According to FINRA, Jacob Harrison Leddy was fined $5,000 and suspended for 10 business days in all capacities for improperly removing and retaining customer non-public personal information without his member firm's or the customers' consent.

In anticipation of joining another FINRA member firm, Leddy improperly removed customers' non-public personal information from his firm by taking photographs of account information contained within the firm's electronic systems. The photographs captured sensitive customer information including customer names, dates of birth, account numbers, and social security numbers.

Following Leddy's resignation from the firm, he improperly retained this customer information. The information was later secured by the new firm through which Leddy had become registered, and Leddy returned the customers' non-public personal information to his former firm prior to its use. However, the unauthorized removal and retention of such sensitive information violated customer privacy and firm policies.

Customer non-public personal information is highly sensitive and subject to strict privacy protections under Regulation S-P and other privacy laws. Firms are required to safeguard customer information and have policies restricting how such information can be accessed, used, and transported. Registered representatives are prohibited from removing customer information without authorization, particularly when transitioning between firms.

This case serves as a reminder that customer information belongs to the firm and customers, not to individual registered representatives. When changing firms, representatives must follow proper procedures for customer transitions and cannot simply take customer information with them. The relatively modest sanction reflects that Leddy returned the information before using it and that it was secured by his new firm. However, the conduct still warranted discipline as it violated important privacy protections.

Investors should be aware that their personal information is protected by privacy regulations and that unauthorized removal or use of such information by registered representatives is a violation subject to sanctions.