prospectuses

• Code contributed to Open Source

• Released patents

1 Note that Public Information may have a 

different classification prior to its release.

• Employee contact information (for 

example, name or email)

• Organization charts

• Basic emergency response plans

• Fidelity policies and procedures

• Fidelity Central and internal 

newsletters

• Employee web/intranet portals

• Fidelity training materials

• General business correspondence 

with no customer/employee data

• Unreleased fund holdings/trades

• Grant information

• Account numbers

• Customer employee ID

• Plan/client data

• Pre-release marketing materials 

• Non-public legal work and litigation 

information

• Budget information and non-public 

financial statements

• Business strategies and plans

• Purchasing/bid information

• Audit reports

• Security findings or reports (e.g., 

SOC-1)

• Most Fidelity source code (see 

Source Code Quick Reference for 

details)

• Non-security technical

specifications/architectures

• External IP addresses

• Money movements

• Systematically generated IDs (e.g., 

Member IDs (MIDs) and Workplace 

IDs (WIDs))

• Passwords and PINs

• System credentials

• Social Security Numbers

• Customer personally identifiable 

information (PII) (e.g., name with 

external IP address, email, phone 

number, HR data, HIPAA data or 

account number)

• Credit card numbers

• Compensation data

• Performance reviews

• Proposed acquisitions, ventures, and 

divestitures

• Security system architectures and 

procedures

• Reports of significant exposures, risk 

assessments, and penetration test 

results

• Highly sensitive legal work

• Management committee reports

• Trade secrets

• Private encryption keys

Know the policy- For more SP2I resources and

the full SP2I policy, visit ECS on Fidelity Central

Effective Date: June 2019

Seek guidance-If you have questions or concerns 

about SP2I, or if you know of items that are out of 

compliance, please contact your manager or your 

business unit’s Information Security Office.

Use sound judgment-The lists above are only 

examples, not definitive classifications. Any item 

containing customer data, security information,

prelaunch new product details, or similar sensitive 

information should be classified as Fidelity Highly 

Confidential.

Fidelity Internal Information

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 18 of 40 PageID #:74
Information Protection Policy (SP2I) Quick Reference

Handle and Dispose CLASSIFICATION

Public Fidelity 

Internal

Fidelity

Confidential

Fidelity Highly Confidential (HC)

All Other 

HC

Personal 

Information1

Employee 

Data2

PINs/ 

Passwords

Handle

Get approval before assigning classification 

Do not share outside Fidelity (such as with vendors or 

contractors) except on a need-to-know basis and when 

the recipient is restricted from disclosing the 

information to others

     

Use caution when discussing in public      

Report possible or actual loss immediately to 

the ISO or Corporate Security      

Encrypt when sending or transporting outside 

Fidelity3     

Inside Fidelity, share only on a need-to-know basis     

Do not leave unsecured on copiers/printers or in any 

workspace, including offices, assigned/unassigned desks, 

common/shared areas, and conference rooms

   

Limit access even on internal websites and systems    

Do not remove from Fidelity premises without a 

specific business requirement   

Encrypt when emailing inside Fidelity3

Strongly Recommended 

Never share with anyone, and never carry with the 

related device 

Dispose

Place in desk-side/shared recycling (paper only)   

Personally shred (paper only) Optional Optional     

Place in locked Fidelity recycling container (paper) or 

turn in to local Security Office (removable media)       

1 See policy for complete definition. 2 Fidelity employee compensation and performance data only. 3 See the policy for detailed guidance.

Fidelity Internal Information

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 19 of 40 PageID #:75
EXHIBIT C

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 20 of 40 PageID #:76
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 21 of 40 PageID #:77
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 22 of 40 PageID #:78
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 23 of 40 PageID #:79
EXHIBIT D

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 24 of 40 PageID #:80
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 25 of 40 PageID #:81
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 26 of 40 PageID #:82
EXHIBIT E

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 27 of 40 PageID #:83
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 28 of 40 PageID #:84
EXHIBIT F

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 29 of 40 PageID #:85
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 30 of 40 PageID #:86
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 31 of 40 PageID #:87
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 32 of 40 PageID #:88
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 33 of 40 PageID #:89
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 34 of 40 PageID #:90
EXHIBIT G

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 35 of 40 PageID #:91
Meredith A. Faro FMR LLC Legal Department

Attorney 

 155 Seaport Blvd, ZW9A, Boston, MA 02110 

Phone: (617) 392-8136 Fax: (617) 850-8335 

 meredith.faro@fmr.com

March 20, 2020 

Via Overnight Delivery 

Jennifer Taylor 

606 Prairie Ave. 

Glen Ellyn, IL 60137 

Dear Ms. Taylor: 

It has come to our attention that after you left your position as Financial Consultant in Fidelity 

Brokerage Services LLC’s Oak Brook, IL Branch, you accepted a position with Fairhaven 

Wealth Management, LLC. 

Fidelity has reason to believe that you may be contacting Fidelity customers for the purpose of 

soliciting their business. The Employee Agreement (“the Agreement”) you signed while in 

Fidelity’s employ (copy attached) prohibits such solicitation of Fidelity’s customers. This letter 

constitutes a formal demand that any such activity cease immediately. Furthermore, all of 

Fidelity’s customer and prospect lists and all information concerning Fidelity’s customers, 

including names, addresses, telephone numbers, email addresses and account information, are 

confidential and proprietary. Pursuant to the Agreement and general principles of law, you are 

obligated to maintain all of Fidelity’s confidential and proprietary information in strictest 

confidence. This includes information that you have in your memory. You may not disclose this 

information or make any use of it for yourself or for others, including your present or future 

employers. 

Please return to Fidelity any confidential or proprietary information belonging to Fidelity in your 

possession, such as records, electronic data, computer files, lists, screen prints, or computer discs 

pertaining to Fidelity clients or individuals or entities you became aware of through your 

employment at Fidelity, including but not limited to names, phone numbers, addresses and/or 

email addresses, whether in original, copied, computerized, handwritten or any other form. To 

the extent these exist in electronic form, you must not delete it or alter it in any way, but instead 

must refrain from using it, accessing it or transferring it to anyone, and you must contact us or 

have your counsel contact us to coordinate its preservation as evidence, and its return to us, in a 

forensically sound manner. It is important to understand that deleting or altering such

electronically stored information without taking forensically sound steps to preserve it will be 

viewed as intentional destruction of evidence, and there can be serious sanctions that result from 

such destruction. Please verify that you have complied in full as set forth above by signing the 

enclosed affidavit and returning it to me by Monday, March 30, 2020. 

Also, as a condition of your employment with Fidelity, you were obligated to comply with 

Fidelity’s Compliance Policy for Electronic Communications, Social Media and Systems Usage 

(the “Social Media Policy”). Pursuant to the Social Media Policy, you were strictly prohibited 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 36 of 40 PageID #:92
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 37 of 40 PageID #:93
AFFIDAVIT OF JENNIFER TAYLOR 

JENNIFER TAYLOR, being first duly sworn, states as follows: 

1. My name is Jennifer Taylor and I am over the age of 18. Except where otherwise indicated, 

the statements contained herein are based on my personal knowledge. I was employed by Fidelity 

Brokerage Services LLC (“Fidelity”) until my employment ended effective March 6, 2020. 

2. I hereby state that I do not have in my possession, custody or control customer lists 

(including any Christmas or holiday card or gift mailing lists), records, electronic data, computer 

files, or documents pertaining to Fidelity clients or prospective clients I worked with or became 

aware of through my employment at Fidelity, including but not limited to names, phone numbers, 

addresses and/or e-mail addresses, whether in original, copied, computerized, handwritten, 

photographed, maintained on an iPhone or iPad or other personal device, or any other form. This 

includes any documents created either during or after I left my employment with Fidelity that 

contain information pertaining to Fidelity clients or prospective clients that I worked with or 

became aware of through my employment at Fidelity, including information recreated through the 

use of memory, or by using information in memory to recreate information from public sources. To 

the extent I had any such information in hard copy, I have returned the hard copy documents to 

Meredith Faro, along with this affidavit. To the extent I had any such information in an 

electronically stored format, I or my counsel has engaged with Fidelity’s counsel to arrange for 

forensically sound preservation, prior to removal, return to Fidelity and deletion from my 

possession, of any such electronically stored information. 

3. I have not given any of the above documents or information or copies thereof to any other 

person or entity. 

Pursuant to 28 USC §1746, I declare under penalty of perjury under the laws of the United States of 

America that the foregoing is true and correct. 

Executed on , 2020 

 Jennifer Taylor 

Sworn to and subscribed before me 

this ____ day of _____________, 2040 

_____________________________ 

Notary Public 

Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 38 of 40 PageID #:94
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 39 of 40 PageID #:95
Case: 1:20-cv-02133 Document #: 5-1 Filed: 04/03/20 Page 40 of 40 PageID #:96