Category: Civil Rights

District Court Holds IRS Lacks Authority to Issue and Enforce Tax Return Preparer Regulations

The National Law Review recently featured an article, District Court Holds IRS Lacks Authority to Issue and Enforce Tax Return Preparer Regulations, written by Gale E. Chan and Robin L. Greenhouse with McDermott Will & Emery:

McDermottLogo_2c_rgb

On January 18, 2013, the District Court for the District of Columbia (District Court) issued a surprising decision in Loving v. Internal Revenue Service, No. 12-385 (JEB), holding that the Internal Revenue Service (IRS) lacked the authority to issue and enforce the final Circular 230 tax return preparer regulations that were issued in 2011 (Regulations).  The District Court also permanently enjoined the IRS from enforcing the Regulations.

Background

As part of the IRS’s initiative to increase oversight of the tax return preparer industry by creating uniform and high ethical standards of conduct, the IRS created a new category of preparers, “registered tax return preparer,” to be subject to the rules of Circular 230.  Attorneys, certified public accountants, enrolled agents and enrolled actuaries were already subject to IRS regulation under Circular 230, and thus, were not affected by the issuance of the Regulations.

In June 2011, the IRS and the U.S. Department of the Treasury (Treasury) issued the Regulations relating to registered tax return preparers and practice before the IRS.  T.D. 9527 (June 3, 2011).  Under these rules, registered tax return preparers have a limited right to practice before the IRS.  A registered tax return preparer can prepare and sign tax returns, claims for refunds and other documents for submission to the IRS.  A registered tax return preparer who signs the return may represent taxpayers before revenue agents and IRS customer service representatives (or similar officers or employees of the IRS) during an examination, but the registered tax return preparer cannot represent the taxpayer before IRS appeals officers, revenue officers, counsel or similar officers or employees of the IRS.  In addition, a registered tax return preparer can only advise a taxpayer as necessary to prepare a tax return, claim for refund or other document intended to be submitted to the IRS.

The Regulations also impose additional examination and continuing education requirements on registered tax return preparers in addition to obtaining a preparer tax identification number (PTIN).  Under the rules, to become a “registered tax return preparer,” an individual must be 18 years old, possess a current and valid PTIN, pass a one-time competency examination, and pass a federal tax compliance check and a background check.  The Regulations require a registered tax return preparer to renew his or her PTIN annually and to pay the requisite user fee.  To renew a PTIN, a registered tax return preparer must also complete a minimum of 15 hours of continuing education credit each year that includes two hours of ethics or professional conduct, three hours of federal tax law updates and 10 hours of federal tax law topics.

Loving v. Internal Revenue Service

In Loving, three individual paid tax return preparers (Plaintiffs) filed suit against the IRS, the Commissioner of Internal Revenue and the United States (collectively, Government) seeking declaratory relief, arguing that tax return preparers whose only “appearance” before the IRS is the preparation of tax returns cannot be regulated by the IRS, and injunctive relief, requesting the court to permanently enjoin the IRS from enforcing the Regulations.  In filed declarations, two of the Plaintiffs indicated that they would likely close their tax businesses if they were forced to comply with the Regulations, and the third Plaintiff, who serves low-income clients, indicated that she would have to increase her prices if forced to comply with the Regulations, likely resulting in a loss of customers.  The Plaintiffs and the Government each filed separate motions for summary judgment.

At issue in the case was the IRS’s claim that it can regulate individuals who practice before it, including tax return preparers.  The IRS relied on an 1884 statute, 31 U.S.C. § 330, which provides the Treasury with the authority to regulate the people who practice before it.  The statute currently provides that the Treasury may “regulate the practice of representatives of persons before the Department of the Treasury.”  31 U.S.C. § 330(a)(1) (emphasis added).  The statute further requires that a representative demonstrate certain characteristics prior to being admitted as a representative to practice, including “competency to advise and assist persons in presenting their cases.”  31 U.S.C. § 330(a)(2)(D) (emphasis added).  The statute also gives the Treasury authority to suspend or disbar a representative from practice before the Treasury in certain circumstances, as well as to impose a monetary penalty.  31 U.S.C. § 330(b).

The District Court’s Application of Chevron

The District Court applied the framework of Chevron U.S.A., Inc. v. Natural Res. Def. Council, Inc., 467 U.S. 837 (1984), and concluded that the text and context of 31 U.S.C. § 330 unambiguously foreclosed the IRS’s interpretation of the statute.  Chevron applies a two-step inquiry to determine whether a statute is ambiguous.  The first step asks whether the intent of Congress is clear in the statute—i.e., has Congress “directly spoken to the precise question at issue.”  Chevron, 467 U.S. at 842.  If a court determines that the intent of Congress is clear, under the Chevron framework, that is the end and the court “must give effect to the unambiguously expressed intent of Congress.”  Id. at 842–43.  However, if the court determines that the statute is silent or ambiguous, the court must proceed to step two of Chevron and ask whether the agency’s interpretation “is based on a permissible construction of the statute.”  Id. at 843.  An agency’s construction under step two is permissible “unless it is arbitrary or capricious in substance, or manifestly contrary to the statute.”  Mayo Found. for Med. Educ. & Research v. United States, 131 S. Ct. 704, 711 (2011) (citation omitted).

In Loving, the District Court concluded that 31 U.S.C. § 330 was unambiguous as to whether tax return preparers are “representatives” who “practice” before the IRS for three reasons.  First, the District Court stated that 31 U.S.C. § 330(a)(2)(D) defines the phrase “practice of representatives” in a way that does not cover tax return preparers.  As noted above, 31 U.S.C. § 330(a)(2)(D) requires a representative to demonstrate that he or she is competent to advise and assist taxpayers in presenting their “cases.”  The District Court stated that the statute thus equates “practice” with advising and assisting with the presentation of a case, which the filing of a tax return is not.  Thus, the District Court concluded that the definition in 31 U.S.C. § 330(a)(2)(D) “makes sense only in connection with those who assist taxpayers in the examination and appeals stages of the process.”

Second, the District Court stated that the IRS’s interpretation of 31 U.S.C. § 330 would undercut various statutory penalties in the Internal Revenue Code (Code) specifically applicable to tax return preparers.  The District Court noted that if 31 U.S.C. § 330(b) is interpreted as authorizing the IRS to penalize tax return preparers under the statute, the statutory penalty provisions in the Code specific to tax return preparers would be displaced, thereby allowing the IRS to penalize tax return preparers more broadly than is permissible under the Code.  Thus, the District Court stated that the specific penalty provisions applicable to tax return preparers in the Code should not be “relegated to oblivion” and trumped by the general penalty provision of 31 U.S.C. § 330(b).

The District Court also stated that 31 U.S.C. § 330(b) does not authorize penalties on tax return preparers because Section 6103(k)(5) of the Code, which provides that the IRS may disclose certain penalties to state and local agencies that license, register or regulate tax return preparers, does not identify 31 U.S.C. § 330(b) as one of the reportable statutory penalty provisions.

Finally, the District Court stated that if the IRS’s interpretation of 31 U.S.C. § 330 is accepted, Section 7407 of the Code would be duplicative.  Section 7407 of the Code provides the IRS with the right to seek an injunction against a tax return preparer to enjoin the preparer from further preparing returns if the preparer engages in specified unlawful conduct.  This right is similar to the authority under 31 U.S.C. § 330(b) to penalize if the IRS’s interpretation of 31 U.S.C. § 330 is accepted.  Under the IRS’s interpretation of 31 U.S.C. § 330, the IRS could disbar a representative from practice before the IRS if a tax return preparer engages in the conduct described in 31 U.S.C. § 330(b) (incompetence, being disreputable, violating regulations and fraud).  Thus, the District Court noted that disbarment under 31 U.S.C. § 330(b) is wholly within the IRS’s control and would be an easier path to penalize a tax return preparer than offered by Section 7407 of the Code.  The District Court stated that under the IRS’s interpretation, the IRS likely would never utilize the remedies available under Section 7407 of the Code, thereby rendering the statute pointless.

Conclusion

The District Court granted the Plaintiffs’ motion for summary judgment, holding that the IRS lacked statutory authority to issue and enforce the Regulations against “registered tax return preparers,” and permanently enjoined the IRS from enforcing the Regulations.  The Government will likely appeal the District Court’s decision.  Nevertheless, the District Court’s decision will have a great impact on the hundreds of thousands of tax return preparers ensnared by the Regulations and the clients they serve.

© 2013 McDermott Will & Emery

HIPAA Final Omnibus Rule Brings “Sweeping Change” to Health Care Industry

Dinsmore-2c-print NEW

On January 17, 2013, the U.S. Department of Health and Human Services (HHS)announced the release of the HIPAA final omnibus rule, which was years in the making. The final rule makes sweeping changes to the HIPAA compliance obligations of covered entities and business associates and comprises four final rules wrapped into one:

  1. Modifications to the HIPAA Privacy, Security, and Enforcement Rules mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act, and certain other modifications to improve the rules, which were issued as a proposed rule on July 14, 2010;
  2. Changes to the HIPAA Enforcement Rule to incorporate the increased and tiered civil money penalty structure provided by the HITECH Act and to adopt the additional HITECH Act enhancements to the Enforcement Rule that were not previously adopted in the October 30, 2009 interim final rule, including provisions to address enforcement where there is HIPAA non-compliance due to willful neglect;
  3. A final rule on Breach Notification for Unsecured Protected Health Information under the HITECH Act, which eliminates the breach notification rule’s “harm” threshold and supplants an interim final rule published on Aug. 24, 2009; and
  4. A final rule modifying the HIPAA Privacy Rule as required by the Genetic Information Nondiscrimination Act (GINA) to prohibit most health plans from using or disclosing genetic information for underwriting purposes, which was published as a proposed rule on Oct. 7, 2009.

HHS estimates a total cost of compliance with the final omnibus rule’s provisions to be between $114 million and $225.4 million in the first year of implementation and approximately $14.5 million each year thereafter. Among the costs HHS associates with the final rule are: (i) costs to covered entities of revising and distributing new notices of privacy practices; (ii) costs to covered entities related to compliance with new breach notification requirements; (iii) costs to business associates to bring their subcontracts into compliance with business associate agreement requirements; and (iv) costs to business associates to come into full compliance with the Security Rule. HHS attributes between $43.6 million and $155 million of its first year estimates to business associate compliance efforts. It is predicted that the true compliance costs for both covered entities and business associates will be far in excess of these HHS estimates.

Some of the key provisions of the final omnibus rule include:

  • Expanded definition of “business associate.” The definition of “business associate” has been expanded to include subcontractors of business associates, any person who “creates, receives, maintains, or transmits” protected health information on behalf of a covered entity, and certain identified categories of data transmission services that require routine access to protected health information, among others. A covered entity is not required to enter into a business associate agreement with a business associate that is a subcontractor; that obligation flows down to the business associate, who is required to obtain the proper written agreement from its subcontractors.
  • Direct compliance obligations and liability of business associates.Business associates are now directly liable for compliance with many of the same standards and implementation specifications, and the same penalties now apply to business associates that apply to covered entities, under the Security Rule. Additionally, the rule requires business associates to comply with many of the same requirements, and applies the same penalties to business associates that apply to covered entities, under the Privacy Rule. Business associates must also obtain satisfactory assurances in the form of a business associate agreement from subcontractors that the subcontractors will safeguard any protected health information in their possession. Finally, business associates must furnish any information the Secretary requires to investigate whether the business associate is in compliance with the regulations.
  • Modified definition of “marketing.” The definition of “marketing” has been modified to encompass treatment and health care operations communications to individuals about health-related products or services if the covered entity receives financial remuneration in exchange for making the communication from or on behalf of the third party whose product or service is being described. A covered entity must obtain an individual’s written authorization prior to sending marketing communications to the individual.
  • Prohibition on sale of PHI without authorization. An individual’s authorization is required before a covered entity may disclose protected health information in exchange for remuneration (i.e., “sell” protected health information), even if the disclosure is for an otherwise permitted disclosure under the Privacy Rule. The final rule includes several exceptions to this authorization requirement.
  • Clear and conspicuous fundraising opt-outs. Covered entities are required to give individuals the opportunity to opt-out of receiving future fundraising communications. The final rule strengthens the opt-out by requiring that it be clear and conspicuous and that an individual’s choice to opt-out should be treated as a revocation of authorization. However, the final rule leaves the scope of the opt-out to the discretion of covered entities. In addition to demographic information, health insurance status, and dates of health care provided to the individual, the final rule also allows covered entities to use and disclose: department of service information, treating physician information, and outcome information for fundraising purposes. Covered entities are prohibited from conditioning treatment or payment on an individual’s choice with respect to the receipt of fundraising communications. In addition, the NPP must inform individuals that the covered entity may contact them to raise funds and that they have a right to opt-out of receiving such communications.
  • Right to electronic copy of PHI. If an individual requests an electronic copy of protected health information that is maintained electronically in one or more designated record sets, the covered entity must provide the individual with access to the electronic information in the electronic form and format requested by the individual, if it is readily producible, or, if not, in a readable electronic form and format as agreed to by the covered entity and the individual.
  • Right to restrict disclosures to health plans. When an individual requests a restriction on disclosure of his or her protected health information, the covered entity must agree to the requested restriction (unless the disclosure is otherwise required by law), if the request for restriction is on disclosures to a health plan for the purpose of carrying out payment or health care operations and if the restriction applies to protected health information for which the health care provider has been paid out of pocket in full. Covered health care providers will need to employ some method to flag or make a notation in the record with respect to the protected health information that has been restricted to ensure that such information is not inadvertently sent to or made accessible to the health plan for payment or health care operations purposes, such as audits by the health plan.
  • GINA changes for some health plans. Health plans that are HIPAA covered entities, except issuers of long term care policies, are prohibited from using or disclosing an individual’s protected health information that is genetic information for underwriting purposes. The rule does not affect health plans that do not currently use or disclose protected health information for underwriting purposes.
  • Provision for compound authorizations for research. A covered entity may combine conditioned and unconditioned authorizations for research, provided that the authorization clearly differentiates between the conditioned and unconditioned research components, clearly allows the individual the option to opt in to the unconditioned research activities, and the research does not involve the use or disclosure of psychotherapy notes. For research that involves the use or disclosure of psychotherapy notes, an authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes.
  • Required changes to Notice of Privacy Practices (NPP). NPPs must be modified and distributed to individuals to advise them of the following: (1) for health plans that underwrite, the prohibition against health plans using or disclosing PHI that is genetic information about an individual for underwriting purposes; (2) the prohibition on the sale of protected health information without the express written authorization of the individual, as well as the other uses and disclosures for which the rule expressly requires the individual’s authorization (i.e., marketing and disclosure of psychotherapy notes, as appropriate); (3) the duty of a covered entity to notify affected individuals of a breach of unsecured protected health information; (4) for entities that have stated their intent to fundraise in their notice of privacy practices, the individual’s right to opt out of receiving fundraising communications from the covered entity; and (5) the right of the individual to restrict disclosures of protected health information to a health plan with respect to health care for which the individual has paid out of pocket in full.
  • Broader disclosure of decedents’ PHI. Covered entities are permitted to disclose a decedent’s protected health information to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.
  • Disclosure of proof of immunizations to schools. A covered entity is permitted to disclose proof of immunization to a school where State or other law requires the school to have such information prior to admitting the student. While written authorization will no longer be required to permit this disclosure, covered entities will still be required to obtain agreement, which may be oral, from a parent, guardian or other person acting in loco parentis for the individual, or from the individual himself or herself, if the individual is an adult or emancipated minor.
  • Tiered and enhanced enforcement provisions. The final rule conforms the regulatory language of the rule to the enhanced enforcement provisions of the HITECH Act. Penalties for non-compliance are based on the level of culpability with a maximum penalty of $1.5 million for uncorrected willful neglect.

As detailed above, the changes announced by HHS expand many of the requirements to business associates and subcontractors. Fortunately, the final rule provides a slight reprieve in one respect. It allows covered entities and business associates up to one year after the 180-day compliance date to modify business associate agreements and contracts to come into compliance with the rule.

Perhaps the most highly anticipated change found in the final omnibus rule relates to what constitutes a “breach” under the Breach Notification Rule. The final rule added language to the definition of breach to clarify that an impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity (or business associate) demonstrates that there is a low probability that the PHI has been compromised. Stated differently, the rule removes the subjective harm standard and modifies the risk assessment to focus instead on the risk that the PHI has been compromised. The final rule also identifies four objective factors covered entities and business associates are to consider when performing a risk assessment to determine if the protected health information has been compromised and breach notification is necessary: (1) the nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification; (2) the unauthorized person who used the protected health information or to whom the disclosure was made; (3) whether the protected health information was actually acquired or viewed; and (4) the extent to which the risk to the protected health information has been mitigated.

The final omnibus rule does not address the accounting for disclosures requirements, which is the subject of a separate proposed rule published on May 31, 2011, or the penalty distribution methodology requirement, which HHS has stated will both be the subject of future rulemaking.

The Office of Civil Rights has characterized the new rules as “the most sweeping changes to the HIPAA Privacy and Security Rules since they were first implemented.” Leon Rodriguez, the Director of the Office of Civil Rights, stated, “These changes not only greatly enhance a patient’s privacy rights and protections, but also strengthen the ability of my office to vigorously enforce the HIPAA privacy and security protections, regardless of whether the information is being held by a health plan, a health care provider, or one of their business associates.”

The HIPAA final omnibus rule is scheduled to be published in the Federal Register on January 25, 2013 and will go into effect on March 26, 2013. Covered entities and business associates must comply with the applicable requirements of the final rule by September 23, 2013. Entities affected by this final rule are strongly urged to begin an analysis of their existing HIPAA compliance policies and procedures and take steps to comply with the final rule.

The HHS Press Release announcing the final rule is available at:
http://www.hhs.gov/news/press/2013pres/01/20130117b.html

The full text of the rule is currently available at:
https://www.federalregister.gov/articles/2013/01/25/2013-01073/modifications-to-the-hipaa-privacy-security-enforcement-and-breach-notification-rules

© 2013 Dinsmore & Shohl LLP

Brace for Impact – Final HITECH Rules Will Require Substantially More Breach Reporting

The National Law Review recently published an article, Brace for Impact – Final HITECH Rules Will Require Substantially More Breach Reporting, written by Elizabeth H. Johnson with Poyner Spruill LLP:

Poyner Spruill

 

The U.S. Department of Health and Human Services (HHS) has finally issued its omnibus HITECH Rules.  Our firm will issue a comprehensive summary of the rules shortly (sign up here), but of immediate import is the change to the breach reporting harm threshold.  The modification will make it much more difficult for covered entities and business associates to justify a decision not to notify when an incident occurs.

Under the interim rule, which remains in effect until September 23, 2013, a breach must be reported if it “poses a significant risk of financial, reputational, or other harm to the individual.” The final rule, released yesterday, eliminates that threshold and instead states:

“[A]n acquisition, access, use, or disclosure of protected health information in a manner not permitted under subpart E [the Privacy Rule] is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a risk assessment of at least the following factors:

(i) The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of re-identification;

(ii) The unauthorized person who used the protected health information or to whom the disclosure was made;

(iii) Whether the protected health information was actually acquired or viewed; and

(iv) The extent to which the risk to the protected health information has been mitigated.”
(Emphasis added).

In other words, if a use or disclosure of information is not permitted by the Privacy Rule (and is not subject to one of only three very narrow exceptions), that use or disclosure will be presumed to be a breach.  Breaches must be reported to affected individuals, HHS and, in some cases, the media.  To rebut the presumption that the incident constitutes a reportable breach, covered entities and business associates must conduct the above-described risk analysis and demonstrate that there is only a low probability the data will be compromised.  If the probability is higher, breach notification is required regardless of whether harm to the individuals affected is likely.  (Interestingly, this analysis means that if there is a low probability of compromise notice may not be required even if the potential harm is very high.)

What is the effect of this change?  First, there will be many more breaches reported resulting in even greater costs and churn than the already staggering figures published by Ponemon which reports that 96% of health care entities have experienced a breach with average annual costs of $6.5 billion since 2010.

Second, enforcement will increase.  Under the new rules, the agency is required (no discretion) to conduct compliance reviews when “a preliminary review of the facts” suggests a violation due to willful neglect.  Any reported breach that suggests willful neglect would then appear to require agency follow-up.  And it is of course free to investigate any breach reported to them.  HHS reports that it already receives an average of 19,000 notifications per year under the current, more favorable breach reporting requirements, so where will it find the time and money to engage in all these reviews?  Well, the agency’s increased fining authority, up to an annual maximum of $1.5 million per type of violation, ought to be some help.

Third, covered entities and business associates can expect to spend a lot of time performing risk analyses.  Every single incident that violates the Privacy Rule and does not fit into one of three narrow exceptions must be the subject of a risk analysis in order to defeat the presumption that it is a reportable breach.  The agency requires that those risk analyses be documented, and they must include at least the factors listed above.

So why did the agency change the reporting standard?  As it says in the rule issuance, “We recognize that some persons may have interpreted the risk of harm standard in the interim final rule as setting a much higher threshold for breach notification than we intended to set. As a result, we have clarified our position that breach notification is necessary in all situations except those in which the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised. . . .”

The agency may also have changed the standard because it was criticized for having initially included a harm threshold in the rule, with critics claiming that the HITECH Act did not provide the authority to insert such a standard.  Although the new standard does, in essence, permit covered entities and business associates to engage in a risk-based analysis to determine whether notice is required, the agency takes the position that the new standard is not a “harm threshold.”  As they put it, “[W]e have removed the harm standard and modified the risk assessment to focus more objectively on the risk that the protected health information has been compromised.”  So, the agency got their way in that they will not have to receive notice of every single event that violates the Privacy Rule and they have made a passable argument to satisfy critics that the “harm threshold” was removed.

The new rules are effective March 26, 2013 with a compliance deadline of September 23, 2013.  Until then, the current breach notification rule with its “significant risk of harm” threshold is in effect.  To prepare for compliance with this new rule, covered entities and business associates need to do the following:

  • Create a risk analysis procedure to facilitate the types of analyses HHS now requires and prepare to apply it in virtually every situation where a use or disclosure of PHI violates the Privacy Rule.
  • Revisit security incident response and breach notification procedures and modify them to adjust notification standards and the need to conduct the risk analysis.
  • Revisit contracts with business associates and subcontractors to ensure that they are reporting appropriate incidents (the definition of a “breach” has now changed and may no longer be correct in your contracts, among other things).
  • If you have not already, consider strong breach mitigation, cost coverage, and indemnification provisions in those contracts.
  • Revisit your data security and breach insurance policies to evaluate coverage, or lack thereof, if applicable.
  • Consider strengthening and reissuing training.  With every Privacy Rule violation now a potentially reportable breach, it’s more important than ever to avoid mistakes by your workforce.  And if they happen anyway, during a subsequent compliance review, it will be important to be able to show that your staff was appropriately trained.
  • Update your policies to address in full these new HIPAA rules.  The rules require it, and it will improve your compliance posture if HHS does conduct a review following a reported breach.

As noted above, our firm will issue a more comprehensive summary of these new HIPAA rules in coming days.

© 2013 Poyner Spruill LLP

EEOC Outlines Enforcement Priorities in Approved Plan

The National Law Review recently published an article, EEOC Outlines Enforcement Priorities in Approved Plan, written by Kelly H. Kolb of Fowler White Boggs P.A.:

Fowler_NoShadow_Logo

The U.S. Equal Employment Opportunity Commission (EEOC) recently approved a Strategic Enforcement Plan (SEP) aimed at establishing national enforcement priorities and more effectively integrating enforcement responsibilities across the Commission’s 54 offices.

As part of the plan, the EEOC has identified six national priorities:

  • Eliminating barriers in recruiting and hiring;
  • Protecting vulnerable workers (such as immigrant workers);
  • Addressing emerging and developing employment discrimination issues;
  • Enforcing equal pay laws;
  • Preserving access to the legal system; and
  • Preventing harassment through systemic enforcement and targeted outreach.

The SEP notes that the EEOC will continue its focus on systemic discrimination, using individual discrimination charges as a vehicle to investigate all of the employment practices of employers. The EEOC will also pay particular attention to use of criminal background checks during the hiring process, an issue we have discussed in other newsletters and on radio, to LGBT discrimination, disability discrimination and to pregnancy discrimination claims.

The SEP lays out an aggressive agenda for the EEOC. Employers are well advised to take precautionary steps now to insulate against a possible EEOC “pandemic”.

©2002-2013 Fowler White Boggs P.A.

Sixth Circuit Affirms Dismissal of “Reverse” Racial Discrimination Claim Against Cracker Barrel

The National Law Review recently published an article, Sixth Circuit Affirms Dismissal of “Reverse” Racial Discrimination Claim Against Cracker Barrel, written by Kyle P. Konwinski of Varnum LLP:

Varnum LLP

 

In Martinez v. Cracker Barrel Old Country Store Inc., Case No. 11-2189 (6th Cir. Jan. 10, 2013), in a published decision, the Sixth Circuit affirmed the dismissal of a “reverse” racial discrimination claim arising out of Cracker Barrel’s termination of the plaintiff’s position as a retail manager at a Flint, Michigan Cracker Barrel.

The plaintiff was a general manager of a Cracker Barrel store for ten years.  Cracker Barrel terminated the plaintiff because she violated company policy when she made remarks during conversations regarding the Haiti earthquake, the plight of those in Haiti, and the use of a “bridge card” as a “ghetto card.”  The plaintiff, a Caucasian, contended that similarly situated African Americans were treated more favorably than her—i.e., not fired for making similar remarks.

Interestingly, the Sixth Circuit noted that a claim of “reverse” racial discrimination under federal law requires a showing of “background circumstances supporting the suspicion that the defendant is that unusual employer who discriminates against the majority.”  Because the plaintiff also brought a claim alleging race discrimination under Michigan’s law, however, she did not need to satisfy this heightened standard of proof to establish a claim because Michigan does not require a heightened standard of proof for reverse discrimination claims.

The Sixth Circuit dismissed the claims because, first, the plaintiff did not come forward with direct evidence of reverse discrimination because her evidence required an inference that Cracker Barrel terminated her based on race.  Second, the plaintiff did not come forward with sufficient evidence that another similarly situated employee was treated more favorably—the plaintiff was differently situated in the management structure of the store and also engaged in more pervasive and severe conduct.  Therefore, the Sixth Circuit found that the plaintiff could not establish a prima facie case of discrimination.

© 2013 Varnum LLP

Privacy of Mobile Applications

The National Law Review recently featured an article, Privacy of Mobile Applications, written by Cynthia J. Larose with Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.:

MintzLogo2010_Black

 

As we continue our “new year, new look” series into important privacy issues for 2013, we boldly predict:

Regulatory Scrutiny of Data Collection and Use Practices of Mobile Apps Will Increase in 2013

Mobile apps are becoming a ubiquitous part of the everyday technology experience.  But, consumer apprehension over data collection and their personal privacy with respect to mobile applications has been growing.   And as consumer apprehension grows, so does regulatory scrutiny.  In 2012, the Federal Trade Commission (FTC) offered guidance to mobile app developers to “get privacy right from the start.”    At the end of 2012, the California Attorney General’s office brought its first privacy complaint against Delta Airlines, Inc., alleging that Delta’s mobile app “Fly Delta” failed to have a conspicuously posted privacy policy in violation of California’s Online Privacy Protection Act.  And also in December, SpongeBob Square Pants found himself in the middle of a complaint filed at the FTC by a privacy advocacy group alleging that the mobile game SpongeBob Diner Dash collected personal information about children without obtaining parental consent.

In 2013, we expect to see new regulatory investigations into privacy practices of mobile applications.   Delta was just one of 100 recipients of notices of non-compliance from the California AG’s office and the first to be the subject of a complaint.  Expect to see more of these filed early in this year as the AG’s office plows through responses from the lucky notice recipients.   Also, we can expect to hear more from the FTC on mobile app disclosure of data collection and use practices and perhaps some enforcement actions against the most blatant offenders.

Recommendation for action in 2013:  Take a good look at your mobile app and its privacy policy.   If you have simply ported your website privacy policy over to your mobile app – take another look.  How is the policy displayed to the end user?  How does the user “accept” its terms?  Is this consistent with existing law, such as California, and does it follow the FTC guidelines?  

©1994-2013 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.

Internet Defamation—What Can You Do When You Are the Target?

McBrayer Logo

We’ve all seen them.  Anonymous spewing hate-filled, defamatory statements on Facebook and Twitter, as well as in the comment pages of news stories on both local and national news.  The commenters have a certain entertainment value, until you or your business are in their sights.  So what do you do?  The answer is not always so simple, especially when you don’t even know who is speaking.

Internet freedom has allowed for an unprecedented expansion in opportunities for the Average Joe to speak, but that expansion has come with a price for those defamed on the internet.  In order to foster a free and expansive internet, in 1996 Congress enacted Section 230 of the Communications Decency Act, 47 U.S.C. § 230.  Section 230 grants interactive internet service providers (such as Facebook, Yelp, YouTube, and Twitter) immunity from civil defamation claims for user-created content.

There are very few exceptions to Section 230 immunity, with the only one recognized in case law being a case in which provider Roommates.com directed the posts to a certain extent using drop-down menus.  See Fair Housing Council v. Roommates.com, LLC, 521 F.3d 1157 (9thCir. 2008).  Providers have learned from Roommates.com’s example and are careful to maintain their Section 230 immunity.

What this means in simple terms is that if you or your business is defamed on Facebook or Twitter, you can’t sue Facebook or Twitter, and you can’t force Facebook or Twitter to remove the defamatory postings.  Section 230 forces you to attempt to track down the user who originally posted the speech—often a virtual impossibility in this day and age when the vast majority of defamatory postings on the internet are done anonymously.

So what can you do?  First, don’t give up on social media and its ability to deal with at least some of the problems.  Interactive internet service providers are aware of the damage defamatory statements can do, and know that they risk losing their Section 230 immunity if they don’t self-police to a certain extent.  All interactive internet service providers have terms of service, and the majority ban defamatory and harassing speech.  Most will delete the offending material upon a showing that the material is indeed defamatory (i.e., not protected opinion), and most providers include a function allowing you to report the post directly from the webpage, without the need to send a demand letter from an attorney.

Furthermore, interactive internet service providers realize that though anonymity enjoys protections under the First Amendment, it also feeds a great deal of the ugliness seen on the internet today.  Facebook, for instance, requires posters to use their real names, and if Facebook is informed that a person is using a pseudonym, Facebook will disable the account.  Likewise, news sites are increasingly requiring commenters to link their comments to their Facebook accounts in order to provide a measure of accountability that anonymous posts lacked.  YouTube also recently began asking posters to use real names, though that is not currently a requirement.  Not all interactive internet service providers eschew anonymity – Twitter and Tumblr still tout the user’s ability to post anonymously – but increasing numbers of providers are requiring that speakers stand behind their comments.

If you can’t get posts removed through the interactive internet service provider, you still have legal options available.  Of course, quite often the best action at this point is no action.  Often defamation lawsuits are counterproductive in that they simply bring more attention to the posts than if the posts are simply ignored.  While difficult to do, sometimes ignoring a simply nasty post is the best policy.

If the post can’t be ignored but is not worth litigation, you can engage with the poster on the interactive site. If someone posts a negative review on Yelp, address the review and contest any factual misrepresentations.  If someone posts on your Facebook wall or sends an angry or defamatory Tweet, address the poster’s concerns.  You have the right to speak too, and quite often thoughtful, careful engagement is the best remedy.

Some posts are simply so egregious and damaging that they must be addressed in a court of law.  If action is warranted, and you are lucky enough to have the name of the poster, you can pursue traditional legal avenues available to victims of defamatory speech.

If you do not have the name, however, if you want to take action you will need to file a civil defamation lawsuit naming as defendant a John Doe.  Unfortunately, even though many interactive internet service providers will remove defamatory posts upon request, none will give up the names, email addresses, or IP addresses of posters without a subpoena.  Once litigation is filed, you and your legal counsel will have subpoena power to require the interactive internet service provider to give up the names, emails and IP addresses associated with the poster.  Normally the providers will still put up a fight even in light of a subpoena, but this is the only way available to obtain the identity of an anonymous poster so that you can hold them responsible for their defamatory speech.

While we have the right to free speech in the United States, our laws require us to take responsibility for what we say when we are wrong and our speech causes damage.  In the case of internet-based speech, it may be difficult to vindicate your rights and hold speakers responsible, but with persistence and a clear understanding of how interactive internet service providers work you can protect your good name on the internet.

© 2012 by McBrayer, McGinnis, Leslie & Kirkland, PLLC

Advocacy Groups Ask White House to Postpone Decisions Affecting Same-Sex Spouses’ Immigration Status

The National Law Review recently published an article by Nataliya Binshteyn of Greenberg Traurig, LLP, Advocacy Groups Ask White House to Postpone Decisions Affecting Same-Sex Spouses’ Immigration Status:

GT Law

 

According to The New York Times, over 50 gay rights and immigrant advocacy groups have written a letter to the White House asking President Obama to delay the adjudication of derivative lawful permanent residency petitions that would benefit the foreign same-sex spouses of U.S. citizens.

In their December 10th request, the groups are seeking a postponement of USCIS decisions until the Supreme Court issues a ruling on same-sex marriage in one of the two such cases it has recently agreed to hear next year. According to the Defense of Marriage Act (DOMA), same-sex marriages do not bestow federal benefits, including those related to immigration. As a result, the USCIS has, to date, denied petitions that would grant legal permanent resident status to the same-sex immigrant spouses of U.S. citizens despite a January 2011 declaration that the U.S. Department of Justice would no longer enforce DOMA in the courts.

©2012 Greenberg Traurig, LLP

“Employee” Status Not Necessarily Dependent on Compensation

Barnes & Thornburg

While Title VII discrimination claims apply only to “employees” and “employers,” the statute’s definitions of those terms are spectacularly unhelpful. An employee is someone who is employed by an employer. 42 U.S.C. § 2000e(b) & (f). Thanks, Congress! In light of this thoroughly circular definition, courts use agency principles to determine employment status when such is not clear.

An illustrative opinion was recently issued by the Northern District of Illinois in Volling v. Antioch Rescue Squad. In Volling, one of the main questions was whether the members of ARS’s volunteer ambulance squad should be considered employees for purposes of Title VII. The opinion can be found here.

Several factors are considered in making this employment determination, including: the skill required; the source of the instrumentalities and tools; the location of the work; the duration of the relationship between the parties; whether the hiring party has the right to assign additional projects to the hired party; the extent of the hired party’s discretion over when and how long to work; the method of payment; the hired party’s role in hiring and paying assistants; whether the work is part of the regular business of the hiring party; whether the hiring party is in business; the provision of employee benefits; and the tax treatment of the hired party. No single factor is dispositive, but courts will often give great weight to the amount of control the putative employer has over the putative employee.

Defendant ARS argued that the volunteer ambulance squad could not be employees because they received no payment. This view seems to be supported by the Second and Fourth Circuits, which require significant economic remuneration for a worker to be considered an employee for Title VII purposes. The Seventh Circuit has yet to rule on the issue, but the district court noted that the Seventh Circuit has rejected labels such as “volunteer” and endorsed the consideration of the common law factors listed above.  Accordingly, the district court agreed with the Sixth Circuit’s view that compensation is just one factor to be considered in the employment analysis. Perhaps significantly, the Volling court stated that compensation may well be less important with regard to not-for-profit organizations such as ARS than to commercial employers.

Thus, the court took into consideration the facts alleged by the plaintiffs, which included, among other things, that plaintiffs: are assigned to work specific shifts and defendants control who works those shifts with them; performed their work in the station and ambulances operated and used by ARS; are required to wear uniforms; received training; had to go through probationary periods; and had supervisory subordinate relationships with team leaders and board members of ARS.

Based on the degree of control exercised by ARS and the mandate to construe Title VII broadly to prevent discrimination, the court refused to dismiss the case for a lack of an employment relationship. “A workplace is not necessarily any different for a non-compensated volunteer than it is for a compensated ‘employee,’ and while both are generally free to quit if they don’t like the conditions (at-will employment being the norm), neither should have to quit to avoid sexual, racial, or other unlawful discrimination and harassment.”

This case serves as a good reminder that – similar to problems that can arise from using independent contractors – just because a worker is considered to be and labeled an unpaid volunteer, trainee, or intern doesn’t mean the employer is necessarily shielded from Title VII (or other federal statutory) liability. What counts is how those workers are treated, not how they are labeled.

© 2012 BARNES & THORNBURG LLP

Holiday Warning: Cut Sexual Harassment From Your Holiday Party Invitation List

The National Law Review recently published an article by Matthew J. Kreutzer of Armstrong Teasdale, Holiday Warning: Cut Sexual Harassment From Your Holiday Party Invitation List:

ArmstrongTeasdale logo

 

A recent federal judge’s decision allowing a sexual harassment case to proceed against an employer is a sobering reminder that the lighthearted, and sometimes drunken, atmosphere at office holiday parties does not equate to a free pass for your employees to engage in unwanted touching, lewd comments and other types of inappropriate behavior that otherwise would not be tolerated. Indeed, employers who fail to protect themselves can be held liable for workers’ conduct that might easily get out of hand at festive events particularly when there is drinking.

Just in time for the 2012 holiday party season, the U.S. District Court for the Western District of New York refused to dismiss a sexual harassment lawsuit filed against the State University of New York growing out of just such a party. (Shiner v. State University of New York, University at Buffalo, No. 11-CV-01024.)

The plaintiff, a clerk working at the University at Buffalo Dental School, alleged she had not wanted to attend the school’s annual holiday party because the conduct at previous events made her uncomfortable. However, a supervisor encouraged her to attend the party, which was held at a local bar. During the party, an associate dean, with supervisory authority over the plaintiff, allegedly made sexual advances toward her that included fondling her, putting his tongue in her ear and pulling her onto his lap. Another department official with supervisory authority allegedly cheered him on.

The plaintiff filed claims of sexual harassment under state and federal anti-discrimination laws, as well common law claims of assault and battery. The judge is allowing the case to proceed to trial, exposing (no pun intended) the employer to a potentially large monetary liability.

Employers can reduce the threat of misbehavior that gives rise to these kinds of allegations by, for example:

  • Reminding employees prior to the event that the company’s code of conduct remains in effect during the event
  • Establishing procedures in advance to handle any inappropriate behavior that might occur
  • Limiting the amount of drinking

If an employee does come to you with a sexual harassment complaint, please consider it seriously and take prompt action as necessary to investigate and stop the harassment.

© Copyright 2012 Armstrong Teasdale LLP