Background: An investment adviser is subject to Regulation S-P, which requires financial institutions to adopt policies and procedures to protect "nonpublic personal information" about consumers, and to provide customers, no later than the time a customer relationship is established, a clear and conspicuous notice that reflects (i) the policies and procedures adopted by the mutual fund to protect nonpublic personal information, (ii) the conditions under which nonpublic personal information about consumers will be disclosed to nonaffiliated third parties, and (iii) the methods available to consumers to prevent the sharing of such information with nonaffiliated third parties. Regulation S-P applies only non-public personal information about individuals (i.e., natural persons) who obtain financial products and services primarily for personal, family or household purposes. Regulation S-P does not apply to information about companies or about individual who obtain financial products or services primarily for business, commercial or agricultural purposes.
Regulation S-P requires an initial notice be delivered at the time a customer relationship is established and another notice be delivered annually during the continuation of the customer relationship. "Annually" means at least once in a period of 12 consecutive months. The initial notice may be delivered within a reasonable period of time if an unaffiliated broker-dealer or investment adviser establishes a customer relationship between a mutual fund and a consumer without the fund's prior knowledge.
An investment adviser must provide a right to "opt out" if the mutual fund reserves the right to disclose nonpublic personal information about the consumer to unaffiliated third parties, unless (i) the unaffiliated third party is performing servicing or marketing services for the fund, (ii) the consumer consents to the disclosure or (iii) the disclosure is permitted or required by law.
A "consumer" is defined as an individual who obtains or has obtained a financial product or service from the mutual fund for personal, family or household purposes. This includes an individual who provides nonpublic personal information to an adviser, even if the individual ultimately does not open an account. An individual who provides only his or her name, address and general areas of investment interest in connection with a request for an investment adviser brochure is not consumer with respect to an investment adviser.
A "customer" is a consumer who has established a customer relationship with an investment adviser. A customer relationship is defined in Regulation S-P to mean a continuing relationship between the consumer and an adviser under which the adviser provides financial products and services to the consumer primarily for personal, family or household purposes. A customer relationship is established when a consumer establishes an investment advisory account with an investment adviser
"Nonpublic personal information" includes nonpublic "personally identifiable financial information", plus any list, description or grouping of customers that is derived from nonpublic personally identifiable financial information.
"Personally identifiable financial information" means any information: (i) the consumer provides to an adviser to obtain financial products or services, (ii) about the consumer resulting from a transaction between the consumer and an investment adviser, or (iii) that an investment adviser otherwise obtains from the consumer in connection with providing financial products or services to the consumer. Such information may include information provided on an account application, account balances and transaction information, the fact that the consumer is or has been a customer of an adviser, information relating to services performed for or transactions entered into on behalf of customers, and information from consumer reports and any data, list or analyses derived from such nonpublic personal information.
Investment advisers that possess consumer report information for business purposes are required to properly dispose of the information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal. “Consumer Report Information” means any record about an individual (e.g., name, social security number, phone number, email address, etc), whether in paper, electronic or other form, that is a consumer report or is derived from a consumer report. The definition includes a compilation of such records, but does not include information that does not identify individuals, such as aggregate information or blind data. “Consumer Report” is defined in the Fair Credit Reporting Act (“FCRA”), but generally means information from a consumer reporting agency bearing on a consumer’s creditworthiness, credit standing, reputation, etc., which is used for the purpose of establishing eligibility for credit, insurance or employment or used for other purposes permitted under the FCRA. An adviser is not required to ensure perfect destruction of consumer report information. Rather, advisers are required to take “reasonable measures” to protect against unauthorized access to or use of the information in connection with its disposal. The rule release states that this means that the SEC expects advisers in devising disposal methods to consider the sensitivity of the consumer report information, the nature and size of the entity’s operations, the costs and benefits of different disposal methods and relevant technological changes. The SEC also notes that “reasonable measures” are very likely to require elements such as the establishment of policies and procedures governing disposal, as well as appropriate employee training.
Finally, Regulation S-P requires written policies and procedures addressing administrative, technical and physical safeguards for the protection of customer records and information.
Policy: The Adviser does not share any nonpublic personal information with any nonaffiliated third parties, except in the following circumstances:
- As necessary to provide the service that the client has requested or authorized, or to maintain and service the client's account;
- As required by regulatory authorities or law enforcement officials who have jurisdiction over the Adviser or as otherwise required by any applicable law; and
- To the extent reasonably necessary to prevent fraud and unauthorized transactions.
The Adviser's officers and employees ("Adviser Personnel") are prohibited, either during or after termination of their employment, from disclosing nonpublic personal information to any person or entity outside the Adviser, except under the circumstances described above. Adviser Personnel are permitted to disclose nonpublic personal information only to such other Adviser Personnel who need to have access to such information to deliver our services to the client.
Security of Client Information
The Adviser restricts access to nonpublic personal information to Adviser Personnel who need to know such information to provide services to shareholders. Any Adviser Personnel who are authorized to have access to nonpublic personal information are required to keep such information in a secure compartment or receptacle on a daily basis as of the close of business each day. All electronic or computer files containing such information shall be password secured and firewall protected from access by unauthorized persons. Any conversations involving nonpublic personal information, if appropriate at all, must be conducted by Adviser Personnel in private, and care must be taken to avoid any unauthorized persons overhearing or intercepting such conversations.
Privacy Notices
The Adviser will provide each consumer with an initial notice of the Adviser's privacy policy at the time an account is established. The Adviser also shall provide each client with a new notice of the Adviser's current privacy policy at least annually. If, at any time, the Adviser adopts material changes to its privacy policy, the Adviser shall provide each client with a revised notice reflecting the new privacy policies. The Chief Compliance Officer is responsible for ensuring that required notices are distributed to consumers and customers. If the Adviser maintains a web site, the privacy policy and the notice will be posted to the site.
Disposal of Nonpublic Personal Information
The Adviser will shred, deliver to a document destruction firm, or otherwise render illegible hard copies of any customer or consumer nonpublic personal information in its possession when the Adviser deems possession of the information to no longer be necessary.
Nonpublic personal information stored on disk, CD, tape or other electronic media shall be cleared, purged, declassified, overwritten and/or encrypted in such a manner so that any information contained therein cannot be restored or decrypted. After the electronic media is cleared, purged, declassified, overwritten or encrypted, the Chief Compliance Officer shall check that the original information is not backed-up or saved on a hard drive, recycle bin or other memories.
The Chief Compliance Officer shall require that each third-party service provider engaged by the Adviser which necessarily obtains access to Advisory Client nonpublic personal information during the course of their services on behalf of the Adviser to utilize similar policies and procedures relating to the secure disposal of nonpublic personal information.