© 2021 Thomson Reuters. All rights reserved. Use of Practical Law websites and services is subject to the Terms of Use

(static.legalsolutions.thomsonreuters.com/static/agreement/westlaw-additional-terms.pdf) and Privacy Policy (a.next.westlaw.com/Privacy).

PRACTICE NOTE

Cybersecurity and ERISA Fiduciary Responsibilities for

RetirementPlans

byMichelle Capezza, Mintz, with Practical Law Employee Benefits & Executive Compensation

Status: Maintained | Jurisdiction: United States

This document is published by Practical Law and can be found at: us.practicallaw.tr.com/w-024-1935

Request a free trial and demonstration at: us.practicallaw.tr.com/about/freetrial

become increasingly more vulnerable to attack as they

travel on employer and third-party systems. This has been

partially due to the advancements in plan administration,

technology, online enrollment and electronic access to

account information, electronic delivery of disclosures

including benefit statements, and benefit plan transaction

processing (including self-certifications of distributions). In

today’s world, most transactions involving retirement plans

are conducted electronically, including maintaining and

sharing data and information across multiple platforms.

to ensure that the plan is operated and maintained in the

best interest of plan participants and beneficiaries. The

extent to which ERISA fiduciary responsibility applied

to the protection of plan participant and beneficiary

data and PII is not statutorily explicit under current law.

While there are protocols and guidance for the privacy

and security of protected health information (PHI), there

had not been clear protocols for ERISA plan fiduciaries

to consider and follow regarding the security of PII for

retirement or other benefit plans, despite their equal

• Fiduciaries.

• Recordkeepers.

• Service providers.

• Participants and beneficiaries.

The EBSA Cybersecurity Guidance:

• Is intended to help plan sponsors and fiduciaries

prudently select a service provider with strong

cybersecurity practices and monitor them.

• Assists plan fiduciaries and recordkeepers in their

responsibilities to manage cybersecurity risks.

plan fiduciaries are at least obligated to ensure proper

mitigation of cybersecurity risk (see Legal Update, DOL

Issues Cybersecurity Guidance for ERISA Retirement

Plans). With the ongoing advancements in technology

(including technological tools that have emerged to aid

in the administration and delivery of employee benefits)

and the novel cybersecurity risks that those advancements

bring, there is widespread concern for the security of both:

A Practice Note providing an overview of how cybersecurity may be part of the responsibilities

imposed by the Employee Retirement Income Security Act of 1974 (ERISA) on fiduciaries of

• The employee data that is collected, transmitted,

processed, and stored for employee benefit plans.

• The assets in participant accounts.

The EBSA Cybersecurity Guidance serves to complement

EBSA’s regulations on electronic records and disclosures

to plan participants and beneficiaries (including provisions

on ensuring that electronic recordkeeping systems have

reasonable controls, that adequate records management

practices are in place, and that electronic disclosure

systems include measures calculated to protect PII).

Responsibilities and Cybersecurity for Retirement Plans.

This Note explains:

• ERISA plan fiduciary responsibilities and cybersecurity.

• Plan assets and cybersecurity.

• Potential fiduciary liability under ERISA for retirement

plan cybersecurity breaches.

ERISA Plan Fiduciaries

An ERISA fiduciary is broadly defined as any person who,

regarding an employee benefit plan subject to ERISA’s

fiduciary duty provisions:

fee or other compensation, whether direct or indirect, or

has any authority or responsibility to do so.

• Has any discretionary authority or responsibility in the

administration of the plan.

(ERISA§3(21) (29 U.S.C.§1002(21)) and see Practice

Note, ERISA Fiduciary Duties: Overview: Fiduciary Status.)

Plan fiduciaries include:

• Plan sponsors.

• Plan administrators.

• Plan benefits committee members.

• Handling plan data.

• Selecting and monitoring third-party service providers.

• Developing and implementing internal cybersecurity

policies and procedures.

• Addressing a cybersecurity breach.

ERISA Fiduciary Responsibilities

and Cybersecurity

Neither ERISA nor federal law addresses cybersecurity

and retirement plan data. However, the EBSA

Cybersecurity Guidance provides tips to assist fiduciaries

• Loyalty (see Duty of Loyalty and the Exclusive Benefit

Rule).

• Prudence (see Duty of Prudence).

• Acting according to plan documents (see Duty to Follow

Plan Documents).

Duty of Loyalty and the Exclusive Benefit

Rule

A fiduciary must act solely in the interest of plan participants

and beneficiaries with the exclusive purpose of providing

benefits to them. Fiduciaries must use plan assets for the

If plan participant data or account assets are hacked,

Under ERISA Section 3(42), the term “plan assets”

means plan assets as defined by the regulations

(29U.S.C.§1002(42)). The regulations define two broad

categories of plan assets, which are:

• Plan investments. When a plan invests in another

entity, the plan’s assets include its investment but

donot, solely by reason of this investment, include

any of the underlying assets of the entity (29 C.F.R.

§2510.3-101(a)(2)).

involves a transfer to or use by or for the benefit of a party

in interest of any assets of the plan (29 U.S.C.§1106).

Under ERISA Section 406, if the definition of a plan

asset includes the actual data and information that

plans maintain, fiduciaries may be liable for a prohibited

transaction related to any misuse or self-dealing

regarding these assets or security breaches resulting from

the transfer of this data between the plan sponsor and

other plan parties in interest.

The regulations do not suggest that PII, account

apply. These developments may further complicate

prohibited transaction analyses.

One court has noted that there is not a single case

in which a court has held that releasing confidential

information or allowing someone to use confidential

information constitutes a breach of fiduciary duty

under ERISA or that this information is a plan asset in

a prohibited transaction (Divanev.Nw. Univ., 2018 WL

2388118, at *12 (N.D. Ill. May 25, 2018), aff’d on other

grounds, 953 F.3d 980 (7th Cir. 2020)).

both breach of fiduciary duty claims and claims for

violations of prohibited transaction rules, alleging that the

plan allowed plan service providers to use their positions

as recordkeepers to obtain access to participants, learning

their ages, length of employment, contact information,

account sizes, and investment choices, and used that

information in marketing lucrative investment products

and wealth management services to participants as

they neared retirement and before retirement. The case

settled before progressing through motion practice,

participant (285 F. Supp. 3d 1056 (M.D. Tenn. 2018)).

More recently, in Harmonv.Shell Oil Company, the US

District Court for the Southern District of Texas determined

that it was unable to conclude that participant data is a

plan asset under ERISA and granted a motion to dismiss

the case (2021 WL 1232694 (S.D. Tex. Mar. 30, 2021)).

Cases are continuing to emerge regarding the use of

participant confidential information to market financial

products and services outside the benefit plan and

are likely to evolve in determining whether participant

• Ensure that the data is used for the exclusive interest of

participants.

to employees concerning use of their data and

determine the applicability of these requirements

to plan participants (for example, there are notice

requirements under the California Consumer Privacy

Act (CCPA) of 2018 and California Privacy Rights Act

(CPRA) of 2020 regarding use of employee data and

sensitive personal information).

litigation risk as well as other potential liabilities.

In the few cases that have been brought to date,

participants and beneficiaries have asserted a variety of

claims, including:

• Claims for breach of fiduciary duty under ERISA.

• Claims for denial of benefits under ERISA.

privacy laws, breach of contract, unjust enrichment,

and negligence).

This is an evolving area of law, and many cases are

– other equitable or remedial relief as a court may

(29 U.S.C.§1109 and see Practice Note, ERISA Litigation:

Causes of Action and Remedies Under ERISA Section 502

for Benefit and Fiduciary Breach Claims.)

In Massachusetts Mutual Life Insurance Co.v.Russell, the

US Supreme Court held that ERISA Section 502(a)(2) only

provides relief that inures to the benefit of the plan as a

(552 U.S. 248 (2008)). Therefore, there is an avenue

to relief under ERISA Section 502(a)(2) for harm to an

individual account in a defined contribution plan.

Similarly, the plaintiff in Bermanv.Estee Lauder brought

the terms of the plan).

• The relief sought is appropriate equitable relief.

(See, for example, Gabrielv.Alaska Elec. Pension Fund,

773 F.3d 945, 954 (9th Cir. 2014) and Mertensv.Hewitt

Assocs., 508 U.S. 248, 256 (1993).)

From the limited number of cases that have been

brought, it is apparent that these types of claims

generally are not alleged by participants and beneficiaries

when a cybersecurity breach occurs, opting instead

for clams that allow for compensatory damages (see

• Their positions as recordkeepers to obtain access to

The settlement agreement that the parties reached

addressed these concerns by obligating the plan sponsor

to refrain from using information about plan participants

acquired in the course of providing recordkeeping services

to the plan to market or sell products or services unrelated

to the plan unless a request for these products or services

is initiated by a plan participant.

Another potential example can arise where the data

stolen includes the participant’s social security number,

date of birth, home address, email address, bank account

causes irreparable harm to the participant but is difficult

to quantify. It remains to be seen whether the equitable

relief available under Section 502(a)(3) may be invoked.

Claims for Benefits Under the Plan Terms

Under Section 502(a)(1)(B)

Individual benefit claims are brought under ERISA Section

502(a)(1)(B) (29 U.S.C.§1132(a)(1)(B)), which allows

participants and beneficiaries to bring a civil cause of

action to recover benefits due under a plan to either:

• Enforce rights under the terms of the plan.

• Exhausted the plan administrative appeals process (if

raised as a defense).

• Are entitled to a particular benefit under the plan’s

terms.

• Were denied that benefit.

As characterized by the US Court of Appeals for the

Fifth Circuit, when an individual simply wants what was

supposed to have been distributed under the plan, the

appropriate remedy is under ERISA Section 502(a)(1)(B)

(Hagerv.DBG Partners, Inc., 903 F.3d 460, 469 (5th Cir.

• The benefits were paid under all plan terms and

requirements.

• The plaintiff’s loss of benefits was due to the plaintiff’s

own failure to comply with the plan’s address change

requirements as well as the fraudulent conduct of the

plaintiff’s ex-spouse.

(693 F.3d 1226 (10th Cir. 2012).)

The plaintiff challenged this determination in the district

court, saying the money had been forfeited in violation of

ERISA, and demanded from the defendant a distribution

was to be mailed to their current address on file and PIN

changes and resets are always mailed to the permanent

address on file. The Tenth Circuit affirmed that decision,

holding that the plan administrator’s decision to not

reimburse the plaintiff for the amount the plaintiff’s

ex-wife withdrew was not an abuse of discretion. The

Tenth Circuit instead found that the plan administrator

safeguarded plan assets as they had already been

paid out in the plaintiff’s name and to do so again then

depletes plan assets. (Foster, 693 F.3d 1226.)

to a participant under ERISA Section 502(a)(1)(B) (29

• Breach of contract.

• Unjust enrichment.

• Promissory or equitable estoppel.

• Violation of state confidentiality requirements.

• Violation of state privacy laws.

• Negligence.

• Breach of covenant of good faith and fair dealing.

• Unfair or deceptive business practices.

For complete ERISA preemption to arise, it must be that

the individual brought a claim for plan benefits under

ERISA Section 502(a) (29 U.S.C.§1132(a)) and there is

no other independent legal duty that is implicated by the

programs are designed in compliance with applicable

law, including:

• Required notices of data collection.

• Security standards.

• Breach notification procedures.

Under the current landscape, plan sponsors and

fiduciaries should also be mindful of the laws addressing

data privacy and security as this area continues to evolve,

which may serve as the basis for various areas of litigation

and compliance enforcement and penalties. Examples of

• General Data Protection Regulation (GDPR). Rules

relating to the protection of natural persons regarding

the processing of personal data and rules relating to

the free movement of personal data. Provides individual

data subjects with the right to be forgotten or have the

controller erase their personal data.

• SEC’s Regulation S-P. Requires registered broker-

dealers, investment companies, and investment advisers

to adopt written policies and procedures that address

administrative, technical, and physical safeguards for the

pinpoint areas where the organization is weaker or needs

improvement. The SPARK Institute has advised that

recordkeepers can make representations that they adhere

to SPARK data security best practices for penetration

testing, which should be inclusive of anywhere that

nonpublic information or PII is processed or stored.