Breach of confidentiality

LYNN is an investment officer at a boutique fund management outfit in downtown Raffles Place. She has an advisory customer who has talked to her about giving approximately $300,000 to charity in the midst of the ongoing pandemic. Lynn is also treasurer of a not-for-profit organisation, which is planning its annual giving campaign. The organisation hopes to expand its list of prospects, particularly those capable of substantial gifts as the Covid-19 outbreak has reduced contributions from those who lost their income.

Lynn recommends that the not-for-profit organisation's vice-president for corporate gifts call on her client and ask for a donation in the $300,000 range.

In this particular scenario, even though the attempt to help the charitable organisation was well intended, Lynn breached the CFA Institute Preservation of Confidentiality Standard by revealing confidential information about her client. What does the standard entail and why is this important?

Preservation of confidentiality

As a premier global association for investment management professionals, the CFA Institute, under its Preservation of Confidentiality Standard, requires its members to keep information about current, former, and prospective clients confidential - unless the information concerns illegal activities on the part of the client; disclosure is required by law; or the client or prospective client permits disclosure of the information.

In the above case, Lynn could have sought her client's permission to disclose confidential information to the charitable organisation, or pointed the client to the organisation of which she is the treasurer. Disclosure on Lynn's position in the charitable organisation is also advised.

The standard is applicable when (1) information is received because of a manager's special ability to conduct a portion of the client's business or personal affairs and (2) information is received that arises from or is relevant to that portion of the client's business that is the subject of the special or confidential relationship. If disclosure of the information is required by law or the information concerns illegal activities by the client, however, there may be an obligation to report the activities to the appropriate authorities.

Does the status of client matter?

This standard protects the confidentiality of client information even if the person or entity is no longer a client. Therefore, the confidentiality of client records must be maintained even after the client relationship has ended. If a client or former client expressly authorises a disclosure of information, however, the manager may follow the terms of the authorisation and provide the information.

Recommended procedures for compliance

The simplest, most conservative and most effective way to comply with this standard is to avoid disclosing any information received from a client except to authorised fellow employees who are also working for the client.

In some instances, however, a member may want to disclose information received from clients that is outside the scope of the confidential relationship and does not involve illegal activities. Before making such a disclosure, these questions should be asked:

Technological change and communication

Technological changes are constantly enhancing the methods that are used to communicate with clients and prospective clients. Reasonable efforts should be made to ensure that firm-supported communication methods and compliance procedures follow practices designed for preventing accidental distribution of confidential information. Given the rate at which technology changes, a regular review of privacy protection measures is encouraged.

Managers should be diligent in discussing with clients the appropriate methods for providing confidential information. It is important to convey to clients that not all firm-sponsored resources may be appropriate for such communications.

Ethics in action

Here is a case to illustrate how the standard works. The case is adapted from material developed by CFA Institute. As a guide, the desired ethical behaviour required is based on the CFA Institute Code of Ethics and Standards of Professional Conduct (Code and Standards).

Case: Accidental disclosure of confidential information

Jane Harianto is an investment officer at the Devina Trust Company (DTC). She has stewardship of a significant number of individually managed taxable accounts.

In addition to receiving quarterly written reports, about a dozen high-net-worth individuals have indicated to Jane a willingness to receive communications about overall economic and financial market outlooks directly from her by way of a social media platform.

Under the direction of her firm's technology and compliance departments, she established a new group page on an existing social media platform specifically for her clients. In the instructions provided to clients, Jane asked them to "join" the group so they may be granted access to the posted content.

The instructions also advised clients that all comments posted would be available to the public. Thus, the platform was not an appropriate method for communicating personal or confidential information.

Six months later, in early January, Jane posted DTC's year-end "Market Outlook".

The report outlined a new asset allocation strategy that the firm is adding to its recommendations in the new year. Jane introduced the publication with a note informing her clients that she would be discussing the changes with them individually in their upcoming meetings.

One of Jane's clients responded directly on the group page that his family recently experienced a major change in their financial profile due to the Covid-19 lockdowns in her country. The client described highly personal and confidential details of the event. Unfortunately, all clients that were part of the group were also able to read the detailed posting until Jane was able to have the comment removed.

Was Jane in breach of the CFA Institute Code of Ethics and Standards of Professional Conduct (Code and Standards)?

Analysis of case

Jane Harianto has taken reasonable steps to protect the confidentiality of client information while using the social media platform.

She provided instructions clarifying that all information posted to the site would be publicly viewable to all group members and warned against using this method for communicating confidential information.

The accidental disclosure of confidential information by a client is not under Jane's control. Her actions to remove the information promptly once she became aware further align with the standard.

In understanding the potential sensitivity clients express surrounding the confidentiality of personal information, this event highlights a need for further training for her clients. Jane might advocate for additional warnings or controls for clients when they consider using social media platforms for two-way communications.