The DOL’s cybersecurity investigation into Alight Solutions, LLC, a retirement plan recordkeeper, has queued up court rulings on the reach of the DOL’s subpoena power that may have important implications for ERISA plan sponsors and their respective recordkeepers and service providers moving forward. First, the Seventh Circuit will weigh in on whether the district court erred in compelling Alight to produce certain documents over Alight’s objections that: (1) the DOL lacks the authority to investigate a recordkeeper because its actions are not fiduciary in nature, (2) the requests are overbroad because they are not limited to cybersecurity incidents involving Alight’s clients, and (3) the requests for unredacted documents would violate Alight’s confidentiality agreements with its clients and plan participants.

In addition, while the appeal has been pending in the Seventh Circuit, the parties await another decision from the district court that will speak to the DOL’s power to share confidential documents received in an investigation across other government agencies. Alight seeks to require the DOL to attach the Confidentiality Order to any disclosure it makes to another governmental agency. However, the DOL has argued in response that the retention and sharing of documents by the United States is already highly regulated and to add additional burdens would circumvent Congress’s power.

Final resolution of these issues will be of interest to benefit plan sponsors and service providers, particularly those with ongoing DOL investigations.