SEC imposes first fines solely over privacy rule

By Jonathan Stempel

NEW YORK (Reuters) – The U.S. Securities and Exchange Commission for the first time fined individuals solely for violating a privacy rule designed to prevent confidential customer information from being sent to third parties without permission.

The fines were imposed against three former executives at the now-defunct Tampa, Florida, firm GunnAllen Financial Inc: President Frederick Kraus, National Sales Manager David Levine and Chief Compliance Officer Mark Ellis.

According to the regulator, Kraus authorized Levine last April to take information on more than 16,000 accounts to his new firm. The SEC said Levine then downloaded names, addresses, account numbers and asset values to a portable thumb drive, and gave them to the new firm, National Securities Corp of Boca Raton, Florida, after resigning from GunnAllen.

This violated the SEC’s Regulation S-P, known as the “Safeguard Rule,” which blocks such transfers when customers are not given notice and a chance to opt out, the SEC said.

Kraus and Levine each agreed to a $20,000 fine. Ellis agreed to a $15,000 fine, after the SEC said he had failed to take reasonable steps to protect customer data. All three also agreed to censures. None admitted wrongdoing.

“The imposition of penalties should send a message that customer protection is serious,” Glenn Gordon, associate director of the SEC regional office in Miami, said in an interview.

The regulator said GunnAllen between July 2005 and February 2009 had “several serious security breaches” including the theft of three laptop computers, and the use of stolen passwords by a fired employee to access internal emails.

Gregg Breitbart, a lawyer for Levine, said his client is pleased to settle, and that he is unaware of any way in which the transferred customer data was compromised.

“The transfers were approved by GunnAllen, and notices were sent to affected clients,” but the SEC ultimately concluded that the notices were inadequate, he said.

A lawyer for Kraus had no immediate comment. A lawyer for Ellis did not immediately return a call seeking a comment.

(Reporting by Jonathan Stempel, editing by Matthew Lewis)

SEC imposes first fines solely over privacy rule