Wrongful use of retirement plan participant data was among the claims made by a class of 40,000 participants against the plan sponsor and others in Cassell et al. v. Vanderbilt University et al. Specifically, the plan participants claimed that the University inter alia breached its “loyalty and prudence” duty by failing to protect confidential employee retirement plan participant information, allowing the plan’s recordkeeper to obtain access to participant’s personal information and to profit from that access.

The parties reached a settlement agreement which included a payment of $14.5 million along with promises to make certain changes in plan administration. Retirement plan sponsors have faced litigation concerning plan administration in a number of areas including investment selection and prudence over plan fees, but the Vanderbilt settlement includes a uniquely heightened focus on protection of data, signaling a trend in this direction.

Recordkeeping, investment of contributions, and other tasks associated with retirement plan administration require access to large amounts of personal information, usually in electronic format. The risks to that are not limited to data breaches. As the Vanderbilt settlement indicates, plan participants have become increasingly aware of the vulnerabilities associated with handling their data, as well as how their data is being used by plan vendors. In addition to monetary compensation, the Vanderbilt settlement stipulates that vendors such as recordkeepers cannot use employee participant data to market or sell products unrelated to the retirement plan to the participants, unless the participants initiate.

The Employee Retirement Income Security Act (“ERISA) is the primary federal statute regulating employee benefit plans, including retirement plans. Currently, there are no express provisions in ERISA that prohibit the use of plan participant data for any particular purpose. However, the plaintiffs in this case relied on ERISA’s long standing fiduciary duty provisions to support their claims concerning plan data:

• ERISA’s fiduciary duty provisions require plan fiduciaries to discharge their duties with respect to a plan solely in the interest of the participants and beneficiaries and for the exclusive purpose of providing benefits to participants and their beneficiaries. 29 U.S. Code § 1104.
• ERISA also prohibits plan fiduciaries from engaging in certain prohibited transactions, including transactions between the plan and a party in interest which the fiduciary knows constitutes a direct or indirect transfer to, or use by or for the benefit of a party in interest, of any assets of the plan. 29 U.S.C. §1106(a)(1).

It will be interesting to see if these kinds of claims take hold, after all, this is only a settlement and not a decision in federal court. One of the issues courts will have to wrestle with is whether plan data constitutes a plan asset.

But for now, plan sponsors should be thinking about their relationships with plan third party service providers. According to the DOL, ERISA requires plan fiduciaries to “obtain and carefully consider” the services to be provided by plan service providers before engaging the provider. Whether that duty extends to assessing the provider’s data privacy and security practices is not clear. But, in light of this settlement, plan sponsors should be asking themselves some basic questions including, who has access to participants’ data? How much (and what) data does the provider have access to, and what are they doing with that data? Is the service provider sharing data with other third parties?

Of course, depending on the bargaining power of the sponsor, it may not be able to convince a vendor to agree not to use participant data solely for plan administration purposes. At a minimum, sponsors should be sure their process includes these and other factors when making selections.