2020-28273. Administration of the Electronic Data Gathering, Analysis, and Retrieval System

AGENCY:

Securities and Exchange Commission.

ACTION:

Final rule.

SUMMARY:

The Securities and Exchange Commission (“Commission”) is adopting a new rule that specifies several actions that the Commission, in its administration of the Electronic Data Gathering, Analysis, and Retrieval system (“EDGAR”), may take to promote the reliability and integrity of EDGAR submissions. The new rule establishes a process for the Commission to notify filers and other relevant persons of its actions under the rule as soon as reasonably practicable. In addition, the Commission is adopting amendments to delegate authority to the Director of the Commission's EDGAR Business Office to take actions pursuant to the new rule and two current rules relating to filing date adjustments and the continuing hardship exemption.

DATES:

This rule is effective February 3, 2021.

FOR FURTHER INFORMATION CONTACT:

Rosemary Filou, Chief Counsel; Monica Lilly, Senior Special Counsel; or Jane Patterson, Senior Counsel; EDGAR Business Office, at 202-551-3900, Securities and Exchange Commission, 100 F Street NE, Washington, DC 20549.

SUPPLEMENTARY INFORMATION:

The Commission is adopting new rule 17 CFR 232.15 (“Rule 15”) under 17 CFR 232.10 through 232.903 (“Regulation S-T”), and new rule 17 CFR 200.30-19 (“Rule 30-19”) under 17 CFR 200.1 through 200.800, the Commission's Rules of Organization and Program Management.

I. Introduction and Background

Regulation S-T addresses, among other things, certain administrative issues related to EDGAR submissions.^[1] For example, Regulation S-T allows a filer to submit an amendment to, or a notice of withdrawal of, the filer's submission to remedy a submission issue (“filer corrective disclosure”).^[2] In recent years, as the volume of EDGAR submissions has grown, the Commission has increasingly confronted administrative issues that impact the Commission's ability to promote the reliability and integrity of EDGAR submissions and that are not easily addressed by existing rules or filer corrective disclosure. When these issues arise, they can create confusion for filers, investors, and other users of EDGAR.

To promote the reliability and integrity of EDGAR submissions and to provide transparency about our practices, the Commission proposed Rule 15 under Regulation S-T on August 21, 2020, to specify actions that the Commission may take to facilitate the resolution of administrative issues.^[3] Proposed Rule 15 provided that, in its administration of EDGAR, the Commission may take the following actions to promote the reliability and integrity of EDGAR submissions:

• Redact, remove, or prevent dissemination of personally identifiable information that if released may result in financial or personal harm to an individual (“Sensitive PII”);
• Prevent submissions that pose a cybersecurity threat;
• Correct system or Commission staff errors;
• Remove or prevent dissemination of submissions made under an incorrect EDGAR identifier;
• Prevent the ability to make submissions when there are disputes over the authority to use EDGAR access codes;
• Prevent acceptance or dissemination of an attempted submission that it has reason to believe may be misleading or manipulative while evaluating the circumstances surrounding the submission, and allow acceptance or dissemination if its concerns are satisfactorily addressed;
• Prevent an unauthorized submission or otherwise remove a filer's access; and
• Remedy similar administrative issues relating to submissions.

Moreover, the proposed rule sets forth a process for the Commission to notify filers and other “relevant persons” (as defined below) of its actions under the rule as soon as reasonably practicable.

We received several comment letters in response to the proposal.^[4] A few commenters were generally supportive of the proposed rule, but expressed concern that the Commission may redact information from a submission without first contacting the filer.^[5] These commenters requested that filers be notified prior to any Commission action under the proposed rule, if possible. These commenters also requested that the Commission always consider an issuer's vendor or supplier to be a relevant person when the Commission provides notice of its actions to a filer and any relevant person.

Another commenter was generally supportive of the proposed Commission action when a submission contains Sensitive PII.^[6] The commenter suggested that the Commission “interpret the definition of Sensitive PII broadly.” The commenter also suggested that the Commission provide that filers may initiate a request for redaction or removal of information from a submission containing Sensitive PII and that the Commission redact or remove such information if the filer demonstrates that the submission contains Sensitive PII.

After consideration of the comments received, we are adopting Rule 15 substantially as proposed.^[7] The rule codifies and clarifies the existing approach the Commission may take to address administrative issues that arise in connection with EDGAR submissions. By adopting Rule 15, we believe there will be increased transparency for filers, investors, and other users of EDGAR about the actions the Commission may take to promote the reliability and integrity of EDGAR submissions and improved efficiency in the Commission's administration of EDGAR.

Rule 15 will not change filers' obligations under the Federal securities laws to ensure the accuracy and completeness of information in their EDGAR submissions. Moreover, in the vast majority of administrative and substantive EDGAR submission issues, filers will continue to address an error by submitting a filer corrective disclosure and nothing in Rule 15 will prevent a filer from continuing to do so.^[8] We intend to continue to rely upon filer corrective disclosure to remedy most submission errors.

Additionally, the Commission is adopting new Rule 30-19 to delegate authority to the Director of the Commission's EDGAR Business Office to take actions pursuant to the following rules under Regulation S-T: Rule 15, 17 CFR 232.13(b) (“Rule 13(b)”) (relating to adjustment of filing dates), and 17 CFR 232.202 (“Rule 202”) (relating to the continuing hardship exemption).

II. Discussion of the Final Rules

A. Adoption of Rule 15

Rule 15 specifies that, in its administration of EDGAR, the Commission may take actions to promote the reliability and integrity of EDGAR submissions. Below we discuss the types of actions the Commission may take pursuant to Rule 15 to achieve those objectives.

1. Sensitive Personally Identifiable Information

We are adopting as proposed 17 CFR 232.15(a)(1) (“Rule 15(a)(1)”), which specifies that the Commission may, with regard to submissions on its public website: (i) Redact submissions containing Sensitive PII; (ii) remove submissions containing Sensitive PII; and/or (iii) prevent dissemination of submissions containing this information.^[9] Pursuant to the rule, the Commission may take further steps to ensure that Sensitive PII does not reside in EDGAR and communicate as necessary with filers to facilitate submissions in which Sensitive PII is redacted.^[10] Whether the Commission removes, redacts, or prevents dissemination of the Sensitive PII in the submission will be based on when the Commission first becomes aware of the Sensitive PII.

One commenter suggested that the Commission interpret the definition of Sensitive PII broadly to include additional categories of information that reflect modern expectations of privacy and physical and financial security risks.^[11] The commenter discussed the personal and financial harm that would result from the disclosure of such information. The commenter also noted the regulatory trends in favor of expanding the categories of information that are considered “sensitive” or “personal” and facilitating safeguards for personally identifiable information generally.^[12]

The Commission has sought to reduce the risk that Sensitive PII included in EDGAR submissions may result in financial or personal harm to individuals, and will continue to do so.^[13] We believe that the description of Sensitive PII in Rule 15(a)(1) as proposed is broad enough to encompass the examples provided by the commenter in relevant circumstances and to provide the Commission with the flexibility to reduce the risk of financial or personal harm to individuals.^[14] We believe it is appropriate to retain flexibility in the description as the categories of what constitutes Sensitive PII continue to evolve in light of new technology and expectations of privacy.

The same commenter also suggested that the Commission provide that filers may initiate a request for redaction or removal of information from a submission containing Sensitive PII, including from any submissions made prior to the effectiveness of the rule. The commenter stated that the inclusion of Sensitive PII in historical EDGAR submissions (whether inadvertent or intentional) cannot be retroactively corrected by making an additional filer corrective disclosure. Moreover, the commenter suggested that the rule require the Commission to redact or remove such information if the filer demonstrates that the submission contains Sensitive PII.^[15]

The Commission currently receives requests from filers for redaction or removal of information from submissions containing Sensitive PII, and we anticipate continuing to receive and evaluate such requests. We do not believe, however, that the Commission should be required to redact or remove Sensitive PII each time a filer requests it. We believe it is appropriate to retain the flexibility to consider the accuracy of EDGAR information publicly disseminated on the Commission's website, the nature of and circumstances surrounding the Sensitive PII at issue, and the Commission's administrative and technical capacity to address the request. If a filer demonstrates that a submission contains Sensitive PII, the Commission will initially work with the filer to facilitate submission of a version in which the Sensitive PII is redacted. The Commission will then exercise its discretion to determine whether the redacted submission would be adequate or whether additional steps need to be taken pursuant to 17 CFR 232.15(a)(8) (“Rule 15(a)(8)”) (as described below), including potentially removing information from the Commission's website.^[16] In any event, regardless of whether there is a request from a filer, the Commission may act to remove, redact, or prevent dissemination of Sensitive PII in a submission pursuant to Rule 15(a)(1) without first notifying the filer or the individual who could experience financial or personal harm if such information was released on EDGAR. The Commission's interest in avoiding a situation in which such information is used to create financial or personal harm may outweigh the need to give notice prior to Commission action, depending on the circumstances.^[17] We are therefore adopting this provision of the rule as proposed.

2. Cybersecurity Threats

We are adopting as proposed 17 CFR 232.15(a)(2), which specifies that the Commission may prevent the submission to EDGAR of any submission that poses a cybersecurity threat, including but not limited to, those containing any malware or virus, and communicate as necessary with the filer regarding the submission. As discussed in the Proposing Release, Commission action to address cybersecurity threats in EDGAR submissions will benefit all EDGAR users and promote the reliability and integrity of EDGAR submissions.^[18] We received no comments on this aspect of the proposal.

3. System and Commission Staff Errors

We are adopting as proposed 17 CFR 232.15(a)(3), which specifies that if the Commission determines that a submission has not been processed by EDGAR, has been processed incorrectly by EDGAR, or contains an error attributable to the Commission staff, the Commission may correct and/or prevent dissemination of the submission and communicate as necessary with the filer to facilitate filer corrective disclosure. In each of these circumstances, the Commission typically first attempts to correct the error without unduly burdening filers.^[19] When necessary, the Commission may work proactively with filers to accomplish filer corrective disclosure.^[20] We received no comments on this aspect of the proposal.

4. Incorrect EDGAR Identifiers

We are adopting as proposed 17 CFR 232.15(a)(4), which specifies that the Commission may remove and/or prevent public dissemination of a submission made under an incorrect EDGAR unique identifying number ^[21] and communicate as necessary with the filer and others to facilitate a filer corrective disclosure. Sometimes, filers make submissions that are not associated with the correct unique identifying number. These errors can create confusion for filers, investors, and other EDGAR users. The Commission may remove the erroneous submission when such errors cannot be resolved by filer corrective disclosure. We received no comments on this aspect of the proposal.

5. EDGAR Access Code Disputes

We are adopting as proposed 17 CFR 232.15(a)(5), which specifies that the Commission may prevent a filer's ability to make submissions if the Commission determines that a dispute exists as to which persons have the authority to make submissions on behalf of the filer, until the dispute is resolved by the disputing parties or by a court of competent jurisdiction. These disputes may arise, for example, when two or more parties each claim control of a filing entity and each demand access to the entity's EDGAR account. Resolution of such disputes often turns on matters of state corporation law or other factors outside the scope of the Federal securities laws. Under existing practice, the Commission staff has asked the disputing parties to either resolve the dispute themselves or have the matter adjudicated under the relevant state corporation law.^[22] The final rule affirms the Commission's ability to take action to ensure that only authorized persons make submissions on behalf of the filer. We received no comments on this aspect of the proposal.

6. Potential Manipulation

We are adopting a modification to proposed Rule 15(a)(6). The proposed rule specified that if the Commission has reason to believe that a submission or an attempted submission may be misleading or manipulative, the Commission may prevent acceptance or dissemination of the submission while evaluating the circumstances surrounding the submission.^[23] The proposed rule also specified that the Commission may allow acceptance or dissemination if its concerns are satisfactorily addressed.^[24]

After further consideration, we are slightly modifying proposed Rule 15(a)(6) to clarify that the Commission may continue to prevent acceptance or dissemination after it has evaluated the circumstances surrounding the submission if its concerns have not been satisfactorily addressed. If the Commission allows acceptance or dissemination of the submission, the initial or initially attempted filing date will be assigned to the submission, assuming the submission does not implicate other provisions of Rule 15. We received no comments on this aspect of the proposal.

7. Unauthorized Submissions

We are adopting as proposed 17 CFR 232.15(a)(7), which specifies that the Commission may prevent the use of EDGAR access codes if it has reason to believe that there has been an unauthorized submission or an attempt to make an unauthorized submission on EDGAR. Under existing practice, when questions arise as to whether a particular submission or attempted submission was authorized, the Commission seeks to better understand the circumstances surrounding the submission and evaluate what steps, if any, to take in response. Rule 15 specifies that, in such situations, the Commission may prevent any further submissions by the filer or otherwise remove the filer's access to EDGAR. If its concerns are satisfactorily addressed, the Commission will allow the use of EDGAR access codes and permit the submission to proceed, assuming the submission does not implicate other provisions of Rule 15. We received no comments on this aspect of the proposal.

8. Additional Remedial Steps

The Commission cannot anticipate every administrative submission issue that may arise in the future. Thus, we are adopting as proposed Rule 15(a)(8), which specifies the circumstances in which the Commission may take further appropriate steps to address a matter and communicate as necessary with the filer regarding a submission. Specifically, under the rule, the Commission may take such further steps if the Commission has reason to believe that, to promote the reliability and integrity of EDGAR submissions, it must address a submission issue that cannot be addressed solely by filer corrective disclosure or by the actions set forth in paragraphs (a)(1) through (7) of Rule 15. We received no comments on this aspect of the proposal.

9. Notice

Finally, we are adopting as proposed Rule 15(b), which provides that the Commission may act without advance notice to filers or any other person. Specifically, Rule 15(b) provides a method for the Commission to provide notice of its actions under the rule to a filer and any person the Commission determines is relevant to the matter (“relevant person”) as soon as practicable after those actions are taken. In response to commenters, we are clarifying that the term “relevant person” encompasses, in appropriate circumstances, a filer's vendor or supplier that made the related submission on behalf of the filer.^[25] In addition, relevant persons could include, but are not limited to, parties other than the filer that are involved in code disputes and parties other than the filer that are involved in submissions made in another entity's account. Rule 15(b) provides that the Commission will send written notice and a brief factual statement of the basis for the action by electronic mail to the email address on record in the filer's EDGAR account, and the email address of any relevant persons. The Commission may also send, if necessary, the notice and factual statement by registered, certified, or express mail to the physical address on record in the filer's EDGAR account and the physical address of any relevant persons. The notice provides the filer and relevant persons an opportunity to bring pertinent information to the Commission's attention and will help facilitate prompt resolution of submission issues.

Three commenters were generally supportive of the proposed rule but expressed concern that the Commission may redact information from a submission without first contacting the filer.^[26] The commenters requested that filers be notified prior to any Commission action in the proposed rule, if possible. The commenters recognized, however, that there may be situations where advance notification would not be feasible and, in such situations, they agreed with the Commission's proposal to notify the filer and relevant persons as soon as possible after the action is taken.

As discussed in the Proposing Release, the Commission typically communicates and works with filers to address submission issues, and the Commission anticipates that it generally will continue to work with filers in advance of taking action under the rule.^[27] At the same time, the final rule allows the Commission the necessary flexibility to take action promptly to avoid harm to investors and other EDGAR users who depend upon the accuracy of the information disseminated by EDGAR.^[28] For example, as discussed above, the Commission has sought to reduce the risk that Sensitive PII included in EDGAR submissions may result in financial or personal harm to individuals.^[29] Immediate Commission action may also be necessary to avoid potential threats to EDGAR, to prevent the dissemination of unauthorized or potentially false or misleading submissions, or to prevent the improper use of filers' EDGAR accounts.^[30] In addition, we are mindful that administrative actions under the proposed rule should not unduly hinder or delay the EDGAR submission process.^[31] We believe that Rule 15, including its notice provision, balances the need to reduce the risk of financial or personal harm to individuals from the disclosure of Sensitive PII, address potential threats, and other circumstances as described above with the need to timely disseminate EDGAR submissions. We are therefore adopting this provision of the rule as proposed.

B. Amendment to the Delegations of the Authority of the Commission

The Commission is adopting new Rule 30-19 of the Rules of Organization and Program Management to delegate authority to the Director of the EDGAR Business Office to take action under Rule 15 and two other rules in Regulation S-T: (i) Rule 13(b), to adjust the filing date of an electronic filing; and (ii) Rule 202, to set the terms of, and grant or deny as appropriate, continuing hardship exemptions from the electronic submission requirements.^[32] This delegated authority is designed to conserve Commission resources by permitting Commission staff to carry out the Commission's efficient administration of EDGAR. The Commission staff may nevertheless submit matters to the Commission for consideration, as it deems appropriate.

III. Economic Analysis

We have carefully considered the economic effects of final Rule 15 under Regulation S-T.^[33] The final rule increases transparency for filers, investors, and other users of EDGAR by specifying the actions the Commission may take to resolve certain administrative issues. Increased transparency about Commission actions will create benefits for both filers and users, because filers and users will know the types of actions they can expect the Commission to take to promote the reliability and integrity of EDGAR submissions. However, we anticipate these benefits will be limited as Rule 15 largely codifies actions that the Commission currently takes to promote the reliability and integrity of EDGAR submissions. For the same reason, we do not expect filers to incur additional costs. Further, we anticipate that the final rule will marginally improve efficiency, but will not have a significant effect on competition or capital formation. Because we generally cannot predict the need for or extent of corrective actions the final rule will address, we cannot quantify the anticipated economic effects of future corrective actions. Furthermore, the Commission received no comments responding to the Proposing Release's request for comments on the economic analysis and any relevant empirical data, estimation methodologies, or factual support. Therefore, the analysis that follows provides primarily a qualitative assessment of the likely economic effects.

A. Economic Baseline

The Commission's current processes and procedures for resolving the enumerated administrative issues listed in the final rule and discussed above serve as the baseline against which we assess the final rule. This section discusses, as it relates to this rulemaking, filers' current usage of EDGAR and the Commission's processes for administering EDGAR.

Because of the variety of administrative issues that may arise in connection with EDGAR submissions, the Commission has developed procedures for identifying and addressing the issues described above, although the Commission has not published those procedures. Where possible, the Commission currently communicates with relevant filers to facilitate filer corrective disclosure to address problematic submissions. While filer corrective disclosure addresses the majority of known EDGAR submission issues, there are circumstances in which working with a filer does not address problematic submissions, such as when the filer is uncooperative or the Commission cannot validate a filer's authorization to make submissions. Additionally, in limited cases, the Commission has responded promptly to submission issues without first consulting relevant filers in order to avoid harm to investors and other EDGAR users who depend upon the accuracy of the information disseminated by EDGAR. For these submissions, the Commission acts expediently to minimize the time the public and the Commission are exposed to such harm. While the Commission typically notifies these filers of its actions afterwards, some filers may not know specifically why the Commission took action or the nature of the issue with the submission.

B. Costs and Benefits

The final rule specifies the actions the Commission may take with respect to specific administrative issues that impact the Commission's ability to promote the reliability and integrity of EDGAR submissions. We believe the final rule will provide increased transparency about the Commission's administrative processes, which in turn may benefit filers and improve the Commission's efficiency in administering EDGAR. We believe, however, that Rule 15 would have limited economic effects because the rule largely codifies actions that the Commission may already take.

More transparency into how the Commission administers EDGAR may benefit filers in two ways. First, by specifying the types of issues for which the Commission may take action, the final rule could encourage filers to take additional actions to prevent these issues if they believe the benefits exceed the costs of preventative actions. Second, when the Commission must act to address a problematic submission prior to notifying a filer or when an issue cannot be addressed solely by a filer corrective disclosure, the final rule's formal notification requirement ensures that filers will receive timely notification of Commission action. To the extent that this requirement results in the Commission notifying filers of issues that they can correct, such as incorrect EDGAR identifiers, EDGAR access code disputes, or potentially misleading filings, filers may be able to benefit from rectifying issues sooner than they would have prior to the rule.^[34]

Because the final rule informs filers of possible actions the Commission may take and the Commission's process to promote the reliability and integrity of EDGAR submissions, the final rule will improve the efficiency of administering EDGAR. This benefit is likely to be limited because the Commission will continue to resolve most issues by contacting filers to facilitate filer corrective disclosure. Since filers may submit fewer filings with errors and the Commission and filers will be able to more quickly correct errors, the final rule could lead to more timely and accurate information in EDGAR, benefiting investors, research analysts, data aggregators, and other financial professionals.^[35] Moreover, since the Commission, as the administrator of EDGAR, already takes corrective actions to promote the reliability and integrity of EDGAR submissions, we do not expect filers to incur additional costs in connection with these improvements. The Commission generally cannot predict the need for or the extent of corrective actions, so we cannot quantify the informational efficiency benefits from future corrective actions.

To the extent that the final rule reduces the number of cybersecurity threats or reduces the administrative frictions in preventing cybersecurity threats, there may be benefits to the users of EDGAR.^[36] In particular, users, including investors, analysts, asset managers, and data collection companies, may incur fewer costs associated with cleaning or repairing systems and recovering data.^[37] Furthermore, individuals, investors, companies, and asset managers, among others, may benefit from the prevention of cybersecurity attacks that disrupt the dissemination of filings through EDGAR or obtain confidential or protected financial information on the Commission's or users' systems.

Lastly, because EDGAR submissions generally do not require Sensitive PII,^[38] and current Commission practices seek to identify and redact Sensitive PII, we do not anticipate that the final rule specifying that the Commission may redact, remove and/or not disseminate EDGAR submissions containing Sensitive PII will have a substantial economic effect.

IV. Administrative Law Matters

The Commission finds, in accordance with section 553(b)(3)(A) of the Administrative Procedure Act (“APA”), that these amendments relate solely to agency organization, procedure, or practice and do not constitute a substantive rule. They are therefore not subject to the provisions of the APA requiring notice of rulemaking, opportunity for public comment, and advance publication of the amendments prior to their effective date. These changes are effective on February 3, 2021. Additionally, the Regulatory Flexibility Act of 1980 ^[39] therefore does not apply. Nevertheless, we previously determined that it would be useful to publish the proposed amendments for notice and comment before adoption. The Commission has considered all comments received. Because these amendments relate to “agency organization, procedure or practice that does not substantially affect the rights or obligations of non-agency parties,” they are not subject to Small Business Regulatory Enforcement Fairness Act of 1996.^[40] These rules do not contain any collection of information requirements as defined by the Paperwork Reduction Act of 1995.^[41]

V. Statutory Basis and Text of Rule Amendments

The amendments to Regulation S-T—General Rules and Regulations for Electronic Filings are adopted pursuant to statutory authority in Sections 6, 7, 8, 10, and 19(a) of the Securities Act,^[42] Sections 3, 12, 13, 14, 15, 15B, 23, and 35A of the Exchange Act,^[43] Section 319 of the Trust Indenture Act of 1939,^[44] and Sections 8, 30, 31, and 38 of the Investment Company Act.^[45] The amendments to the Commission's Rules of Organization and Program Management are adopted pursuant to statutory authority granted to the Commission, including Section 19 of the Securities Act of 1933, 15 U.S.C. 77s; Sections 4A, 4B, and 23 of the Exchange Act, 15 U.S.C. 78d-1, 78d-2, and 78w; Section 38 of the Investment Company Act of 1940, 15 U.S.C. 80a-37; Section 211 of the Investment Advisers Act of 1940, 15 U.S.C. 80b-11; and Section 3 of the Sarbanes-Oxley Act of 2002, 15 U.S.C. 7202.

List of Subjects

17 CFR Part 200

• Administrative practice and procedure
• Authority delegations (Government agencies)
• Organization and functions (Government agencies)

17 CFR Part 232

• Incorporation by reference
• Reporting and recordkeeping requirements
• Securities

For the reasons discussed above, we are amending 17 CFR chapter II as follows:

PART 200—ORGANIZATION; CONDUCT AND ETHICS; AND INFORMATION AND REQUESTS

Subpart A-Organization and Program Management

1. The general authority citation for part 200, subpart A, continues to read as follows:

Authority: 15 U.S.C. 77c, 77 o, 77s, 77z-3, 77sss, 78d, 78d-1, 78d-2, 78 o-4, 78w, 78 ll (d), 78mm, 80a-37, 80b-11, 7202, and 7211 et seq., unless otherwise noted.

* * * * *

2. Add § 200.30-19 to read as follows:

§ 200.30-19

Delegation of authority to Director of the EDGAR Business Office.

Pursuant to the provisions of Public Law 100-181, 101 Stat. 1254, 1255 (15 U.S.C. 78d-1, 78d-2), the Securities and Exchange Commission hereby delegates, until the Commission orders otherwise, the following functions to the Director of the EDGAR Business Office, to be performed by the Director or under the Director's direction by such other person or persons as may be designated from time to time by the Chairman of the Commission:

(a) With respect to the Securities Act of 1933 (15 U.S.C. 77a et seq.), the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.), the Trust Indenture Act of 1939 (15 U.S.C. 77aaa et seq.), the Investment Company Act of 1940 (15 U.S.C. 80a-1 et seq.) and part 232 of this chapter (Regulation S-T), to grant or deny a request submitted pursuant to § 232.13(b) of this chapter to adjust the filing date of an electronic filing, after consultation with the division or office with primary regulatory oversight for the relevant filing.

(b) With respect to the Securities Act of 1933 (15 U.S.C. 77a et seq.), the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.), the Trust Indenture Act of 1939 (15 U.S.C. 77aaa et seq.), the Investment Company Act of 1940 (15 U.S.C. 80a-1 et seq.), and part 232 of this chapter (Regulation S-T) to set the terms of, and grant or deny as appropriate, continuing hardship exemptions pursuant to § 232.202 of this chapter from the electronic submission requirements of Regulation S-T, after consultation with the division or office with primary regulatory oversight for the relevant filing.

(c) With respect to the Securities Act of 1933 (15 U.S.C. 77a et seq.), the Securities Exchange Act of 1934 (15 U.S.C. 78a et seq.), the Trust Indenture Act of 1939 (15 U.S.C. 77aaa et seq.), the Investment Company Act of 1940 (15 U.S.C. 80a-1 et seq.), and part 232 of this chapter (Regulation S-T) to take actions pursuant to § 232.15 of this chapter to promote the reliability and integrity of submissions made through the Electronic Data Gathering, Analysis, and Retrieval system (EDGAR).

PART 232—REGULATION S-T—GENERAL RULES AND REGULATIONS FOR ELECTRONIC FILINGS

3. The general authority citation for part 232 continues to read as follows:

Authority: 15 U.S.C. 77c, 77f, 77g, 77h, 77j, 77s(a), 77z-3, 77sss(a), 78c(b), 78 l, 78m, 78n, 78o(d), 78w(a), 78 ll, 80a-6(c), 80a-8, 80a-29, 80a-30, 80a-37, 7201 et seq.; and 18 U.S.C. 1350, unless otherwise noted.

* * * * *

4. Add § 232.15 to read as follows:

§ 232.15

Administration of EDGAR.

(a) In its administration of EDGAR, the Commission may take the following actions to promote the reliability and integrity of submissions made through EDGAR.

(1) If the Commission determines that a submission contains personally identifiable information that if released may result in financial or personal harm to an individual, which may comprise a single item of information or a combination of two or more items, the Commission may redact such information from the submission, prevent dissemination of the submission, and/or remove the submission from the Commission's public website, and may communicate as necessary with the filer to facilitate submission of a version in which such information is redacted;

(2) The Commission may prevent the submission to EDGAR of any submission that poses a cybersecurity threat, including but not limited to, submissions containing any malware or virus, and may communicate as necessary with the filer regarding the submission;

(3) If the Commission determines that a submission has not been processed by EDGAR, or has been processed incorrectly by EDGAR, or contains an error attributable to the Commission staff, the Commission may correct and/or prevent public dissemination of the submission and may communicate with the filer as necessary to facilitate the filer's submission of an amendment to, or a notice of withdrawal of, the filer's submission (a “filer corrective disclosure”);

(4) If the Commission determines that a submission is made under an incorrect EDGAR unique identifying number, the Commission may remove and/or prevent public dissemination of the submission and may communicate with the filer as necessary to facilitate a filer corrective disclosure;

(5) If the Commission determines that a dispute exists regarding the authority to make submissions on behalf of a filer, the Commission may prevent a filer's ability to make submissions until the dispute is resolved by the disputing parties or by a court of competent jurisdiction;

(6) If the Commission has reason to believe that an attempted submission may be misleading or manipulative, the Commission may prevent acceptance or dissemination of the submission unless, after evaluating the circumstances surrounding the submission, the Commission's concerns are satisfactorily addressed;

(7) If the Commission has reason to believe that a filer has made an unauthorized submission or attempted to make an unauthorized submission, the Commission may prevent any further submissions by the filer or otherwise remove the filer's access to EDGAR; and

(8) If the Commission otherwise has reason to believe that, to promote the reliability and integrity of submissions made through EDGAR, it must address a submission issue that cannot be addressed solely by filer corrective disclosure or by the actions set forth in paragraphs (a)(1) through (7) of this section, the Commission may take such further steps as are appropriate to address the matter and communicate as necessary with the filer regarding the submission.

(b) The Commission may act under paragraph (a) of this section without providing advance notice to the filer or any other person. As soon as reasonably practicable after taking action under paragraph (a) of this section, the Commission will provide written notice and a brief factual statement of the basis for the action to the filer and any other person the Commission determines is relevant to the matter (“relevant persons”). The Commission will send the notice and factual statement by electronic mail to the email address on record in the filer's EDGAR account, and to the email address of any relevant persons. The Commission may also send, if necessary, the notice and factual statement by registered, certified, or express mail to the physical address on record in the filer's EDGAR account and the physical address of any relevant persons.

(c) Nothing in this section prevents a filer from addressing an error or mistake in the filer's submission by making a filer corrective disclosure.

By the Commission.

Dated: December 11, 2020.

Vanessa A. Countryman,

Secretary.

Footnotes

1.  See Administration of the Electronic Data Gathering, Analysis, and Retrieval System, Release No. 33-10821 (Aug. 21, 2020) [85 FR 58018 (Sep. 17, 2020)] (the “Proposing Release”), at 58018. In 1993, the Commission adopted rules mandating that certain filings be made with the Commission electronically through the newly launched EDGAR system. See id.

2.  Regulation S-T anticipates that filers may address their own substantive, and in some cases, administrative, submission issues through filer corrective disclosure. See Proposing Release, supra footnote 1, at 58018.

3.  See Proposing Release, supra footnote 1.

4.  The comment letters on the Proposing Release (File No. S7-11-20) are available at https://www.sec.gov/​comments/​s7-11-20/​s71120.htm.

5.  See Comment Letters of XBRL US (Oct. 5, 2020) (“XBRL US Comment Letter I”); JT Foxx (Oct.12, 2020) (“JT Foxx Comment Letter”); Auto Connection Manassas VA (Oct. 13, 2020) (“Auto Connection Comment Letter”).

6.  See Comment Letter of Ropes & Gray LLP (Oct. 19, 2020) (“Ropes & Gray Comment Letter”).

7.  As discussed in more detail in Section II.A.6, we have modified 17 CFR 232.15(a)(6) (“Rule 15(a)(6)”) as proposed to clarify that the Commission may continue to prevent acceptance or dissemination of the submission if the Commission has reason to believe that an attempted submission may be misleading or manipulative and the Commission's concerns have not been satisfactorily addressed after evaluating the circumstances surrounding the attempted submission.

8.  See 17 CFR 232.15(c), which is being adopted as proposed (“[n]othing in this rule prevents a filer from addressing an error or mistake in the filer's submission by making a filer corrective disclosure”). We received no comments on this aspect of the proposal. See also, e.g., 17 CFR 232.103, 232.105, and 232.501(a)(3).

9.  Sensitive PII may comprise a single item of information (for example, a Social Security number) or a combination of two or more items (for example, a full name and financial, medical, criminal, or employment history). See Rule 15(a)(1).

10.  Although the Commission may take steps to ensure that Sensitive PII does not reside in EDGAR, the burden of the responsibility to redact such information from submissions continues to lie with the filer and not the Commission.

11.  See Ropes & Gray Comment Letter (noting that the Commission release, Amendments to Forms and Schedules to Remove Provision of Certain Personally Identifiable Information, Release No. 33-10846 (Apr. 25, 2018) [83 FR 22190 (May 14, 2018)] (“2018 PII Form Amendments Release”), contemplated the removal of Social Security numbers, foreign identity numbers, dates of birth, and places of birth from certain Commission forms and schedules, and that, in the commenter's view, the information referred to in the 2018 PII Amendments Release was the minimum of what should constitute Sensitive PII for purposes of Rule 15). See also Proposing Release, supra footnote 1, at 58019 (discussing the 2018 PII Form Amendments Release). The commenter requested that the Commission interpret Sensitive PII to include information such as bank account numbers and balance information, wire transfer instructions and related information (e.g., the sender or recipient's name, phone number, address, and bank name) and credit card numbers. The commenter also requested that Sensitive PII include, among other things, email addresses and mobile phone numbers, physical addresses, login information for any bank, trading or similar account, and information associated with an individual's digital asset account.

12.  See Ropes & Gray Comment Letter (discussing emerging privacy regimes such as the California Consumer Privacy Act and the General Data Protection Regulation in Europe). The commenter indicated that these regimes expressly consider email addresses to be a type of personally identifiable information and are often interpreted to cover other types of information such as mobile phone numbers.

13.  See Proposing Release, supra footnote 1, at 58019.

14.  The description of Sensitive PII that the Commission is adopting in Rule 15 is generally consistent with the Privacy Act and other statements of the Commission. See Updated Disclosure Requirements and Summary Prospectus for Variable Annuity and Variable Life Insurance Contracts, Release No. 33-10765 (Mar. 11, 2020) [85 FR 25964 (May 1, 2020)]; FAST Act Modernization and Simplification of Regulation S-K, Release No. 33-10618 (Mar. 20, 2019) [84 FR 12674 (Apr. 2, 2019)]; Amendments to Forms and Schedules to Remove Provision of Certain Personally Identifiable Information, Release 33-10486 (Apr. 25, 2018) [83 FR 22190 (May 14, 2018)].

15.  See Ropes & Gray Comment Letter (stating that the Commission should be required to remove or redact Sensitive PII if a filer demonstrates that the Sensitive PII, if released or allowed to remain publicly available, may result in financial or personal harm to an individual).

16.  See Section II.A.8.

17.  After taking action pursuant to Rule 15(a), the Commission will provide notice to the filer and any relevant persons as soon as reasonably practicable. See 17 CFR 232.15(b) (“Rule 15(b)”).

18.  See Proposing Release, supra footnote 1, at 58019.

19.  See, e.g., Proposing Release, supra footnote 1, at 58019 (discussing Commission practices of correcting system and Commission staff errors without first communicating with the filer).

20.  17 CFR 232.103 (Rule 103 of Regulation S-T) addresses concerns that filers may have about liability when issues arise that are not the fault of the filer. Moreover, Rule 13(b) of Regulation S-T makes clear that if a filer in good faith attempts to timely file but the filing is delayed due to technical difficulties beyond the filer's control, the filer may request an adjustment of the filing date of the document.

21.  EDGAR provides each entity a unique identifying number, and submissions made by an entity are associated with that number. If an individual who has access to more than one unique identifying number (for example, a filing agent) were to make a submission for one entity using another entity's number, it erroneously would appear to EDGAR users that the submission is a filing by the unique identifying number holder. See 17 CFR 232.10(b).

22.  When a dispute arises between parties, each of whom claims to be the legitimate corporate representative—which may occur after a leadership change at a filing entity—the Commission staff typically prevents future submissions until the parties can reach an agreement, or a party is able to provide a court order designating the appropriate corporate representative.

23.  See Proposed Rule 15(a)(6). See also Proposing Release, supra footnote 1, at 58020 (discussing examples of submissions or attempted submissions that may be misleading or manipulative).

24.  See Proposed Rule 15(a)(6).

25.  See XBRL US Comment Letter I; JT Foxx Comment Letter; Auto Connection Comment Letter (requesting that the Commission always consider an issuer's vendor or supplier to be a relevant person when the Commission provides notice of its actions to a filer and any relevant person).

26.  Id.

27.  See Proposing Release, supra footnote 1, at 58020.

28.  Id.

29.  See Section II.A.1 and Proposing Release, supra footnote 1, at 58019.

30.  See Proposing Release, supra footnote 1, at 58020.

31.  Id.

32.  The functions in new Rule 30-19 are performed by the Director of the EDGAR Business Office or under the Director's direction by such other person or persons as may be designated from time to time by the Chairman of the Commission. Functions related to filing date adjustments pursuant to Rule 13(b) and continuing hardship exemptions pursuant to Rule 202 would be performed after consultation with the division or office with primary regulatory oversight for the relevant filing. See new Rule 30-19.

33.  Section 2(b) of the Securities Act of 1933 (“Securities Act”), Section 3(f) of the Securities Exchange Act of 1934 (“Exchange Act”), and Section 2(c) of the Investment Company Act of 1940 (“Investment Company Act”) require us, when engaging in rulemaking that requires us to consider or determine whether an action is necessary or appropriate in (or, with respect to the Investment Company Act, consistent with) the public interest, to consider, in addition to the protection of investors, whether the action will promote efficiency, competition, and capital formation. In addition, Section 23(a)(2) of the Exchange Act requires the Commission to consider the effects on competition of any rules the Commission adopts under the Exchange Act and prohibits the Commission from adopting any rule that would impose a burden on competition not necessary or appropriate in furtherance of the purposes of the Exchange Act.

34.  In addition to filers, the Commission may work with EDGAR filing agents, counsel, and other entities to correct administrative issues. As with filers, these entities may incur lower costs if they are notified and can rectify issues with EDGAR submissions sooner.

35.  See generally Michael S. Drake, Darren T. Roulstone, and Jacob R. Thornock, The Determinants and Consequences of Information Acquisition via EDGAR, 32 Contemporary Accounting Research 3 (2016) (Most EDGAR users access the database a few times per quarter around corporate events such as restatements, earnings announcements, and acquisition announcements. This activity is related to, but distinct from, financial press articles. A small subset of users access EDGAR daily for multiple filings.); Jonathan L. Rogers, Douglas J. Skinner, and Sarah L. C. Zechman, Run EDGAR Run: SEC Dissemination in a High-Frequency World, Chicago Booth Research Paper No. 14-36 (Feb. 17, 2017) (finding that for a sample of Form 4 filings, there was an economically significant advantage to accessing data because of then-existing lags between the Commission's EDGAR website and the public dissemination feed); Brian Gibbons, Peter Iliev, and Jonathan Kalodimos, Analyst Information Acquisition via EDGAR, Working Paper (Nov. 15, 2019) (finding that information acquisition from EDGAR is associated with smaller analyst forecast errors); Peter Iliev, Jonathan Kalodimos, and Michelle Lowry, Investors' Attention to Corporate Governance, 9th Miami Behavioral Finance Conference 2018 (Jul. 16, 2020) (using EDGAR log files, finding that investors conduct significant research into corporate governance, particularly for large firms, firms with low managerial entrenchment, and those with meetings outside of the proxy season); Huaizhi Chen, Lauren Cohen, Umit Gurun, Dong Lou, and Christopher J. Malloy, IQ from IP: Simplifying Search in Portfolio Choice, NBER Working Paper No. 24801 (Apr. 20, 2019) (using EDGAR log data, shows institutional investors tracked management teams and insider-trading filings of firms); and Zhongling Qin, Measuring Attention: The Case of Amendments to 10K Annual Reports, Working Paper (Nov. 15, 2019) (showing consistently higher trading volume once there are enough attentive readers of 10-K/A filings, as defined by whether the readers read the original 10-K filings, though consistent with gradual diffusion of information). But see Stefano DellaVigna and Joshua M. Pollet, Investor Inattention and Friday Earnings Announcements, 64 J. of Fin. 2 (Mar. 13, 2009) (finding less immediate response for Friday announcements than for announcements on other days, consistent with investor inattention); and Tim Loughran and Bill McDonald, The Use of EDGAR Filings by Investors, J. of Behavioral Fin. Forthcoming (Dec. 4, 2016) (showing that the average publicly traded firm has its annual report accessed only 28.4 times on the day of and day after the filing, though other filings such as initial public offering filings are more quickly consumed).

36.  Under current practice, the Commission immediately prevents submissions to EDGAR of any submission that poses cybersecurity risks once the Commission identifies them. Furthermore, the Commission has already promulgated a rule addressing the removal of submissions or parts of submissions that contain executable code. 17 CFR 232.106.

37.  See The Council of Econ. Advisers, The Cost of Malicious Cyber Activity to the U.S. Economy (Feb. 2018). Available at: https://www.whitehouse.gov/​wp-content/​uploads/​2018/​03/​The-Cost-of-Malicious-Cyber-Activity-to-the-U.S.-Economy.pdf (estimating that in 2016, malicious cyber activity cost the U.S. economy between $57 and $106 billion through denial of service attacks, disruption of business activity, or destruction or theft of proprietary and strategic information).

38.  In 2018, the Commission amended forms and schedules to eliminate requirements to provide certain personally identifiable information. See PII Form Amendments Release, supra footnote 11. Also, in the EDGAR Filer Manual, the Commission advises against including social security numbers in filings submitted to the Commission. See https://www.sec.gov/​info/​edgar/​edgarfm-vol2-v47.pdf. Some forms may require Sensitive PII in certain circumstances. For example, Form 20-F requires dates of birth of a company's directors and senior management if required to be reported in the home country or otherwise publicly disclosed by the company. Additionally, Forms MA and Funding Portal require IRS Tax numbers if CRD numbers are unavailable. IRS Tax numbers also are required on Form SBSE if CRD numbers, IARD numbers, and foreign business numbers are unavailable.

39.  5 U.S.C. 601 et seq.

40.  5 U.S.C. 801 et seq.

41.  44 U.S.C. 3501 et seq.

42.  15 U.S.C. 77f, 77g, 77h, 77j, and 77s(a).

43.  15 U.S.C. 78c, 78d-1, 78d-2, 78 l, 78m, 78n, 78 o, 78 o-4, 78w, and 78 ll.

44.  15 U.S.C. 77sss.

45.  15 U.S.C. 80a-8, 80a-29, 80a-30, and 80a-37.