×
Monday, April 6, 2026

Back in the Game: Recent SEC Settlement Makes Unprecedented Extension of Whistleblower Protection Rule into Realm of Data Security - Armstrong Teasdale LLP

Since its initial run of 12 enforcement actions prior to the U.S. Supreme Court’s rejection of a key provision of the Securities and Exchange Commission’s (SEC) Whistleblower protection rules in 2018, the SEC’s policing of its Whistleblower rules under Rule 21F languished. The SEC brought just one stand-alone Rule 21F enforcement action since then. Recently, though, the SEC announced that it is not only willing to enforce Rule 21F but expand its reach to new territory.

A key feature of the SEC’s Whistleblower protection regime has been Rule 21F-17(a). Exchange Act Rule 21F-17(a), promulgated under the Dodd-Frank Act, prohibits taking “any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement . . . with respect to such communications.”

Previously, the SEC had taken a prophylactic approach to interpreting Rule 21F-17(a). The SEC applied Rule 21F-17(a) to routine confidentiality agreements, anti-disparagement clauses or internal policies that could theoretically discourage potential whistleblowers from bringing their concerns to the SEC. From the SEC’s view, it simply did not matter that there was no proof that any person ever had a concern or in any way felt discouraged from contacting the SEC about potential securities law violations.

The SEC’s recent enforcement action in In re David Hansen has taken this already broad...



Read Full Story: https://www.armstrongteasdale.com/thought-leadership/back-in-the-game-recent-...