Computer hacking seems to be a daily fact of life. Since most plan information is stored electronically, hacking presents a vulnerability that fiduciaries can’t ignore. For example, if hackers were to gain access to participant social security numbers or account balances, they could steal the money or a participant’s identity. And the plan would be liable.

This is a fiduciary issue because of a DOL regulation that says fiduciaries need to protect participant information by taking

“[A]ppropriate and necessary measures reasonably calculated to ensure that the system for furnishing documents … protects the confidentiality of personal information relating to the individual's accounts and benefits (e.g., incorporating into the system measures designed to preclude unauthorized receipt of or access to such information by individuals other than the individual for whom the information is intended).” (ERISA Regulation Section 2520.104b-1(c)(1)(i)).

In other words, plan fiduciaries have to take steps to protect participant information; the steps must be “appropriate and necessary”; and the protections need to be incorporated into the “system” being used to communicate with the participants. The regulation says the steps must only be “reasonably calculated” to protect the data. So, while fiduciaries need to take cyber protection seriously, the DOL recognizes that they probably can’t achieve perfection.

This is all well and good, but the “system” where the data is maintained is most likely the plan recordkeeper’s. What can a plan fiduciary do? Remember that another important duty is the fiduciary obligation to prudently select and monitor service providers. In selecting or deciding to retain the recordkeeper (and others that either have, or have access to, participant data), fiduciaries need to find out how they protect the data. Make sure the recordkeeper (or other service provider) has cybersecurity policies in place, then review these cybersecurity policies for comprehensiveness and periodically monitor whether the service provider is complying with the policies.