Protecting Personal Confidential Information

Identity theft can occur if someone obtains a party’s personal information and uses it to take the party’s money or to commit fraud or other crimes. Identity theft can devastate a party’s credit rating and derail financial security. FINRA Dispute Resolution Services (DRS) takes steps to protect parties’ personal confidential information throughout the arbitration and mediation process.

Except for arbitration awards, which are publicly available, the documents and information in DRS case files are confidential. DRS limits access to personal confidential information to FINRA staff who need it to perform their job functions, and to arbitrators, mediators, or other individuals involved directly in the arbitration or mediation process. Examples of personal confidential information include:

  • Social security numbers;
  • Brokerage, bank, or other financial account numbers;
  • Taxpayer identification numbers; and
  • Medical records.

What DRS Does to Protect Personal Confidential Information

DRS takes numerous steps to protect personal confidential information. Here are a few examples of the precautionary measures we take:

  • Train DRS staff about the importance of protecting personal confidential information;
  • Verify the recipient for all case correspondence;
  • Confirm arbitrator and mediator contact information (address, email and fax) upon appointment;
  • Encrypt electronic messages sent outside DRS that contain personal confidential information;
  • Encrypt digital files when stored on laptops or portable media devices (e.g., flash drives);
  • Store and dispose of case materials in a manner that preserves the confidentiality of the information; and
  • Remove personal confidential information that appears in publicly available awards.1

Case Related Documents that Include Personal Confidential Information

DRS does not disclose personal confidential information unless a party to whom the information pertains authorizes DRS to make the disclosure. DRS may, however, disclose personal confidential information under the following circumstances: to comply with a state or federal law or regulation; to respond to a subpoena, court order, government request, or other legal process; or as otherwise permitted by law.

What Arbitrators and Mediators do to Protect Personal Confidential Information

Arbitrators and mediators also play an important role in protecting personal confidential information. They have a duty to:

  • Keep confidential all information obtained in connection with an arbitration or mediation.
  • Transport and store, of case materials in a manner that preserves the confidentiality of the information.
  • Securely dispose of electronic and paper case materials at the conclusion of service on a case (for more information, see the Arbitrator’s Guide). 
  • Participate in DRS training programs on information security.

What Parties, Including Investors Representing Themselves, Can Do to Protect Personal Confidential Information

FINRA urges parties representing themselves2 and parties' counsel to take steps to protect personal confidential information. Actions parties can take include the following:

  • Safeguard personal confidential information by redacting, which means to black out or hide, such information from pleadings, exhibits, and other documents upon agreement of the parties. For example, the parties may agree:
    • Not to use or to redact birth dates, social security, brokerage, bank or financial account, or driver's license numbers; and
    • Where such data must be referenced, to use only the birth year, the last few digits of social security, brokerage, bank or financial account numbers, or similar information.
      redacted example
  • Ask the arbitrators to resolve any disagreement among the parties concerning the use or redacting of personal confidential information; and
  • Take all documents that are not needed for the official record when leaving the arbitration hearing or mediation session, if held in person.

Do's and Dont's of Redacting (Blacking Out or Hiding) Personal Confidential Information

DO’s:

Below are examples of methods that could be used to redact personal confidential information:

  • Use technology: Technology solutions may be available to the public for purposes of redacting information. Most of these solutions will have a fee for use, which would be incurred solely by the party using the solution. The technology solution will usually involve the download of a program that can be used to redact information as instructed by the user.
  • Manual redaction: Manually redact hard copy or paper documents by using adhesive tape that is 100% impenetrable by light and is neither transparent nor translucent. Such tape is typically found in providers of office supplies. The tape is typically colored black or white and comes in a range of widths, allowing text of different sizes to be completely hidden.

It is only after the personal confidential information is properly hidden, that parties should upload the documents to the DR Portal. Investors representing themselves may also mail or email the documents to DRS.

DON’Ts:

Below are examples of methods not to use for redacting personal confidential information:

  • Do not strikethrough text with a ball-point pen, dark marker or correction fluid, as the text underneath will often remain partially legible. Parties must take care to ensure that the information cannot be read from the back of the page or when the document is held up to light.
  • Do not change the font to white. By doing so, the words are still there although they seem to have disappeared.

By working together, we can ensure that personal confidential information is well protected.

1 Arbitration awards are made publicly available on FINRA’s website. Most arbitration awards do not contain personal confidential information. On occasion, an award might contain personal confidential information, such as an account number. In that case, FINRA staff will redact that information from the award before we publish the award on our website. See Arbitration Awards Online, https://www.finra.org/arbitration-mediation/arbitration-awards.

2 Parties representing themselves are not represented by counsel. Investors representing themselves are often claimants in an arbitration.