top of page
Search

What Can We Learn from $14.5 Million Lawsuit about Protection of Personal Information?

Writer: ursula.kozwitzkiursula.kozwitzki

Vanderbilt University in Nashville paid a proposed $14.5 million to settle a class-action fiduciary lawsuit charging the university failed to prevent excessive fees for proper record-keeping, investment and administrative services.


This lawsuit initiated on the U.S. soil, it was between Employee Retirement Income Security Act, ERISA (U.S.) and Vanderbilt University in Nashville, for breaching their fiduciary duties in the management of retirement plans, charging they failed to use their bargaining power to prevent excessive fees for record-keeping, investment and administrative services. At the time the original lawsuit was filed, Vanderbilt's plan used four record keepers that offered a total of 340 investment options. The retirement plan later hired a company, Fidelity Investments as a single record keeper. Plaintiffs also filed an amended complaint in 2018, alleging the university failed to protect retirement plan assets by allowing third parties to market services to participants.


A case brought by participants in a Vanderbilt University plan argued that participant data should be covered under ERISA as a retirement plan asset. The case relied on an expanded interpretation of Interpretive Bulletin 96-1 from the Department of Labor (U.S.) on investor education to require fiduciary protection of information. While the court did not rule on the participants' claim, Vanderbilt agreed in a settlement to prohibit the plan's recordkeeper from using participant information acquired in the course of providing recordkeeping services to market other products or services to participants unless a request for such products or services is initiated by a participant.

Vanderbilt University paid out $14.5 million to resolve a class action challenging the fees and investment options in its $3.4 billion retirement plan.

Guarding participant data


Participant data should be treated as a plan asset, recent litigation suggests that plan sponsors will want to make an effort to safeguard data and limit what they share with service providers.There are several best practices for plan sponsors that have emerged as a result of the settlements:


Do not approve of personal information being used to cross-sell


Recent litigation suggests that plan participants are not interested in having their personal information used to help recordkeepers or advisors market other products and services to them. This data includes investment choices, age, and account balances among other factors.


Settlement impacts responsibilities of retirement plan sponsors


To prohibit the plan's record-keeper from using participant information acquired in the course of providing record-keeping services to market other products or services to participants unless a request for such products or services is initiated by a participant.


Plan sponsors should begin discussions on data protection with service providers.It is advisable for plan sponsors to inquire about what data is needed by a service provider and for what purpose during the engagement phase.


Information about cross-marketing and cybersecurity practices should also be obtained through the engagement phase and a limited scope for the use of participant data should be established.

Mismanagement of retirement plans by American Universities


This deal is the largest settlement in the recent series of lawsuits accusing prominent universities of retirement plan mismanagement. Other settling schools include Duke University ($10.65 million), the University of Chicago ($6.5 million), and Brown University ($3.5 million).


Comments


bottom of page