Protect Retirement Plan Participant Data from Misuse by Third Parties

There is a growing trend of using participant data to cross-sell financial products unrelated to plan recordkeeping by large recordkeepers and asset custodians of employer-sponsored retirement plans. In light of the fact that plan fiduciaries are ultimately legally responsible for the management and mismanagement of a retirement plan, this trend to use participant data may raise issues for employers in their role as plan sponsors and fiduciaries.

Recently, numerous plan fiduciaries have been swept up in a wave of excessive fee litigation for failing to provide prudent investment options at a reasonable fee for plan participants—a trend that is likely going to continue and reach more retirement plans. Excessive fee litigation has pressured plan fiduciaries to renegotiate and monitor fees charged by service providers.

Due to reduced fees, service providers have turned to other options to expand their businesses. Some service providers are using participant data acquired through the administration of retirement plans to sell and market services unrelated to those plans.

There is no definitive case law or other legal guidance prohibiting or restricting service providers from using plan participants' personal information to cross-sell financial products. Nevertheless, there are several reasons plan fiduciaries may want to be wary of allowing such personal information gleaned from plans to be used for non-plan–related purposes.

Excessive Fee Litigation

Some of the claims in the excessive fee litigation cases against plan fiduciaries include fiduciary breaches for allowing excessive recordkeeping and investment management fees. Arguments that participant data is an Employee Retirement Income Security Act (ERISA) plan asset have fallen flat. However, several settlements for excessive fee cases have included terms that require a contractual restriction on the service provider's ability to cross-sell products or services not related to the plan or plan participants unless a participant first requests them.

Protecting participant data is becoming part of the solution to excessive fee cases because it helps mitigate the movement of plan assets from a lower-cost retirement vehicle (the retirement plan) to a higher-cost retirement vehicle (an individual retirement arrangement or IRA).

Fiduciary Duty and Personal Data

While the argument that participant data is an ERISA plan asset has not convinced courts, participant data still has value and plan fiduciaries must monitor the services of service providers, which are generally not plan fiduciaries. A fiduciary can determine that using participant data to sell non-plan financial services is an improper use of that data.

Plan sponsors may want to provide restraint on what service providers do, including limiting use of participant data for purposes outside of the administration of the retirement plan. Participant personal data is valuable to service providers. Plan fiduciaries may monitor and prevent service providers from using the data in ways in which it was not intended.

DOL Audits

In its plan audit reviews, the U.S. Department of Labor (DOL) has asked for the uses of plan participant data. Specifically, the DOL is requesting documents and communications describing the use of participant data by the plan sponsor or any service provider for the direct or indirect purpose of cross-selling or marketing products and services.

The DOL is asking about cross-selling by service providers as part of its audit review, and it is likely formulating a position that will scrutinize the use of participant data in this context.

DOL Fiduciary Rule

Issued by the DOL in 2017, the Fiduciary Rule provided that retirement advisors must act in the best interests of their clients and make certain disclosures to their clients. The rule would have treated as fiduciaries service providers that recommended or solicited plan participants to roll over retirement plan assets. If a service provider was treated as a plan fiduciary, the service provider likely would not use plan participant data to cross-sell financial products unrelated to the plan because of the increased legal risk.

The Fifth Circuit Court of Appeals vacated the rule in March 2018, so it never went into effect. Nevertheless, the DOL is considering reviving the Fiduciary Rule. The DOL has its eye on State Privacy Laws

Kevin L. Burch is a shareholder in the Indianapolis office of law firm Ogltetree Deakins, and Matthew Hoffman is an associate in the firm's Indianapolis office. © 2022, Ogletree, Deakins, Nash, Smoak & Stewart, P.C. All rights reserved. Republished with permission.