In 2002, Romero signed a consent decree the New York Attorney General at the time, Elliot Spitzer, to settle a privacy breach that had been discovered on the ACLU website. Although an outside company was responsible for the breach, Spitzer's office had demanded $10,000 from the ACLU for the error, which would later be reimbursed by the outside company directly responsible. However, as designated in the decree, Romero was required to distribute the decree itself to the national ACLU board within 30 days. Instead, he waited 6 months to do so, when he reportedly "offered vague and inconsistent explanations of the circumstances surrounding the negotiation, execution, and eventual distribution of the agreement".