The Original vs. The Copy – Does It Really Matter From An Evidentiary Perspective?
While there are many hurdles a business document needs to overcome in order to be admitted as evidence in court, there is one hurdle that many clients routinely inquire about – the legality and admissibility of digital image copies, in lieu of original documents. While lawyers recognize this as a best evidence issue, a legal doctrine that states an original piece of evidence is superior to a copy, for clients this is a matter of whether they need to retain an original signed contract or could they save space in their file cabinets and rely on a scanned copy on their hard drive. Although state laws concerning admissibility of evidence vary, states have generally adopted the language, in whole or part, of the Uniform Rules of Evidence (“URE”) and/or the Uniform Photographic Copies of Business and Public Records as Evidence Act (“UPA”). For the purpose of this article the differences between the URE and the UPA are not important or relevant. Accordingly there is a nationwide consensus that a digital image copy can generally overcome a best evidence challenge and be admitted as the original document.
The fundamental basis for states admission of digital duplicates can found in the URE, which allows copies that are established as business records to be admitted into evidence “to the same extent as the original.” Duplication is permitted by any technique that “accurately reproduces the original.” Similarly under the UPA, duplicate records are admissible as the original, in judicial or administrative proceedings, provided that the duplicate was generated by a “process which accurately reproduces the original.” The UPA permits the destruction of original documents, unless preservation is required by law (i.e. wills, negotiability documents and copyrights). Hence, the law permits the destruction of original documents subject to certain evidentiary requirements.
When read together and interpreted by the majority of states, the URE and the UPA allow duplicate copies to be given the same evidentiary weight as originals, so long as those copies are properly generated, maintained and authenticated. Therefore, clients are encouraged to adopt certain practices when copying their business documents:
- The copies should be produced and relied upon during the regular course of business.
- The business should have a written policy specifying the process of duplication, as well as where and how copies will be stored. This written policy should be made available to the business’s custodian(s) of records.
- The business’s written policy should include a requirement that at least one witness be present at the time of duplication that would be available to testify under oath that the generated duplicate accurately and completely represents the original.
- The business’s written policy should be subject to regular review in order to ensure the stated compliance procedures are satisfied.
Ultimately, clients should feel free to indulge their desire to “save the space” and dispose of an original contract, so as long as the above duplication practices are adhered to and all other relevant evidentiary and other legal requirements are satisfied. Clients should also be aware that since the medium for storing electronic records must meet certain legal standards, their choice of hardware is critical when it comes to admissibility of a duplicated record. Given the variety of legal and technological nuances that need to be taken into consideration, when in doubt it is always best to seek the guidance of a qualified and experienced attorney to avoid any potential legal pitfalls. The above article reflects the national trend in the United States and so to ensure that your business has complied with state and/or country specific regulations it is once again best to contact a qualified and experienced attorney who practices in your jurisdiction.
Effective April 1, 2014, businesses with a New York City office that have 20 or more employees working out of such office are required to provide five paid sick days per calendar year to their employees. (The law will expand to employers with 15 or more employees starting October 1, 2015.) Businesses with fewer employees working out of an office in New York City do not have to provide paid sick time, but must allow their employees five unpaid sick days.
The purpose of this Client Alert is to address some of the Frequently Asked Questions we have received from our clients about the new employment law. As we often stress, simple employment mistakes are often quite costly to fix:
Q. Does the law apply only to full-time employees? No. The law applies to all employees whether full-time, part-time, temporary or seasonal, as long as they work more than 80 hours in a calendar year.
Q. Does it matter whether the principal location of the business is in New York City? No. The law applies to any business as long as the business has employees based out of a location in New York City. Employers with offices in different states need only accommodate employees working in New York City with the leave time required under this law.
Q. Are there any limitations to the use of sick time? Almost none. Employees may use sick time for absences due to their own illness, injury or health condition or the illness, injury or health condition of a family member. In addition, the law allows sick time if the place of business is closed due to a health emergency or the employee must take care of a child whose school or care provider has been closed under similar circumstances.
Q. Do the five days need to be provided automatically to new employees? No. New employees can be required to work at least four months before they can use the sick days.
Q. How are the sick days accrued per year? Employees will accrue one hour of sick time for every 30 hours worked, and are entitled to 40 hours per calendar year.
Q. Can the employer insist on documentation if the employee uses multiple days on a consecutive basis? Yes. The law permits employers to require reasonable documentation for sick time lasting more than three consecutive work days.
Q. Does the law require businesses to extend any existing sick leave policy by the five days covered under the law? No. Employers who already provide at least five days of leave time (40 hours per calendar year) for the same paid leave usage and under the same conditions as leave time required under the new law are not required to provide additional sick time.
Q. Do the five days carry over from year to year? Yes. But the business may cap usage of accrued unused sick days to a maximum of 40 hours in a calendar year.
Q. Are businesses required to notify the employees about this change in the law? Yes. Written notice of rights must be provided to the employee at commencement of employment.
If you have any questions, please feel free to contact Howard A. Matalon, Esq. at 908-964-2424.
The Supreme Court of New Jersey held that individuals have a reasonable expectation of privacy in their cell phone location data under the NJ state constitution and that “cell-phone location information, which users must provide to receive service, can reveal a great deal of personal information about an individual.”
In a turn that is becoming less and less surprising given the trailblazing nature of the New Jersey Supreme Court, the Court recently ruled in State v. Thomas W. Earls that police must obtain search warrants before obtaining the personal tracking information for alleged perpetrators from cell phone providers. While this ruling has obvious implications for law enforcement professionals, from a broader perspective, the decision impacts — and, most importantly, protects — the privacy of individuals (and related businesses) who conduct business and their personal lives on cell phones throughout the nation. The decision underscores a continuing battle between government intrusion into personal privacy which is increasingly in tension with the advancement of the digital age vis a vis the use of smartphones to conduct day-to-day business. While various states throughout the country have been toying with the idea of passing legislation which would require probable cause warrants to issue before access to cell phone data is granted, the New Jersey Supreme Court’s ruling puts New Jersey at the forefront of addressing this issue.
While the facts of the case are not specifically relevant and pale in impact when compared to the implications of the decision, for completeness, the case involved burglaries in Middletown, New Jersey. In investigating the burglaries, law enforcement officials used the data received from T-Mobile to track the stolen merchandise including a cellular phone which ultimately led to arrests of Mr. Earls. In protecting the rights of Mr. Earls and overturning the decision of the lower courts, the New Jersey Supreme Court matter-of-factly ruled that individuals can and should “reasonably expect that their personal information will remain private” when entering into a contract with a cell phone carrier. In explicitly recognizing a Constitutionally-based right to privacy as to the location of his or her cell phone, this decision builds on last year’s ruling by the United States Supreme Court in United States v. Jones, 615 F.3d 544 (2012). In that case the United States Supreme Court said that the State’s/Government’s attachment of a GPS device to a vehicle and the use of that device and data to monitor a vehicle’s movements constitutes a search under the Fourth Amendment and, as such, is protected under the laws related thereto.
Given the capabilities of cell phones, the New Jersey Supreme Court declared that, in essence, a cell phone was a GPS device. In fact, the Court went as far as to say that using a cell phone for locational purposes can “be far more revealing than acquiring toll billing, bank, or Internet subscriber records. It is akin to using a tracking device and can function as a substitute for 24/7 surveillance without police having to confront the limits of their resources” Interestingly enough, the Court’s decision also raises the possible impact of use of the data on access to PHI (protected health information). The suggestion is that that cell phone tracking could theoretically be used to determine when and who a patient is treating with given that the location of a medical facility is easily discernible.
This is only the tip of the iceberg. While the Court does a reasonable job at spinning out possible scenarios where the privacy of the cell phone owner could be impacted due to intrusions on privacy without a warrant, the Court speaks in a targeted and hypothetical manner. Though the Court attempts to temper things legally by placing an “emergency aid” exception to the use of a warrant and ultimately the fruits of the search, the possibility of mining this data should be recognized by individuals who continue to use cell phones for every aspect of their daily lives. As cell phone (and data) use naturally increases, it will be crucial to provide tight restrictions on third-party use of cell phone information because not only will companies likely try to monetize the same, in using data in any unauthorized way, the rights and interests of privacy as a whole come into play.
OlenderFeldman LLP has significant experience dealing with privacy and business related issues which are implicated in the decision discussed above. If you have any questions about the legal or practical implications of this case, please contact Christian Jensen, Esq. (email@example.com) at (908) 964-2485.
In response to questions from concerned business owners, we’ve compiled answers to some of the frequently asked legal questions regarding complying with the Affordable Care Act, or “Obamacare”.
The Affordable Care Act: FAQ For Business Owners
Many businesses are still unaware that they must assess this year whether they are required under the Patient Protection and Affordable Care Act (“ACA”) — otherwise commonly referred to as “Obamacare” — to provide affordable healthcare to their Full Time employees when the health care plan mandate goes into effect on January 1, 2014.
Because of the complex nature of the ACA’s provisions and their nationwide impact, we have prepared this FAQ Sheet to explain in basic terms how the ACA works and to address the most common misunderstandings about the law itself by the business community. Remember: simple mistakes can often be costly to fix.
1. Do the ACA’s Health Care Plan Requirements apply to every business? No. The ACA only applies to businesses having “Large Employer Status”, which is defined under the ACA as having 50 or more Full Time or Full Time Equivalent (“FTE”) employees.
A Full Time employee under the ACA is someone who works an average of 30 hours per week (or 130 hours per month) as measured over a period of six (6) consecutive months in the 2013 calendar year. Hours include both time worked and time paid but not worked (such as holidays, paid time off, and so forth). But this is not the end of the assessment process because FTE employees also must be taken into account.
To protect against businesses trying to get around the 50 Full Time employee threshold by simply reducing the hours of a few employees below 30 hours per week, the ACA requires that an employer add together the total number of Full Time employees and FTEs for purposes of evaluating “Large Employer Status”. The number of FTEs is determined by combining the number of hours of service in a given month for all employees averaging less than 30 hours of service per week and dividing that number by 120. That calculation will yield the number of FTEs that must be added to the total number of Full Time employees to determine whether an employer meets the “Larger Employer Status” threshold.
Example: Business X has 42 Full Time employees and 20 employees who each work on average 80 hours per month. Using the calculation set forth above, those 20 employees would translate into 13 FTEs (20 x 80/120). The total of Full Time employees and FTEs at Business X would therefore be 55 and trigger “Large Employer Status.” Business X must therefore provide an ACA-compliant health care plan for its Full Time employees in 2014.
2. If a business qualifies as a “Large Employer” under the ACA, does it need to provide healthcare plans for all company employees? No.
Businesses that are required to have an ACA-compliant plan only need to provide health care benefits to Full Time employees (i.e., those working 30 hours or more per week).
3. What does a business need to include in its health care plan to become “ACA-compliant”? ACA-compliant Plans must: (A) be “Affordable”; (B) Provide “Essential Benefits”; and (C) Cover 60% of the Plan Cost (otherwise known as “Minimum Value”).
The Affordability Test.
In order to meet ACA’s definition of an “Affordable” health care plan, the lowest cost option for a Full Time employee’s individual coverage must be less than 9.5% of the employee’s modified adjusted gross household income. Businesses can evaluate whether they satisfy the 9.5% threshold of an individual employee’s AGI by looking to Box 1 of an employee’s Form W-2 Wages.
Example: Employee X has W-2 Wages of $30,000. The health care plan requires the employee to contribute $200 per month for individual coverage (or $2,400 per year). The coverage would therefore meet ACA’s definition of Affordable. If the plan were to require the employee to contribute $250 per month (or $3,000 per year) it would exceed the 9.5% threshold and therefore the plan would not satisfy the affordability standard.
The “Essential Benefits” Requirements.
An ACA-compliant Plan must also contain “Essential Benefits” unless the plan is grandfathered under the ACA (and most existing plans do not qualify for grandfathered status for reasons not addressed here – consult your healthcare consultant or provider for details).
Such Essential Benefits must include at a minimum:
- Ambulatory patient services, such as doctor’s visits and outpatient services;
- Emergency services;
- Maternity and newborn care;
- Mental health and substance use disorder services, including behavioral health treatment;
- Prescription drugs;
- Rehabilitative and habilitative services and devices;
- Laboratory services;
- Preventive and wellness services and chronic disease management; and
- Pediatric services, including oral and vision care.
In addition, an Essential Benefits small group Plan is subject to annual deductible limits ($2,000 for self coverage and $4,000 for family) and all plans are subject to annual out-of-pocket maximums for Essential Benefits. For 2014, the out-of-pocket maximums are $6,350 for individual coverage and $12,700 for family coverage.
The “Minimum Value” Test
“Minimum Value” under the ACA means that the employer’s share of its sponsored plan is at least 60% of the total cost of the plan.
Both the CMS.gov and IRS.gov websites have a Minimum Value Calculator that can be downloaded as an Excel Spreadsheet and used by the employer to determine whether its sponsored Plan meets the Minimum Value requirements. This calculation can easily be handled by health care benefits consultants, who will be able to recommend approaches to health care plans to insure minimum value is achieved.
4. Do businesses have any obligation to notify employees of their rights under the ACA regardless of whether or not they are providing an ACA-compliant Plan in 2014? Yes.
On or before October 1, 2013, all businesses that would otherwise be subject to the Fair Labor Standards Act (which includes any business in the United States with annual dollar volume of sales or receipts in the amount of $500,000 or more) must provide ACA notification advising employees of their rights and whether the employer will be providing an ACA-compliant plan.
This notice is known as a “Marketplace Exchange Notice,” which relates to the fact that individuals can obtain health care subsidies or purchase health care through State Marketplace Exchanges; such exchanges are expected to go into effect later this year if such insurance is not offered through an employer. Sample notice links from the Department of Labor are attached here (employers who offer a health plan) and here (employers who do not offer a health plan).
5. Does the ACA make any changes to COBRA that businesses must comply with? Yes.
The ACA also requires businesses to notify any employees eligible to receive COBRA benefits that they are entitled to elect coverage under the Marketplace Exchange rather than COBRA.
A link to the DOL website page regarding new sample COBRA notification forms is available here.
6. What exposure do businesses have if they are required to provide an ACA-compliant health care plan and fail to do so? The penalties for non-compliance under the ACA range from $2,000 to $3,000 per Full Time employee for each year of non-compliance, with the amount of the fine dependent on the nature of the employer’s failure to comply with the law.
If a business fails to offer Full Time employees a healthcare plan, the ACA penalty is $2,000 per Full Time employee (after the first 30 Full Time employees) for any employee that would otherwise be eligible to receive coverage under an ACA-compliant plan from their employer.
If a business offers a plan to all Full Time employees, but the plan is not ACA-compliant, the business may be fined $3,000 for each Full Time employee that seeks health care coverage through a healthcare exchange rather than through the employer sponsored plan.
It is also important to note that because the Internal Revenue Service will be policing ACA compliance, an employer who fails to comply with ACA may expose itself to other federal investigations into employee matters, including a full IRS or Department of Labor audit.
In conclusion, every business MUST carefully consider as part of its planning whether it is subject to the ACA and take steps this year to come into compliance if necessary. OlenderFeldman LLP is available to assist you in this regard and to make recommendations on health care consultants as well to develop and structure an ACA-compliant plan. Please contact Howard Matalon, OF’s Employment Partner, for an evaluation of your ACA compliance requirements by email or by using our contact us form.
Support may be growing for allowing cybertheft victims to “hack back.” What are the privacy concerns of allowing hackbacks?
The concept isn’t crazy (the article’s warning that hacking back at the Chinese Army might be trouble notwithstanding) — there is a general common law right to self-defense (you don’t have to let someone hit you), to defense of property (you don’t have to let someone steal your stuff), to defense of others (you can stop someone snatching another’s purse), and to peaceably reclaim property (you can walk down the block and take your bike back off the front lawn of the kid who took it). The rub with hacking back is that it is made illegal by the same law that makes the hacking illegal — that is, hacking, without regard to the underlying crime of theft of property or IP, is itself illegal. Half the point is that it gives prosecutors a way to get around the idea of whether copying data is crime and to cut off snooping before it turns into a more destructive hack.
Later, discussing Professor Orin Kerr’s statment that “because it is so easy to disguise cyberattacks, there is a real risk that retaliatory measures could affect innocent bystanders, which raises a range of privacy concerns,” Rick writes:
If the person that is hacked back isn’t the actual hacker, then their information is exposed through no fault of their own and the original victim has now compounded the damage. That’s an actual concern, not some vague notion that is readily dismissed. It’s got a nice real-world parallel: if someone steals your bike, and you go to take it back but take the bike from someone who owns the same one and didn’t steal yours, that’s bad. We all understand that. Imagine: allowing people to reclaim property creates a range of ownership concerns.
You can read the whole post here.
New Jersey’s Revised Uniform Limited Liability Company Act – What all owners of New Jersey LLCs Need to Know
What is the New Jersey’s Revised Uniform Limited Liability Company Act?
The Revised Uniform Limited Liability Company Act (“RULLCA”) replaces and expands New Jersey’s Uniform Limited Liability Company Act (“NJ ULLCA”) which was originally put in place to govern limited liability companies in January of 1994. RULLCA was officially enacted on March 18, 2013, and, at least for the next 11 months, applies only to LLCs formed after that date. After March 1, 2014, the RULLCA will apply to all LLCs regardless of the date of formation.
How will the RULLCA affect your LLC?
The following is a brief summary of the most significant changes to the statute that may affect your LLC:
1. Fiduciary Duties
Under the outgoing NJ ULLCA, LLC members owe fiduciary duties to other members. (These are generally the duty of loyalty and the duty of care.) The duty of loyalty often involves avoiding conflicts of interest, however, the members could waive the fiduciary duty in the operating agreement. This framework allows many people to participate in multiple businesses outside an LLC even when those other activities might conflict with the LLC’s business.
RULLCA no longer permits the members to agree to waive certain rights, including fiduciary and other rights that they owe to each other, like the duty of good faith and fair dealing. While this may not have significant impact on the operation of a company in the ordinary course, in disputes between members involving activities outside of the company, this can have a dramatic effect and provides an aggrieved member with significantly improved rights.
Under the RULLCA, the default rule on distributions is that all profit available for distribution will be made to the members on a ‘per capita” distribution, meaning equal shares for each member, unless otherwise agreed to in the operating agreement. This change means that any LLCs that do not have an operating agreement and that have been distributing profit other than on an “equal share” basis, will be required to do so.
Under the NJ ULLCA, upon disassociation a member, absent a contrary provision in the operating agreement, is entitled to be paid the fair value of his or her interest in the company, which can be a financial stress on a business that might prefer to deploy its capital for growth. Under the RUCLLA, a “resigning” member is no longer automatically entitled to receive fair value; instead that person becomes dissociated as a member and assumes the rights of economic interest holder. This change means that the member loses the right to participate in the governance of the company (as well as the potential liability associated with the operation of the company), but retains the rights to receive distributions of profit and of the company’s assets upon liquidation or dissolution. Absent a provision in the operating agreement that requires the sale of the member’s interest upon disassociation, a member will neither be entitled to be bought out nor will the company have the right (or obligation) to do so (note that this can have the effect of enabling a member to cease participating in the business while continuing to profit from it, an outcome typically not desired by the remaining members).
4. Deadlock and Oppression
Under the NJ ULLCA, there are very few rights afforded to a minority member that is oppressed by the majority or, similarly, to resolve a deadlock between members. As such, this issue is typically addressed in the operating agreement to ensure that the members have remedies in the event of oppression or deadlock. The RULLCA provides express remedies for oppressed minority members: the right to seek the dissolution of the LLC or the appointment of a custodian. These remedies give the oppressed minority substantial leverage to obtain a buyout or other relief relating to the operation of the company that it previously did not expressly have under the NJ ULLCA.
While it is good practice to have your LLC operating agreement reviewed every few years to ensure that it is consistent with the intentions and practices of the members, the changes effectuated by the RULLCA make it critical that every company’s operating agreement be updated to make sure that it consistent with the revisions to the law.
New Law Significantly Limits Viability of Certain Shareholder Derivative Suits in New Jersey
On April 2nd, New Jersey Governor Chris Christie signed bill A-3123 into law and in doing so, significantly revised the law in New Jersey regarding shareholder derivative proceedings under N.J.S.A. §14A:3-6, etseq. The stated purpose of the new law is to temper derivative lawsuits brought by shareholders against a corporation, its directors or majority shareholders and to make efforts to curb excessive and unnecessary litigation costs on New Jersey corporations. Beyond this succinct goal, an ancillary intent of the law is to encourage corporations to continue to incorporate in New Jersey by making the state more corporate friendly.
Notable changes include the following:
As a precondition to suit, a shareholder must make a written demand to the corporation to take suitable corrective action and allow the corporation 90 days to investigate and respond to the demand unless “irreparable injury to the corporation would result by waiting.” This 90 day waiting period is a akin to a tort claims notice and is intended to give corporations adequate time to remedy potentially minor issues before dealing with the costs and expense of litigation.
In the event that a plaintiff challenges a company’s actions in suit after the demands made in the 90 day letter are rejected, he/she/it must allege with particularity that the decision was improper and show any rejection was in bad faith or not made by “independent directors.” A status as a litigant does not divest a director of independence and unless the independence of the directors is challenged successfully, the plaintiff must show bad faith on the part of the entity.
The law increases the interest requirement that a plaintiff must hold an entity to avoid the posting of security against the possible award of attorney’s fees and costs. If litigant a holds less than 5% of the outstanding shares of any class or series of the corporation, unless the shares have a market value in excess of $250,000, the corporation can require the plaintiff to give security for the reasonable expenses, including attorney’s fees. This will hopefully dissuade minority shareholders from filing suits with questionable merit.
The law requires that a plaintiff remain a shareholder throughout any initiated litigation so that it can adequately and fairly represent the corporation’s interests. Prior to this change, the shareholder merely had to be a shareholder at the time suit was filed.
The law applies to both derivative proceedings brought on behalf of single shareholders as well as class actions.
A corporation can move for dismissal of a suit, after a good faith investigation, and assert that the derivative proceeding is not in the best interest of the corporation on the grounds that its board is independent and acted in good faith. Such a motion will be granted unless the court finds otherwise or the shareholders rebut the corporation’s supporting facts.
The court must stay discovery until ruling on the motion to dismiss, but can order limited discovery if the plaintiff shows a lack of independence or good faith.
The court must approve any settlement or dismissal.
The court can award expenses to the plaintiff if the proceedings result in a substantial benefit to the corporation, or to the defendant if the case was commenced or maintained without reasonable diligence or reasonable cause or for an improper purpose.
For these new provisions to apply, existing corporations must amend their certificate of incorporation and explicitly adopt these provisions.
For more information about this new law and how it may impact your business please contact Olender Feldman LLP, or review our additional business legal resources here.
What is the best way to protect against employee lawsuits?
We recently received an inquiry about the best ways for businesses to protect against employee lawsuits. We’ve found that most employee lawsuits occur due to low morale, unaddressed personality conflicts, disparate productivity between employees and/or failure to give effective performance reviews. Of course, it is always important to have effective, well-drafted legal documents and policies that clearly delineate employee rights and obligations from the outset, which will help your business win lawsuits . However, the easiest way to protect your business from lawsuits is by preventing them in the first place. This means ensuring a good working environment, keeping employees happy, and giving employees recourse to deal with the issues that come up in the workplace, ideally through a dedicated and effective HR representative.
OlenderFeldman LLP Data Protection and Privacy lawyers Michael Feldman and Aaron Messing will attend the International Association of Privacy Professionals (IAPP) Global Privacy Summit, to be held March 6-8 in Washington, D.C.
The event will feature thousands of privacy industry professionals participating in dozens of educational sessions. If you would like to meetup with Michael or Aaron, please send them an email or contact us using the contact form. We hope to see you there.
OlenderFeldman LLP Quoted in 2013 Data Privacy, Information Security and Cyber Insurance Trends ReportJanuary 28th, 2013
In honor of Data Privacy Day, Cyber Data Risk Managers asked top industry experts their thoughts on what they think, feel and should happen in 2013 as it pertains to Data Privacy, Information Security and Cyber Insurance and what steps can be taken to mitigate risk.
Cyber Data Risk Managers asked many top privacy and data security experts, including Dr. Larry Ponemon, Rick Kam, Richard Santalesa and Bruce Schneier, their thoughts on what to expect in 2013. OlenderFeldman LLP’s information privacy lawyer Aaron Messing contributed the following quote:
2012 was notable for several high-profile breaches of major companies, including LinkedIn, Yahoo!, and Zappos, among others. As businesses move more confidential and sensitive data to the cloud (especially in the aftermath of Hurricane Sandy’s devastation and the havoc it wreaked on businesses with locally-based servers), data security obligations are of paramount importance. Businesses should expect more notable data breaches, more class-action lawsuits, and federal legislation concerning data breach obligations in 2013.
To protect themselves, business should: (i) require that cloud providers and other third-party vendors provide them with a written information security plan containing appropriate administrative, technical and physical security measures to safeguard their valuable information; and (ii) ensure compliance with those obligations by drafting appropriate contractual provisions that delineate indemnification and data breach remediation obligations, among others. In particular, when using smaller providers, businesses should consider requiring that the providers be insured, so that they will be able to satisfy their indemnification and remediation obligations in the event of a breach.
Give the 2013 Data Privacy, Information Security and Cyber Insurance Trends report a read.
We often receive questions about how to choose an attorney or law firm that is suitable for your particular issue or business. Here are some considerations to keep in mind.
There are a number of consideration that go into vetting an appropriate attorney. The first, and arguably most important, is ensuring that your attorney understands business relationships and how companies function. While many lawyers are technically proficient in the law, it is important to ensure that your attorney understands, and craft legal solutions specific to, your business and industry. Your attorney should be practical and be able to develop solutions that not only address your requirements, but also those with whom you wish to do business with or interact with. In the negotiating process, many attorneys make unrealistic demands based on idealistic desired outcomes, or are unwilling to consider strategic compromises in order to make sure an agreement is actually reached. This ultimately works against your ultimate interests, as the job of your attorney is to make sure that your goals are accomplished with a minimum of time, effort and cost.
You should also ensure that your attorney has subject matter experience, both in the industry and specific to the work to be performed. This enables the attorney to work efficiently, and minimize cost and time. This is an important consideration that is often overlooked and bears emphasis. Hourly rates are actually less important than the ability to execute work efficiently. If an attorney is learning “on the go”, they will ultimately end up being more expensive than a lawyer who has experience in the industry and subject matter, even if the inexperienced lawyer’s hourly rates are cheaper.
Finally, you should ensure that the attorney is accessible, and that if work is to be delegated, that your attorney retains constant oversight of subordinates, rather than just handing off the work.
The Federal Trade Commission has proposed revisions that will bring the Children’s Online Privacy Protection Act in line with 21st century technology, largely targeting social networks and online advertisers.
By Alice Cheng
Based on comments solicited last year, the Federal Trade Commission (FTC) has posted proposed revisions to the Children’s Online Privacy Protection Act (COPPA). The Act, which has not been updated since its inception in 1998, may be extended to include social networks and online advertisers.
According to the current regulations, COPPA applies only to website operators who know or have reason to know that users are under the age of 13, requiring the sites to obtain parental consent before any collection of data. In the past decade, an increased ability to harvest consumer information has necessitated revisions. In a FTC staff report conducted earlier this year, the Commission addressed a growing need for app stores and app developers to provide more information regarding their data collection practices to parents. With the proposed changes posted today, the FTC plans to update COPPA to respond to modern concerns surrounding social networking sites, advertising networks, and applications. Under the proposed changes, such third parties may be held responsible for unlawful data collection practices when they know or have reason to know that they are connecting to children’s websites. Mixed audience websites may have to screen all visitors in order for COPPA regulations to apply to users under 13 years of age. Additionally, restrictions on advertising based on children’s online activity may be tightened.
The FTC will be accepting public comment to the proposed rules via the FTC website. Comments will be accepted until September 10, 2012.
Several House lawmakers have sent letters to nine major data broker firms, seeking transparency on data practices.
By Alice Cheng
Last week, eight House members, including Congressional Bi-Partisan Privacy Caucus chairmen Ed Markey (D-Mass.) and Joe Barton (R-Tex.), sent letters to nine major data broker firms, asking for information on how they collect, assemble, maintain, and sell consumer information to third parties.
The letter references a recent New York Times article profiling data broker Acxiom, which may have spurred the lawmakers’ decision to target the firms. Data brokers are large firms that aggregate information about hundreds of millions of consumers, selling them to third parties for marketing, advertising, and other purposes. Oftentimes, profiles of consumers are created to reflect spending habits, political affiliation, and other behavioral information. As the article explains, the issue with these activities is that they are largely unregulated, largely unknown to the general public, and are often be difficult to opt out of.
Privacy advocates, lawmakers, and often the Federal Trade Commission have made continued moves towards increased transparency of the activities of data brokers. A statement explains that, in sending the letter to the nine firms, the lawmakers in the Bi-Partisan Privacy Caucus seek to obtain information on the brokers relating to “privacy, transparency and consumer notification, including as they relate to children and teens.”
Survey finds that only 61.3% of apps have privacy policies, reflecting perceived need for increased app privacy regulations.
By Alice Cheng
The FPF credits the consumer privacy efforts of various groups, including the Federal Trade Commission and the California Attorney General. The FTC has made continuous efforts to develop companies develop best consumer privacy practices, and has been involved in battling privacy violations. In February, California Attorney General Kamala Harris persuaded six major companies with mobile platforms (including Apple, Microsoft, and Google) to ensure that app developers include privacy policies that comply with the California Online Privacy Protection Act. More recently, Harris also announced the formation of the Privacy Enforcement and Protection Unit to oversee privacy issues and to ensure that companies are in compliance with the state’s privacy laws.