Announcements Mark Out a Clearer Path, but MSAs and Gifts Still Require Careful Review
Last week, the Consumer Financial Protection Bureau (“CFPB” or “Bureau”) announced significant changes to how it will view the legality of Marketing and Services Agreements (“MSAs”) under the Real Estate Settlement Procedures Act (“RESPA”).  Most strikingly, the Bureau formally rescinded its controversial Compliance Bulletin 2015-05:  RESPA Compliance and Marketing Services Agreements (Oct. 8, 2015) (“2015 MSA Bulletin”).  MSAs historically have been used as a way for settlement service providers to gain access to additional potential customers via paid advertising and marketing services.  But the 2015 Bulletin, issued after a string of Bureau RESPA enforcement actions, expressed the view that virtually all MSAs should be scrutinized and pose a high risk of violating RESPA’s prohibitions on paid referrals and/or the splitting of unearned fees.[1]

In addition to rescinding the prior guidance, the Bureau last week also released a slew of new “Frequently Asked Questions” (“FAQs”) on the legality of MSAs, gifts and promotional activities, and other RESPA matters.  In all, the Bureau’s actions last week on MSAs in particular amount to a further repudiation of aggressive RESPA interpretations that the agency advanced during the last decade.

On October 12, 2020, the California Attorney General provided public notice of a new Proposed Third Set of Modifications to the Regulations under the California Consumer Privacy Act (the “CCPA”).  You will be forgiven if you assumed that “final approval” of the existing Regulations back in August meant the Regulations were final—or at least we hope so because we made the same assumption.

Since August, however, it appears the AG was working behind the scenes to resurrect previously withdrawn Sections 999.306(b)(2) (covering offline notice of opt-out if a business substantially interacts with consumers offline); 999.315(c) (minimum standards for opt-out requests); and 999.326(c) (specific requirements for authorized agents).  The AG describes the newly proposed rules as follows:

Monetary penalties are the attention-grabbing headline when the FTC or any regulator brings an enforcement action against a company.  They are the looming threat to incentivize and influence compliance.  Over the summer, FTC Chairman Joseph J. Simons (“Chairman Simons”) issued a statement in connection with a settlement that Chairman Simons believes “the goal of a civil penalty should be to make compliance more attractive than violation.  Said another way, violation should not be more profitable than compliance.”

On September 17, 2020, four Republican Senators (Roger Wicker – Mississippi, Chairman, John Thune – South Dakota, Deb Fischer – Nebraska, and Marsha Blackburn – Tennessee) introduced sweeping federal privacy legislation entitled: Setting an American Framework to Ensure Data Access, Transparency, and Accountability (“SAFE DATA”) Act. This proposed comprehensive national privacy law has three main components:

  • Provides consumers with more choice and control over their data
  • Directs business to be more transparent and accountable
  • Strengthens the FTC’s enforcement power

    • The U.S. Department of Health and Human Services Office for Civil Rights (OCR) reached a settlement for $1,500,000 and entered into a substantial corrective action plan with Athens Orthopedic Clinic (AOC) as a result of AOC’s alleged systemic noncompliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. AOC, located in Georgia, provides a wide range of orthopedic services to approximately 138,000 patients a year.

    Problems began for AOC in June 2016, when the practice was notified by a journalist that AOC patient records may have been posted for sale on the internet. Shortly thereafter, AOC was contacted by a hacker demanding payment for the stolen patient records. It was later determined that the hacker had accessed AOC’s electronic medical records using a vendor’s credentials on June 14, 2016, and continued to access protected health information (PHI) until July 16, 2016. AOC filed a breach report with OCR on July 29, 2016, revealing that the names, dates of birth, social security numbers, and other PHI of over 200,000 patients had been compromised by this breach.

    money_closeup

    On September 15, 2020, the Financial Crimes Enforcement Network (“FinCEN”) published a Final Rule bringing banks that lack a federal functional regulator further under its purview. The rule subjects these institutions to minimum standards for anti-money laundering (“AML”) requirements, including a BSA officer, AML policies and procedures, and regular employee training, among other obligations. It…

    On July 21, the New York Department of Financial Services (NYDFS) filed charges against First American Title Insurance Company (First American) for violating multiple sections of the New York Cybersecurity Regulation,  23 NYCRR 500.00, et seq.  The significance of the NYDFS enforcement action cannot be overemphasized.  This is the first action filed under the Cybersecurity Regulation, signaling a more aggressive enforcement stance by the regulator.  The good news is the filings provide important guidance on best practices and red flags to avoid agency sanctions.

    The NYDFS Statement of Charges alleges that First American knowingly exposed tens of millions of documents containing consumer sensitive personal information (e.g., bank account numbers, bank statements, mortgage records, Social Security numbers, wire transaction receipts, drivers’ license images, etc.). The charges further allege that for almost 5 years (from October 2014 through May 2019) these records were available on First American’s public-facing website to anyone with a web browser.  The fact that First American failed to remediate the vulnerability, even after it was discovered by a penetration test in December 2018, was particularly troublesome for the regulators.  The charges state that, “Remarkably, [First American] allowed unfettered access to the personal and financial data of millions of its customers for six more months. . .”   Clearly, the NYDFS found this treatment of sensitive consumer data unconscionable and that First American demonstrated a total disregard for the Cyber Regulations.

    On July 31, 2020, Varo Money Inc. announced that it was granted a national bank charter by the U.S. Office of the Comptroller of the Currency (OCC).  The charter will allow Varo, a mobile banking fintech, to launch a national bank and offer a range of financial services and products that are backed by the Federal Deposit Insurance Corp (FDIC).

    The announcement marks a historic moment for fintech companies, as Varo will become the first fintech company to obtain a national bank charter with the OCC.

    On July 23, 2020, the New York Department of Financial Services (“DFS”) filed its appellate brief asking the Second Circuit Court of Appeals to uphold the lower court’s decision to block the Office of Comptroller of the Currency’s (“OCC”)’s special purpose national bank charter (“fintech charter”).

    The DFS initially challenged the OCC’s fintech charter in…