February 12, 2019
“Information Security” Performance Metrics: Disney’s Shareholder Proposal
– Liz Dunshee
Some pundits like to say that “everything is securities fraud” – and one pretty common example is lawsuits and penalties stemming from cybersecurity or privacy issues. Now it’s starting to feel like everything that could be securities fraud could also, on the front end, be an executive pay metric. For instance, Disney’s proxy statement includes this shareholder proposal from Jim McRitchie:
RESOLVED: Shareholders of The Walt Disney Company (the “Company” or “Disney”) ask our board of directors (the “Board”) to publish a report (at reasonable expense, within a reasonable time, and omitting confidential or propriety information) assessing the feasibility of integrating additional cyber security and data privacy metrics into the performance measures of senior executives under Disney’s compensation incentive plans.
In opposing the proposal, Disney makes the case in its proxy and additional soliciting materials that it already considers data security & data privacy in its executive compensation design – by factoring non-financial performance factors into awards for individuals who have direct responsibility for those matters. In his supporting statement and voluntary exempt solicitation, Jim emphasizes the cost of data breaches and privacy issues and argues that the metrics should apply to all high-level executives. Shareholders voted down a similar proposal last year at Verizon.