Benefits administrator Alight Solutions LLC lost its appeal challenging a Labor Department subpoena seeking information about alleged cybersecurity breaches, when the Seventh Circuit ruled the department has authority under ERISA to investigate parties that aren’t plan fiduciaries.
The department’s authority to issue subpoenas while investigating potential violations of the Employee Retirement Income Security Act doesn’t turn on whether the entity being subpoenaed is a plan fiduciary under the statute, the US Court of Appeals for the Seventh Circuit ruled. ERISA authorizes the department to investigate whether “any person” has violated “any provision” of the statute or its regulations, the court said.
“A contrary rule would allow ERISA fiduciaries to avoid liability altogether by outsourcing recordkeeping and administrative functions to non-fiduciary third parties, evading regulatory oversight,” the court said. “Congress did not confine the Department’s investigatory power in this manner.”
Alight is a health and retirement plan administrator serving more than 750 clients and supporting more than 20 million plan participants. The department began investigating Alight in 2019 after discovering the company processed unauthorized distributions of plan benefits as a result of cybersecurity breaches in its benefit plan accounts. The department says Alight failed to report, disclose, and restore these unauthorized distributions, while Alight denies any knowledge of breaches resulting in such unauthorized distributions, according to the court.
Alight challenged the subpoena by arguing that the department’s investigative authority doesn’t extend to cybersecurity issues. The Seventh Circuit said this argument was both forfeited and “unconvincing,” adding that the reasonableness of Alight’s cybersecurity services, and any related breaches, is relevant in determining whether ERISA has been violated by either Alight or one of the employers whose benefit plans it administers.
The court also declined to hold that the department’s subpoena was unduly burdensome. Although Alight claimed that producing the requested information would require “thousands of hours of work,” the company hasn’t shown that this undertaking would be “unduly burdensome,” the court said.
The department represented itself. DLA Piper LLP represented Alight.
The case is Walsh v. Alight Sols. LLC, 2022 BL 281317, 7th Cir., No. 21-3290, 8/12/22.