Self-Regulatory Organizations; Financial Industry Regulatory Authority, Inc.; Notice of Filing of Proposed Rule Change Relating to Protecting Personal Confidential Information in Documents Filed With FINRA Dispute Resolution

Pursuant to Section 19(b)(1) of the Securities Exchange Act of 1934 (“Act”) and Rule 19b-4 thereunder, notice is hereby given that on February 13, 2014, Financial Industry Regulatory Authority, Inc. (“FINRA”) filed with the Securities and Exchange Commission (“SEC” or “Commission”) the proposed rule change as described in Items I, II, and III below, which Items have been prepared substantially by FINRA. The Commission is publishing this notice to solicit comments on the proposed rule change from interested persons.

I. Self-Regulatory Organization's Statement of the Terms of Substance of the Proposed Rule Change

FINRA is proposing to amend the Code of Arbitration Procedure for Customer Disputes (the “Customer Code”) and the Code of Arbitration Procedure for Industry Disputes (the “Industry Code”) to provide that any document that a party files with FINRA that contains an individual's Social Security number, taxpayer identification number, or financial account number must be redacted to include only the last four digits of any of these numbers. The proposed amendments would apply only to documents filed with FINRA. They would not apply to documents that parties exchange with each other or submit to the arbitrators at a hearing on the merits. In addition, the amendments would not apply to cases administered under Rule 12800 of the Customer Code and Rule 13800 of the Industry Code (collectively, the “Simplified Arbitration rules”).

The text of the proposed rule change is available at the principal office of FINRA, on FINRA's Web site at http://www.finra.org,, and at the Commission's Public Reference Room.

II. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change

In its filing with the Commission, FINRA included statements concerning the purpose of and basis for the proposed rule change and discussed any comments it received on the proposed rule change. The text of these statements may be examined at the places specified in Item IV below. FINRA has prepared summaries, set forth in sections A, B, and C below, of the most significant aspects of such statements.

A. Self-Regulatory Organization's Statement of the Purpose of, and Statutory Basis for, the Proposed Rule Change

1. Purpose

During an arbitration proceeding, parties submit pleadings and supporting documents to FINRA Dispute Resolution (“DR”) that may contain an individual's Social Security number, taxpayer identification number, or financial account number (“personal confidential information” or “PCI”). Since FINRA employees are regularly exposed to PCI as they handle party documents, FINRA has procedures in place to guide staff on how to keep confidential information safe. FINRA maintains an Information Privacy and Protection Policy (“Policy”), and administers Information Privacy and Protection Training to all FINRA staff annually. In addition to the Policy, DR has its own detailed procedures for protecting confidential information relating to, among other matters, storage and disposal of case materials in a manner that preserves the confidentiality of the information, and removal of PCI that appears in awards that will be publicly available.

DR procedures also provide staff with guidance on what arbitrators and mediators can do to protect confidential information. For example, DR requires arbitrators and mediators to keep confidential all information obtained in connection with an arbitration or mediation and to participate in FINRA training programs on information security.

In 2010, FINRA published a Notice to Parties (“Notice”) stating that parties and their counsel should take steps to protect confidential information. The Notice states that parties can safeguard confidential information by redacting such information from pleadings, exhibits, and other documents upon agreement of the parties. For example, the parties may agree not to use, or to redact, Social Security, account, or driver license numbers. Where parties must reference such data, they may use only the last few digits of the numbers or similar information. While these efforts have enhanced the security of party documents and information, parties continue to file with DR pleadings and attachments containing PCI. For example, customers often file account opening documents and account statements that show their account numbers.

As a service to forum users, DR serves certain pleadings on other parties to an arbitration matter. The parties are responsible for providing DR with addresses for service. The greatest risk of DR staff misdirecting PCI occurs when DR staff serves pleadings on a party (e.g., an associated person of a member who has not updated his or her Central Registration Depository record) at an incorrect/outdated address. In addition, DR provides the arbitrators with pleadings and attachments. On occasion, arbitrators have misplaced parties' pleadings containing PCI.

In an effort to protect parties from identity theft and the accidental loss of PCI, FINRA is proposing to amend the Customer Code and the Industry Code to require parties to redact specified PCI from documents they file with FINRA. FINRA is proposing to amend Rules 12300 (Filing and Serving Documents) and 12307 (Deficient Claims) of the Customer Code and Rules 13300 (Filing and Serving Documents) and 13307 (Deficient Claims) of the Industry Code as described below. For ease of reading, the description below only refers to Rules 12300 and 12307 of the Customer Code. The proposed amendments to Rules 13300 and 13307 of the Industry Code are identical and FINRA's rationale is the same.

FINRA is proposing to amend Rule 12300 to provide that, in an electronic or paper filing with FINRA, any document that contains an individual's Social Security number, taxpayer identification number, or financial account number must be redacted to include only the last four digits of any of these numbers. The rule would specify that a party shall not include full numbers. If FINRA receives a claim, including supporting documents, with a full Social Security, taxpayer identification, or financial account number, FINRA would deem the filing deficient under Rule 12307 and would request that the party refile the document, without the PCI, within 30 days. If a party files a document with PCI that is not covered by Rule 12307 (a document other than a claim, such as a motion), FINRA would deem the filing to be improper and would request that the party refile the document, with the required redaction, within 30 days. If the party refiles the document within 30 days in compliance with the rule, FINRA would consider the document to be filed on the date the party initially filed it with FINRA.

The proposed rule change would include two exemptions—one for documents that parties exchange with each other or submit to the arbitrators at a hearing on the merits, and one for cases administered under the Simplified Arbitration rules. As explained above, FINRA's greatest risk of misdirecting PCI occurs when DR staff is transmitting pleadings and documents to parties and arbitrators. Therefore, FINRA is proposing to exempt documents that parties exchange with each other or submit as exhibits during a hearing to reduce the burden of the new requirements. The parties can agree to measures to protect PCI in documents they share or use at a hearing and DR staff would not be at risk of transmitting PCI. FINRA is less concerned about exhibits produced by parties at hearings because parties only bring hard copies of exhibits to a hearing, as opposed to transmitting them via email, and can safely dispose of them by using secure shredding services. FINRA believes this is a balanced approach to protecting PCI that would minimize the burden on parties.

The second exemption relates to claims administered under the Simplified Arbitration rules. Generally, a single arbitrator decides these claims based solely on the parties' written submissions. Many claimants who initiate a claim under the Simplified Arbitration rules are not represented by counsel (i.e., they are pro se parties). FINRA believes that the redaction requirements in the proposed rule change may prove difficult for pro se parties to handle because they are not familiar with the practice of redacting documents. Therefore, FINRA proposes to exempt from this rule all claims administered under the Simplified Arbitration rules.

FINRA is proposing to make conforming changes to Rule 12307. FINRA would amend Rule 12307(a) to add an item to the list of deficiencies enumerated in the rule—that the claim does not comply with the restrictions on filings with PCI under Rule 12300(g). FINRA is proposing to amend Rule 12307(c) to clarify that if a party corrects a deficiency in a counterclaim, cross claim or third party claim within 30 days, FINRA will consider the document to be filed on the date the party initially filed the counterclaim, cross claim or third party claim with FINRA. FINRA would also amend Rule 12307(c) to correct a typographical error by deleting the word “the” (indicated by brackets) in the sentence that currently reads “The Director will notify the party making the counterclaim, cross claim or third party claim of [the] any deficiencies in writing.”

2. Statutory Basis

FINRA believes that the proposed rule change is consistent with the provisions of Section 15A(b)(6) of the Act, which requires, among other things, that FINRA rules must be designed to prevent fraudulent and manipulative acts and practices, to promote just and equitable principles of trade, and, in general, to protect investors and the public interest. FINRA believes that the proposed rule change would protect investors and the public interest because it would reduce the risk to forum users of identity theft. DR staff takes seriously its obligation to safeguard parties' PCI. However, because of the high volume of documents that DR staff handles and the manual process of transmitting documents, there continue to be risks to the security of an individual's personal information. FINRA believes that the best way to reduce the risk to forum users is to prohibit parties from submitting documents with PCI.

B. Self-Regulatory Organization's Statement on Burden on Competition

FINRA does not believe that the proposed rule change will result in any burden on competition that is not necessary or appropriate in furtherance of the purposes of the Act. FINRA considered the potential burden on the parties of the proposed redaction requirement. FINRA believes that the potential benefits outweigh the potential burden. Currently, Rule 5.2 of the Federal Rules of Civil Procedure (Privacy Protection for Filings Made with the Court) allows parties filing documents in Federal Court to include only the last four digits of a Social Security number, taxpayer identification number, and financial account number. Rule 5.2's redaction requirement applies to all documents, including attachments. Since many party representatives are already accustomed to complying with a redaction requirement, and because the redaction requirement applies only to documents filed with DR and not to documents that the parties exchange with each other or submit to the arbitrators at a hearing on the merits, or to documents submitted pursuant to the Simplified Arbitration rules, FINRA believes that the additional burden to these representatives would be minimal. Further, FINRA member firms are required to protect PCI under federal laws such as Regulation S-P and already redact PCI in other contexts.

C. Self-Regulatory Organization's Statement on Comments on the Proposed Rule Change Received From Members, Participants, or Others

Written comments were neither solicited nor received.

III. Date of Effectiveness of the Proposed Rule Change and Timing for Commission Action

Within 45 days of the date of publication of this notice in the Federal Register or within such longer period (i) as the Commission may designate up to 90 days of such date if it finds such longer period to be appropriate and publishes its reasons for so finding or (ii) as to which the self-regulatory organization consents, the Commission will:

(A) By order approve or disapprove such proposed rule change, or

(B) institute proceedings to determine whether the proposed rule change should be disapproved.

IV. Solicitation of Comments

Interested persons are invited to submit written data, views and arguments concerning the foregoing, including whether the proposed rule change is consistent with the Act. Comments may be submitted by any of the following methods:

Electronic Comments

• Use the Commission's Internet comment form ( http://www.sec.gov/rules/sro.shtml ); or
• Send an email to rule-comments@sec.gov. Please include File Number SR-FINRA-2014-008 on the subject line.

Paper Comments

• Send paper comments in triplicate to Elizabeth M. Murphy, Secretary, Securities and Exchange Commission, 100 F Street NE., Washington, DC 20549-1090.

All submissions should refer to File Number SR-FINRA-2014-008. This file number should be included on the subject line if email is used. To help the Commission process and review your comments more efficiently, please use only one method. The Commission will post all comments on the Commission's Internet Web site ( http://www.sec.gov/rules/sro.shtml ). Copies of the submission, all subsequent amendments, all written statements with respect to the proposed rule change that are filed with the Commission, and all written communications relating to the proposed rule change between the Commission and any person, other than those that may be withheld from the public in accordance with the provisions of 5 U.S.C. 552, will be available for Web site viewing and printing in the Commission's Public Reference Room, 100 F Street NE., Washington, DC 20549, on official business days between the hours of 10:00 a.m. and 3:00 p.m. Copies of such filing also will be available for inspection and copying at the principal office of FINRA. All comments received will be posted without change; the Commission does not edit personal identifying information from submissions. You should submit only information that you wish to make available publicly. All submissions should refer to File Number SR-FINRA-2014-008 and should be submitted on or before March 21, 2014.