A Wells Fargo advisor is gearing up for a fight with FINRA.

The advisor last month appealed FINRA’s decision to suspend him for 90 days after the regulator’s National Adjudicatory Council extended the original 10-day suspension he received from an initial hearing panel. Now, the advisor is appealing his case to the SEC.

FINRA smacked Steven Robert Tomlinson with a 90-day suspension for downloading reams of confidential, nonpublic information for more than 2,000 customers of a credit union where he had previously been employed.

According to FINRA, Tomlinson took more information than is allowed when he left a credit union affiliated with Raymond James Financial Services to join Wells Fargo Advisors (then Wachovia Securities) in late November 2008.

Tomlinson did not return a call or email seeking comment.

Prior to resigning from the credit union, where he worked as manager of the investment services group, Tomlinson allegedly used a personal flash drive to download confidential customer information, including account balances, social security numbers, dates of birth, and quarterly account statements. Of the 2,000 customers whose information he downloaded, only about 200 were his clients, FINRA says.

In March 2013, a FINRA hearing panel fined Tomlinson $10,000 and suspended him for 10 business days, sanctions that Tomlinson argued were too harsh. After an independent review of the case, FINRA’s adjudicatory council upped the suspension to 90 days and affirmed the $10,000 fine.

FINRA slammed Tomlinson for downloading the information and then providing it to Wells Fargo without customer authorization, as required under Regulation S-P. That rule prohibits the disclosure of non-public personal customer information to a nonaffiliated third party without notifying the customers involved and giving them an opportunity to opt out of the disclosure.

“By downloading and disclosing nonpublic confidential information of his customers and other Raymond James and credit union customers, Tomlinson placed important and confidential customer information at risk and his own interests before his customers’ privacy interests,” FINRA’s National Adjudicatory Council wrote in its decision.

According to FINRA, Tomlinson gave the flash drive to a Wells Fargo administrative assistant so she could create mailing labels for announcements that he had joined the bank. But Tomlinson did not supervise the assistant and never informed her that the drive contained unencrypted confidential information, and was not password protected, FINRA says. The flash drive was in the assistant’s possession for one day.

“Anytime representatives start downloading stuff to flash drives, it’s immediately one of those things that’s really hard to defend,” said Patrick J. Burns, Jr., managing attorney with the law offices of Patrick J. Burns, Jr., P.C., in Beverly Hills, Calif.

Burns does not represent anybody involved in this case, but he says that generally such behavior can lead to a temporary restraining order or an injunction against a representative and possibly even a lawsuit for taking confidential information, with “legal bills escalating pretty wildly out of control very quickly.” It can also put representatives at risk of regulatory action, as was the case with Tomlinson.

Wells Fargo allegedly told Tomlinson that he could not bring any client statements, customer account numbers, social security numbers or any other information other than what is allowable—namely customer names, account titles, addresses, emails and phone numbers.

Wells Fargo provided Tomlinson with a flash drive for him to use to download only basic customer information, according to FINRA.

Burns, of Patrick J. Burns, finds it unusual that Wells Fargo would provide flash drives to potential employees. “I wouldn’t think that Wells Fargo or any other party that a rep is going to join would be handing out flash drives....I haven’t come across a firm that would step into that kind of liability,” Burns said.

Tony Mattera, a spokesperson for Wells Fargo, said the practice was not unusual and that the firm frequently provided flash drives to help financial advisors with their transition. Moreover, he said, Well Fargo is a signatory to the Protocol for Broker Recruiting, an agreement among broker-dealers that they will not sue one another for recruiting registered reps if the departing representative, after providing notice to the firm he is departing, takes limited customer information, such as customer names and telephone numbers.

While FINRA affirmed the original $10,000 fine, it refrained from imposing it because Tomlinson demonstrated a bona fide inability to pay it. It also declined to impose the hearing panel’s order that he pay costs in the amount of $2,900.

Read more: