CONCLUSION
Employee benefit data breaches will recur and are now a fact of life. Plan participants and beneficiaries have become sensitized to the vulnerability of their personal information and it is reasonable to expect that they will look to plan fiduciaries to protect that information. State regulators and the FTC are alert to these issues as is the US Department of Labor. Given that service providers often have been the point of entry for attacks on plan data, plan fiduciaries are well served by conducting defensible due diligence in selecting providers, incorporating specific privacy and data security obligations into a binding agreement with the service provider, and monitoring the service provider’s ongoing compliance with those obligations. These steps should reduce the risk of data breaches affecting the sensitive personal information of plan beneficiaries and participants and, if one occurs, reduce the exposure of the plan and its fiduciaries.