[Federal Register Volume 85, Number 92 (Tuesday, May 12, 2020)]
[Notices]
[Pages 28069-28082]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2020-10040]
[[Page 28069]]
-----------------------------------------------------------------------
SECURITIES AND EXCHANGE COMMISSION
[Release No. 34-88826; File No. S7-24-89]
Joint Industry Plan; Order Approving the Forty-Seventh Amendment
to the Joint Self-Regulatory Organization Plan Governing the
Collection, Consolidation and Dissemination of Quotation and
Transaction Information for Nasdaq-Listed Securities Traded on
Exchanges on an Unlisted Trading Privileges, as Modified by the
Commission, Concerning a Confidentiality Policy
May 6, 2020.
I. Introduction
On November 25, 2019,\1\ the Joint Self-Regulatory Organization
Plan Governing the Collection, Consolidation and Dissemination of
Quotation and Transaction Information for Nasdaq-Listed Securities
Traded on Exchanges on an Unlisted Trading Privileges Basis (``Nasdaq/
UTP Plan'' or ``Plan'') participants (``Participants'') \2\ filed with
the Securities and Exchange Commission (``SEC'' or ``Commission'')
pursuant to Section 11A of the Securities Exchange Act of 1934
(``Act'') \3\ and Rule 608 of Regulation National Market System
(``NMS'') thereunder,\4\ a proposal to amend the Nasdaq/UTP Plan.\5\
The amendment represents the Forty-Seventh Amendment to the Plan
(``Amendment''). As described in the Amendment, the Participants
proposed to adopt a confidentiality policy to provide guidelines for
the Operating Committee and the Advisory Committee of the Plan, and all
subcommittees thereof, regarding the confidentiality of any data or
information generated, accessed, or transmitted to the Operating
Committee, as well as discussions occurring at a meeting of the
Operating Committee or any subcommittee. The Amendment was published
for comment in the Federal Register on January 14, 2020.\6\
---------------------------------------------------------------------------
\1\ See Letter from Robert Books, Chairman, Operating Committee,
Nasdaq/UTP Plan, to Vanessa Countryman, Secretary, Commission, dated
November 19, 2019 (``Transmittal Letter'').
\2\ The Participants are the national securities association and
national securities exchanges that submit trades and quotes to the
Plan and include: Cboe BYX Exchange, Inc., Cboe BZX Exchange, Inc.,
Cboe EDGA Exchange, Inc., Cboe EDGX Exchange, Inc., Cboe Exchange,
Inc., Financial Industry Regulatory Authority, Inc., The Investors
Exchange LLC, Long-Term Stock Exchange, Inc., Nasdaq BX, Inc.,
Nasdaq ISE, LLC, Nasdaq PHLX, Inc., The Nasdaq Stock Market LLC, New
York Stock Exchange LLC, NYSE American LLC, NYSE Arca, Inc., NYSE
Chicago, Inc., and NYSE National, Inc. (each a ``Participant'' and
collectively, the ``Participants''). Participants also are members
of the Plan's Operating Committees. Other parties include the
``Processor,'' who is charged with collecting, processing and
preparing for distribution or publication all Plan information. The
``Administrator'' is charged with administering the Plan to include
data feed approval, customer communications, contract management,
and related functions. The ``Advisory Committee members'' are
individuals who represent particular types of financial services
firms or actors in the securities market, and who were selected by
Plan participants to be on the Advisory Committee. A list of the
Processor, Administrator, and Advisory Committee members is
available at http://www.utpplan.com/governance.
\3\ 15 U.S.C. 78k-1(a)(3).
\4\ 17 CFR 242.608.
\5\ The Plan governs the collection, processing, and
dissemination on a consolidated basis of quotation information and
transaction reports in Eligible Securities for its Participants.
This consolidated information informs investors of the current
quotation and recent trade prices of Nasdaq securities. It enables
investors to ascertain from one data source the current prices in
all the markets trading Nasdaq securities. The Plan serves as the
required transaction reporting plan for its Participants, which is a
prerequisite for their trading Eligible Securities. See Securities
Exchange Act Release No. 55647 (April 19, 2007), 72 FR 20891 (April
26, 2007).
\6\ See Securities Exchange Act Release No. 87910 (January 8,
2020), 85 FR 2212 (January 14, 2020) (``Notice''). Comments received
in response to the Notice are available at https://www.sec.gov/comments/s7-24-89/s72489.shtml.
---------------------------------------------------------------------------
In the Commission's view, the Amendment must balance protection
against the potential misuse of confidential information with the
strong interest in public transparency about the operations of the Plan
in light of the important function the Plan serves in the national
market system. This order approves the Amendment to the Plan, as
modified by the Commission, to better strike that balance. A copy of
the Amendment, as modified by the Commission, is attached as Exhibit A
hereto. The Commission concludes that the Amendment, as modified, is
appropriate in the public interest, for the protection of investors and
the maintenance of fair and orderly markets, to remove impediments to,
and perfect the mechanism of a national market system, or is otherwise
in furtherance of the purposes of the Act.\7\
---------------------------------------------------------------------------
\7\ 17 CFR 242.608(b)(2).
---------------------------------------------------------------------------
II. Description of the Proposal
According to the Participants, the confidentiality policy is
designed broadly to (i) protect against any potential misuse of
confidential information, which includes, but is not limited to,
protecting confidential information obtained or generated by the
Administrator and Processor in connection with the operation of the
securities information processor (``SIP'') operated pursuant to the
Plan; as well as (ii) to allow the Operating Committee to disclose
confidential information to the Advisory Committee to obtain its input
without concern that such confidential information may be shared beyond
the Advisory Committee.\8\
---------------------------------------------------------------------------
\8\ See Notice, supra note 6, 85 FR at 2207. The Amendment also
proposes to define the term ``Public Information'' and require that
certain information be made publicly available. See Section 2(d) of
the proposed policy.
---------------------------------------------------------------------------
Among other things, the Participants believe that the proposed
Amendment will allow for more sharing of information with the Advisory
Committee regarding the operation of the Plan and elicit more input by
the Advisory Committee on Plan matters that might otherwise be deemed
confidential.\9\ By sharing information that would in the ordinary
course be considered appropriate for confidential treatment, the
Participants believe that the Advisory Committee will be able to
provide more informed advice and recommendations with respect to the
operation and governance of the Plan.\10\
---------------------------------------------------------------------------
\9\ See Notice, supra note 6, 85 FR at 2213.
\10\ See id. at 2214.
---------------------------------------------------------------------------
A. Proposed Confidentiality Policy
The confidentiality policy proposed by the Participants applies to
all representatives of the Participants, Pending Participants, the
Nasdaq/UTP Administrator and Processor, and the Advisory Committee.
Additionally, it applies to agents of the Operating Committee,
including, but not limited to, attorneys, advisors, accountants,
contractors or subcontractors, as well as any third parties invited to
attend meetings of the Operating Committee or Plan subcommittees. These
persons are collectively defined in the confidentiality policy as
``Covered Persons.'' \11\
---------------------------------------------------------------------------
\11\ As specifically set forth by the Participants under Section
1(b) of the proposed policy, Covered Persons would not include staff
of the Commission.
---------------------------------------------------------------------------
The policy establishes guidelines and procedures for (i)
identifying and categorizing types of confidential information, (ii)
providing increasing degrees of protection for more sensitive types of
confidential information, and (iii) setting forth the circumstances in
which disclosure of confidential information may be authorized. The
proposed confidentiality policy creates three categories of
confidential information: (1) Restricted Information; \12\ (2) Highly
Confidential Information; \13\ and (3) Confidential
[[Page 28070]]
Information.\14\ The proposed confidentiality policy also defines the
term ``Public Information.'' \15\ The confidentiality policy outlines
the procedures with respect to identifying documents as Restricted,
Highly Confidential, or Confidential as well as the procedures
regarding how to treat documents and information in each category. The
confidentiality policy places the obligation on the Administrator and
the Processor to be the custodians of all documents discussed by the
Operating Committee and to maintain the classification of such
documents.\16\
---------------------------------------------------------------------------
\12\ Restricted Information was defined by the Participants
under Section 2(a) of the proposed policy as (i) highly sensitive
customer-specific financial information, (ii) customer-specific
audit information, (iii) other customer financial information, and
(iv) ``Personal Identifiable Information.''
\13\ Highly Confidential Information was defined by the
Participants under Section 2(b) of the proposed policy as (i) any
data or information shared in an Executive Session or that would
otherwise qualify for confidential treatment pursuant to the Plan's
Executive Session Policy; and (ii) any other highly sensitive
Participant-specific, customer-specific, individual-specific, or
otherwise sensitive information relating to the Operating Committee,
Participants, or customers that is not otherwise Restricted
Information. Highly Confidential Information includes: A
Participant's contract negotiations with the Processor or
Administrator; personnel matters; information concerning the
intellectual property of Participants or customers; and any document
subject to the Attorney-Client Privilege or Work Product Doctrine.
\14\ Confidential Information was defined by the Participants
under Section 2(c) of the proposed policy as (i) any non-public data
or information designated as Confidential by a majority vote of the
Operating Committee; (ii) any document generated by a Participant or
Advisor and designated by that Participant or Advisor as
Confidential; (iii) the minutes of the Operating Committee or any
subcommittee thereof unless approved by the Operating Committee for
release to the public; and (iv) the individual views and statements
of Covered Persons and SEC staff disclosed during a meeting of the
Operating Committee or any subcommittees thereunder.
\15\ Public Information was defined by the Participants under
Section 2(d) of the proposed policy as (i) any information that is
not either Restricted Information or Highly Confidential Information
or that has not been designated as Confidential Information; (ii)
any confidential information that has been approved by the Operating
Committee for release to the public; or (iii) any information that
is otherwise publicly available. Public Information includes, but is
not limited to, any topic discussed during a meeting of the
Operating Committee, an outcome of a topic discussed, or a Final
Decision of the Operating Committee.
\16\ The Administrator may, under delegated authority, designate
documents as Restricted, Highly Confidential, or Confidential, which
will be determinative unless altered by a majority vote of the
Operating Committee.
---------------------------------------------------------------------------
B. Procedures Governing Restricted Information
With respect to Restricted Information, to ensure the protection of
customer identities and customer-related information, the proposed
Amendment provides that such information will be disclosed only when
necessary to conduct Plan-related business.\17\ Specifically,
Restricted Information will be kept in confidence by the Administrator
and Processor and will not be disclosed to the Operating Committee or
any subcommittee thereof, or during Executive Session,\18\ or to the
Advisory Committee except in limited circumstances.
---------------------------------------------------------------------------
\17\ See Notice, supra note 6, 85 FR at 2215.
\18\ See Section IV.E.(d) of the Nasdaq/UTP Plan (providing for
the use of ``Executive Sessions'' in which the Operating Committee
meets without members of the Advisory Committee present).
---------------------------------------------------------------------------
C. Procedures Governing Highly Confidential Information
With respect to Highly Confidential Information, the proposed
confidentiality policy provides that such information may be disclosed
only in Executive Session of the Operating Committee or to the Legal
Subcommittee. Highly Confidential Information also may be disclosed to
SEC staff, unless it is protected by the Attorney-Client Privilege or
the Work Product Doctrine.
In addition, the proposal allows a Covered Person that is a
representative of a Participant to disclose Highly Confidential
Information to other employees or agents of the Participant or to the
Participant's affiliates as needed for such Covered Person to perform
his or her function on behalf of the Participant, as reasonably
determined by the Covered Person.\19\
---------------------------------------------------------------------------
\19\ The proposal requires that the policy be made available to
the recipient and states that the recipient will be required to
abide by the confidentiality policy.
---------------------------------------------------------------------------
Further, because of the heightened concerns regarding the
disclosure of Highly Confidential Information, in the event a Covered
Person is determined by a majority vote of the Operating Committee to
have disclosed Highly Confidential Information, the proposal authorizes
the Operating Committee to determine the appropriate remedy for the
breach based on the facts and circumstances of the event.\20\
---------------------------------------------------------------------------
\20\ For the representatives of a Participant, the proposal
specifies that appropriate remedies include a letter of complaint
submitted to the SEC, which may be made public by the Operating
Committee. For a member of the Advisory Committee, the proposal
specifies that appropriate remedies include removal of that member
from the Advisory Committee.
---------------------------------------------------------------------------
D. Procedures Governing Confidential Information
Under the proposed confidentiality policy, Confidential Information
may be disclosed to the Operating Committee, any subcommittee thereof,
and the Advisory Committee. A Covered Person may not disclose
Confidential Information to any individual that is not either a Covered
Person or a member of the SEC staff, except with authorization of the
Operating Committee, or as may be otherwise required by law.\21\
---------------------------------------------------------------------------
\21\ With respect to Confidential Information that is generated
by a Participant or member of the Advisory Committee, the Operating
Committee may authorize its disclosure only with the consent of that
Participant or Advisory Committee member.
---------------------------------------------------------------------------
Further, in order to elicit industry feedback, members of the
Advisory Committee may be authorized by the Operating Committee to
disclose particular Confidential Information to enable them to consult
with third-party industry representatives or technical experts subject
to certain restrictions.
As it does for Highly Confidential Information, the proposal allows
a Covered Person that is a representative of a Participant to disclose
Confidential Information to other employees or agents of the
Participant or to the Participant's affiliates as needed for such
Covered Person to perform his or her function on behalf of the
Participant, as reasonably determined by the Covered Person.\22\
---------------------------------------------------------------------------
\22\ The proposal requires that the policy be made available to
the recipient and states that the recipient will be required to
abide by the confidentiality policy.
---------------------------------------------------------------------------
Finally, the proposal requires a Covered Person that discloses
Confidential Information without the authorization of the Operating
Committee to report such disclosure to the Chair of the Operating
Committee, which will then be recorded in the minutes of the meeting of
the Operating Committee.\23\
---------------------------------------------------------------------------
\23\ The proposal further requires the name(s) of the person(s)
who disclosed such Confidential Information to be recorded in any
publicly available summaries of Operating Committee minutes.
---------------------------------------------------------------------------
III. Discussion and Modifications by the Commission
Pursuant to Rule 608, the Commission shall approve the amendment,
``with such changes or subject to such conditions as the Commission may
deem necessary or appropriate,'' if it finds that the amendment is
``necessary or appropriate in the public interest, for the protection
of investors and the maintenance of fair and orderly markets, to remove
impediments to, and perfect the mechanisms of, a national market
system, or otherwise in furtherance of the purposes of the Act.'' \24\
After carefully considering the comments received on the Amendment, the
Commission is approving the Amendment, as modified by the Commission
pursuant to Section 11A of the Act \25\ and Rule 608 thereunder. The
Commission believes the Plan should have a confidentiality policy, but
believes that the modifications
[[Page 28071]]
discussed in detail below are appropriate.
---------------------------------------------------------------------------
\24\ 17 CFR 608(b)(2).
\25\ 15 U.S.C. 78k-1.
---------------------------------------------------------------------------
A. Scope
1. Applicability
In the Notice, the Commission solicited comments on, among other
things, whether the proposed guidelines and procedures setting forth
the circumstances in which disclosure of confidential information may
be authorized are sufficiently clear and comprehensive.\26\ Among other
questions, the Commission asked whether commenters believe ``that the
scope of the proposed Amendment is sufficiently comprehensive to cover
all parties that might have access to confidential information, or
should the scope be broadened to apply to additional classes of
persons.'' For example, the Commission asked whether ``outsourced
service providers (including, but not limited to, firms and persons
that provide audit services, accounting services, or legal services to
the Plan, the Administrator, or the Processor) [should] be subject to
additional restrictions, particularly if they are directly or
indirectly affiliated with a Participant, the Administrator, the
Processor, or any entity that offers separately proprietary data
products to a substantially similar customer base, i.e., customers or
potential customers of the SIPs.'' \27\ The Commission further asked
whether the Plan should ``explicitly preclude itself from engaging with
an Administrator, Processor, auditor, or any agents or third parties
thereof, unless the entity establishes, maintains, and enforces
policies and procedures to safeguard confidential and proprietary
information and to prevent its direct or indirect misuse'' and, if so,
whether ``the Operating Committee [should] review those policies and
procedures and/or should they be made public (i.e., provided on the
Plan's website).'' \28\
---------------------------------------------------------------------------
\26\ See Notice, supra note 6, 85 FR at 2217.
\27\ Id.
\28\ Id.
---------------------------------------------------------------------------
In response to the Notice, the Advisory Committee said it believes
that ``the confidentiality policy should extend to any information
obtained by outsourced service providers in order to ensure that
information learned by such service providers is only shared with those
individuals of the Operating Committee required to receive such
information and in furtherance of the service provider's agreement with
the plan.'' \29\ Another commenter similarly stated that ``[o]utsourced
service providers (including, but not limited to, firms and persons
that provide audit, accounting, or legal services to the Plan(s), the
Administrator, or the Processor) should be subject to additional
restrictions, particularly if they are directly or indirectly
affiliated with a Participant Administrator, Processor, or any entity
that offers separately proprietary data products to a substantially
similar customer base.'' \30\ The commenter further recommended that
the ``Plan(s) should explicitly preclude themselves from engaging with
an Administrator Processor, auditor, or any agents or third parties
thereof, unless the entity attests and adheres to the confidentiality
policies and procedures established by the Plan . . . and provides
conflicts of interest disclosures.'' \31\
---------------------------------------------------------------------------
\29\ Letter from CTA/UTP Advisory Committee to Vanessa
Countryman, Secretary, Commission, dated January 24, 2020
(``Advisory Committee Letter'') at 2.
\30\ Letter from Joseph Kinahan, Managing Director, Client
Advocacy and Market Structure, TD Ameritrade to Vanessa A.
Countryman, Secretary, Commission, dated February 4, 2020 (``TD
Ameritrade Letter'') at 9.
\31\ Id. Other comments received in response to the Commission's
separate notice of a proposed order concerning a new NMS plan
regarding consolidated equity market data (Securities Exchange Act
Release No. 87906 (January 8, 2020), 85 FR 2164 (January 14, 2020)
(File No. 4-757) (``Governance Notice'') also supported a robust
confidentiality policy that would apply to SRO and non-SRO persons.
See, e.g., Letter from Sherry Madera, Chief Industry Government
Affairs Officer, Refinitiv, to Vanessa Countryman, Secretary,
Commission, dated February 27, 2020 at 3; Letter from Lisa Mahon
Lynch, Associate Director, Global Trading, Wellington Management
Company LLP, to Vanessa Countryman, Secretary, Commission, dated
February 28, 2020 at 2; Letter from Anders Franzon, General Counsel,
Members Exchange LLC, to Vanessa Countryman, Secretary, Commission,
dated February 28, 2020 at 6; Letter from Jennifer W. Han, Associate
General Counsel, Managed Funds Association, and Adam Jacobs-Dean,
Managing Director, Global Head of Markets Regulation, Alternative
Investment Management Association, to Vanessa Countryman, Secretary,
Commission, dated February 28, 2020 at 5; Letter from Ellen Greene,
Managing Director, Equity & Options Market Structure, Securities
Industry and Financial Markets Association, to Vanessa Countryman,
Secretary, Commission, dated February 28, 2020 at 6; Letter from
Rich Steiner, Head of Client Advocacy and Market Innovation, RBC
Capital Markets, LLC, to Vanessa Countryman, Secretary, Commission,
dated February 28, 2020 at 4; Letter from Joe Wald, Chief Executive
Officer, and Ray Ross, Chief Technology Officer; Clearpool Group, to
Vanessa Countryman, Secretary, Commission, dated February 28, 2020
at 5; Letter from Daniel Keegan, Head of North America Market
Securities Services, Co-Head of Global Equities & Securities
Services, Citigroup Global Markets Inc., to Vanessa Countryman,
Secretary, Commission, dated March 2, 2020 at 4.
---------------------------------------------------------------------------
After considering the comments received in response to the
Amendment, the Commission believes that it is appropriate to modify the
scope of the Amendment to extend it to affiliates and employees of the
Operating Committee, a Participant, a Pending Participant, the
Administrator, and the Processor. The Commission agrees with commenters
that the scope of the proposed Amendment should be broadened to include
other parties or persons that might have access to confidential
information, including but not limited to outsourced service providers,
such as firms and persons that provide audit services, accounting
services, or legal services to the Plan, Administrator, or
Processor.\32\ The Commission believes that all parties that generate,
receive, or have access to sensitive Plan-related information by virtue
of their service to the Plan, or their affiliation with a party that
has such access, should be subject to the same standards to protect the
confidentiality of that information. Including them within the scope of
the Amendment will strengthen the confidentiality of information
protections afforded by the policy.
---------------------------------------------------------------------------
\32\ Firms and persons that provide audit services, accounting
services, or legal services, depending on the services that they are
performing for the Plan, may or may not be licensed and/or
registered if they are not otherwise required to be so licensed or
registered under applicable law. For example, a person that works on
audits of SIP subscribers' data usage and customer classifications
for compliance with SIP billing requirements might not herself be a
registered public accountant. Persons that are registered and/or
licensed may be subject to pre-existing professional standards of
conduct that separately provide for the protection of confidential
client information and impose other professional responsibility
obligations. Whether persons are licensed and/or registered or not,
the Commission believes that extending the Amendment to cover
affiliates and employees is appropriate to ensure the protection of
confidential information in light of the unique conflicts of
interest inherent in Plan governance and operations. To the extent
disclosure of confidential information is required by law or
professional ethics obligations, the proposed Amendment provides for
that possibility and allows such disclosure.
---------------------------------------------------------------------------
More specifically, the Commission is concerned about the
possibility of a Participant exchange obtaining commercially valuable
data and information through its affiliates and employees that have
responsibilities to the Plan, and then using that information and/or
sharing it with employees or affiliates of the Participant exchange to
benefit the exchange's proprietary data businesses. The conflicts
resulting from such access could influence decisions as to the Plan's
operation and thereby impede its ability to achieve the goals of the
Plan to ensure the ``prompt, accurate, reliable, and fair collection,
processing, distribution and publication of information with respect to
quotations for and transactions in such securities and the fairness and
usefulness of the
[[Page 28072]]
form and content of such information.'' \33\
---------------------------------------------------------------------------
\33\ 15 U.S.C. 78k-1(c)(1)(B).
---------------------------------------------------------------------------
Accordingly, the Commission is adding the phrase ``affiliates,
employees, and'' to Section 1(b) and repeating the phrase ``a
Participant, a Pending Participant, the Administrator, and the
Processor,'' to provide that the policy will apply to ``affiliates,
employees, and agents of the Operating Committee, a Participant, a
Pending Participant, the Administrator, and the Processor.'' \34\
Similarly, the Commission is adding the phrase ``Covered Persons'' to
the start of Section 1(c) and deleting the words ``The Administrator
and Processor,'' to track the scope of Section 1(b) and the term
``Covered Persons'' used therein. The Commission also is moving text,
beginning with the second sentence of Section 1(c), to create a new
Section (d) and adding thereto the phrase ``and the control of their
Agents,'' to specifically require the written confidential information
policies, which the Administrator and Processor must establish to
protect information under their control, to also apply to information
under the control of Agents of the Administrator and Processor. The
Participants state that these provisions, like all others in the
proposal, were discussed with, and incorporate input and comments
received from, members of the Advisory Committee.\35\ Consistent with
comments received in response to the proposed Amendment from, among
others, members of the Advisory Committee, however, the Commission
believes that these changes are appropriate to help ensure that the
scope of the proposed Amendment is sufficiently broad so as to
encompass other parties or persons that might have access to
confidential information.
---------------------------------------------------------------------------
\34\ In addition, in the non-exhaustive list of Agents contained
in Section 1(b), the Commission is adding the word ``auditors.''
While auditors are already covered as ``contractors or
subcontractors,'' auditors have access to competitively sensitive
non-public information. Explicitly listing them avoids any doubt
that they are covered by the confidentiality policy.
\35\ See Notice, supra note 6, 85 FR at 2214, 2215.
---------------------------------------------------------------------------
Further, the Commission believes that it is appropriate to modify
the reference to ``all members of the Advisory Committee'' in Section
1(b) to be ``all members of the Advisory Committee and their
employers'' to require that Advisory Committee members' firms must
protect the confidentiality of Plan information in the same way, for
example, that a representative of a Participant's firm is required by
this modified Amendment to protect the confidentiality of Plan
information.\36\ In addition, Section 1(b) of the proposed policy
provides that ``[a]ll Covered Persons must adhere to the principles set
out in this Policy.'' The Commission believes that it is appropriate to
modify Section 1(b) to add a provision whereby ``all Covered Persons
that are natural persons may not receive Plan data and information
until they affirm in writing that they have read this Policy and
undertake to abide by its terms.'' The Commission believes that this
additional provision will strengthen Section 1(b) of the policy by
prohibiting access to Plan data and information until a Covered Person
has affirmed in writing that the Covered Person has read the policy and
undertaken to abide by its terms.
---------------------------------------------------------------------------
\36\ This change, together with other modifications made by the
Commission, should enhance the ability of Advisory Committee members
to seek meaningful input from their respective employers while
helping to ensure that standards for the sharing of protected
information apply on equal terms to all Covered Persons. See Section
3(d)(iii) (allowing the Operating Committee to authorize Advisors to
disclose particular Confidential Information for consultation
purposes).
---------------------------------------------------------------------------
2. Classification Based Solely on Content
With respect to proposed guidelines for the classification of
information, the Commission solicited comments on whether information
shared in Executive Sessions should be classified as Highly
Confidential simply because it had been shared in an Executive Session,
or whether information should ``be classified based solely on its
content and competitive sensitivity.'' \37\
---------------------------------------------------------------------------
\37\ See Notice, supra note 6, 85 FR at 2217.
---------------------------------------------------------------------------
In response, one commenter stated its belief that ``information
shared in Executive Session should be classified based solely on its
content and competitive sensitivity, and not simply due to the fact
that such information was shared during Executive Session.'' \38\
Another commenter stated that ``information shared in Executive Session
should not, by virtue of that fact alone, be treated as highly
confidential. Rather, a case-by-case analysis is appropriate to
determine whether or not information warrants confidential treatment.''
\39\
---------------------------------------------------------------------------
\38\ TD Ameritrade Letter, supra note 30, at 7. According to the
commenter, ``[a]llowing information to be classified based on its
content provides for a flexible policy that will mature without the
need for amendment as markets evolve.'' Id.
\39\ Letter from Rich Steiner, Head of Client Advocacy and
Market Information, RBC Capital Markets, to Vanessa Countryman,
Secretary Commission, dated February 4, 2020 (``RBC Letter'') at 2-
3.
---------------------------------------------------------------------------
The Commission agrees with commenters that policies and procedures
for the classification of information should be based on the content
and sensitivity of the information, rather than on the venue in which
the information is shared.
The Commission is therefore adding new Section 1(e) to require that
``[i]nformation will be classified solely based on its content.''
Consistent with that modification, the Commission believes that it is
appropriate to modify the definition of ``Highly Confidential
Information'' in Section 2(b) to delete therefrom a clause that would
have classified information as ``Highly Confidential'' solely because
it was shared in Executive Session or pursuant to the Executive Session
policy. Specifically, the Commission is deleting subsection (i)
containing the words ``(i) any data or information shared in an
Executive Session or that would otherwise qualify for confidential
treatment pursuant to the Plan's Executive Session Policy; and (ii)''
and making a conforming change to delete the word ``other'' from the
start of current subsection (ii).\40\ The Participants state that
Executive Sessions are used sparingly to discuss a limited set of
topics, as listed in the Plan's Executive Session policy, and that the
proposed policy seeks to further facilitate the sharing of additional
confidential information with the Advisory Committee.\41\ The
Commission recognizes the Operating Committee's efforts to limit the
use of Executive Sessions. Consistent with comments received, however,
the Commission believes that methods for classification of information
should be based on the content and sensitivity of information, rather
than on the forum in which the information is shared.
---------------------------------------------------------------------------
\40\ As such, the definition no longer contains two subsections.
\41\ See Notice, supra note 6, 85 FR at 2213.
---------------------------------------------------------------------------
Executive Sessions may be appropriate for Participants to discuss
information that, on its own merits, is Highly Confidential and
therefore not appropriate for broad dissemination. Executive Sessions
should not shield from public dissemination information that is not
sensitive or customer-specific and would not otherwise fall within the
definitions of Restricted or Highly Confidential. But by classifying
information based merely upon its being shared in Executive Session,
the proposed policy may have the effect of shielding information that
was not otherwise restricted or confidential. The Commission believes
that a content-based approach to classifying information should help
balance the need to safeguard sensitive information
[[Page 28073]]
with the important interest of providing greater transparency into the
governance and operation of the Plan. The Commission does not believe
that its modifications will inhibit information sharing within the
Operating Committee. Rather, sensitive information, as well as
information that is specific to individual persons and entities, that
is Highly Confidential will continue to be protected, including through
permissible use of Executive Sessions, while information that does not
meet that standard can and should be shared with Advisors on the
Operating Committee and, where appropriate, with the public.
3. Operating Committee Review of Policies
In the Notice, with respect to proposed policies and procedures for
the classification of information, the Commission solicited commenters'
views with respect to whether ``a need may arise for information or
data that are not initially categorized as confidential to be
categorized as such at a later point in time'' and, if so, whether the
Operating Committee should ``be able to classify or de-classify
material as appropriate based on a majority vote.'' \42\ Similarly, the
Commission asked whether the Amendment ``should require all
Participants and other Covered Persons to establish, maintain, and
enforce policies and procedures to safeguard confidential and
proprietary information received via their participation in the Plan
and to prevent its misuse by such Participants or entities controlling,
controlled by, or under common control with such Participants.'' \43\
The Commission further asked whether commenters agree ``that certain
confidential information may become less sensitive if it is anonymized
and aggregated'' and even whether ``certain types of restricted or
highly confidential information could be anonymized and aggregated to
the point where it could be classified as public.'' \44\ The Commission
asked about the methodology for anonymizing confidential information
and whether the methodology should be standardized.\45\ The Commission
also asked whether these policies should ``be subject to review and
approval by the Operating Committee, and be posted publicly, to help
ensure their adequacy and completeness.'' \46\
---------------------------------------------------------------------------
\42\ Id. at 2217.
\43\ Id. at 2216-2217.
\44\ Id. at 2217.
\45\ Id.
\46\ Id.
---------------------------------------------------------------------------
In response, one commenter stated ``the Plan(s) should explicitly
define the required policies and procedures to safeguard confidential
and proprietary information'' and designate responsibility for their
development to one body to ensure a standardized approach.\47\ With
respect to the classification of data or information, the commenter
stated that ``a need may arise for information or data that are not
initially categorized as confidential to be categorized as such at a
later point in time,'' pointing out that one ``would anticipate the
Plan Administrator may classify such document as Confidential subject
to the next meeting of the Operating Committee, where they should be
granted authority to review and re-classify or de-classify material as
appropriate based on a majority vote.'' \48\ With respect to methods
for rendering information less sensitive, the commenter believed that
``[c]ertain confidential information may become less sensitive if it is
anonymized and aggregated,'' adding that ``[c]ertain types of
restricted or highly confidential information could be anonymized and
aggregated to the point where it could be classified as confidential or
public.'' \49\ According to the commenter, ``[t]he methodology for
redacting/aggregating/anonymizing confidential information should be
standardized such that the Administrator, Processor, auditor, and all
other relevant parties follow a consistent practice. The methodology
should include requirements for what information should always be
redacted/aggregated/anonymized (e.g., customer names, size/demographic
information that could reasonably be used to determine the name of the
customer, etc.).'' \50\ The commenter recommended that ``[i]f any
information that is anonymized, aggregated or redacted could still
reasonably be used, whether independently or with current information
available in the industry, to identify less than or equal to two firms/
Participants, then such information may not be re-classified to
public.'' \51\
---------------------------------------------------------------------------
\47\ TD Ameritrade Letter, supra note 30, at 4.
\48\ Id. at 6.
\49\ Id. at 9.
\50\ Id.
\51\ Id.
---------------------------------------------------------------------------
After considering the comments received in response to the Notice,
the Commission believes that it is appropriate to modify Section 1(c)
(now located in Section 1(d)), which requires the Administrator and
Processor to establish written confidentiality policies, to more
specifically provide that those documents should include ``policies and
procedures that provide systemic controls for classifying,
declassifying, redacting, aggregating, anonymizing, and safeguarding
information.'' The Commission believes that adding this detail is
appropriate because it outlines the items that the written
confidentiality policies must, at a minimum, address in order to
protect the confidentiality of Plan information.
In addition, the Commission believes that it is appropriate to
require the Operating Committee to review and approve the
confidentiality policies of the Administrator and Processor, upon
adoption and on a periodic basis every two years thereafter or whenever
changes are made, after which the policies would be publicly posted. As
proposed, the policies would have been made available to the Operating
Committee every two years or when changes are made.
The Commission believes that requiring the Operating Committee to
review and approve these important policies in this manner will help
ensure that they are clear, complete, and comply with the Amendment.
The Commission believes it is appropriate specifically to require the
Operating Committee to affirmatively approve (in addition to
``review'') the policies to ensure that the Operating Committee
carefully considers and takes action on them. Requiring robust policies
at the Administrator and Processor level, where some of the most
sensitive information is generated, classified, and maintained for the
Plan, is critical to the effectiveness of the Amendment. The Operating
Committee can play an important role in protecting confidential
information by carefully reviewing the policies of the Administrator
and Processor and ensuring that they are consistent with the principles
and procedures established in this Amendment. Finally, the Commission
believes that it is appropriate to require the policies and procedures
to be made publicly available, which will provide important
transparency to market participants and the public about the steps the
Processor and Administrator take to protect commercially sensitive
information collected on behalf of the Plan. Further, the Commission
believes that transparency via public dissemination should be favored
to the greatest extent possible, and that when sensitive information
can be anonymized or aggregated to reduce its sensitivity, such
information should be anonymized and aggregated in accordance with a
clear, standardized methodology to be consistently applied by
Administrator and Processor. Thus, as revised, the Commission believes
that
[[Page 28074]]
Section 1(d) creates an effective process to develop clear and robust
confidentiality policies for the Administrator and Processor, and to
periodically update such policies as technology and markets evolve.
B. Definitions: Public Information
In the Notice, the Commission solicited comments on, among other
things, whether certain SIP-related information should be considered
public and available to be shared outside of the Operating
Committee.\52\ The Commission further asked whether ``information that
is not classified at some level of confidentiality should be considered
public and may be shared freely outside of the Operating Committee.''
\53\ The Commission also solicited comment on whether Advisory
Committee members needed access to sensitive information of substantial
commercial and competitive value in order to perform their duties, such
as underlying information relied on by Participants when making
decisions on funding improvements to the SIP.\54\
---------------------------------------------------------------------------
\52\ See Notice, supra note 6, 85 FR at 2217.
\53\ Id.
\54\ See id. at 2217-2218.
---------------------------------------------------------------------------
In response, one commenter stated that ``[i]nformation that is not
classified at some level of confidentiality should be considered public
and may be shared freely outside of the Operating Committee. Specific
information that [the commenter] believes should be considered public
and shared outside of the Operating Committee may include shared Plan
revenue information, industry subscriber and quote metrics, Processor
transmission metrics and Operating Committee minutes.'' \55\ According
to the commenter, ``[t]his information provides transparency into the
operation of the Plan(s), valuable for making determinations on the
efficacy of Plan operations.'' \56\ Two commenters supported the
adoption of specific policies to specify what information should be
made available outside of Executive Sessions or otherwise.\57\ One
commenter expressed concern about ``the inclusion of the individual
views and statements of Covered Persons during a meeting of the
Operating Committee as Confidential Information'' and suggested that
``at a minimum, a summary of direction/votes made by Covered Persons
should be included in Committee Minutes, which would become public
information.'' \58\ According to the commenter, ``[w]ithout
transparency into the views attributable to individual Covered Persons
responsible for directing Plan operations through their role on the
Operating Committee, members of the public, as consumers of plan data,
would be unable to determine whether those Covered Persons were acting
in the best interests of the Plan(s) and were effective in their
roles.'' \59\ One commenter supported disclosure of audited financial
information and data and the use of funds by the Plan.\60\ Another
commenter stated that ``the public deserves to know how much profits
the exchanges make . . . [and] information that is currently non-public
about the costs and operations [of the Plan].'' \61\
---------------------------------------------------------------------------
\55\ TD Ameritrade Letter, supra note 30, at 7.
\56\ Id.
\57\ See Letter from Jeff Brown, Senior Vice President--
Legislative and Regulatory Affairs, Charles Schwab, to Vanessa
Countryman, Secretary, Commission, dated February 4, 2020 (``Charles
Schwab Letter''), at 3 and RBC Letter, supra note 39, at 3.
\58\ TD Ameritrade Letter, supra note 30, at 5-6.
\59\ Id.
\60\ See Charles Schwab Letter, supra note 57, at 3.
\61\ Letter from Tyler Gellasch, Executive Director, Healthy
Markets Association to Vanessa Countryman, Secretary, Commission,
dated February 20, 2020 (``Healthy Markets Letter''), at 20.
---------------------------------------------------------------------------
One commenter expressed concern ``regarding the classification of
all contracts between the Operating Committee and its agents as
Confidential Information,'' stating that ``anyone with an interest in
the Plan(s) should have sufficient transparency into the agents
utilized by the Plan(s) to be able to contextualize and understand
whether or not a conflict of interest may exist between the Operating
Committee and contracted agents.'' \62\ According to the commenter,
this ``may be a situation in which the Plan(s) allow for the
flexibility to redact sensitive information from certain documents
(e.g., pricing terms and conditions) and allow the classification of
such information to remain public.'' \63\
---------------------------------------------------------------------------
\62\ TD Ameritrade Letter, supra note 30, at 6.
\63\ Id. The Commission is not modifying the Amendment to
specifically include this requirement, but the Operating Committee
could consider this suggestion.
---------------------------------------------------------------------------
As discussed above regarding the classification of Plan-related
information based solely on its content, the Commission believes that
public availability of information should be favored to the greatest
extent possible while still protecting sensitive information. After
considering the comments received in response to the Notice, the
Commission believes that this principle extends to certain information
discussed by or relied upon by the Participants when making decisions
on the administration and operation of the SIPs. Making this
information public, so that members of the Advisory Committee and
others can review it, will provide Advisors and members of the general
public with access to previously unavailable information on the
administration and operation of the SIPs, which serve an important
public function in the equities market. The SIPs are critical
regulatory market infrastructure, authorized by Congress and operated
jointly by self-regulatory organizations as a key part of the
securities markets, which Congress categorized as ``an important
national asset.'' \64\ Market participants rely on the SIPs to inform
their trading and assure their regulatory compliance efforts. Requiring
greater transparency into the Plan's operations should provide market
participants and the general public with a more comprehensive
understanding of Plan operations, which should, in turn, facilitate
their ability to make informed assessments and actively contribute,
whether through feedback, input, or otherwise, to the effective
governance of the Plan. And classifying the information discussed below
as Public Information will facilitate market participants' and the
public's ability to track, assess, and contribute to SIP governance and
operations and therefore is consistent with the public interest, the
protection of investors, and the maintenance of fair and orderly
markets.
---------------------------------------------------------------------------
\64\ 15 U.S.C. 78k-1(a)(1)(A).
---------------------------------------------------------------------------
While the proposed policy defines the term ``Public Information,''
the proposal does not expressly provide that any specific, identifiable
information or data relating to plan governance, operations, or
administration is public, other than, as an illustrative example, ``any
topic discussed during a meeting of the Operating Committee, an outcome
of a topic discussed, or a Final Decision of the Operating Committee. .
. .'' \65\ Defining more information on Plan governance, operations,
and administration as ``Public Information,'' while still protecting
sensitive information, should strengthen Plan administration and
governance by promoting transparency, thereby facilitating review and
feedback from market participants and the public. In addition, the
Advisory Committee members and other firms and members of the public
currently are prevented from seeing much of the underlying information
relied on by the Participants when making decisions on funding of and
improvements for the SIP. With greater access to information on the
Plan's governance, operations, and administration, Advisors will be
[[Page 28075]]
better able to perform their responsibilities and will have the benefit
of feedback from other firms and members of the public to inform their
decision-making. The Operating Committee will correspondingly benefit
from a valuable source of better informed input.
---------------------------------------------------------------------------
\65\ See Section 2(d) of the policy as proposed.
---------------------------------------------------------------------------
Thus, the Commission believes that it is appropriate to modify the
definition of ``Public Information'' in Section 2(d) to include the
following additional items of information: \66\
---------------------------------------------------------------------------
\66\ Further, the Commission is adding the phrase ``except to
the extent covered by (a), (b), or (d)'' to the start of Section
2(c) to reflect that nothing in Section 2(c) can alter what is
defined as Restricted, Highly Confidential, or Public. For example,
the Operating Committee, a Participant, or an Advisor could not
designate as Restricted Information, Highly Confidential
Information, or Confidential Information something that falls within
the definition of Public Information. The Commission also is
modifying the definition of ``Public Information'' under Section
2(d)(vi) concerning ``any information that is otherwise publicly
available'' to add the phrase ``except for information made public
as a result of a violation of this Policy or any applicable law or
regulation'' to clarify that ``otherwise publicly available'' refers
to information that is legally and appropriately within the public
domain.
---------------------------------------------------------------------------
The duly approved minutes of the Operating Committee and
any subcommittee thereof with detail sufficient to inform the public on
matters under discussion and the views expressed thereon (without
attribution),\67\
---------------------------------------------------------------------------
\67\ The Commission also is making a conforming change to
Section 2(c) to reflect this provision by deleting subsection (iii)
which, as proposed, stated: ``the minutes of the Operating Committee
or any subcommittee thereof unless approved by the Operating
Committee for release to the public.''
---------------------------------------------------------------------------
Plan subscriber and performance metrics, and
Processor transmission metrics.
With respect to the public availability of the duly approved
minutes for each meeting, the Commission is not requiring publicly
available minutes to include legally privileged, Restricted, or Highly
Confidential Information. Rather, the duly approved minutes generally
must reflect, at a minimum, what entity met, the time and date of the
meeting, the parties present, the topics discussed and views expressed
thereon (without attribution), and the decisions made and votes
recorded. Defining this information as ``Public Information'' will
facilitate broader awareness of the governance of the critical market
infrastructure for which the Participants are responsible under the
Plan. In turn, broader awareness of Plan governance can facilitate the
ability of market participants and the public to comment and provide
input on important matters being considered by the Participants for the
SIPs, which ultimately will promote fair and orderly markets and the
protection of investors in the public interest to extent their input
helps shape future Plan initiatives and strengthen the SIPs on which
market participants and the public rely.
Finally, the Commission believes, as supported by the commenter
discussed above, that certain core metrics on the Plan's subscribers,
performance, and data transmission should be public information in
order to promote transparency of the Plan's operation and oversight.
The Plan already makes such information publicly available, and
specifically including it within the definition of Public Information
recognizes that fact and ensures that such information, as well as
similar information that may be prepared in the future, can continue to
be made publicly available.\68\
---------------------------------------------------------------------------
\68\ See Metrics published by the Plan, available at https://www.utpplan.com/metrics. Current subscriber metrics publicly
disseminated include quarterly statistics on nonprofessional
subscribers, professional subscribers, households, quote usage,
internal vendors, external vendors, and non-display vendors. Current
key operating metrics publicly disseminated by the Plan include
statistics on system availability, peak messages (for certain
defined periods of time), capacity messages (for certain defined
periods of time), capacity versus peak ratios, peak transactions per
day, capacity transactions per day, average and median latency, and
various percentile latencies. As modified, the Amendment provides
that this category of information will be considered Public
Information. Accordingly, similar information prepared in the future
that falls under these categories will be classified as Public
Information.
---------------------------------------------------------------------------
Public availability of Plan subscriber and performance metrics and
Processor transmission metrics affords a limited, basic level of
transparency of the key metrics associated with Plan operations, such
as number of subscribers by category, system availability metrics,
latency, and other information. Public transparency of this
information, some of which already currently occurs, should provide
greater transparency into important aspects of the Plan's operation and
oversight. As noted above, the SIPs are critical regulatory market
infrastructure, operated jointly by self-regulatory organizations
providing quote and trade information upon which market participants
and the public rely and which Congress categorized as ``an important
national asset.'' \69\ As market participants rely on the SIPs to
inform their trading and assure their regulatory compliance efforts,
they have an interest in effective Plan operations and ensuring that
the SIPs keep pace with evolving technology, markets, and regulatory
developments. Classifying Plan subscriber and performance metrics and
Processor transmission metrics as ``Public Information'' will
facilitate market participants' and the public's ability to monitor,
assess, and contribute to improving SIP operations and the ability of
the SIPs to fulfill their purpose as critical market infrastructure as
the markets evolve, thereby facilitating the maintenance of fair and
orderly markets in the future.
---------------------------------------------------------------------------
\69\ 15 U.S.C. 78k-1(a)(1)(A).
---------------------------------------------------------------------------
For the reasons discussed throughout this order, the Commission
believes that transparency of key Plan information, including duly
approved Operating Committee meeting minutes, and performance,
subscriber, and transmission metrics, is consistent with the public
interest, the protection of investors, and the maintenance of fair and
orderly markets.\70\
---------------------------------------------------------------------------
\70\ The Plan currently publishes information on plan
operations, including summaries of the General Sessions from the
Operating Committees' quarterly meetings, plan policies, quarterly
and monthly performance metrics, pricing schedules, and technical
specifications. The Plan also makes publicly available certain
information on SIP-related revenues, including trade and quote
revenue distributed to Participants, per trade and quote message
revenue (in aggregate) distributed to Participants, and revenue
earned by fee type. This revenue data is updated on a quarterly
basis, with a 60 day lag, and is available on the Plan's website at
http://www.utpplan.com/metrics.
---------------------------------------------------------------------------
C. Procedures
1. General Procedures
As discussed above, the Commission believes that it is appropriate
to modify the Amendment to require the Administrator and Processor to
establish written confidentiality policies, which, among other things,
address the safeguarding of confidential information. As a conforming
change to Section 3(a)(iii), which requires the Administrator to ensure
that documents are properly labeled, the Commission is modifying that
provision to include the phrase ``and, if applicable, electronically
safeguarded.'' \71\ This conforming modification reflects the fact that
the Administrator would be required to safeguard electronic documents
within its control and/or possession such as by, for example,
encrypting them during transmission and/or protecting them with a
password or other access control.
---------------------------------------------------------------------------
\71\ The Commission also is modifying Section 3(a)(iii) to add
the word ``The'' before the word ``Administrator.''
---------------------------------------------------------------------------
2. Procedures for Restricted and Highly Confidential Information
In the Notice, the Commission solicited comments on, among other
things, whether commenters believe ``that Participants involved in the
operation or governance of each Plan have, by consequence of their
position,
[[Page 28076]]
access to information of substantial commercial and competitive
value.'' \72\ If so, the Commission asked commenters to consider
whether ``certain of that information, including customer-specific
financial information, customer-specific audit information, personally
identifiable information, and information concerning the intellectual
property of Participants or customers, is highly sensitive to such a
degree that its possession and use should be more tightly controlled.''
\73\
---------------------------------------------------------------------------
\72\ Notice, supra note 6, 85 FR at 2216.
\73\ Id.
---------------------------------------------------------------------------
The Commission asked whether ``any Participant or Advisory
Committee member that is directly involved in the management, sale, or
development of similar proprietary market data products that may be
sold to customers of the SIPs should have access to any customer
information from the SIPs'' or whether Operating Committee members, as
well as the Administrator, Processor, and auditor ``should be
prohibited, unless otherwise required by law, from sharing confidential
information with individuals that are not involved with the operation
of the Plan and individuals employed by or affiliated with the same
entity if such individuals are involved in the management, sale, or
development of proprietary data products that are offered separately to
a substantially similar customer base, i.e., customers or potential
customer of the SIPs.'' \74\
---------------------------------------------------------------------------
\74\ Id.
---------------------------------------------------------------------------
With respect to the Participants' representatives, the Commission
sought comment on whether ``Participants' representatives should be
subject to restrictions and/or information barriers as part of the
confidentiality policy to address their direct or indirect involvement
in the development or sale of proprietary data products to SIP
customers.'' \75\ The Commission further asked for comment on whether
``Participants' access to a list of the Processor's customers as well
as information on those customers' data usage and fees paid to the Plan
has competitive implications'' and, if so, whether ``the Plan should
require recusal in certain circumstances (e.g., during Executive
Sessions or Operating Committee meetings) because the potential for
misuse of competitively sensitive confidential information is too
great.'' \76\
---------------------------------------------------------------------------
\75\ Id.
\76\ Id. While the Commission is not modifying this Amendment to
require recusal, it is, as discussed below, modifying provisions
concerning the disclosure of Highly Confidential Information and
Confidential Information to others. In addition, the Commission
separately is approving modified amendments to address the Plan's
conflicts of interest policies, which, as approved, do provide for
recusal in certain circumstances. See Securities Exchange Act
Release No. 88824 (May 6, 2020).
---------------------------------------------------------------------------
Further, the Commission solicited comment on whether additional
protections are needed when ``a Participant is either employed by or
affiliated with an entity that offers proprietary data products that
are offered for sale to a substantially similar customer base (i.e.,
customer or potential customers of the SIPs).'' \77\ The Commission
also requested comment on whether a Participant should be able to share
information with other employees and agents, asking whether
``outsourced service providers (including, but not limited to, firms
and persons that provide audit services, accounting services, or legal
services to the Plan, the Administrator, or the Processor) [should] be
subject to additional restrictions, particularly if they are directly
or indirectly affiliated with a Participant, the Administrator, the
Processor, or any entity that offers separately proprietary data
products to a substantially similar customer base, i.e., customers or
potential customers of the SIPs.'' \78\ In response to the Notice and
requests for comment as to whether the proposed Amendment should be
further enhanced, the Commission received comments and input from the
Advisory Committee to the Plan, as well as from several other
commenters. The Advisory Committee had concerns with the proposed
situations in which Highly Confidential and Confidential information
may be shared by a Participant representative and Advisors. The
Advisory Committee explained that:
---------------------------------------------------------------------------
\77\ Notice, supra note 6, 85 FR at 2217.
\78\ Id.
Under the proposed policy, Highly Confidential and Confidential
information may each be shared by a representative of a Participant
`to other employees or agents of the Participant or its affiliates
only as needed for such Covered Person to perform his or her
function on behalf of the Participant, as reasonably determined by
the Covered Person.' We believe this standard is insufficient. The
rationale that information may be shared `to perform his or her
function on behalf of the Participant' assumes that the
representative's role on the committee is to further the interests
of the Participant rather than the plan--this strikes at the heart
of the conflict of interest inherent in the governance of the plan.
Such information should only be shared to further the interests of
the plan, and such sharing should at least be disclosed to and
potentially authorized by the Operating Committee. In situations
where the Participant representative is subject to a conflict due to
their own responsibility regarding the sale of proprietary exchange
data, the policy should limit access to such confidential
information by the Participant representative.\79\
---------------------------------------------------------------------------
\79\ Advisory Committee Letter, supra note 29, at 2.
One commenter stated that the proposed policy should include
``requirements to prevent the sharing of information with a competitive
value to those individuals who have direct responsibility for the
management, sale, or development of proprietary data products offered
separately.'' \80\ The commenter recommended that control procedures
for restricted, highly sensitive or confidential information ``should
be explicitly defined'' and should include ``required logging of the
sharing of Restricted and Highly Confidential Information,'' the
``required use of common logical security controls'' such as encryption
and password protection, and ``standardized procedures for the
redaction/aggregation/anonymization of information.'' \81\ The
commenter also stated that with respect to Restricted and Highly
Confidential Information, the policy should not allow for the automatic
sharing of information between the Administrator and Processor or the
Participant and its employees or agents unless required for performance
of responsibilities as required by the Plan; the commenter cited
customer audit information as an example.\82\ With respect to sharing
Restricted Information, the commenter also stated its belief that if
unredacted information is shared in Executive Session, ``the
Administrator should also ensure that no parties with a conflict of
interest are present in such session, or if so, should develop
procedures to require that individual's recusal to ensure they do not
receive information or significant competitive value.'' \83\ With
respect to the classification of information or data generated or
discussed by the Operating Committee, the commenter stated its belief
that the proposal should give non-SRO members information available in
executive session, because ``[n]on-SRO members may provide valuable
feedback and insight into decisions made with respect to an
Administrator, Processor, auditor, or third-party service provider.''
\84\ An additional commenter stated that ``if the Administrator
function is staffed by personnel of one of the Participant exchanges,
there must be a separation of functions'' and those personnel ``should
[[Page 28077]]
not be employed by the Participant's proprietary data business line,
and they should not share with the Participant's proprietary data
business line confidential SIP information obtained in their role as
administrator.'' \85\
---------------------------------------------------------------------------
\80\ TD Ameritrade Letter, supra note 30, at 3.
\81\ Id. at 2-3. These detailed suggestions are beyond the scope
of this Amendment, but the Operating Committee could consider them
in the appropriate context.
\82\ TD Ameritrade Letter, supra note 30, at 3.
\83\ Id.
\84\ Id. at 6-7.
\85\ Charles Schwab Letter, supra note 57, at 2-3.
---------------------------------------------------------------------------
After considering the comments received, the Commission believes
that it is appropriate to modify the procedures concerning Restricted
Information and Highly Confidential Information. Given that Restricted
Information and Highly Confidential Information both contain highly
sensitive and entity-specific information, the Commission believes that
Covered Persons in possession of such information should protect that
information in a substantially similar way by not disclosing it to
others, including Agents and outside affiliated persons, unless an
exception exists.\86\
---------------------------------------------------------------------------
\86\ See Section 2(a) of the Amendment, defining Restricted
Information (as including ``highly sensitive customer-specific''
information as well as ``Personal Identifiable Information'') and
Highly Confidential Information (as including ``highly sensitive
Participant-specific, customer-specific, individual-specific, or
otherwise sensitive information'').
---------------------------------------------------------------------------
The parties involved in the governance of the Plan and the SIP are
privy to confidential and proprietary information generated in
connection with the Plan. The Commission believes it is important to
protect the confidentiality of certain SIP-related information because
some Participant exchanges or their affiliates have a dual role as both
an SRO jointly responsible for the operation of the Plan, on one hand,
and, on the other hand, as part of a publicly held company that offers
proprietary data products and connectivity services. As a consequence
of this dual role, an exchange's representative on the Plan's Operating
Committee may have conflicting responsibilities both to the exchange's
proprietary data business as well as to the SIP. These potential
conflicts of interest are of particular concern because the proprietary
data products offered by an exchange generate revenue in addition to
the revenue the exchange receives from the Plan.
Allowing sensitive Plan-related information to be shared with and
disclosed to non-Plan personnel of the Participant--particularly those
responsible for the Participant's own proprietary data business that
competes with the SIP--could create a potential conflict. The
Commission is concerned about the potential for such sharing as non-
Plan personnel likely would have no need to know such information as
they have no responsibilities to the Plan. Further, if Restricted
Information or Highly Confidential Information is disclosed to those
persons, such persons could use the competitively valuable non-public
information for purposes unrelated to, and potentially inconsistent
with, Plan business. The Commission believes that Restricted
Information and Highly Confidential Information generated in connection
with the operation of the Plan and its SIP should be retained in the
confidences of Plan and SIP personnel not used in ways that could
potentially harm the interests of the Plan to the extent the
information is used to further the competitive advantage of a
Participant.
Therefore, the Commission is modifying Section 3(b)(i), which says
that Restricted Information will be kept in confidence by the
Administrator and Processor, to begin that subsection with the
following: ``Except as provided below, Covered Persons in possession of
Restricted Information are prohibited from disclosing it to others,
including Agents. This prohibition does not apply to disclosures to the
staff of the SEC or as otherwise required by law or to other Covered
Persons as expressly provided for by this Policy.'' \87\ The change is
intended to assure that the Administrator and Processor, who are
required by the policy to ``[keep] in confidence'' Restricted
Information, do not disclose that information to outside persons who
may be directly or indirectly affiliated with them, including
employees, agents, service providers, and subcontractors. The
Commission believes it would be inconsistent with the ``[keep] in
confidence'' standard for the Administrator or Processor to disclose
Restricted Information to affiliated persons, and is thus modifying the
Amendment to state so explicitly. The Commission believes that
Restricted Information, including personally identifiable information,
customer-specific financial information, and audit information, is
highly sensitive to such a degree that its possession and use should be
tightly controlled.
---------------------------------------------------------------------------
\87\ In addition, the Commission is modifying Section 3(b)(i)(3)
to add ``staff of the'' in front of ``SEC'' to conform to Section
3(b)(i)(1).
---------------------------------------------------------------------------
In addition, the Commission is modifying Section 3(c)(i)(1) to be
parallel to the Section 3(b)(i)(1) on Restricted Information. As
modified, Section 3(c)(i)(1) reads: ``Except as provided below, Covered
Persons in possession of Highly Confidential Information are prohibited
from disclosing it to others, including Agents. This prohibition does
not apply to disclosures to the staff of the SEC or as otherwise
required by law or to other Covered Persons authorized to receive it.''
The Commission believes that the proposed Amendment's restrictions on
the disclosure of Highly Confidential Information to an Executive
Session of the Operating Committee or to the Legal Subcommittee reflect
the highly sensitive and commercially valuable nature of that
information. In light of the value and sensitivity of such information,
the Commission shares commenters' concerns about circumstances in which
a Participant's representative, who has access to the information, may
be involved in the development or sale of proprietary data products to
a customer base similar to that of SIP customers. Thus, the Commission
believes that the use and possession of Highly Confidential Information
should be tightly controlled to prevent a Participant's representative
from disclosing such information to affiliated persons.
3. Procedures for Confidential Information
Most of the questions and potential modifications in the Notice
discussed above for Restricted Information and Highly Confidential
Information also relate to Confidential Information. In addition, in
the Notice, the Commission also solicited comments on, among other
things, whether ``commenters believe that the Plan should require all
Participants and other Covered Persons to establish, maintain, and
enforce policies and procedures to safeguard confidential and
proprietary information received via their participation in the Plan
and to prevent its misuse by such Participants or entities controlling,
controlled by, or under common control with such Participants.'' \88\
More specifically, the Commission asked whether commenters ``believe
that the proposed provisions allowing Participants to disclose
confidential and highly confidential information to other employees or
agents of the Participant or its affiliates as needed as they
reasonably determine'' are appropriate.\89\ Among other things, the
Commission also solicited comments on whether Participants'
representatives should be subject to restrictions and/or information
barriers to address their direct or indirect involvement in the
development or sale of proprietary data products to SIP customers.\90\
---------------------------------------------------------------------------
\88\ Notice, supra note 6, 85 FR at 2216-2217.
\89\ Id. at 2217.
\90\ See id. at 2216.
---------------------------------------------------------------------------
[[Page 28078]]
In response to the Notice, including the Commission's solicitation
of comments on these issues and on whether the proposed Amendment
should be further enhanced, the Advisory Committee stated that
``Advisors may only share Confidential Information to solicit industry
feedback and then only if specifically authorized by the Operating
Committee'' and recommended that there ``is no reason for Participant
representatives and Advisors to have different standards for sharing
information--in each case it should only be to further the interests of
the plan, and the standard for determining that threshold should be
equivalent.'' \91\ The Advisory Committee further recommended that the
provisions protecting Confidential Information ``should extend to any
information obtained by outsourced service providers in order to ensure
that information learned by such service providers is only shared with
those individuals of the Operating Committee required to receive such
information and in furtherance of the service provider's engagement and
the plan.'' \92\
---------------------------------------------------------------------------
\91\ Advisory Committee Letter, supra note 29, at 2.
\92\ Id.
---------------------------------------------------------------------------
As discussed above in the context of Restricted Information and
Highly Confidential Information, the Advisory Committee also objected
to the proposed standard that would allow a Participant's
representative to share Highly Confidential Information and
Confidential Information ``to other employees or agents of the
Participant or its affiliates only as needed for such Covered Person to
perform his or her function on behalf of the Participant, as reasonably
determined by the Covered Person.'' \93\ Believing that standard to be
``insufficient,'' the Advisory Committee criticized that provision as
assuming ``that the representative's role on the committee is to
further the interests of the Participant rather than the plan,'' which
the Advisory Committee said ``strikes at the heart of the conflict of
interest inherent in the governance of the plan.'' \94\ The Advisory
Committee recommended that confidential information ``should only be
shared to further the interests of the plan, and such sharing should at
least be disclosed to and potentially authorized by the Operating
Committee'' and where a Participant's representative ``is subject to a
conflict due to their own responsibility regarding the sale of
proprietary exchange data, the policy should limit access to such
confidential information by the Participant representative.'' \95\
---------------------------------------------------------------------------
\93\ Id.
\94\ Id.
\95\ Id.
---------------------------------------------------------------------------
One commenter agreed that the standard should be the same for all
Covered Persons, and that any confidential information should be shared
``as reasonably determined to perform [the Covered Person's]
function.'' \96\ Another commenter believed that control procedures
need to be sufficient to prevent disclosure to ``individuals without
specific reason to receive such information to address their
responsibilities according to the Plan(s) requirements.'' \97\ That
commenter recommended that the proposed policy include ``requirements
to prevent the sharing of information with competitive value to those
individuals who have direct responsibility for the management, sale, or
development of proprietary data products offered separately.'' \98\ The
commenter further recommended that, given the potential conflicts of
interests involved and the difficulties associated with mitigating such
conflicts, ``Participants should be explicitly prohibited from
disclosing restricted, highly confidential and confidential information
to other employees or agents of the Participant or its affiliates
unless authorized to do so on a case-by-case basis from the Operating
Committee, and only if required to do so for such individual to perform
his or her function on behalf of the Plan, unless such disclosure is
required by law.'' \99\
---------------------------------------------------------------------------
\96\ Charles Schwab Letter, supra note 57, at 3. Another comment
received in response to the Governance Notice recommended that the
confidentiality policy standards should be the same for both the
SROs and non-SROs and further suggested that for the non-SRO members
to be able to effectively engage with the Operating Committee, they
should be able to exercise reasonable discretion in sharing with
others within their firm information that may be relevant to policy
issues and proposals being considered by the SROs. See Letter from
John Ramsay, Chief Market Policy Officer, Investors Exchange, LLC,
to Vanessa Countryman, Secretary, Commission, dated March 4, 2020 at
6. A separate comment received in response to the Governance Notice
thought that the proposed Amendment would improve the handling of
confidential information and is designed both to protect
confidential information from misuse and to facilitate the sharing
of confidential information with the Advisory Committee. See Letter
from Patrick Sexton, EVP, General Counsel and Corporate Secretary,
Cboe Global Markets, Inc., to Vanessa Countryman, Secretary,
Commission, dated February 28, 2020 at 5.
\97\ TD Ameritrade Letter, supra note 30, at 2.
\98\ Id. at 3.
\99\ The commenter also stated that if disclosure is required by
law, the Covered Person should be required to first notify the
Operating Committee so as to provide it with an opportunity to
redact information or to dispute the requirement to provide it in
its entirety. See id. at 8. The Commission is not modifying the
Amendments to specifically include this requirement, but the
Operating Committee could consider this suggestion.
---------------------------------------------------------------------------
After considering the comments received, the Commission believes it
is appropriate to modify the Amendment concerning the procedures for
protecting Confidential Information. First, the Commission is modifying
Section 3(d)(i), which currently allows Covered Persons to disclose
Confidential Information to other Covered Persons. As discussed above,
the Commission has expanded the definition of Covered Persons to
include affiliates and employees, to whom disclosing Confidential
Information might not be appropriate. Accordingly, the Commission is
modifying Section 3(d)(i) to provide that a Covered Person ``may only
disclose Confidential Information to other persons who need to receive
such information to fulfill their responsibilities to the Plan.'' In
addition, disclosure will continue to be permitted to staff of the SEC,
as authorized by the Operating Committee, or as otherwise required by
law.\100\ For the same reasons discussed above with respect to
Restricted Information and Highly Confidential Information, the
Commission shares commenters' concerns about circumstances in which a
Participant's representative may be involved in the development or sale
of proprietary data products to a customer base similar to that of SIP
customers. If the Participant's representative straddles both roles
simultaneously, or provides Confidential Information to other employees
of the Participant, the Confidential Information can be used to benefit
the Participant's proprietary data business in a manner contrary to the
interests of the Plan.
---------------------------------------------------------------------------
\100\ The Commission is making non-substantive wording changes
to the last sentence of Section 3(d)(i) to accommodate the revisions
to the beginning of that sentence. Specifically, it is separating
out the second part of the sentence into a stand-alone sentence that
continues to provide that: ``A Covered Person also may disclose
Confidential Information to the staff of the SEC, as authorized by
the Operating Committee as described below, or as may be otherwise
required by law.''
---------------------------------------------------------------------------
Similarly, the Commission is modifying Section 3(d)(iv), which
applies to the sharing of information between a Participant's
representative and other employees or agents of the Participant. As
proposed, the provision would allow a Participant's representative to
disclose Confidential Information (and Highly Confidential Information)
``to other employees or agents of the Participant or its affiliates
only as needed for such Covered Person to perform his or her function
on behalf of the Participant, as reasonably determined by the Covered
Person.''
[[Page 28079]]
The Commission is striking the phrase ``Participant, as reasonably
determined by the Covered Person'' and the phrase ``and Highly
Confidential Information'' such that the revised provision will provide
that ``A Covered Person that is a representative of a Participant may
be authorized by the Operating Committee to disclose particular
Confidential Information to other employees or agents of the
Participant or its affiliates only in furtherance of the interests of
the Plan as needed for such Covered Person to perform his or her
function on behalf of the Plan.''
Without this change, the Commission agrees with commenters that the
protections in the proposed policy would be insufficient to adequately
address circumstances in which a Participant's representative may be
involved in the development or sale of proprietary data products to a
customer base similar to that of SIP customers. The Commission believes
that an exchange's commercial interests in its proprietary data
businesses and its potential access to confidential information
generated by the Plan and its SIP create potential conflicts of
interest, which have the potential to inappropriately influence
decisions as to the Plan's operation and thereby impede the Plan's
ability to ensure the ``prompt, accurate, reliable, and fair
collection, processing, distribution and publication of information
with respect to quotations for and transactions in such securities and
the fairness and usefulness of the form and content of such
information.'' \101\ Limiting the disclosure of Confidential
Information to situations where the disclosure is reasonably necessary
to further the interests of the Plan in the performance of the person's
role with the Plan should help mitigate the conflict by protecting
against misuse of commercially valuable non-public information.
---------------------------------------------------------------------------
\101\ 15 U.S.C. 78k-1(c)(1)(B).
---------------------------------------------------------------------------
Further, the Commission is making a change to conform Section
3(d)(iii) to the modifications it made to Section 3(d)(iv) so that both
Advisors and Participants' representatives will be subject to the same
standard with respect to disclosing Plan-related Confidential
Information. As modified, Advisors may be authorized by the Operating
Committee to disclose particular Confidential Information ``only in
furtherance of the interests of the Plan. . . .'' Advisors will still
be required to take any steps requested by the Operating Committee to
prevent further dissemination of that Confidential Information. The
Commission agrees with commenters that the standard for sharing
Confidential Information should be the same for Covered Persons that
are representatives of a Participant as well as Advisors, and be
limited to situations in which the disclosure is made to further the
interests of the Plan. Regardless of the identity of the person in
possession of Confidential Information, the Commission believes that
information that is labeled as Confidential Information should be
protected to the same extent by all Covered Persons. If such
information is appropriate to share more broadly, then it should be
classified as Public Information. The Commission is therefore modifying
the Amendment so that members of the Advisory Committee are treated
like Participants' representatives in this regard.
4. Unauthorized Disclosures
In the Notice, the Commission solicited comment on remedies for
disclosures inconsistent with the proposed policy. As proposed, the
policy provides that unauthorized disclosures of Highly Confidential
Information, as determined by the Operating Committee acting by
majority vote, will be subject to an ``appropriate remedy'' that could
include a letter of complaint against a Participant's representative,
or the removal of an Advisor from the Advisory Committee.\102\ With
respect to Confidential Information, the policy provides that
unauthorized disclosure will be self-reported to the Chair of the
Operating Committee and disclosed in the minutes. The Commission asked,
among other things, whether these proposed remedies are sufficient to
deter unauthorized disclosure, or whether any other consequences of
such disclosure should be provided.\103\ The Commission also asked
whether commenters believe that ``appropriate remedies for Participants
and Advisors should differ, or should potential remedies for
Participants that disclose confidential information also include the
possibility of removal of that Participant from the Operating
Committee.'' \104\
---------------------------------------------------------------------------
\102\ See Section 3(c)(ii).
\103\ See Notice, supra note 6, 85 FR at 2218.
\104\ Id.
---------------------------------------------------------------------------
In response, one commenter stated that ``[r]emedies for
unauthorized disclosure of any confidential information, regardless of
classification, should be the same irrespective of the nature of the
Covered Person'' and that ``breaches by a Covered Person should be
disclosed to the Operating Committee, recorded, and reviewed by the
Operating Committee for determination upon majority vote of an
appropriate remedy, which should include remedies up to and including:
Required recusal of future discussions of related confidential topics,
or removal from any role with respect to Plan Activities.'' \105\
According to the commenter, ``[a]ny reviews of votes regarding a breach
should require recusal of such Covered Person who caused the breach.''
\106\ Another commenter believes that a Participant representative
should be removed from the Operating Committee if she is in violation
of the Confidentiality Policy, just as an Advisory Committee member can
be removed as described in the Amendment.\107\
---------------------------------------------------------------------------
\105\ TD Ameritrade Letter, supra note 30, at 10 (internal
quotation marks omitted).
\106\ Id.
\107\ See Charles Schwab Letter, supra note 57, at 3. The
Commission is not modifying the Amendment to remove a Participant
from the Operating Committee in the manner suggested by the
commenter. The Participants, as SROs, have legal obligations and
responsibilities under the Act, including with regard to operating
the Plan. See 15 U.S.C. 78k-1(a)(3)(B). Requiring their removal from
the Operating Committee would impede their ability to fulfil their
statutory requirements.
---------------------------------------------------------------------------
After considering the comments received in response to the Notice,
the Commission believes that it is appropriate to modify Section
3(d)(vi) to specifically provide a process for a Covered Persons to
report potential unauthorized disclosures to the Chair of the Operating
Committee so that the Amendment does not rely solely on self-reporting
of unauthorized disclosures. Specifically, the Commission is adding the
following new sentence to the beginning of Section 3(d)(vi): ``A person
that has reason to believe that Confidential Information has been
disclosed by another without the authorization of the Operating
Committee or otherwise in a manner inconsistent with this Policy may
report such potential unauthorized disclosure to the Chair of the
Operating Committee.'' \108\ The Participants in their submission state
that the proposal addresses unauthorized disclosure insofar as a
Covered Person who discloses Confidential Information without the
authorization of the Operating Committee would be obligated to self-
report such disclosure to the Chair of the Operating Committee, which
would then be recorded in the minutes of the Operating Committee.\109\
The Commission believes that relying on self-reporting is insufficient.
Rather,
[[Page 28080]]
the Commission believes that providing a formal mechanism for any
Covered Person as well as others to report potential unauthorized
disclosures will assure such individuals that they can bring such
instances to the attention of the leadership of the Operating
Committee.\110\ This modification is intended to make clear that
persons who have reason to believe that Confidential Information has
been disclosed by another without the authorization of the Operating
Committee or otherwise in a manner inconsistent with this Policy may
report such potential unauthorized disclosure to the Chair of the
Operating Committee. Thus, the Commission believes that this
modification will promote compliance with persons tasked with
protecting the confidentiality of Plan-related information and, to the
extent it results in unauthorized disclosures being found and disclosed
in the minutes, it will provide transparency into overall compliance
with the policy.
---------------------------------------------------------------------------
\108\ In light of the new first sentence, the Commission is
making a conforming change to the second sentence of Section
3(d)(vi) to begin with the phrase ``In addition.''
\109\ See Notice, supra note 6, 85 FR at 2215.
\110\ This new provision supplements the proposed provisions
that require self-reporting by a Covered Person in breach of the
policy and the recording of such breaches in the minutes of the
Operating Committee, neither of which the Commission is modifying.
The Commission is modifying Section 3(d)(vi) to add the words
``self-reported'' to make it clear that the proposed provisions that
require the name of the self-reporting Participant to be identified
in the minutes do not apply to the Commission's modification that
lets any person report such potential unauthorized disclosure to the
Chair of the Operating Committee. The Operating Committee may, at
its discretion, choose to put in place an appropriate process to
review such reports of potential unauthorized disclosures.
---------------------------------------------------------------------------
IV. Commission Findings
For the reasons discussed throughout, the Commission finds that the
proposed Amendment to the Plan, as modified by the Commission, is
consistent with the requirements of the Act and the rules and
regulations thereunder, and in particular, Section 11A of the Act \111\
and Rule 608 \112\ thereunder in that it is necessary or appropriate in
the public interest, for the protection of investors and the
maintenance of fair and orderly markets, to remove impediments to, and
perfect the mechanisms of, a national market system.
---------------------------------------------------------------------------
\111\ 15 U.S.C. 78k-1.
\112\ 17 CFR 240.608.
---------------------------------------------------------------------------
Section 11A of the Act \113\ sets forth Congress' finding that it
is in the public interest and appropriate for the protection of
investors and the maintenance of fair and orderly markets to ensure the
prompt, accurate, reliable and fair collection, processing,
distribution, and publication of information with respect to quotations
for and transactions in such securities and the fairness and usefulness
of the form and content of such information. The Commission believes
that the confidentiality policy, as modified, furthers these goals set
forth by Congress.
---------------------------------------------------------------------------
\113\ 15 U.S.C. 78k-1(c)(1)(B).
---------------------------------------------------------------------------
V. Conclusion
It is therefore ordered, pursuant to Section 11A of the Act,\114\
and the rules thereunder, that the proposed Amendment to the Nasdaq/UTP
Plan (File No. S7-24-89), as modified by the Commission, is approved.
---------------------------------------------------------------------------
\114\ 15 U.S.C. 78k-1.
By the Commission.
J. Matthew DeLesDernier,
Assistant Secretary.
Exhibit A
Marked To Show Changes From the Proposal
The Commission's additions are italicized; deletions are
[bracketed].
UTP Confidentiality Policy
1. Purpose and Scope
a. The purpose of this Confidentiality Policy (the ``Policy'') is
to provide guidance to the Operating and Advisory Committees of the UTP
Plan (the ``Plan''), and all Subcommittees thereof, regarding the
confidentiality of any data or information (in physical or electronic
form) generated, accessed or transmitted to the Operating Committee, as
well as discussions occurring at a meeting of the Operating Committee
or any Subcommittee.
b. This Policy applies to all representatives of the Participants,
Pending Participants, and the UTP Administrator and Processor
(``Administrator and Processor''); affiliates, employees, and agents of
the Operating Committee, a Participant, a Pending Participant, the
Administrator, and the Processor, including, but not limited to,
attorneys, auditors, advisors, accountants, contractors or
subcontractors (``Agents''); any third parties invited to attend
meetings of the Operating Committee or Plan subcommittees; and all
members of the Advisory Committee and their employers (collectively,
``Covered Persons''). Covered Persons do not include staff of the
Securities and Exchange Commission (``SEC''). All Covered Persons must
adhere to the principles set out in this Policy and all Covered Persons
that are natural persons may not receive Plan data and information
until they affirm in writing that they have read this Policy and
undertake to abide by its terms.
c. Covered Persons [The Administrator and Processor ]may not
disclose Restricted, Highly Confidential, or Confidential information
except as consistent with this Policy and directed by the Operating
Committee.
d. The Administrator and Processor will establish written
confidential information policies that provide for the protection of
information under their control and the control of their Agents,
including policies and procedures that provide systemic controls for
classifying, declassifying, redacting, aggregating, anonymizing, and
safeguarding information, that is in addition to, and not less than,
the protection afforded herein. Such policies will be reviewed and
approved by the Operating Committee, publicly posted, and made
available to the Operating Committee for review and approval every two
years thereafter or when changes are made, whichever is sooner.
e. Information will be classified solely based on its content.
2. Definitions
a. ``Restricted Information'' is highly sensitive customer-specific
financial information, customer-specific audit information, other
customer financial information, and Personal Identifiable Information
(``PII'').
b. ``Highly Confidential Information'' is[: (i) any data or
information shared in an Executive Session or that would otherwise
qualify for confidential treatment pursuant to the Plan's Executive
Session Policy; and (ii)]any [other ]highly sensitive Participant-
specific, customer-specific, individual-specific, or otherwise
sensitive information relating to the Operating Committee,
Participants, or customers that is not otherwise Restricted
Information. Highly Confidential Information includes: A Participant's
contract negotiations with the Processor or Administrator; personnel
matters; information concerning the intellectual property of
Participants or customers; and any document subject to the Attorney-
Client Privilege or Work Product Doctrine.
c. ``Confidential Information'' is, except to the extent covered by
(a), (b), or (d): (i) any non-public data or information designated as
Confidential by a majority vote of the Operating Committee; (ii) any
document generated by a Participant or Advisor and designated by that
Participant or Advisor as Confidential; and (iii) [the minutes of the
Operating Committee or any subcommittee thereof unless approved by the
Operating Committee for release to the public; and (iv)]the individual
views and statements of
[[Page 28081]]
Covered Persons and SEC staff disclosed during a meeting of the
Operating Committee or any subcommittees thereunder.
d. ``Public Information'' is: (i) any information that is not
either Restricted Information or Highly Confidential Information or
that has not been designated as Confidential Information; (ii) any
confidential information that has been approved by the Operating
Committee for release to the public; [or ](iii) the duly approved
minutes of the Operating Committee and any subcommittee thereof with
detail sufficient to inform the public on matters under discussion and
the views expressed thereon (without attribution); (iv) Plan subscriber
and performance metrics; (v) Processor transmission metrics; and (vi)
any information that is otherwise publicly available, except for
information made public as a result of a violation of this Policy or
any applicable law or regulation. Public Information includes, but is
not limited to, any topic discussed during a meeting of the Operating
Committee, an outcome of a topic discussed, or a Final Decision of the
Operating Committee, as defined below.
e. A ``Final Decision of the Operating Committee'' is an action or
inaction of the Operating Committee as a result of the vote of the
Operating Committee, but will not include the individual votes of a
Participant.
f. The ``Operating Committee'' consists of the Participants,
Pending Participants, Administrator and Processor, and designated
Agents.
g. An ``Executive Session'' of the Operating Committee consists of
the Participants, Administrator and Processor and designated Agents.
h. The ``Advisory Committee'' consists of any individual selected
by the Operating Committee or a Plan Participant as an advisor to the
Operating Committee.
i. The ``Legal Subcommittee'' of the Operating Committee consists
of the Participants, Administrator and Processor and Legal Counsel.
3. Procedures
a. General
i. The Administrator and Processor will be the custodians of all
documents discussed by the Operating Committee and will be responsible
for maintaining the classification of such documents pursuant to this
Policy.
ii. The Administrator may, under delegated authority, designate
documents as Restricted, Highly Confidential, or Confidential, which
will be determinative unless altered by a majority vote of the
Operating Committee.
iii. The Administrator will ensure that all Restricted, Highly
Confidential, or Confidential documents are properly labeled and, if
applicable, electronically safeguarded.
iv. All contracts between the Operating Committee and its Agents
shall require Operating Committee information to be treated as
Confidential Information that may not be disclosed to third parties,
except as necessary to effect the terms of the contract or as required
by law, and shall incorporate the terms of this Policy, or terms that
are substantially equivalent or more restrictive, into the contract.
b. Procedures Concerning Restricted Information
i. Except as provided below, Covered Persons in possession of
Restricted Information are prohibited from disclosing it to others,
including Agents. This prohibition does not apply to disclosures to the
staff of the SEC or as otherwise required by law, or to other Covered
Persons as expressly provided for by this Policy. Restricted
Information will be kept in confidence by the Administrator and
Processor and will not be disclosed to the Operating Committee or any
subcommittee thereof, or during Executive Session, or the Advisory
Committee, except as follows:
1. If the Administrator determines that it is appropriate to share
a customer's financial information with the Operating Committee or a
subcommittee thereof, the Administrator will first anonymize the
information by redacting the customer's name and any other information
that may lead to the identification of the customer.
2. The Administrator may disclose the identity of a customer that
is the subject of Restricted Information in Executive Session only if
the Administrator determines in good faith that it is necessary to
disclose the customer's identity in order to obtain input or feedback
from the Operating Committee or a subcommittee thereof about a matter
of importance to the Plan. In such an event, the Administrator will
change the designation of the information at issue from ``Restricted
Information'' to ``Highly Confidential Information,'' and its use will
be governed by the procedures for Highly Confidential Information in
paragraph (c) below.
3. The Administrator may share Restricted Information related to
any willful, reckless or grossly negligent conduct by a customer
discovered by the Administrator with the UTP Administrator or with the
staff of the SEC, as appropriate, upon majority vote of the Operating
Committee in Executive Session, provided that, in any report by the
Administrator during Executive Session related to such disclosure, the
Administrator anonymizes the information related to the wrongdoing by
removing the names of the party or parties involved, as well as any
other information that may lead to the identification of such party or
parties.
c. Procedures Concerning Highly Confidential Information
i. Disclosure of Highly Confidential Information:
1. Except as provided below, Covered Persons in possession of
Highly Confidential Information are prohibited from disclosing it to
others, including Agents. This prohibition does not apply to
disclosures to the staff of the SEC or as otherwise required by law, or
to other Covered Persons authorized to receive it. Highly Confidential
Information may be disclosed only in Executive Session of the Operating
Committee or to the Legal Subcommittee.
2. Highly Confidential Information may be disclosed to the staff of
the SEC, unless it is protected by the Attorney-Client Privilege or the
Work Product Doctrine. Any disclosure of Highly Confidential
Information to the staff of the SEC will be accompanied by a FOIA
Confidential Treatment request.
3. Apart from the foregoing, the Operating Committee has no power
to authorize any other disclosure of Highly Confidential Information.
ii. In the event that a Covered Person is determined by a majority
vote of the Operating Committee to have disclosed Highly Confidential
Information, the Operating Committee will determine the appropriate
remedy for the breach based on the facts and circumstances of the
event. For the representatives of a Participant, remedies include a
letter of complaint submitted to the SEC, which may be made public by
the Operating Committee. For a member of the Advisory Committee,
remedies include removal of that member from the Advisory Committee.
d. Procedures Concerning Confidential Information
i. Confidential Information may be disclosed to the Operating
Committee, any subcommittee thereof, and the Advisory Committee. A
Covered Person may only disclose Confidential Information to other
persons who need to receive such information to fulfill their
responsibilities to the Plan. A Covered Person also may disclose
Confidential Information to [will not disclose Confidential Information
to any individual that is not either a Covered
[[Page 28082]]
Person or a member of]the staff of the SEC, [except]as authorized by
[with authorization of]the Operating Committee as described below, or
as may be otherwise required by law.
ii. The Operating Committee or a subcommittee thereof may authorize
the disclosure of Confidential Information by an affirmative vote of
the number of members that represent a majority of the total number of
members of the Operating Committee or subcommittee. Notwithstanding the
foregoing, the Operating Committee will not authorize the disclosure of
Confidential Information that is generated by a Participant or Advisor
and designated by that Participant or Advisor as Confidential, unless
such Participant or Advisor consents to the disclosure.
iii. Members of the Advisory Committee may be authorized by the
Operating Committee to disclose particular Confidential Information
only in furtherance of the interests of the Plan, to enable them to
consult with industry representatives or technical experts, provided
that the Member of the Advisory Committee takes any steps requested by
the Operating Committee to prevent further dissemination of that
Confidential Information, including providing the individual(s)
consulted with a copy of this policy and requesting that person to
maintain the confidentiality of such information in a manner consistent
with this policy.
iv. A Covered Person that is a representative of a Participant may
be authorized by the Operating Committee to disclose particular
Confidential Information [and Highly Confidential Information]to other
employees or agents of the Participant or its affiliates only in
furtherance of the interests of the Plan as needed for such Covered
Person to perform his or her function on behalf of the
Plan[Participant, as reasonably determined by the Covered Person]. A
copy of this policy will be made available to recipients of such
information who are employees or agents of a Participant or its
affiliates that are not Covered Persons, who will be required to abide
by this policy.
v. A Covered Person may disclose their own individual views and
statements that may otherwise be considered Confidential Information
without obtaining authorization of the Operating Committee, provided
that in so disclosing, the Covered Person is not disclosing the views
or statements of any other Covered Person or Participant that are
considered Confidential Information.
vi. A person that has reason to believe that Confidential
Information has been disclosed by another without the authorization of
the Operating Committee or otherwise in a manner inconsistent with this
Policy may report such potential unauthorized disclosure to the Chair
of the Operating Committee. In addition, a [A ]Covered Person that
discloses Confidential Information without the authorization of the
Operating Committee will report such disclosure to the Chair of the
Operating Committee. Such self-reported unauthorized disclosure of
Confidential Information will be recorded in the minutes of the meeting
of the Operating Committee and will contain: (a) The name(s) of the
person(s) who disclosed such Confidential Information, and (b) a
description of the Confidential Information disclosed. The name(s) of
the person(s) who disclosed such Confidential Information will also be
recorded in any publicly available summaries of Operating Committee
minutes.
[FR Doc. 2020-10040 Filed 5-11-20; 8:45 am]
BILLING CODE 8011-01-P