Document ID: SEC-2014-0345-0001
Agency: sec
Document Type: Notice
Title: Self-Regulatory Organizations; Proposed Rule Changes: Financial Industry Regulatory Authority, Inc.
Posted Date: 2014-02-28T05:00Z

[Federal Register Volume 79, Number 40 (Friday, February 28, 2014)]
[Notices]
[Pages 11491-11494]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2014-04435]

-----------------------------------------------------------------------

SECURITIES AND EXCHANGE COMMISSION

[Release No. 34-71608; File No. SR-FINRA-2014-008]

Self-Regulatory Organizations; Financial Industry Regulatory 
Authority, Inc.; Notice of Filing of Proposed Rule Change Relating to 
Protecting Personal Confidential Information in Documents Filed With 
FINRA Dispute Resolution

February 24, 2014.
    Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 
(``Act'') \1\ and Rule 19b-4 thereunder,\2\ notice is hereby given that 
on February 13, 2014, Financial Industry Regulatory Authority, Inc. 
(``FINRA'') filed with the Securities and Exchange Commission (``SEC'' 
or ``Commission'') the proposed rule change as described in Items I, 
II, and III below, which Items have been prepared substantially by 
FINRA. The Commission is publishing this notice to solicit comments on 
the proposed rule change from interested persons.
---------------------------------------------------------------------------

    \1\ 15 U.S.C. 78s(b)(1).
    \2\ 17 CFR 240.19b-4.

---------------------------------------------------------------------------

[[Page 11492]]

I. Self-Regulatory Organization's Statement of the Terms of Substance 
of the Proposed Rule Change

    FINRA is proposing to amend the Code of Arbitration Procedure for 
Customer Disputes (the ``Customer Code'') and the Code of Arbitration 
Procedure for Industry Disputes (the ``Industry Code'') to provide that 
any document that a party files with FINRA that contains an 
individual's Social Security number, taxpayer identification number, or 
financial account number must be redacted to include only the last four 
digits of any of these numbers. The proposed amendments would apply 
only to documents filed with FINRA. They would not apply to documents 
that parties exchange with each other or submit to the arbitrators at a 
hearing on the merits. In addition, the amendments would not apply to 
cases administered under Rule 12800 of the Customer Code and Rule 13800 
of the Industry Code (collectively, the ``Simplified Arbitration 
rules'').\3\
---------------------------------------------------------------------------

    \3\ Rules 12800 and 13800 apply to arbitrations involving 
$50,000 or less, exclusive of interest and expenses.
---------------------------------------------------------------------------

    The text of the proposed rule change is available at the principal 
office of FINRA, on FINRA's Web site at http://www.finra.org, and at 
the Commission's Public Reference Room.

II. Self-Regulatory Organization's Statement of the Purpose of, and 
Statutory Basis for, the Proposed Rule Change

    In its filing with the Commission, FINRA included statements 
concerning the purpose of and basis for the proposed rule change and 
discussed any comments it received on the proposed rule change. The 
text of these statements may be examined at the places specified in 
Item IV below. FINRA has prepared summaries, set forth in sections A, 
B, and C below, of the most significant aspects of such statements.

A. Self-Regulatory Organization's Statement of the Purpose of, and 
Statutory Basis for, the Proposed Rule Change

1. Purpose
    During an arbitration proceeding, parties submit pleadings and 
supporting documents to FINRA Dispute Resolution (``DR'') that may 
contain an individual's Social Security number, taxpayer identification 
number, or financial account number (``personal confidential 
information'' or ``PCI''). Since FINRA employees are regularly exposed 
to PCI as they handle party documents, FINRA has procedures in place to 
guide staff on how to keep confidential information safe. FINRA 
maintains an Information Privacy and Protection Policy (``Policy''), 
and administers Information Privacy and Protection Training to all 
FINRA staff annually. In addition to the Policy, DR has its own 
detailed procedures for protecting confidential information relating 
to, among other matters, storage and disposal of case materials in a 
manner that preserves the confidentiality of the information, and 
removal of PCI that appears in awards that will be publicly 
available.\4\
---------------------------------------------------------------------------

    \4\ FINRA keeps all documents and information in DR case files 
confidential except for arbitration awards. FINRA publishes every 
award in the Arbitration Awards Online Database on FINRA's Web site.
---------------------------------------------------------------------------

    DR procedures also provide staff with guidance on what arbitrators 
and mediators can do to protect confidential information. For example, 
DR requires arbitrators and mediators to keep confidential all 
information obtained in connection with an arbitration or mediation and 
to participate in FINRA training programs on information security.
    In 2010, FINRA published a Notice to Parties \5\ (``Notice'') 
stating that parties and their counsel should take steps to protect 
confidential information. The Notice states that parties can safeguard 
confidential information by redacting such information from 
pleadings,\6\ exhibits, and other documents upon agreement of the 
parties. For example, the parties may agree not to use, or to redact, 
Social Security, account, or driver license numbers. Where parties must 
reference such data, they may use only the last few digits of the 
numbers or similar information. While these efforts have enhanced the 
security of party documents and information, parties continue to file 
with DR pleadings and attachments containing PCI. For example, 
customers often file account opening documents and account statements 
that show their account numbers.
---------------------------------------------------------------------------

    \5\ http://www.finra.org/ArbitrationAndMediation/Arbitration/Rules/NoticestoArbitratorsParties/NoticestoParties/P123999.
    \6\ A pleading is a statement describing a party's causes of 
action or defenses. Documents that are considered pleadings are: A 
statement of claim, an answer, a counterclaim, a cross claim, a 
third party claim, and any replies.
---------------------------------------------------------------------------

    As a service to forum users, DR serves certain pleadings on other 
parties to an arbitration matter. The parties are responsible for 
providing DR with addresses for service. The greatest risk of DR staff 
misdirecting PCI occurs when DR staff serves pleadings on a party 
(e.g., an associated person of a member who has not updated his or her 
Central Registration Depository record) at an incorrect/outdated 
address. In addition, DR provides the arbitrators with pleadings and 
attachments. On occasion, arbitrators have misplaced parties' pleadings 
containing PCI.
    In an effort to protect parties from identity theft and the 
accidental loss of PCI, FINRA is proposing to amend the Customer Code 
and the Industry Code to require parties to redact specified PCI from 
documents they file with FINRA. FINRA is proposing to amend Rules 12300 
(Filing and Serving Documents) and 12307 (Deficient Claims) of the 
Customer Code and Rules 13300 (Filing and Serving Documents) and 13307 
(Deficient Claims) of the Industry Code as described below. For ease of 
reading, the description below only refers to Rules 12300 and 12307 of 
the Customer Code. The proposed amendments to Rules 13300 and 13307 of 
the Industry Code are identical and FINRA's rationale is the same.
    FINRA is proposing to amend Rule 12300 to provide that, in an 
electronic or paper filing with FINRA, any document that contains an 
individual's Social Security number, taxpayer identification number, or 
financial account number must be redacted to include only the last four 
digits of any of these numbers. The rule would specify that a party 
shall not include full numbers. If FINRA receives a claim,\7\ including 
supporting documents, with a full Social Security, taxpayer 
identification, or financial account number, FINRA would deem the 
filing deficient under Rule 12307 and would request that the party 
refile the document, without the PCI, within 30 days. If a party files 
a document with PCI that is not covered by Rule 12307 (a document other 
than a claim, such as a motion), FINRA would deem the filing to be 
improper and would request that the party refile the document, with the 
required redaction, within 30 days. If the party refiles the document 
within 30 days in compliance with the rule, FINRA would consider the 
document to be filed on the date the party initially filed it with 
FINRA.
---------------------------------------------------------------------------

    \7\ The term ``claim'' means an allegation or request for relief 
and includes counterclaims, cross claims and third party claims.
---------------------------------------------------------------------------

    The proposed rule change would include two exemptions--one for 
documents that parties exchange with each other or submit to the 
arbitrators at a hearing on the merits, and one for cases administered 
under the Simplified Arbitration rules. As explained above, FINRA's 
greatest risk of misdirecting PCI occurs when DR staff is transmitting 
pleadings and documents to parties and

[[Page 11493]]

arbitrators. Therefore, FINRA is proposing to exempt documents that 
parties exchange with each other or submit as exhibits during a hearing 
to reduce the burden of the new requirements. The parties can agree to 
measures to protect PCI in documents they share or use at a hearing and 
DR staff would not be at risk of transmitting PCI. FINRA is less 
concerned about exhibits produced by parties at hearings because 
parties only bring hard copies of exhibits to a hearing, as opposed to 
transmitting them via email, and can safely dispose of them by using 
secure shredding services. FINRA believes this is a balanced approach 
to protecting PCI that would minimize the burden on parties.
    The second exemption relates to claims administered under the 
Simplified Arbitration rules. Generally, a single arbitrator decides 
these claims based solely on the parties' written submissions. Many 
claimants who initiate a claim under the Simplified Arbitration rules 
are not represented by counsel (i.e., they are pro se parties). FINRA 
believes that the redaction requirements in the proposed rule change 
may prove difficult for pro se parties to handle because they are not 
familiar with the practice of redacting documents. Therefore, FINRA 
proposes to exempt from this rule all claims administered under the 
Simplified Arbitration rules.
    FINRA is proposing to make conforming changes to Rule 12307. FINRA 
would amend Rule 12307(a) to add an item to the list of deficiencies 
enumerated in the rule--that the claim does not comply with the 
restrictions on filings with PCI under Rule 12300(g). FINRA is 
proposing to amend Rule 12307(c) to clarify that if a party corrects a 
deficiency in a counterclaim, cross claim or third party claim within 
30 days, FINRA will consider the document to be filed on the date the 
party initially filed the counterclaim, cross claim or third party 
claim with FINRA. FINRA would also amend Rule 12307(c) to correct a 
typographical error by deleting the word ``the'' (indicated by 
brackets) in the sentence that currently reads ``The Director will 
notify the party making the counterclaim, cross claim or third party 
claim of [the] any deficiencies in writing.''
2. Statutory Basis
    FINRA believes that the proposed rule change is consistent with the 
provisions of Section 15A(b)(6) of the Act,\8\ which requires, among 
other things, that FINRA rules must be designed to prevent fraudulent 
and manipulative acts and practices, to promote just and equitable 
principles of trade, and, in general, to protect investors and the 
public interest. FINRA believes that the proposed rule change would 
protect investors and the public interest because it would reduce the 
risk to forum users of identity theft. DR staff takes seriously its 
obligation to safeguard parties' PCI. However, because of the high 
volume of documents that DR staff handles and the manual process of 
transmitting documents, there continue to be risks to the security of 
an individual's personal information. FINRA believes that the best way 
to reduce the risk to forum users is to prohibit parties from 
submitting documents with PCI.
---------------------------------------------------------------------------

    \8\ 15 U.S.C. 78o-3(b)(6).
---------------------------------------------------------------------------

B. Self-Regulatory Organization's Statement on Burden on Competition

    FINRA does not believe that the proposed rule change will result in 
any burden on competition that is not necessary or appropriate in 
furtherance of the purposes of the Act. FINRA considered the potential 
burden on the parties of the proposed redaction requirement. FINRA 
believes that the potential benefits outweigh the potential burden. 
Currently, Rule 5.2 of the Federal Rules of Civil Procedure (Privacy 
Protection for Filings Made with the Court) allows parties filing 
documents in Federal Court to include only the last four digits of a 
Social Security number, taxpayer identification number, and financial 
account number. Rule 5.2's redaction requirement applies to all 
documents, including attachments. Since many party representatives are 
already accustomed to complying with a redaction requirement, and 
because the redaction requirement applies only to documents filed with 
DR and not to documents that the parties exchange with each other or 
submit to the arbitrators at a hearing on the merits, or to documents 
submitted pursuant to the Simplified Arbitration rules, FINRA believes 
that the additional burden to these representatives would be minimal. 
Further, FINRA member firms are required to protect PCI under federal 
laws such as Regulation S-P \9\ and already redact PCI in other 
contexts.
---------------------------------------------------------------------------

    \9\ Under Regulation S-P (17 CFR 248.1-248.30), the SEC adopted 
rules implementing notice requirements and restrictions on a 
financial institution's ability to disclose non-public personal 
information about consumers.
---------------------------------------------------------------------------

C. Self-Regulatory Organization's Statement on Comments on the Proposed 
Rule Change Received From Members, Participants, or Others

    Written comments were neither solicited nor received.

III. Date of Effectiveness of the Proposed Rule Change and Timing for 
Commission Action

    Within 45 days of the date of publication of this notice in the 
Federal Register or within such longer period (i) as the Commission may 
designate up to 90 days of such date if it finds such longer period to 
be appropriate and publishes its reasons for so finding or (ii) as to 
which the self-regulatory organization consents, the Commission will:
    (A) By order approve or disapprove such proposed rule change, or
    (B) institute proceedings to determine whether the proposed rule 
change should be disapproved.

IV. Solicitation of Comments

    Interested persons are invited to submit written data, views and 
arguments concerning the foregoing, including whether the proposed rule 
change is consistent with the Act. Comments may be submitted by any of 
the following methods:

Electronic Comments

     Use the Commission's Internet comment form (http://www.sec.gov/rules/sro.shtml ); or
     Send an email to rule-comments@sec.gov. Please include 
File Number SR-FINRA-2014-008 on the subject line.

Paper Comments

     Send paper comments in triplicate to Elizabeth M. Murphy, 
Secretary, Securities and Exchange Commission, 100 F Street NE., 
Washington, DC 20549-1090.

All submissions should refer to File Number SR-FINRA-2014-008. This 
file number should be included on the subject line if email is used. To 
help the Commission process and review your comments more efficiently, 
please use only one method. The Commission will post all comments on 
the Commission's Internet Web site (http://www.sec.gov/rules/sro.shtml 
). Copies of the submission, all subsequent amendments, all written 
statements with respect to the proposed rule change that are filed with 
the Commission, and all written communications relating to the proposed 
rule change between the Commission and any person, other than those 
that may be withheld from the

[[Page 11494]]

public in accordance with the provisions of 5 U.S.C. 552, will be 
available for Web site viewing and printing in the Commission's Public 
Reference Room, 100 F Street NE., Washington, DC 20549, on official 
business days between the hours of 10:00 a.m. and 3:00 p.m. Copies of 
such filing also will be available for inspection and copying at the 
principal office of FINRA. All comments received will be posted without 
change; the Commission does not edit personal identifying information 
from submissions. You should submit only information that you wish to 
make available publicly. All submissions should refer to File Number 
SR-FINRA-2014-008 and should be submitted on or before March 21, 2014.

    For the Commission, by the Division of Trading and Markets, 
pursuant to delegated authority.\10\
---------------------------------------------------------------------------

    \10\ 17 CFR 200.30-3(a)(12).
---------------------------------------------------------------------------

Kevin M. O'Neill,
Deputy Secretary.
[FR Doc. 2014-04435 Filed 2-27-14; 8:45 am]
BILLING CODE 8011-01-P