Crisis Management at the Intersection of Marketing, Privacy, Security and Reputation

For those of you interested and available, on Thursday, April 23rd at 1 PM ET, Joe Rosenbaum, NY Partner at Rimon Law and chair of Rimon’s Global Alliance will be conducting a one hour seminar entitled Crisis Management at the Intersection of Marketing, Privacy, Security and Reputation touching on some of the current issues in marketing, privacy, public relations, cybersecurity & reputation management arising from the COVID-19 pandemic.

While the issues raised may well apply in many crisis situations, now, more than ever, as increased numbers of people are working, schooling and playing at home or at other remote locations, the value of online and mobile advertising and promotions has increased substantially. At the same time, the amounts of information being made available by people scrambling for information, trying to keep up with breaking news, and signing up for online, digital services and information, present legal challenges for compliance with both old and newly enacted privacy and data protection regulation. Not coincidentally, online and mobile scammers are seeking to capitalize on the growing number of inexperienced web surfing consumers and cyber criminals are using the opportunity to capture valuable personally identifiable as a result of lax or relaxed security measures. The inaccurate perception that strong security may be an obstacle to utility or speed and simply the increased number of inexperienced users accessing the Internet, provide fertile ground for exploitation. What you should know? What you can do? What you should be telling your clients and employees? What can we all do to help?

To register simply go to REGISTER: Crisis Management at the Intersection of Marketing, Privacy, Security and Reputation

The course is open to lawyers and non-lawyers, is approved for New York bar members who are eligible for 1 CLE credit per course through NY’s Approved Jurisdiction Policy and approved by the California State Bar for 1 hour of CLE credit.  Most other states recognize CA accredited courses and if you would like credit in any other state, please check your local state bar’s regulations.

California Consumer Privacy Act (CCPA)

Although amended twice (September 13th and October 11th of 2018) after its initial passage by the California State Legislature and being signed into law by Governor Jerry Brown in June of 2018, the California Consumer Privacy Act (California Civil Code Section 1798.100) (“CCPA”) becomes effective with the new year (January 1, 2020).

Although it is intended to protect and afford California residents with certain rights (in some areas, greater or somewhat different than the European Union’s General Data Protection Directive 2016/679), it affects non-profit entities that do business in California, and that collect personal information of consumers and either has annual gross revenues over $25 million OR buys or sells personal data of 50,000 or more consumers/households OR earns over half its annual revenue from selling consumer personal information.

If your organization fits into any of those categories, you are required to establish, put into place and maintain reasonable security procedures and practices to protect consumer data and to afford California residents the right to know what personal data is being collected about them; to know whether and to whom the consumer’s personal data is sold or disclosed; to refuse to permit the sale of their personal data; to access their personal information; and to ask you to delete personal information collected from them.  The law also prohibits discrimination against any consumer for exercising any of their privacy rights under the CCPA.

While many business have been busily amending their agreements with suppliers, service providers and likely have been presented updated and revised contracts with “CCPA” amendments in order to ensure those in the chain of collection, storage, handling, distribution and use are in compliance, if you do any business in or with California residents, don’t forget to update your privacy policies and any terms of use that apply to your websites, e-commerce and online/mobile presence generally.  Those sites, even those that do not require any registration or input directly from consumers, almost certainly will be collecting information that is covered by the broad definition of “personal information” under the CCPA.

If you would like to know more about the CCPA or have any questions about this post, don’t hesitate to contact me Joe Rosenbaum, or any of the Rimon lawyers with whom you regularly work.

 

Global Social Media Handbook

I am proud to be among the 22 legal professionals, including 7 of my colleagues at Rimon, who contributed and co-authored a new book entitled Handbook on Global Social Media Law for Business Lawyers, published by ABA Publishing. This comprehensive work, sponsored by the Business Law Section of the American Bar Association, was co-edited by Valerie Surgenor, a partner in the Glasgow, Scotland, law firm MacRoberts LLP and John Isaza, my friend and partner here at Rimon, P.C.   Although principally focused on the United States, there are contributions from foreign lawyers in key regions around the world, including Canada, the European Union, Australia, Russia and Asia.

The Handbook deals with national and international law principles and emerging issues related to social media law, ethics, compliance and governance, including cybersecurity, cyber terrorism and risk management in a social media environment (e.g., hacking, corporate espionage, data loss and data breach); intellectual property issues in social media;  defamation, “fake news” and social media;  implementation of a social media crisis plan; use of social media as a tool in recruitment of employees and the privacy implications to employers;  promotional, endorsement and social media disclosure guidelines promulgated by the Federal Trade Commission in the US; and recent trends in UK and European social media legislation and regulation.  There is a separate chapter that discusses information and records management within the context of social media.

If you are interested, you can order a copy directly from the ABA (Handbook on Global Social Media Law for Business Lawyers) and of course, if you need more information or want to discuss your particular requirements with knowledgeable and experienced professionals, feel free to reach out to me, Joe Rosenbaum, or to any of the lawyers at Rimon with whom you work with regularly.

 

First Joint Consultations May Foreshadow Effectiveness of Privacy Shield

–  Stephen Díaz, Partner, Rimon, P.C. &  Claudio Palmieri, Of  Counsel Rimon, P.C. (Principal, Studio Legale Palmieri –Rimôn Italia)

On October 6, 2015, the Court of Justice of the European Union invalidated the so-called “Safe Harbor” that previously governed data transfers between the U.S. and the EU (Case C-362/14 – Maximillian Schrems v. Data Protection Commissioner, 6 October 2015).

As you already know if you read our Legal Bytes’ posting in May concerning the US-EU Data Transfer Privacy Shield, personal data cannot be transferred to from the EU to a non-European Union/European Economic Area country, unless that country can ensure “adequate levels of protection” for such personal data. While the European Commission had identified a number of countries that met the ‘adequate protection’ test, the United States was not one of them and without the Safe Harbor understandings, transatlantic exchanges of data – both for commercial and national security reasons – were at risk of being non-compliant with EU regulations!  In an attempt to temporarily address the data transfer issues, the EU and the U.S. proposed a new framework for exchanges of personal data for commercial purposes, known as the EU-U.S. Privacy Shield (“Privacy Shield”) which was formally launched on July 12, 2016.

Further complicating matters, a new EU General Data Protection Regulation (GDPR) comes into effect on May 25, 2018.    In furtherance of a formal and more permanent agreement under the Privacy Shield and in contemplation of the new regulations, representatives of the U.S. and the EU have announced they will meet in Washington, DC during the week of September 18, 2017, for the first Annual Review of the Privacy Shield.  In advance of the meeting, the EU’s official Working Group (WP 29) sent the European Commission their recommendations and consistent with previous pronouncements, they believe the meeting should focus on enforcement of rights and obligations, as well as changes in U.S. law since the adoption of the Privacy Shield.  WP29 recommended discussions focus on these issue and that any formal agreement must deal with both commercial, as well as law enforcement and national security access.

These concerns and considerations are explored in more detail in our full Client Alert: No Certainty in Future of Privacy Shield as Transatlantic Consultations Set to Begin and it is clear that the September consultations may well be an indication of whether the Privacy Shield will prove an adequate regulatory regime for the transatlantic transfer of personal data and whether meaningful progress is likely in the current environment.

If you would like more information, a better understanding or need guidance regarding compliance with these regulations, contact Stephen Díaz Gavin, a Rimon Law Partner based in Washington, DC or Claudio Palmieri is of counsel to Rimon, P.C. and the principal of Studio Legale Palmieri –Rimôn Italia in Rome, Italy. Of course you can always contact me, Joe Rosenbaum, or any of the lawyers at Rimon with whom you regularly work.

 

Forensic DNA and Missing Children: The Legal & Ethical Issues

Since 1983, when the day was designated by U.S. President Ronald Reagan as National Missing Children’s Day in the United States and spreading internationally through the Global Missing Children’s Network (GMCN), May 25th has been celebrated as International Missing Children’s Day.  GMAC is a jointly sponsored venture of the U.S. National Center for Missing & Exploited Children (NCMEC) and the International Centre for Missing & Exploited Children (ICMEC),  that focuses on educating parents on steps they can take in protecting their children, as well sharing best practices and information in investigating cases of child abduction, trafficking and illegal adoptions.

This year, I have the distinct privilege and great honor of speaking at the conference for Missing Children and Genetic Identity, organized by the Portuguese Association for Missing and Exploited Children [Associaçāo Portuguesa de Crianças Desaparecidas] and sponsored by Genomed, to be held at Lusófona University in Lisbon on the 25th of May 2017 – International Missing Children’s Day.

The conference will explore the connection between modern genetics and forensic science and on national and international efforts to aide investigations of missing and abused children.  The legal and ethical issues surrounding DNA collection and use, the pros and cons of storing DNA samples and maintaining a database of digital DNA ‘fingerprints’ as well as other bio metric information from individuals – convicted criminals, arrested individuals, victims, family members and even the general public – continues to be hotly debated on the national and international level throughout the world.  In addition to issues of privacy and security, the use and potential abuse of genetic and other bio metric evidence, whether to exonerate individuals or convict guilty individuals, is not just complicated, it is inconsistent across jurisdictional borders.  Sharing of critical information that may help identify a child or investigate a missing person, whether or not a crime may have been committed, is neither assured nor routine – despite the obvious benefits a regulated and carefully constructed information sharing system might be to family members, law enforcement and the forensic scientific community.

The conference, one of many throughout  the world on May 25th, will attract distinguished guests and provide a forum for discussion and shine a much needed spotlight on the legal and ethical challenges and opportunities at the intersection of science, law and law enforcement. I will publish a copy of my presentation and remarks after the conference concludes, but if you would like to know more about the conference, feel free to contact me, Joe Rosenbaum, or the organizers directly.

 

US-EU Data Transfer Privacy Shield

Being referred to by the European Union as the most important change in data privacy regulation in 20 years, the new EU General Data Protection Regulation (GDPR) comes into effect on May 25, 2018.  There is even a ‘countdown’ clock on the website and under the GDPR, “Personal Data” means information relating to an identified or identifiable natural person (including email addresses, telephone numbers, addresses and IP addresses).   While the European Commission has determined a number of countries already meet the ‘adequate protection’ test, the United States is not one of them!

As most readers of Legal Bytes already know, personal data cannot be transferred to from the EU to a non-European Union/European Economic Area country, unless that country can ensure “adequate levels of protection” for such personal data.

As background, in July of 2016, a new framework for the movement of personal data between the EU and the US was finalized – EU-U.S. and Swiss-U.S. Privacy Shield Frameworks – which was put into place in an effort to meet the requirements of the EU Data Directive.   However, critics noting the holes in that framework, have generated increasing concern as the 2018 effective date of the new EU GDPR approaches.   A few months ago, immediately following the inauguration ceremony, President Trump issued United States’ Executive Order 13768 (January 25, 2017) that has created even greater concern.  While it is possible a new or refined agreement and framework may be put into place in the months leading up to 2018, there is no certainty.

What do you need to know? What should you consider doing now?   My colleague Jill Williamson has written an article which has been published in Risk & Compliance Magazine, entitled “The Fragile Framework of the Privacy Shield“.   If you want to know more about the privacy and data protection implications of the new framework, its potential risks to your business and what you should be considering as you look to the future, feel free to contact Jill Williamson directly.  Of course, you can always contact me, Joe Rosenbaum, or any of the Rimon lawyers with whom you regularly work.

The Paradox of Illumination

I first heard about the paradox of illumination from Lee Loevinger, an extraordinary gentleman I was privileged to know professionally.  Lee was a multi-faceted, multi-talented, thought-provoking lawyer whose sage advice and stimulating ideas continue to resonate with those honored to have known him, and everyone else wise enough to read his work and the words he left behind.

In a nutshell, the paradox of illumination is extraordinarily complex, but simple to describe.  Much like Albert Einstein who, when asked about his theory of relativity and the notion that time is not constant, described it in personal terms: if a man is at dinner for 10 minutes with a beautiful woman, it seems like a fleeting instant; but sit on a burning hot stove for 10 minutes and it seems like an eternity :).

The paradox of illumination can similarly be described on a personal level.  Sit in completely dark room.  Really.  Completely dark.  What can you see?  Nothing.  You know little about your surroundings and can only sense your own body – in fact, you don’t even know how far your surroundings extend beyond your immediate sensations.

Now light a match.  The circle of illumination allows you to see a little of what is around you – but the perimeter and beyond are still dark.  Now light a candle.  The circle of what you can see illuminated by the light is larger than before, but the size of the perimeter beyond which you cannot see is also a lot larger than before.  The larger the light, the larger the area of illumination, but larger by far is the perimeter beyond which we know nothing.

The more we can see and the more we know and understand about the world around us, the larger the amount becomes that we don’t know.  In other words, as the circle of our knowledge grows, so does the amount of knowledge we cannot see and don’t know.  The paradox of illumination is the paradox of knowledge.  Perhaps that is why Michelangelo, when he was more than 87 years old, still said, “Ancora Imparo” (I am still learning).

Thought Leadership

Thought leadership is a state of being in which one or more individuals articulate innovative ideas – ideas that stimulate thought and are futuristic or leading-edge.

Thought leadership requires confidence and a willingness to share ideas in the form of insights and principles that inform and guide future considerations.

Thought leadership is often controversial. New or different ideas, like innovative technology, can cause evolutionary change, but can also create disruptive or revolutionary change.

Although not all thought leadership must be actionable, it is often the basis for a re-evaluation of existing pathways, and a guidepost for new roads ahead.

2016 Metamorphosis *

Legal Bytes will soon morph** and undergo a transformation***

Watch For It

*    Metamorphosis: A noticeable change in character, appearance, function or condition.

**    Morph: To undergo dramatic change in a seamless and barely noticeable fashion.

*** Transformation: A marked change in appearance or character, especially for the better.

White House Releases Privacy Report and Calls For a Consumer Bill of Rights

Earlier today, Secretary of Commerce John Bryson and Federal Trade Commission Chairman John Liebowitz outlined the Obama administration’s strategy for ensuring “consumers’ trust in the technologies and companies that drive the digital economy.” On the heels of their announcement, and although it is dated January 2012, the Department of Commerce released a long-awaited report entitled “Consumer Data Privacy in a Networked World, A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy,” the administration’s roadmap for privacy legislation and regulation in the years ahead.

The announcement and privacy blueprint envisions a comprehensive and integrated framework for data protection, rather than the current sector-patchwork-quilt approach, and is comprised of four key pillars: (1) a consumer privacy bill of rights; (2) a multi-stakeholder process and approach dealing with how such a bill of rights would apply in a business context; (3) more effective enforcement; and (4) greater commitment to harmonization and cooperation in the international community.

The Report outlines the seven principles of its proposed Consumer Privacy Bill of Rights and, although calling for legislation and regulation to codify and memorialize these rights, also sets out consumer privacy standards that companies are asked to immediately and voluntarily adopt in a cooperative public-private partnership. These seven principles are:

  1. Individual Control Through Choice
  2. Greater Transparency
  3. Respect for Context
  4. Secure Handling
  5. Access & Correction Rights
  6. Focused Collection
  7. Accountability

The Report notes that a company’s adherence to the voluntary codes will be viewed favorably by the FTC in any investigation or enforcement action for unfair and deceptive trade practices. By implication, a company that does not adopt and follow these principles might be used as evidence of a violation of Section 5 of the FTC Act, even if federal legislation is not passed on the subject. The FTC is expected to soon release its Final Staff Report on Consumer Privacy that will be consistent with the Obama administration’s proposed Framework Report. The report reinforces the administration’s commitment to international harmonization, and also touches upon the role state attorneys general in the United States can play. While we are still reviewing the details – and more will likely be forthcoming from the administration in the weeks and months ahead – Legal Bytes will keep you on top of these developments as they arise.

You can read the entire report right here: Consumer Data Privacy in a Networked World, A Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy.

These are developments that affect all businesses, domestic and multi-national, global and local, consumers and regulators. The complexity and challenges of compliance should not be underestimated, nor should the administration’s commitment to follow the roadmap outlined. Rimon has teams of lawyers who have experience and follow developments in privacy and data protection, from prevention and policy to compliance and implementation. If you want to know more, need counsel, need help navigating, or if you require legal representation in this or any other area, feel free to call me, Joseph I. (“Joe”) Rosenbaum, or any of the Rimon lawyers with whom you regularly work.