The CFPB Becomes the Latest Federal Agency to Take on Data Security

摘要

On March 2, 2016, the Consumer Financial Protection Bureau (CFPB) announced its first data security enforcement action against an online payment processor, Dwolla, Inc. Even though the CFPB did not allege that Dwolla had experienced any kind of data breach or other security incident, the CFPB chose to move forward with its enforcement action based on alleged misrepresentations made by Dwolla about the level of data security being provided to consumers using the Dwolla payment platform. Dwolla agreed to resolve the CFPB's allegations by entering into a consent order (Consent Order) that requires the company, among other things, to pay a $100,000 civil money penalty and to implement measures designed to improve the safety and security of its operations and the consumer information that is stored on, or transmitted through, its network.