In a significant development, Vanderbilt University has settled a fiduciary lawsuit--and the settlement includes prohibitions on the use of participant data by plan vendors to market non-plan products.

There are few rules under current federal law to prevent financial firms from exploiting individuals’ personal financial information. Employers are a key source of financial firms access to employees’ financial information (through employer-sponsored retirement plans). So, with employers already involved in providing employees’ financial information, what can employers do to protect that data?