If you follow developments in TCPA case law, you’ve probably heard by now that the DC Circuit Court of Appeals last week overturned the 2015 FCC Order that had required TCPA opt-out notices on both solicited and unsolicited faxes. The court held that the FCC’s rule was “unlawful to the extent that it requires opt-out notices on solicited faxes.” See Bais Yaakov of Spring Valley v. FCC, et al., Case No. 14-1234 (D.C. Cir.). In fact, the DC Circuit—despite years of FCC guidance, 13 consolidated appeals and more than two dozen lawyers participating in the briefing—seemed to view this as a relatively simple issue of statutory construction: “The text of the Act provides a clear answer to the question presented in this case. . . . Congress drew a line in the text of the statute between unsolicited fax advertisements and solicited fax advertisements. Unsolicited fax advertisements must include an opt-out notice. But the Act does not require (or give the FCC authority to require) opt-out notices on solicited fax advertisements. It is the Judiciary’s job to respect the line drawn by Congress, not to redraw it as we might think best.” Continue Reading DC Circuit Opts Out of Flawed FCC Ruling

Smiling PigPlaintiffs’ lawyers across the land have trumpeted the U.S. Supreme Court’s decision in Spokeo as a victory (or at least not a loss). Spokeo, Inc. v. Robins, 136 S. Ct. 1540 (2016).  At least one plaintiff’s lawyer has gone so far as to suggest that defense lawyers who raise Spokeo-based arguments should fear sanctions.  As a Southern colleague of mine would say, those lawyers are trying to make a silk purse of a sow’s ear.

Although many post-Spokeo decisions have not yielded dismissal, many have, and they have done so based largely on Spokeo, which does more than reaffirm prior notions of standing and rather strengthens them in a way that is quite beneficial to corporate defendants facing trumped-up claims with no real harm.  One of the most recent defense victories post-Spokeo is Meyers v. Nicolet Rest. of De Pere, LLC, 2016 U.S. App. LEXIS 22139 (7th Cir. Dec. 13, 2016). Continue Reading Spokeo Was a Loss for Plaintiffs, Seventh Circuit Reaffirms

After nine months of intense negotiations and uncertainty, and despite ongoing criticisms from powerful data protection regulators, the new EU-U.S. Privacy Shield program went into effect this week as the U.S. Department of Commerce began accepting applications online. Some companies that are self-certifying their compliance have already submitted their documentation and many more are expected to do so in the coming days and weeks as they seek shelter under the replacement for the long-standing EU-U.S. Safe Harbor arrangement that was invalidated by the European Court of Justice last year.

Companies can now “sign up” for the Privacy Shield list, but they should not expect a rubber stamp from the Commerce Department just because they have self-certified. To ensure that their applications are approved, companies should take the following steps:

  • Confirm that they are eligible to participate—not all organizations are. Only companies subject to the jurisdiction of the FTC or the DOT may participate at this time
  • Develop a Privacy Shield-compliant privacy policy statement
  • Identify their independent recourse mechanism—under the new framework, self-certifying organizations must provide an independent recourse mechanism available to investigate unresolved complaints at no cost to the individual
  • Ensure that they have compliance verification mechanisms in place
  • Designate contacts within their organizations to serve as liaisons regarding the Privacy Shield
  • Review the information required to self-certify
  • Go online to www.privacyshield.gov to self-certify

Continue Reading Time to Raise Your Shield: The New EU-U.S. Framework Is Here

It’s been awhile since last we published for our firm blog Media & Privacy Risk Report, and one thing is largely to blame: ransomware attacks on our clients have been keeping us very busy. We’ve learned many lessons from these attacks that we plan to share over the coming months with our readers. But the focus of this post is recent guidance from the Office of Civil Rights of the Department of Health and Human Services (OCR) indicating that any ransomware attack involving protected health information PHI) could be a data breach with Health Insurance Portability and Accountability Act (HIPAA) reporting obligations.

Often in ransomware matters, a hacker encrypts data and demands that a ransom be paid (usually in Bitcoin) before the hacker will decrypt the data and make it once again accessible to the data owner (or covered entity) or maintainer (or business associate). But just because a hacker has frozen your data, does that mean that the hacker has accessed, acquired or exfiltrated your data? Isn’t it possible that a hacker could freeze your data without accessing, acquiring or exfiltrating it? By analogy, couldn’t someone render the locks on your house unusable (and thus your house inaccessible to you without a forced break-in) without actually accessing your house, acquiring anything within your house, or taking anything out of your house? It would seem that the answer would be yes. But if the OCR is asked that question, the presumption is that the answer is no, at least in the realm of ransomware attacks. Continue Reading OCR: Ransomware Attack Often Is a Data Breach

On Wednesday, President Obama signed the federal Defend Trade Secrets Act of 2016 (the “Act”) that passed both houses of Congress in late April.  The statute is the first federal statutory protection afforded to trade secrets and could have a significant impact on trade secrets litigation nationwide.  The passage of the law comes as no surprise, and much has already been written about what it means for the future of these disputes.  But what about those who are currently involved in trade secrets litigation —could the Act change the course of those cases?  There is not a definitive answer, but it is something that all litigants should consider now that the Act has become law.

The first question is whether the Act applies at all in such instances. The Act applies to “any misappropriation of a trade secret (as defined in section 1839 of title 18, United States Code, as amended by this section) for which any act occurs on or after the date of the enactment of this Act.” S. 1890, 1144th Cong. § 2(e) (emphasis added). “Misappropriation” is defined as “(A) acquisition of a trade secret of another by a person who knows or has reason to know that the trade secret was acquired by improper means; or (B) disclosure or use of a trade secret of another without express or implied consent.  18 U.S.C. § 1839(5).  So, in litigation where the “use” of trade secrets is ongoing, there may be an argument that the Act applies. Continue Reading Impact of Defend Trade Secrets Act on Pending Cases is Unclear

On May 11, 2016, President Obama signed into law the Defend Trade Secrets Act (DTSA). Unlike other forms of intellectual property, trade secrets issues have been addressed mainly through state law. The DTSA provides a new federal court civil remedy for acts of trade secret misappropriation, among other key provisions:

Ex Parte Seizure of Property

The most controversial aspect of the DTSA is the ex parte seizure provision, which permits a court to order the seizure of property if deemed necessary to prevent the propagation or dissemination of the trade secret. A party seeking an ex parte seizure will have to demonstrate that “extraordinary circumstances” exist warranting the seizure. The ex parte provision also allows a defendant to seek damages for abusive or wrongfully-acquired seizure orders.

Jurisdiction

The DTSA provides that the U.S. district courts have original jurisdiction over civil actions brought under the law. Such jurisdiction is not exclusive. To establish jurisdiction in federal court, a plaintiff will have to show that the trade secret is “related to a product or service used in, or intended for use in, interstate or foreign commerce.” Continue Reading President Obama Signs the Defend Trade Secrets Act into Law: What You Need to Know Now

As published in State Bar of Michigan Health Care Law Section

“In recent years, the likelihood of suffering a data breach has risen significantly for American companies across numerous industries. Health care providers, in particular, have been targeted due to the value of the sensitive information they hold regarding their patients and employees, including birth dates and Social Security numbers. Health care providers that suffer data breaches risk incurring significant fines, settlement amounts, legal fees, negative publicity and increased scrutiny from regulatory authorities …”

To read the publication in its entirety, please click here.

Audit. A simple enough word, which basically means “to count.” Yet few words can evoke fear as much as this one word. No one asks their love “How do I love thee? Let me audit the ways,” nor do we tell our children to “Audit your blessings.” And while audits are not inherently unreasonable, their use should be reasonable and relevant. And due to the negative connotation of the word, many IT vendors are even couching their audit notices in “kinder” terms, characterizing the reviews as customer-benefitting and the like. But just as Shakespeare noted about misnamed flowers, an audit by any other name doesn’t change anything, and still holds risk.

Software audits are on the rise, and with most users reporting some under-licensing situations (and the requisite payment of additional license and support fees), this upward trend will only continue as more IT providers focus on this “low hanging fruit” revenue source. An increasing number of IT solutions providers are asking (or sometimes just telling) their customers to submit to an audit, albeit many times called by a different name, and taking increasingly aggressive approaches. The IT industry and the industries of its customers are taking notice, as in many cases, what is portrayed as a simple review will end up with tens or hundreds of thousands of dollars of exposure in the form of license and maintenance fees. Continue Reading Software Audits: A Rose by any Other Name…

The Internal Revenue Service recently issued an alert to payroll and human resources professionals to be aware of an emerging phishing e-mail scheme that purports to be from company executives and requests personal information about employees1. Vedder Price would like to reiterate this alert, as it is personally aware of multiple companies having fallen victim to this scheme in the past few days.

The phishing e-mails typically appear to be from the company CEO or other executive, and are generally directed to a company employee in the payroll, human resources or accounting departments. The “CEO” sends an e-mail to the company employee and requests certain tax documents or other personally identifiable information (“PII”) pertaining to the company employees, including W-2s, SSNs, dates of birth, addresses and salaries. Continue Reading Emerging Phishing E-mail Scheme Alert

Last week, the European Commission unveiled the latest documentation related to the EU-U.S. Privacy Shield intended to restore trust in transatlantic data transfer and establish a mechanism for U.S. companies to once again transfer data from the EU with confidence. We wrote last month about the initial announcement of the Privacy Shield but expressed caution about whether the European Union and the United States would be able to iron out the details of the complicated agreement before the February 29, 2016 deadline set by the Article 29 Working Party (“WP29”).  But it appears that the two sides were able to make significant progress in the month of February, and the European Commission released more than 120 pages of documentation setting forth the new Privacy Shield requirements.

There are many details in the documentation released last week, but following are the key points:

  • Participating organizations will be required to follow rules related to consent, relevance, proportionality, access and correction.
  • Arbitration will be available for disputes.
  • Participating organizations will be required to provide additional information to data subjects at the point of consent.
  • Participating organizations must implement stronger controls on data transfers to third-party data processors and controllers.
  • Participating organizations must commit to address EU member complaints “expeditiously” through the FTC.
  • The FTC will verify self-certification.

It remains to be seen whether this will be enough to satisfy key stakeholders in the EU.  WP39 has announced that it will provide its opinion on the level of protection afforded by the Privacy Shield on April 13, 2016.  We will continue to monitor these developments and keep you apprised.