The Consumer Financial Protection Bureau's (CFPB) announcement that it has settled its first data security enforcement action puts to rest any expectations that it would defer to the federal banking agencies and the Federal Trade Commission when it comes to data security. The CFPB's target in the action was a company that operates an online payment system and uses consumers’ personal information to complete financial transactions. The CFPB alleged that the company's failure to maintain adequate data security practices despite representations made to consumers on the company's website and elsewhere violated the Dodd-Frank Act's prohibition of unfair, deceptive, or abusive acts or practices (UDAAP). The CFPB's decision to use its UDAAP authority with respect to data security matters significantly ups the ante for large banks and nonbanks subject to the CFPB's enforcement jurisdiction.

In this webinar, we will discuss the implications of the CFPB's entry into the data security arena through the use of its UDAAP enforcement authority for banks and nonbanks.


  • How data security practices can create UDAAP risk
  • What the consent order's terms means for the CFPB's data security expectations
  • Data security issues in CFPB examinations
  • How banks and nonbanks should prepare for increased CFPB activity in the area of data security

Date & Time

Friday, March 18, 2016
12:00 PM - 1:00 PM ET


Alan S. Kaplinsky, Practice Group Leader
Consumer Financial Services Group


Edward J. McAndrew

Privacy and Data Security/Consumer Financial Services Group

John L. Culhane, Jr.

Consumer Financial Services Group

Kim Phan
Privacy and Data Security/Consumer Financial Services Group

This program is open to Ballard Spahr clients interested in the CFPB's first data security enforcement action. There is no cost to attend. This program is not eligible for continuing education credits.

Please register at least two days before the webinar. Login details will be sent to all approved registrants. For more information, contact Eva M. D'Ignazio at