Another Lesson for Higher Education Institutions about the Importance of Cybersecurity Investment

Key Takeaway

A Massachusetts class action claim underscores that institutions of higher education will continue to be targets for cybercriminals – and class action plaintiffs know it.

Background

On January 4, 2023, in Jackson v. Suffolk University, No. 23-cv-10019, Jackson (Plaintiff) filed a proposed class action lawsuit in the U.S. District Court for the District of Massachusetts against her alma matter, Suffolk University (Suffolk), arising from a data breach affecting thousands of current and former Suffolk students.

The complaint alleges that an unauthorized party gained access to Suffolk’s computer network on or about July 9, 2022.  After learning of the unauthorized access, Suffolk engaged cybersecurity experts to assist in an investigation. Suffolk completed the investigation on November 14, 2022.  The investigation concluded that an unauthorized third party gained access to and/or exfiltrated files containing personally identifiable information (PII) for students who enrolled after 2002.

The complaint further alleges that the PII exposed in the data breach included students’ full names, Social Security Numbers, Driver License numbers, state identification numbers, financial account information, and Protected Health Information.  While Suffolk did not release the total number of students affected by the data breach, the complaint alleges that approximately 36,000 Massachusetts residents were affected.  No information was provided about affected out-of-state residents.

Colleges and Universities are Prime Targets for Cybercriminals

Unfortunately, Suffolk’s data breach is not an outlier.  Colleges and universities present a wealth of opportunities for cyber criminals because they house massive amounts of sensitive data, including employee and student personal and financial information, medical records, and confidential and proprietary data.  Given how stolen data can be sold through open and anonymous forums on the Dark Web, colleges and universities will continue to remain prime targets for cybercriminals.

Recognizing this, the FBI issued a warning for higher education institutions in March 2021, informing them that cybercriminals have been targeting institutions of higher education with ransomware attacks.  In May 2022, the FBI issued a second alert, warning that cyber bad actors continue to conduct attacks against colleges and universities.

Suffolk Allegedly Breached Data Protection Duty

In the complaint, Plaintiff alleges that Suffolk did not follow industry and government guidelines to protect student PII.  In particular, Plaintiff alleges that Suffolk’s failure to protect student PII is prohibited by the Federal Trade Commission Act, 15 U.S.C.A. § 45 and that Suffolk failed to comply with the Financial Privacy Rule of the Gramm-Leach-Bliley Act (GLBA),  15 U.S.C.A. § 6801.  Further, the suit alleges that Suffolk violated the Massachusetts Right to Privacy Law, Mass. Gen. Laws Ann. ch. 214, § 1B, as well as its common law duties.

How Much Cybersecurity is Enough?

To mitigate cyber risk, colleges and university must not only follow applicable government guidelines but also  consider following industry best practices to protect student PII.

In particular, GLBA requires a covered organization to designate a qualified individual to oversee its information security program and conduct risk assessments that continually assess internal and external risks to the security, confidentiality and integrity of personal information.  After the risk assessment, the organization must address the identified risks and document the specific safeguards intended to address those risks.  See 16 CFR § 314.4.  

Suffolk, as well as other colleges and universities, may also want to look to Massachusetts law for guidance about how to further invest in its cybersecurity program.  Massachusetts was an early leader among U.S. states when, in 2007, it enacted the “Regulations to safeguard personal information of commonwealth residents” (Mass. Gen. Laws ch. 93H § 2) (Data Security Law).  The Data Security Law – still among the most prescriptive general data security state law – sets forth a list of minimum requirements that, while not specific to colleges and universities, serves as a good cybersecurity checklist for all organizations:

  1. Designation of one or more employees responsible for the WISP.
  2. Assessments of risks to the security, confidentiality and/or integrity of organizational Information and the effectiveness of the current safeguards for limiting those risks, including ongoing employee and independent contractor training, compliance with the WISP and tools for detecting and preventing security system failures.
  3. Employee security policies relating to protection of organizational Information outside of business premises.
  4. Disciplinary measures for violations of the WISP and related policies.
  5. Access control measures that prevent terminated employees from accessing organizational Information.
  6. Management of service providers that access organizational Information as part of providing services directly to the organization, including retaining service providers capable of protecting organizational Information consistent with the Data Security Regulations and other applicable laws and requiring service providers by contract to implement and maintain appropriate measures to protect organizational Information.
  7. Physical access restrictions for records containing organizational Information and storage of those records in locked facilities, storage areas or containers.
  8. Regular monitoring of the WISP to ensure that it is preventing unauthorized access to or use of organizational Information and upgrading the WISP as necessary to limit risks.
  9. Review the WISP at least annually or more often if business practices that relate to the protection of organizational Information materially change.
  10. Documentation of responsive actions taken in connection with any “breach of security” and mandatory post-incident review of those actions to evaluate the need for changes to business practices relating to protection of organizational Information.

An organization not implementing any of these controls should consider documenting the decision-making process as a defensive measure.  In implementing these requirements and recommendations, colleges and universities can best position themselves to thwart cybercriminals and plaintiffs alike.

© Copyright 2023 Squire Patton Boggs (US) LLP

B.S.ing with Bob Major [PODCAST]

When Bob Major founded Major, Lindsey & Africa in 1982, he could not have envisioned what the organization would become and the impact it would have on the legal profession. In this episode of B.S.: Beyond Stereotypes, Bob shares his journey with Merle Vaughn, including his childhood in Texas and Oklahoma, his Stanford education, and how both influenced his outlook on life personally and professionally.

Bob Major, founder and Partner at Major, Lindsey & Africa, grew up in Texas and Oklahoma. He received his undergraduate degree from Stanford University and attended The University of Texas at Austin where he received a J.D. degree. Bob spent five years at the Washington, D.C., firm of Wilmer, Cutler & Pickering (now WilmerHale) practicing in its federal administrative practice. Prior to founding his own legal recruiting firm, he spent a year in-house as securities counsel at Saga Corporation (Menlo Park, California).

©2023 Major, Lindsey & Africa, an Allegis Group Company. All rights reserved.

The Scope of Attorney-Client Privilege Over Dual-Purpose Communications

The Supreme Court will evaluate the scope of attorney-client privilege when applied to communications shared between counsel and client that involve both legal and non-legal advice (“dual-purpose communications”). The decision of the highest court will have long-lasting implications for both business organizations and their retained counsels. The potential outcome of this case cannot be understated.

In this matter, the grand jury issued subpoenas to an anonymous law firm seeking documents related to the government’s investigation of the firm’s client. The law firm had provided both legal and business services to the client by advising on tax-related legal issues and preparing the client’s annual tax returns. When the law firm and client (“Petitioners”) withheld certain correspondence on the grounds that they were protected by attorney-client privilege and the work-product doctrine, the government moved to compel the production of those documents. The district court held that, while the correspondence contained a “dual-purpose,” they were not protected by attorney-client privilege because the primary purpose of the correspondence was to obtain business tax advice and not legal advice.

On appeal, Petitioners argued that the appellate court should apply the “because of” test rather than the “primary purpose” test. The “because of” test asks whether the dual-purpose correspondence was made because of a need for legal advice. The application of this test would expand the scope of attorney-client privilege and protect the correspondence at issue. The Ninth Circuit Court of Appeals, however, rejected Petitioners’ argument and affirmed the district court’s decision. Petitioners appealed the Ninth Circuit’s decision, and the Supreme Court granted certiorari on October 3, 2022.

The Supreme Court’s decision in In re Grand Jury 21-1397 will be of particular significance for in-house counsels who regularly provide both business and legal advice to their employers. For outside counsels, the outcome of this case will shed light on the standard to be applied for asserting privilege over dual-purpose communications. Oral argument occurred on January 9, 2023 at the Supreme Court.

For more litigation news, click here to visit the National Law Review.

© Polsinelli PC, Polsinelli LLP in California

December 2022 Legal Industry News Highlights: Law Firm Hiring and Growth, End-of-Year Industry Awards, and Diversity and Inclusion News Updates

Happy New Year from the National Law Review! We hope you are remaining happy, safe, and healthy as 2022 ends and 2023 begins. We thank you for all the time you’ve spent with us this past year, and we are looking forward to an even brighter year coming up!

In case you missed it, be sure to check out the National Law Review’s 2022 Go-To Thought Leadership Awards, which recognizes around 75 noteworthy thought leaders that have published with the NLR in the past year. Awardees have been selected for their high-quality writing, timely publication, and wide readerships! The NLR’s thought leadership awards go to a small subsection of our talented contributing authors, and we sincerely appreciate their part in providing the legal community a free to use, reliable news source.

Finally, please be sure to check out this year’s final episode of our Legal News Reach podcast: Creating A Diverse, Equitable and Inclusive Work Environment with Stacey Sublett Halliday of Beveridge & Diamond! Also, a big shout out to Crissonna Tennison and Shelby Garrett for taking on the hosting duties of the NLR’s podcast.

Law Firm Hiring and Expansion

Davis Graham & Stubbs LLP (DGS) has announced the addition of six new partners: Andrea M. Bronson, who focuses her practice on environmental law and litigation; Nathan J. Goergen, who focuses his practice on mergers and acquisitions; Jonathan M. Goldstein, who focuses his practice on real estate law; Almira Moronne, who focuses her practice on mergers and acquisitions and financing; Alena Prokop, who focuses her practice on executive and equity compensation; and Daniel A. Richards, who focuses his practice on complex civil litigation.

“These six attorneys have shown an impressive level of dedication to the firm and to the community we serve,” said Davis Graham & Stubbs Co-Managing Partner Kristin L. Lentz. “Their professionalism, experience, and commitment to our clients make them valuable additions to the firm’s partnership. We wish them all the best in this exciting next chapter in their careers as lawyers at DGS.”

Rob McFadden has joined Hill Ward Henderson as Senior Counsel. A commercial real estate attorney, Mr. McFadden’s practice is primarily focused on representing clients in commercial development work with an emphasis on retail, office, industrial and ground leases. He provides clients with practical advice and solutions that safeguard their interests while furthering their business objectives.

Hill Ward Henderson has also added four new associates: Ana Abado, who focuses her practice on general commercial litigation; Ezichi Chukwu, who focuses her practices on commercial leasing and real estate acquisitions; Matthew Kelly, who focuses his practice on real estate transactions and development agreements; and Tyler Miller, who focuses his practice on mergers and acquisitions, venture capital, and private equity.

Laquan T. Lightfoot has joined Goldberg Segalla’s Transportation and Civil Litigation and Trial groups in Philadelphia. Ms. Lightfoot focuses her practice on a wide array of civil litigation matters, with a particular focus on transportation law. She has also formerly litigated in a variety of fields, including product liability, premises liability, premises security, motor vehicle accident, catastrophic injury, and employment law matters.

In addition to her litigation practice, Ms. Lightfoot serves as an arbitrator with the Philadelphia Court of Common Pleas Compulsory Arbitration Program adjudicating various civil disputes. Before entering private practice, Lightfoot served as an assistant district attorney in the Philadelphia District Attorney’s Office, where she was assigned to Major Trials of the Southwest Division.

Blank Rome LLP has added twelve new partners, as well as four new counsel, effective as of January 1st, 2023. The following attorneys were selected:

“We are thrilled to announce our firm’s 2023 elevated class,” said Grant S. Palmer, Blank Rome’s Managing Partner and CEO. “This group’s demonstrated talent, stellar client service, diverse backgrounds, and collaborative leadership and teamwork in their respective practice areas reflects Blank Rome’s commitment to recruiting, supporting, and advancing talented attorneys who will not only help our firm continue to grow and succeed, but also elevate the next successful generation of legal industry professionals.

Awards and Recognition for Law Firms

Sean C. Griffin, a member at Dykema Gossett PLLC in Washington, D.C., has joined the International Association of Defense Counsel, a highly-recognized, invitation-only global legal organization for attorneys who represent corporate and insurance interests. Mr. Griffin, a former trial attorney for the Department of Justice, represents government contractors, law firms, construction companies, and other businesses in complicated contract litigation. He additionally serves as the senior director at the Federation of Defense & Corporate Counsel.

“I look forward to my membership with the IADC and the opportunity to contribute to this global association of preeminent attorneys,” Mr. Griffin said. “I am excited to meet my fellow members.”

Stubbs Alderton & Markiles, LLP attorney Roger Lee has been recognized by the Los Angeles Business Journal in its annual list of “Leaders of Influence: Thriving in Their 40s.” The list, which specifically honors leading business professionals between the ages of 40 and 49, covers Mr. Lee’s noteworthy representation of Bushfire Kitchen in its new partnership with leading private investment firm CapitalSpring to fuel Bushfire’s growth in Southern California and beyond.

Mr. Lee is senior counsel at Stubbs Alderton & Markiles. His practice is primarily focused on advising emerging growth and middle market companies in a wide variety of transactions, including buy and sell side mergers and acquisitions, mezzanine and senior debt financing transactions, and asset-based financing transactions. Notably, Mr. Lee was also recognized as a 2022 Go-To Thought Leader by the National Law Review for his coverage of President Biden’s Creating Helpful Incentives to Produce Semiconductors Act.

John Rolecki of Varnum LLP has been named to the Privacy Bar Section Advisory Board for the International Association of Privacy Professionals, a not-for-profit association committed to providing a forum for privacy professionals. As the world’s largest information privacy organization, the IAPP is dedicated to defining, promoting, and improving the privacy profession globally by allowing professionals to share best practices, track trends, and advance privacy management issues.

Mr. Rolecki is a partner in Varnum’s Data Privacy and Cybersecurity Practice. Primarily, he advises leading technology companies on emerging domestic and international data privacy regulations, and additionally provides counsel on matters such as data breach responses and ransomware situations.

Legal Industry Diversity, Equity, and Inclusion News

Emily Burkhardt Vicente, a labor and employment partner at Hunton Andrews Kurth, and Jane Hinton, a real estate investment and finance partner at Hunton Andrews Kurth, were recognized as 2022 Diversity & Inclusion Visionaries in The Los Angeles Times’ Diversity, Equity, Inclusion & Accessibility magazine. This publication recognizes diverse business leaders who inspire change and exhibit achievements both within their organizations and the community at large through actionable programs and initiatives impacting diversity, equity, inclusion and accessibility.

Ms. Hinton focuses her practice primarily on real estate transactions, which includes joint ventures, acquisitions, and leasing and portfolio property management. She places a particular emphasis on structuring debt and equity transactions. Ms. Vicente co-chairs the firm’s labor and employment group, focusing her practice primarily on complex employment litigation (such as California and FLSA wage and hour class and collective actions), PAGA actions, and employment discrimination class actions.

Recently, a number of lawyers and legal professionals have been named to the Lawyers of Color 2022 Hot List. Four attorneys at Foley & Lardner LLP have been named to the list, including partner Senayt Rahwa, senior counsel Olivia Singelmann, and associates Elizabeth Nevle and Jennifer Park. The publication is a nonprofit dedicated to promoting diversity in the legal profession, as well as advancing democracy and equality in marginalized communities.

Ms. Rahwa and Ms. Singelmann are both located in the firm’s Washington, D.C. office. Ms. Rahwa focuses her practice on finance and financial institutions, whereas Ms. Singelman focuses her practice on government enforcement defense, investigations, and business litigation. Ms. Nevle, located in the firm’s Houston office, focuses her practice on business litigation and dispute resolution. Ms. Park, located in the firm’s Chicago office, focuses her practice on business litigation and dispute resolution as well.

Katten’s Fabiola Valenzuela has also been added to the Lawyers of Color 2022 Hot List. Ms. Valenzuela concentrates her practice on structuring, negotiating and documenting business transactions, previously representing companies and investors through the entire corporate life cycle. She places particular focus on formations, mergers, acquisitions, venture capital financings, and corporate governance.

At the firm, Ms. Valenzuela also maintains an active pro bono practice, handling, among other matters, cases involving minors in federal immigration and deportation proceedings.

Moore & Van Allen’s (MVA) Jules W. Carter has also been named to the 2022 Lawyers of Color Hot List. Located in the firm’s Charlotte office, Ms. Carter concentrates on financial regulatory compliance issues, helping clients navigate complex regulatory environments and pursue business strategies that balance innovation with risk-awareness.

“Making the Lawyers of Color Annual Hot List is a prestigious and well-deserved honor for Jules,” said Thomas L. Mitchell, MVA’s managing partner and chair of the firm’s Management Committee. “We are proud of Jules’ commitment to provide sophisticated litigation and regulatory services to our clients, and grateful for her leadership as the chair of the firm’s Black Attorney Resource Group.”

Copyright ©2022 National Law Forum, LLC

An Essential Guide to Become a Paralegal

Paralegals are the backbone of the legal industry. By supporting lawyers and managing their day-to-day tasks, paralegals ensure that the law firm runs smoothly and efficiently.

If you’re interested in becoming a paralegal or want to strengthen your skills, continue reading to learn more about this growing field, the job responsibilities, and what you can do to position yourself for success.

What Is a Paralegal?

A paralegal is a professional in the legal field who performs tasks that require knowledge of the law and legal concepts but not to the full extent of a lawyer licensed to practice law. As part of the support staff, a paralegal is working to enhance a lawyer’s work, and the lawyer takes full responsibility for that work produced.

What Do Paralegals Do?

Paralegals assist lawyers with legal cases by researching and preparing reports for lawyers to use in their work. They’re not permitted to work alone and must be under the supervision of a licensed attorney. Paralegals may work in many legal settings, including law firms, nonprofits, and government agencies, but their duties may include:

  • Investigating information about a case

  • Researching information about a case

  • Interviewing witnesses

  • Researching and learning about regulations and laws

  • Writing reports

  • Maintaining a database of records related to each case

  • Drafting letters, documents, and emails

  • Acquiring affidavits for court

  • Helping to draft legal arguments

  • Corresponding with clients

  • Preparing wills, real estate contracts, divorce decrees, and other civil documents

The duties of a paralegal can vary according to the environment in which they work. They can work within an area of practice, just like lawyers do, with different duties. For example, they may work in probate, immigration, litigation, intellectual property, or corporate law.

Is Paralegal Work Difficult?

The legal field is high pressure, high stakes, and driven by deadlines, and not just for lawyers. Working as a paralegal has its perks, but it can be stressful and demanding. Clients trust in the lawyer to protect their best interests, and that lawyer is depending on the paralegal to make that possible.

What Skills Should a Paralegal Have?

Paralegals have a variety of hard and soft skills, including:

  • Communication: Paralegals must communicate with lawyers, clients, court officials, witnesses, government officials, and insurance companies in both verbal and written correspondence.

  • Investigative Skills: A lot of paralegal work involves researching, analyzing, and seeking out information to assist lawyers. Paralegals must have attention to detail and a good eye for discerning relevant facts.

  • Teamwork: Paralegals don’t work alone. They must interact with other paralegals, legal assistants, secretaries, and lawyers throughout the day, so teamwork is essential.

  • Time Management: Much of the legal field revolves around good time management, and not just for lawyers. Paralegals have to adhere to deadlines and complete tasks in a timely manner, knowing how to prioritize appropriately.

  • Technology Skills: Paralegals use technology to complete their work, often using word processors, spreadsheets, and presentation software. Many law firms use law practice management software, which paralegals must also learn to use effectively.

How Do You Become a Paralegal?

Paralegals are not licensed on the national level, so there are no federal standards for the profession. Only a few states regulate the profession on the state level. Instead, the employers establish the hiring standards and require some formal education.

The options for paralegal education or training include:

Associate Degree

An associate degree takes about two years to complete and requires a high school diploma. Some schools may have additional admissions requirements.

Bachelor’s Degree

A bachelor’s degree in legal studies, paralegal studies, or similar fields is appropriate for paralegal education. Typically, bachelor’s degrees take four years to complete. According to the National Federation of Paralegal Associations (NFPA), more employers are placing an emphasis on earning a bachelor’s degree.

Master’s Degree

If you have a bachelor’s degree, a master’s degree in legal studies (MLS) is a good choice to increase your knowledge in skills like negotiation, employment law, legal writing, and intellectual property law. This not only deepens the skill set for a paralegal, but it offers a broader scope of work as a legal professional.

Paralegal certification is another option to either replace a degree program or enhance it. The NFPA recommends achieving a paralegal certification to enhance employment prospects. There are several options available from the National Association of Legal Assistants (NALA), including a Certified Paralegal, an Advanced Certified Paralegal, and a Professional Paralegal certification.

Several schools also offer certification programs for paralegal work, though it’s important to research carefully to ensure you’re getting a certification that will benefit you professionally.

Are There Different Requirements in Each State to Become a Paralegal?

Generally, paralegals don’t have to meet any state licensing requirements, according to the United States Bureau of Labor Statistics (BLS). Professional certification or degrees at the national and regional level is voluntary.

That said, state governments have no restrictions from establishing their own rules, and a few states have chosen to regulate the paralegal profession closely.

According to the American Bar Association, California has restrictions for workers using the title “paralegal,” as well as “freelance paralegal,” “contract paralegal,” “independent paralegal,” “legal assistant,” and “attorney assistant.” These rules prohibit paralegals from engaging in certain activities, including representing clients in court or giving legal advice. They also have minimum education and experience requirements, as well as continuing education requirements.

In addition, both Washington and Utah require licensing for paralegals and non-attorney roles in the legal field. This doesn’t mean these paralegals must be licensed to work, but that highly educated and experienced paralegals can become credentialed to perform a broader scope of legal work.

Outlook of Paralegals

According to the BLS, the median annual wage for paralegals and legal assistants was $56,230 as of May 2021. Employment of paralegals and legal assistants is projected to grow 14% from 2021 to 2031, which is a faster rate than all occupations. About 45,800 openings for these roles are projected each year, on average, over the next decades.

Since the recession, law firms have been making changes to become more efficient and competitive, which may include expanding the scope of work for paralegals. Other institutions also recognize the benefits of workers with legal training, such as government agencies and banks.

Since then, there’s been a rising demand for paralegals — particularly ones with technology skills. Paralegals that can navigate technology tools, such as law practice management software, digital forensics, and electronic evidence discovery and preservation, are highly sought.

Paralegals often handle billing and invoicing, which is simplified with legal billing software.

Pro Tip: To gain a competitive edge, paralegals should consider receiving a certificate in law practice management software. PracticePanther offers the certification for free and can be completed on your own time.

Become a Skilled Paralegal

The role of paralegals is growing in demand and constantly evolving. Though it’s not required, the more educated and technologically sophisticated paralegals are, the more career opportunities they have in the legal field – and that includes experience and skills with law practice management software.

© Copyright 2022 PracticePanther

NFT Endorsed by Celebrities Prompts Class Action

Since the early days of the launch of the Bored Ape Yacht Club (BAYC) non-fungible tokens (NFTs), several celebrities have promoted the NFTs. On Dec. 8, 2022, plaintiffs Adonis Real and Adam Titcher brought a lawsuit against Yuga Labs, creators of the BAYC, alleging that Yuga Labs was involved in a scheme with the “highly connected” talent agent Greg Oseary, a number of well-known celebrities, and Moonpay USA LLC, a crypto tech company. According to the complaint:

  1. Yuga Labs partnered with Oseary to recruit celebrities to promote and solicit sales of BYAC;
  2. Celebrities promoted the BAYC on their various platforms;
  3. Oseary used MoonPay to secretly pay the celebrities; and
  4. The celebrities failed to disclose the payments in their endorsements.

According to the complaint, as a result of the various and misleading celebrity promotions, trading volume for the BYAC NFTs exploded, prompting the defendants to launch the ApeCoin and form the ApeCoin decentralized autonomous organization (DAO). Investors who had purchased the ApeCoin allegedly lost a significant amount of money when the value of the coins decreased.

This case highlights the potential risks that may arise in connection with certain endorsements. In addition to the FTC, the SEC also has issued guidance on requirements in connection with promotional activities relating to securities, which may include digital assets, such as tokens or NFTs. Under SEC guidance, any paid promoter, celebrity or otherwise, of a security, including digital assets, must disclose the nature, scope and amount of compensation received in exchange for the promotion. This would include tv/radio advertisements and print, in addition to promotions on social media sites.

©2022 Greenberg Traurig, LLP. All rights reserved.

Bouncing Back with Shaun Sethna [PODCAST]

Finding the right home for your career can do wonders to change your perspective. For Shaun Sethna, the move in-house was exactly what he needed to go from feeling like work as something he had to do to work being something he enjoyed. In this episode of Bouncing Back, he talks to Rebecca Glatzer about his career journey, the bumps along the way and his growth mindset.

Shaun Sethna is Deputy General Counsel at Altisource, a FinTech and services provider to the mortgage and real estate industries.  Shaun has been at Altisource for almost 10 years, where his practice focuses on technology transactions and M&A.  He also developed and helps to manage a team focused on contracts, compliance, and general legal support to Altisource’s technology, mortgage cooperative and insurance businesses. Previously Shaun was at Schlumberger in Houston, and he got his start in the IP practice group at King & Spalding LLP in Atlanta. Shaun received his undergraduate degree in Industrial Engineering from the Georgia Institute of Technology and his J.D. from Columbia Law School.  Shaun’s favorite aspect of his job is managing and developing teams.

©2022 Major, Lindsey & Africa, an Allegis Group Company. All rights reserved.

When Corporate Legal Teams Break

Forward-thinking organizations that refocus their legal teams on the removal of systemic friction and value creation can better detect and forecast risk; however, organizations that have not modernized their legal teams often miss subtleties masking surprisingly deep areas of risk. Recent history shows nothing is too big to fail, but earlier risk detection may have helped avoid some of the most catastrophic losses.

The most recent and notable industry-wide example, of course, was the financial services industry, which triggered the Great Recession from 2007 to 2009.

In the world’s most infamous accounting scandal, Enron imploded in 2001, wiping out $74bn of shareholder funds and the pensions and jobs of thousands of employees. Enron’s auditor also collapsed. The organizations were interconnected and dependent systems. One fell, the other followed. Undetected risk festered and worsened, and the interconnectedness of these organizations and systems created a complex network that made detecting risk more difficult.

As modern society demands more capable systems, they become more interconnected and complex by necessity. As Meltdown: Why Our Systems Fail and What We Can Do About It posits, this staggering complexity means that tiny mistakes or simple accidents can lead to devastating catastrophes that often go undetected. The reasons for failure can stem from very different problems, but the underlying causes are similar.

In accounting scandals with nefarious actors, huge debts are obscured and once revealed, lead to corporate failure. In legal departments with good actors – led by a noble General Counsel (GC) who serves as the defender of the enterprise – business risks are obscured and once revealed, can lead to devastating consequences: bet-the-company litigation, core intellectual property battles, merger & acquisition failure, and crippling regulatory fines, to name a few.

Embracing digital helps identify and expose risk, but organizations set the stage for failure when legal, or other critical functions, don’t keep up, fail to embrace the digital evolution, become disconnected, and lack or lose visibility. Those organizations make decisions without a clear view of the legal implications, and they might not even know it because, for now, they operate with blind trust of the Office of the GC.

Corporations in all industries are “going digital” to remain competitive amidst technological disruption. This focus on digital starts with core products and service offerings, and then is pushed throughout the business to align company to product. The result? Faster moving businesses with a wave of demand pummelling the legal department…if not yet, then soon as digital initiatives across the business mature.

Most corporate legal departments simply do not have the systems required to keep up — providing consistent regulatory counsel, detecting and preventing impending litigation, or simply knowing who is doing what in the legal organization is already a challenge Risk is obscured. A “break” like we’ve never experienced is primed.

If we examine the ecosystem, the warning signs are there.

Catching up to other corporate functions

As demands on legal teams continue to grow and CFOs ask GCs to do more with less, quality suffers amid rising law firm rates and unchecked complexity. Corners get cut. Risks emerge while their likelihood to go undetected rises. Of course, when adding headcount is not an option, revamping processes and technology is often the answer.

In finance, accounting, information technology, and human resource departments, among others, advances in technology have enabled self-service, helped control costs, made it easier to compare costs, and increased quality choices. These corporate functions have embraced systems-level restructuring with artificial intelligence (AI), data analytics, cloud computing and “Big Data” to modernize working practices and improve performance.

In their often siloed and conservative world, most GCs and corporate legal departments, on the other hand, make crucial decisions guided as much by gut instinct as by data and industry benchmarks. For decades, they have resisted change or lacked sufficient resources to enable change in technology, working practices, and corporate culture. Now, with the real-time requirement for speed, scale, and transparency — that era is over.

To retain and increase influence, improve their performance and trim costs as recessionary fears grow, GCs would be wise to more fully modernize their legal departments quickly through an open, digitally-savvy, and collaborative working culture.

Collaborate and listen

Building a data-driven, digital, secure and scalable legal system is an ethical and commercial imperative for GCs. Technology is part of the solution but not the place to start.

To more proactively expose, manage and mitigate risk, executives and their boards need GCs to emphasize the imperative for a more analytical, data-based and efficient approach to corporate legal practice with concrete examples to punctuate the “Why.”

You could start with three actions.

  1. Educate yourself and your colleagues about trends in legal digitization, performance improvement and new working practices. A comprehensive source of information is thDigital Legal Exchange, a global institute of leading thinkers from academia, business, government, technology and law.
  2. Become Modern. Be the change. Lead the change. Make tough decisions about your top leaders and whether they are capable of a data and digital-first mindset and way of working. Change leadership is the prime point of failure for legal modernization efforts.
  3. Be ambitious in the scope of your reforms. Small, pilot projects (ie, e-signature or automated NDAs) won’t make much of an impact and won’t convince your board of the need for bold legal change.

Modernizing the legal system and companies’ legal departments can improve affordability and performance for clients, lawyers, company boards, and shareholders.

Absent modern means of detection, legal risk can proliferate unknown and unseen only to all too often reveal triggers of impending corporate failure when it’s already too late.

© 2022 UnitedLex, All Rights Reserved

How to Unplug From Work During the Holidays

It can be challenging to fully unplug from work during the holidays, especially if you have a lot of responsibilities or if you run your own business.

But taking a break from work during this slower period can be beneficial for your mental health and overall well-being.

It’s really important to not feel guilty about taking some time off or deciding that you don’t necessarily want to take time off, maybe want to spend time building your brand and business and if you do, I have plenty of tips for that as well!

Here are a few tips for unplugging from work during the holidays:

  • Set boundaries: Let your coworkers and clients know that you will be unavailable during specific times, such as during the holidays or on a certain day of the week. This will help prevent you from feeling pressure to respond to work-related messages or calls while you are trying to relax.
  • Create a relaxing routine: Plan activities that will help you relax and unwind, such as exercising, reading or spending time with family and friends. Having a relaxing routine can help you disconnect from work and focus on self-care.
  • Avoid checking work emails or messages too often. Try to resist the temptation to check work emails or messages all the time while you are on vacation. If you must check your email, set a specific time each day to do so and limit the amount of time you spend on it.
  • Take breaks from work-related tasks: If you are working on a project or task during the holidays, take regular breaks to rest and recharge. This will help you avoid burnout and maintain a healthy work-life balance.
  • Plan in advance: This is a great time of year to repurpose your content and utilize social media scheduling tools so that you don’t actually need to be present online to post. That being said, if you post anything you should still check social media so that you can engage with the comments on your posts, because that helps increase visibility. Let what you already have work, harder and smarter for you!

By setting clear boundaries, creating a relaxing routine and taking breaks from work-related tasks, you can help ensure that you fully unplug from work and enjoy your time off during the holidays!

Which of these tips resonate with you and do you have any others to add?

PS – If you’re looking for ways to build your brand during downtime here are a few ideas:

  • Use this time to assess your brand and identify areas for improvement. This could involve updating your website, revamping your social media accounts, or reassessing your target audience.
  • Create valuable content that can be shared during downtimes. This could be blog posts, videos, podcasts or other forms of content that showcase your expertise and add value to your audience.
  • Engage with your audience on social media or through email newsletters. Keep your audience updated on your brand and continue to provide value, even during downtimes.
  • Partner with other brands or influencers to cross-promote your products or services. This can help expose your brand to a new audience and increase your reach.
  • Take advantage of any downtime to learn new skills or attend workshops or conferences. This will help you stay current and improve your expertise, which can benefit your brand in the long run. (Check out my YouTube channel for lots of videos!)
  • Use downtime to reflect on your brand and consider new ways to innovate and stand out in your industry. This could involve launching new products or services, or finding unique ways to differentiate your brand.

Which one of these will you try? Happy holidays!

Copyright © 2022, Stefanie M. Marrone. All Rights Reserved.

TCPA Turnstile: 2022 Year in Review (TCPA Case Update Vol. 17)

As 2022 comes to a close, we wanted to look back at the most significant Telephone Consumer Protection Act, 47 U.S.C. § 227 (“TCPA”) decisions of the year.  While we didn’t see the types of landscape-altering decisions that we saw in 2021, there’s still plenty to take note of.  We summarize here the biggest developments since our last update, listed by issue category in alphabetical order.

Arbitration: In Kelly v. McClatchy Co., LLC, 2022 WL 1693339 (E.D. Cal.  May 26, 2022), the District Court denied the defendant’s motion to compel arbitration because the contractual relationship between the parties had terminated before the unwanted calls were made. Plaintiffs had originally signed defendant’s Terms of Service which bound them to an arbitration provision for all legal disputes. Plaintiffs then cancelled their subscriptions which subsequently ended the enforceability of the Terms of Service against them. However, plaintiffs then received unwanted calls from Defendant seeking service renewals which the court deemed were not covered by the arbitration clause, even under a theory of post-expiration enforcement.

ATDS: Following Facebook v. Duguid, 141 S. Ct. 1163 (2021), courts are still struggling to define an “automatic telephone dialing system,” and the Third Circuit weighed in through Panzarella v. Navient Sols., Inc., 2022 WL 2127220 (3d Cir. June 14, 2022).  The district court granted defendant’s motion for summary judgment on the grounds that plaintiffs failed to show that an ATDS was used to call their phones. The Third Circuit upheld the summary judgment ruling but did not decide whether the dialing equipment used constituted an “ATDS” under the TCPA. Rather, its ruling hinged on the fact that defendant’s dialer pulled phone numbers from its internal database, not computer-generated tables. As such, the Third Circuit found that even though the system may very well be an unlawful ATDS system under the TCPA, if it is not used in that way, defendants could not be held liable.

In an interesting move, the court in Jiminez v. Credit One Bank, N.A., Nco Fin. Sys., 2022 WL 4611924 (S.D.N.Y. Sept. 30, 2022), narrowed the definition of an “ATDS,” choosing to reject the Second Circuit approach in favor of the Third Circuit’s approach in Panzarella. Here, plaintiff alleged that defendant used a dialing system to send numerous calls without consent. The Second Circuit follows the majority view that, if a system used to dial numbers has the ability to store or generate random numbers, the call made violates the TCPA, even if the random dialing function is not actually utilized. But the court in Jiminez found the Third Circuit’s reasoning persuasive and applied it to the case, finding that plaintiff failed to show the dialing system was actually used in a way that violated the TCPA. It granted summary judgment to defendants on the TCPA claims because the evidence showed the numbers used were all taken from a pre-approved customer list, not generated from random dialing.

Similarly, in Borden v. Efinancial, LLC, 2022 WL 16955661 (9th Cir. Nov. 16, 2022), the Ninth Circuit also adopted a narrower definition of an ATDS, finding that to qualify as an ATDS, a dialing system must use its automation function generate and dial random or sequential telephone numbers. This means that a mere ability to generate random or sequential numbers is irrelevant, the generated numbers must actually be telephone numbers. Given the circuit split on this issue, it seems likely that the Supreme Court will eventually have to weigh in.

Notably, in May 2022, the FCC issued a new order which will target unlawful robocalls originating outside the country. The order creates a new classification of service providers called “Gateway Providers” which have traditionally served a transmitters of international robocalls. These providers are domestic intermediaries which are now required to register with the FCC’s Robocall Mitigation database, file a mitigation plan with the agency, and certify compliance with the practices therein.

Class Certification: In Drazen v. Pinto, 41 F. 4th 1354 (11th Cir. July 27, 2022), the Eleventh Circuit considered the issue of standing in a TCPA class action. Plaintiffs’ proposed settlement class included unnamed plaintiffs who had only received one unsolicited text message. Because the court held in an earlier case (Salcedo v. Hanna, 936 F.3d 1162 (11th Cir. 2019)) that just one unwanted message is not sufficient to satisfy Article III standing, it found that some of the class members did not have adequate standing. The district court approved the class with these members in it, finding that those members could remain because they had standing in their respective Circuit and only named plaintiffs needed to have standing. The Eleventh Circuit held otherwise and vacated the class certification and settlement in the case. It remanded, allowing for redefinition of the class giving all members standing.

Consent: Chennette v. Porch, 2022 WL 6884084 (9th Cir. Oct. 12, 2022), involved a defendant who used cell phone numbers posted on publicly available websites, like Yelp and Facebook, to solicit client leads to contractors through unwanted text messages. The court rejected defendant’s argument that plaintiffs consented to the calls because their businesses were advertised through these public posts with the intent of obtaining new business. Beyond that, the court also found that even though these cell phones were used for both personal and business purposes, the numbers still fell within the protection of the TCPA, allowing plaintiffs to satisfy both statutory and Article III standing.

Damages: In Wakefield v. ViSalus, 2022 WL 11530386 (9th Cir. Oct. 20, 2022), the Ninth Circuit adopted a new test to determine the constitutionality of an exceptionally large damages award. Defendant was a marketing company that made unwanted calls to former customers, soliciting them to renew their subscriptions to weigh-loss products. After a multi-day trial, a jury returned a verdict for the plaintiff with a statutory damages award of almost $1 billion. The Ninth Circuit reversed and remanded to the district court to consider the constitutionality of the award. While the district court’s test asked whether the award was “so severe and oppressive” as to violate defendant’s due process rights, the Ninth Circuit instructed it to reassess using a test outlined in a different case, Six Mexican Workers. The Six Mexican Workers test assesses the following factors in determining the constitutionality of the damages award: “1) the amount of award to each plaintiff, 2) the total award, 3) the nature and persistence of the violations, 4) the extent of the defendant’s culpability, 5) damage awards in similar cases, 6) the substantive or technical nature of the violations, and 7) the circumstances of each .” We are still awaiting that determination on remand.

Standing: In Hall v. Smosh Dot Com, Inc., 2022 WL 2704571 (E.D. Cal July 12, 2022), the court addressed whether plaintiff had standing under the TCPA as a cell phone plan subscriber where the text messages were only received by someone else on the plan; in this case, plaintiff was the subscriber and her minor son was the recipient of the unwanted text messages. The court granted defendant’s motion to dismiss for lack of standing because she could not show that status of a subscriber alone could convey adequate standing under Article III.

In Rombough v. State Farm, No. 22-CV-15-CJW-MAR, (N.D. Iowa June 9, 2022), the court evaluated standing under the TCPA based on a plaintiff’s number being listed on the Do Not Call list. It determined that being on the DNC was not an easy ticket into court, plaintiff needed to allege more than just having its number on the list. Rather, the plaintiff need have actually registered their own numbers on the list.

© 2022 Vedder Price
For more Cybersecurity and Privacy Law news, click here to visit the National Law Review.