Hedge funds are increasingly subject to international and local data protection regulations. The amount of personal data held by hedge funds and service providers continues to grow. As obligations to collect data increases with new regulations such as the U.S. Foreign Account Tax Compliance Act (FATCA), hedge fund managers and other service providers must pay attention to data protection laws and regulations.
The obligations of hedge funds, investment managers and service providers to protect confidential information relating to investors and avoid breaches of data privacy legislation is increasingly in focus. Hedge funds have long been required to obtain personal data on their investors as a result of anti-money laundering/know your customer requirements and investor suitability purposes. New regulations including FATCA will require that investment managers, funds and service providers obtain additional amounts of personal data. With the requirement to obtain increased amounts of personal data, combined with the penalties and reputational risks involved with the breach of data privacy legislation, this is an area that cannot be overlooked or ignored. This article will examine some of the issues on this topic, including the cross-border transfer of investor information and data.
Due to the nature of a hedge funds business being inherently multijurisdictional it is likely that the data protection legislation in at least two or more jurisdictions, if not more, will apply. The European Union (EU) is widely regarded as the most progressive political entity to have legislated in this area with the EU Data Protection Directive (EU Data Protection Directive), passed in 1995. As it was passed in the form of a Directive, the European Union member states are subject to minimum standards as set out in the Directive, and may implement higher standards which several states have done. The laws of the EU member states should therefore be considered when analysing the rules that apply for registration or notification with respect to the standards and requirements for holding personal data. One of the key points to note is the extraterritorial nature of the EU Data Protection Directive which requires that personal data, subject to certain exceptions, may not be transmitted to a jurisdiction that does not have a level of protection which is adequate by the EU. In the United States, the situation is more complex as there is generally no federal laws regulating the protection of data in the same manner as the EU Data Protection Directive and it has been left to the individual states to pass legislation in this area. Massachusetts is a notable jurisdiction which has adopted some of the strictest data protection legislation and which hedge fund managers and service providers should be aware of, in the event that personal data is held on Massachusetts residents.
What data is in scope?
The data which is regarded as in scope and the parties to whom the data relates differs between the jurisdictions. Under the EU Data Protection Directive, the data is described as ‘Personal Data’. Personal Data includes information that identifies the ‘Data Subject’, which is the person to whom the data applies. Data Subjects are natural persons, and therefore the Directive would not apply to data on a corporate entity. It will of course apply to the Personal Data relating to natural persons obtained in respect of the corporate entity e.g. the directors or shareholders. As many of the rules in this area follow the person to whom the data applies it is critical to understand the obligations you may have in the jurisdictions where your investors are based. By way of example, Massachusetts has enacted some of the strictest data protection laws in the U.S. Under the Massachusetts regulations an entity is subject to their rules simply by holding personal data on a Massachusetts resident. A party covered by those rules does not need to have a place of business in the state or other nexus with the state (which is required for the regulations in other states to apply). The data which would bring an entity in scope of the Massachusetts regulations is holding a resident’s first name and last name or first initial and last name in combination with any one or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver’s licence number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident’s financial account.
What restrictions are placed on the use of data?
It is very unlikely that a hedge fund or service provider will use personal data received other than for the purposes of processing an investment and meeting their legitimate reporting and record keeping obligations. In this regard the EU imposes the strictest uses on the handling and use of personal data. The EU Data Protection Directive imposes a number of principles to the handling of data including requiring that data is processed fairly and lawfully and for a specific legitimate purpose. Other principles applying under the EU Data Protection Directive require that only relevant information is collected (i.e. additional information not directly required is obtained), and importantly, personal data is destroyed when no longer required. In addition, when complying with the data principles if further processing or use of the data is to be undertaken this may only be done when the Data Subject consents or other exceptions provided by law or other public interest exclusions apply. In addition, the EU Data Protection Directive requires that the party holding the data discloses to the data subject upon request what data they hold on them.
What are the notification requirements for a breach of data protection rules?
Most U.S. states have implemented data breach notification statutes, including New York State, California, Arizona and Massachusetts among others. Generally, the data breach notification laws will require that the person to whom the data relates is notified of the breach. Notification is also normally required to the state (e.g. Attorney General). The procedures, penalties, required actions and liabilities for a data breach vary from state to state. In the European Union certain countries have also enacted data breach notification requirements and the EU Commission has proposed that rules relating to such breaches should be incorporated in amendments to the EU Data Protection Directive.
What impact do the data protection rules impose on contractual negotiations?
When negotiating contracts or agreements with a third party (e.g. a service provider such as an Administrator or other repository of data), the parties should take care to oblige the service provider to ensure that they comply with relevant data protection laws and will protect the data which they receive or will process. A careful review of the liability clauses and indemnities should be reviewed to establish which party will be liable in the event that there is a breach. Certain jurisdictions require paperwork to be put in place covering export or transfers of data (see the references to the EU Model Contracts below). In addition, by way of example the Massachusetts data protection regulations require that parties include a contractual provision in contracts to implement and maintain appropriate security measures for the safeguarding of personal information. As from March 2012, parties were required go back and request that such a provision be included in existing contracts.
What terms should be included in an Offering Memorandum or Subscription document to cover data protection?
When preparing the disclosures in the offering memorandum and subscription documents, consideration should be given to including risk disclosures that information may be transferred to jurisdictions which do not have comparable data protection standards, opt-in or opt-out clauses for investors to decide if they want to share their information (or consents) and consents in the event that information is to be shared with third parties.
What restrictions apply to data export from the EU?
In European Union, the key term is that a third country to which information is exported must have data protection measures which are ‘adequate’. Note the use of the term ‘adequate’ rather than ‘equivalent’. The European Union currently recognises a limited number of jurisdictions as having adequate data protection measures. The jurisdictions are Argentina, Canada, Guernsey, Isle of Man and Switzerland. For the purposes of the EU Data Protection Directive those jurisdictions are therefore treated in the same way as data being transmitted between EU member states. For countries (including the U.S.) which are not so recognised as having adequate data protection standards then additional steps must be taken in order to export the data to such third countries.
The European Union and the U.S. agreed to a special arrangement where data transfers from the EU to the U.S. may be regarded as subject to “safe harbour” provisions. Under the terms of the safe harbour, if an entity in the U.S. wishes to process data on EU Data Subjects they must self certify to comply with certain data protection principles set out in the EU Data Protection Directive (which are similar to the principles applying under the Directive to data processors in the EU).
Transfers to other countries which do not have adequate data protection standards, can be achieved on a case-by-case basis by entering into ‘model contracts’ under the terms of the EU Data Protection Directive. The European Union has agreed the form of the “model contracts”. The terms of the model contracts are quite standard, however, it should be noted that election as to the type of information being exported may need to be specified. In addition, some European Union member states require registration of the model contracts, while others do not. Therefore, it is important to verify what the laws of the relevant member state require to make the data export under the model contracts effective.
Do you have a proper data protection system or require further advice?
Anthony Murray is a partner of Murray LLP, a law firm based in New York City providing commercial law advice with an emphasis on servicing the financial services sector and hedge funds. Anthony has fifteen years legal experience, commencing his career as a Lawyer in the UK in 1997. In 2000 he relocated to the Netherlands and was latterly appointed as Associate General Counsel for Europe for a large fund service organization and in 2010 moved to the U.S. and assumed the position of Associate General Counsel for the Americas. He has extensive experience of legal, finance and regulatory matters in many jurisdictions, including the Netherlands, United Kingdom, Ireland, Luxembourg, Switzerland, Guernsey, Jersey, The United States, Bermuda, The Bahamas, British Virgin Islands and the Cayman Islands. He became a partner of Murray LLP in 2012. He graduated with a Bachelor of Laws (LL.B (Honors)), First Class Honors and Post Graduate Diploma in Legal Practice from the University of Dundee, Scotland. Anthony Murray is qualified as a Solicitor in Scotland and admitted as an Attorney-at- Law in New York State.
Murray LLP, is a law practice based in New York established for the purpose of providing clients with timely and effective legal representation. We specialize in commercial transactions, business legal advice and hedge funds. We also have extensive international experience. The Attorneys of Murray LLP have many years experience of handling some of the most complex legal issues. For more information, please visit www.murrayllp.com.
