Category: Communication Media & Internet

The “Reasonable” Perils of Data Security Law

Your House Counsel Logo

The following is drawn from the materials to be presented at the 17th Annual America’s Claims Event 2013 conference in the “Cyber-Liability and Data Loss Claims: A Case Study from Notice of Occurrence Through Conclusion” session on June 20, 2013 in Austin, Texas.

NEGLIGENCE. “The omission to do something which a reasonable man, guided by those ordinary considerations which ordinarily regulate human affairs, would do, or the doing of something which a reasonable and prudent man would not do.”1

“When we think about data breaches, we often worry about malicious minded computer hackers exploiting software flaws, or perhaps Internet criminals seeking to enrich themselves at our expense. But the truth is that errors and negligence within the workplace are a significant cause of data breaches that compromise sensitive personal information.”2

According to a recent privacy institute study by the Ponemon Institute, only 8% of the surveyed data breach incidents were due to external cyber attack, while 22% could be attributed in part to malicious employees or other insiders. Loss of laptops or other mobile devices containing sensitive data topped the survey, while mishandling of data “at rest” or “in motion” were also major contributors.3 A later study showed that 39% of surveyed organizations identified negligence as the root cause of their data breaches, while 37% were attributed to malicious or criminal attack.4

Negligent document disposal is a clear source of preventable negligence. On December 7, 2012, at least eight garbage bags were left unattended on a dirt road in Hudson, Florida, containing credit applications to Rock Bottom Auto Sales with names, driver’s license information, and Social Security numbers. Three days later, in Pittsburgh, Pennsylvania, job placement documents were found in a dumpster from the West Pittsburgh Partnership, all containing names and SSN’s.5 For that matter, the Internal Revenue Service in 2008 was found to have disposed of taxpayer documents in regular waste containers and dumpsters, and that a follow-up investigation revealed that IRS officials failed to consistently verify whether contract employees who have access to taxpayer documents had passed background checks.6

Convincing users to back up their laptops has been difficult enough in practice; getting them to encrypt them voluntarily is much more daunting a task. A 2010 Ponemon Institute study, admittedly biased towards large corporations, concluded that of those surveyed typically 46% of the laptops held confidential data, while only 30% had their contents encrypted. A startlingly low 29% of the laptops had backup/imaging software installed, which implies that more than two thirds of all laptops if lost or stolen would leave no backup of work in progress.7

Even though more devices are coming to market with built-in encryption capabilities, these features may simply be left switched off by their users despite the fact that lost laptops, tablets, smartphones, USB “thumb” drives and other portable devices with unencrypted contents continue to provide a wealth of information to identity thieves.

On March 22, 2013, a laptop used by clinicians at the University of Mississippi Medical Center was discovered to be missing. It contained patient names, social security numbers, addresses, diagnoses, birthdates and other personal information, protected only by a password.8

On January 8, 2013, an unencrypted flash drive was stolen from a Hephzibah Georgia middle school teacher’s car, containing student SSN’s and other information.9 TD Bank had two unencrypted backup tapes with customer and their dependent names, SSN’s, addresses, account, credit and debit card numbers go missing while being transported between two TD Bank offices in March 2012, but public notice was not made until March 4, 2013.10

An examination of reported data security incidents with potential or actual data privacy breaches reveals that the scope of what is deemed “reasonable” ranges from ordinary care in the disposal of documents containing personally identifiable information (“PII”) and personal health information (“PHI”), to sophisticated data encryption, access authentication and other highly technical data security practices that the “reasonably prudent” persons, companies and governmental agencies are now expected to employ to protect the personal data that they have collected.

On October 10, 2012, the South Carolina Department of Revenue was informed of a potential cyber attack involving the personal information of taxpayers.11 The origin of the attack was traced to a state Department of Revenue employee who clicked on an embedded link in a “salacious” email and compromised his computer.12 The subsequent investigation revealed that “outdated computers and security flaws at the state’s Department of Revenue allowed international hackers to steal 3.8 million tax records”, according to Governor Nikki R. Haley. Apparently South Carolina did not encrypt Social Security Numbers, and once the outer perimeter security was compromised the hackers were able to log in as tax officials and read the data.13

Users of online services will routinely provide personal information as a matter of course to shop or obtain other services, all of which gets recorded and tracked. Data privacy laws are intended to promote and enforce a number of fair information practices to give individuals the ability to find out what personal information is being kept and by whom, opportunities to correct or remove such information, assurances that reasonable measures will be undertaken to protect such information from disclosure and to properly dispose of such information when appropriate, and may include remedial measures to be undertaken in the event of a data breach.

In the United States, there is no single comprehensive statute for data privacy laws.14 Instead, a number of sector-specific federal laws have been enacted to address the particular sensitivity of information generally recorded by companies in that market sector, and forty six states have enacted data breach notification statutes. If there is a data breach, you may be liable under state law to provide notice to those affected.15 In some jurisdictions, you may be required to provide notice to all consumer credit reporting agencies as well.16

The financial exposure to a data breach by a company may be insurable to some degree using various forms of “cyber liability” insurance, which expand and supplement many forms of more standard insurance coverages underwritten today. Policy premiums for such policies, however, are dependent upon the extent of data security practices implemented.

Conducting a data security risk assessment before encountering a data breach should identify measures that can be taken at the corporate level to provide additional protection not only to sensitive data, but also mitigate the consequences of a security incident where company data is disclosed, lost or stolen. Encrypted data in many cases may not be considered “exposed” for purposes of mandated notice to affected individuals.

In the event of a data security incident, please consider obtaining a data forensic team to not only identify the source and extent of the breach, but to preserve evidence in the event that a potential prosecution may be possible.

We will discuss a data breach case study from inception through enforcement, resolution and potential mitigation through cyber liability insurance at our presentation at ACE 2013. We hope to see you then.

1 BLACK’S LAW DICTIONARY 1184 (4th ed. 1968).

2 Privacy Rights Clearinghouse, Are the Businesses You Frequent or Work For Exposing You to an Identity Thief?, (Mar. 6, 2012), https://www.privacyrights.org/workplace-identity-theft-quiz-alert-2012

3 The Human Factor in Data Protection, 3 PONEMON INSTITUTE LLC (January 2012), available athttp://www.ponemon.org/local/upload/file/The_Human_Factor_in_data_Protection_WP_FINAL.pdf.

4 2011 Cost of Data Breach Study: United States, 7 PONEMON INSTITUTE LLC (March 2012),available at http://   www.ponemon.org/local/upload/file/2011_US_CODB_FINAL_5.pdf.

5 http://www.privacyrights.org/data-breach/new (check Breach Type “PHYS”, Organization Type “BSR” and Year “2012”).

6 Increased Management Oversight of the Sensitive but Unclassified Waste Disposal Process Is Needed to Prevent Inadvertent Disclosure of Personally Identifiable Information, TREASUR INSPECTOR GENERAL FOR TAX ADMINISTRATION (May 8, 2009), http://www.treas.gov/tigta/auditreports/2009reports/200930059fr.pdf.

7 The Billion Dollar Lost Laptop Problem 6 PONEMON INSTITUTE LLC (Sept. 30, 2010), availableat http://newsroom.intel.com/servlet/JiveServlet/download/1544-8-3132/The_Billion_Dollar_Lost_Laptop_Study.pdf.

8 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “EDU” and Year “2013”).

9 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “EDU” and Year “2013”).

10 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “BSF” and Year “2013”).

11 Kara Durrette, SC Department of Revenue hacked; millions of SC residents affected, http://www.midlandsconnect.com/sports/story.aspx?id=817902#.UVyOdheYu7w (posted Oct. 26, 2012, updated Oct. 27, 2012).

12 Matthew J. Schwartz, How South Carolina Failed To Spot Hack Attack, INFORMATION WEEK, Nov. 26, 2012, http://www.informationweek.com/security/attacks/how-south-carolina-failed-to-spot-hack-a/240142543.

13 Robbie Brown, South Carolina Offers Details of Data Theft and Warns It Could Happen Elsewhere, N.Y. TIMES, Nov. 20, 2012, available at http://www.nytimes.com/2012/11/21/us/more-details-of-southcarolina-hacking-episode.html?_r=0.

14 PETER P. SWIRE & KENESA AHMAD, FOUNDATIONS OF INFORMATION PRIVACY AND DATA PROTECTION 41 (International Association of Privacy Professionals) (2012).

15 NYC Administrative Code § 20-117(c) (2013); NY CLS State Technology Law § 208(2) (NY state residents only); 73 Pa. Stat. § 2303 (PA residents).

16 73 Pa. Stat. § 2305; NY CLS State Technology Law §208(7)(b).

Article By:

of

Price Transparency and the Legal Marketplace

consumer_colorlogo (1)

My teenage children don’t know a world without the internet; a place where the sum of all human wisdom is a few clicks away.
Or where it’s really easy to research and buy the latest videogame.

 

Aside from the democratization of information and sharing enabled by the internet, the biggest impact of the web in most people’s lives is how it has transformed the consumer experience.  It has done so in two important ways:  by creating unprecedented levels of transparency and removing friction from the purchase process.   In nearly every industry, a wealth of information is available to consumers prior to making a purchase:  what the options are, differences between products, user feedback, and price transparency.  With full information about products, including price, the internet makes comparison shopping easy.

 

And with all of that information, purchasing is smoothed out as well.  Web services continue to refine the art of removing friction from the purchase process.  Amazon aggressively knocked down reasons to purchasing goods in brick-and-mortar stores.  Uber removed the transactional choke points from cab rides.  iTunes made it easy to buy music on an a la carte basis.  Much of the consumer internet continues to iterate and expand on the winning concept of blending ever-higher levels of information with ever-smoother transaction processing.

 

This online purchasing revolution has also reached beyond everyday consumer goods and services.  Buying insurance, trading stocks, even government licensing – all have been streamlined online.

 

But there’s one notable area that has remained largely impervious: legal services.  Despite some increases in transparency on lawyer backgrounds (Avvo) and do-it-yourself online legal forms (LegalZoom), the legal marketplace has seen nothing approaching the change in consumer empowerment and ease of transacting experienced in virtually all other industries.
It’s not as if legal services is a tiny economic niche.  The market for legal services in the U.S. is worth over $250 billion per year, and nearly 40% of that is made up of consumer legal spending.  Rather, a mixture of byzantine regulation, barriers to market entry, and restrictions on common forms of marketing have kept consumers from experiencing the same form of experimentation and innovation that has transformed the delivery of so many other goods and services:

  • Until the late 1970’s, lawyers in the U.S. could not advertise in any meaningful way, and many states still have laws on the books prohibiting lawyers from using common advertising techniques.
  • Non-lawyers cannot own even a minority interest law firms, preventing outside investment in the industry and removing the ability to offer equity compensation to talented non-lawyer leaders.
  • Except in limited circumstances, attorneys are prevented from participating in services that attempt to match clients with lawyers based on specific legal circumstances.
  • Rules based on the geographic location of an attorney prevent many forms of remote counseling, even when the matter in question is not dependent on a given state’s law.
  • Legal obligations in most states make it difficult for attorneys to offer limited-scope services that attempt to counsel or coach consumers through specific legal issues rather than engage in full-blown client advocacy.

Some of these restrictions are rooted in a learned profession’s reliance on tradition and resistance to rapid change, and much of it stems from a desire to protect clients and ensure the quality of legal work.  But a consequence of the locked-down nature of the industry is that many consumers who would otherwise use legal services do not avail themselves of them.

 

It’s not hard to see why.  There’s no way to shop for a lawyer-reviewed estate plan the way you would for a pair of shoes or a flight to Mexico.  And beyond price transparency, attorneys and law firm have shown little interest in marketing fixed-price, entry-level offerings that work fine for a large percentage of consumers.  Instead of leading with such offers and then upselling to those needing more involved help, the vast majority of lawyers treat every client as being in need of a custom solution.

 

It’s a shame for both consumers and lawyers. Many consumers who choose to do without a lawyer’s help are no doubt getting suboptimal outcomes in their legal matters.  And lawyers, by failing to deliver the transparency and ease of transacting that consumers have become used to, are missing out on a massive, underserved market.

–          Josh King is vice president and general counsel of Avvo.com, the web’s largest legal Q&A platform, directory and marketplace.

Federal Communications Commission (FCC) Considers Proposal To Lift 25% Cap On Indirect Foreign Investment In Broadcast Licensees

Sheppard Mullin 2012

In August 2012, the Coalition for Broadcast Investment (“CBI”), a group comprising national broadcast networks, radio and television station licensees, and community and consumer organizations, filed a letter with the FCC requesting clarification of the foreign ownership rules contained in Section 310(b)(4) of the Communications Act. Specifically, CBI requested clarification that “the FCC will conduct a substantive, facts, and circumstances evaluation of proposals for foreign investment in excess of 25 percent in the parent company of a broadcast licensee.…” If adopted, this approach would represent a marked change of course for the FCC, which has in the past “categorically refused” to consider transactions involving investment in broadcasters above the 25% benchmark, according to CBI.

Citing the numerous other contexts where foreign investment above 25% is permitted (including, among others, sectors such as cable, direct-to-home satellite, and wireless), CBI highlighted the “structural disadvantage” broadcasters face because of the FCC’s “effective presumption” against foreign investment above 25% in the broadcast sector. In addition, CBI pointed out that ending the presumption would place broadcasters “on the same footing” as other industry participants, facilitating crucial access to capital in a market where they face increasing competition for consumers.

In February 2013, the FCC responded with a Public Notice (MB Docket No. 13-50) soliciting comments on CBI’s request. The first round of comments were due April 15, and a review of those submissions reveals a uniform desire for the FCC to relax the de facto 25% indirect cap applied to foreign ownership in broadcasters. Although all commenters supported CBI’s request, different groups highlighted particular points of emphasis.

Adelante Media Group, the National Association of Broadcasters, and Nexstar Broadcasting all noted that the Over-the-Top providers competing with traditional broadcasters face no restriction on foreign ownership. The Minority Media and Telecommunications Council emphasized that encouraging foreign investment in broadcasters would help “reverse the decline in minority broadcast ownership.” The National Association of Media Brokers referenced the fact that many entities that provided working capital to prospective new broadcasters were no longer in the market.

The question remains whether the FCC will hear the pleas of the broadcasters for regulatory parity. On the one hand, broadcasters may have reason for optimism if the FCC’s recent Public Notice (IB Docket No. 11-133) stating that it has streamlined its policies and procedures for reviewing foreign ownership of common carrier wireless licenses and certain aeronautical radio licenses is any indication. On the other hand, the broadcast industry has a long history of special concern in Congress due to its potential to influence the outcome of elections, and the FCC has not yet heard from Congress on these issues.

Reply comments on the proposal to lift the 25% cap on indirect foreign ownership of broadcast licensees are due at the FCC on April 30.

Article By:

 of

Investment Regulation Update – April 2013

GT Law

The Investment Regulation Update is a periodic publication providing key regulatory and compliance information relevant to broker-dealers, investment advisers, private funds, registered investment companies and their independent boards, commodity trading advisers, commodity pool operators, futures commission merchants, major swap participants, structured product sponsors and financial institutions.

This Update includes the following topics:

  • SEC Adopts Rules to Help Protect Investors from Identity Theft
  • Increased Attention to Broker-Dealer Registration in the Private Fund World
  • SEC Issues Guidance Update on Social Media Filings By Investment Companies
  • AIFMD — Effect on U.S. Fund Managers
  • SEC Announces 2013 Examination Priorities
  • Reminder — Upcoming Form PF Filing Deadline
  • Reminder — Upcoming Dodd-Frank Protocol Adherence Deadline
  • Are you a Lobbyist?
  • Recent Events

SEC Adopts Rules to Help Protect Investors from Identity Theft

On April 10, 2013, SEC Chairman Mary Jo White’s official first day on the job, the SEC, jointly with the CFTC, adopted rules and guidelines requiring broker-dealers, mutual funds, investment advisers and certain other regulated entities that meet the definition of “financial institution” or “creditor” under the Fair Credit Reporting Act (FCRA) to adopt and implement written identity theft prevention programs designed to detect, prevent and mitigate identify theft in connection with certain accounts. Rather than prescribing specific policies and procedures, the rules require entities to determine which red flags are relevant to their business and the covered accounts that they manage to allow the entities to respond and adapt to new forms of identity theft and the attendant risks as they arise. The rules also include guidelines to assist entities subject to the rules in the formulation and maintenance of the required programs, including guidelines on identifying and detecting red flags and methods for administering the program. The rules also establish special requirements for any credit and debit card issuers subject to the SEC or CFTC’s enforcement authority to assess the validity of notifications of changes of address under certain circumstances. Chairman White stated, “These rules are a common-sense response to the growing threat of identity theft to all Americans who invest, save or borrow money.” The final rules will become effective 30 days after date of publication in the Federal Register and the compliance date will be six months thereafter.

Increased Attention to Broker-Dealer Registration in the Private Fund World

The role of unregistered persons in the sale of interests in privately placed investment funds is an area of great interest for the SEC and the subject of recent enforcement actions. On March 8, 2013, the SEC filed and settled charges against a private fund manager, Ranieri Partners, LLC, one of the manager’s senior executives and an external marketing consultant regarding the consultant’s failure to register as a broker-dealer. The Ranieri Partners enforcement actions are especially interesting for two reasons: (i) there were no allegations of fraud and (ii) the private fund manager and former senior executive, in addition to the consultant, were charged.

On April 5, 2013, David Blass, the Chief Counsel to the SEC’s Division of Trading and Markets, addressed a subcommittee of the American Bar Association. His remarks have been posted on the SEC website. Mr. Blass referenced a speech by the former Director of the Division of Investment Management, who expressed concern that some participants in the private fund industry may be inappropriately claiming to rely on exemptions or interpretive guidance to avoid broker-dealer registration.

In addition, Mr. Blass noted Securities Exchange Act Rule 3a4-1’s safe harbor for certain associated persons of an issuer generally is not or cannot be used by private fund advisers. He suggested that private fund managers should consider how they raise capital and whether they are soliciting securities transactions, but he did acknowledge that a key factor in determining whether someone must register as a broker-dealer is the presence of transaction-based compensation. The Chief Counsel also raised the question of whether receiving transaction-based fees in connection with the sale of portfolio companies’ required broker-dealer registration. He suggested that private fund managers may receive fees additional to advisory fees that could require broker-dealer registration, e.g., fees for investment banking activity.

On a related note, in two recent “no-action” letters, the SEC has established fairly clear rules regarding how Internet funding network sponsors may operate without being required to register as broker-dealers. On March 26 and 28, 2013, the SEC’s Division of Trading and Markets addressed this narrow, fact-specific issue in response to requests from FundersClub Inc. and AngelList LLC seeking assurances that their online investment matchmaking activities would not result in enforcement action by the SEC. The April 10, 2013 GT Alert—SEC Clarifies Position on Unregistered Broker-Dealer Sponsors of Internet Funding Networks is availablehere.

SEC Issues Guidance Update on Social Media Filings by Investment Companies

On March 15, 2013, the SEC published guidance from the Division of Investment Management (IM Guidance) to clarify the obligations of mutual funds and other investment companies to seek review of materials posted on their social media sites. This report stems from the SEC’s awareness of many mutual funds and other investment companies unnecessarily including real-time electronic materials posted on their social media sites (interactive content) with their Financial Industry Regulatory Authority filings (FINRA). In determining whether a communication needs to be filed, the content, context, and presentation of the communication and the underlying substantive information transmitted to the social media user and consideration of any other facts and circumstances are all taken into account, such as whether the communication is merely a response to a request or inquiry from the social media user or is forwarding previously-filed content. The IM Guidance offers examples of interactive content that should or should not be filed with FINRA. The IM Guidance is the first in a series of updates to offer the SEC’s views on emerging legal issues and to provide transparency and enhance compliance with federal securities laws and regulations. You may find a link to the SEC Press Release and IM Guidance here.

On a related note, on April 2, 2013, the SEC released a report of an investigation regarding whether the use of social media to disclose nonpublic material information violates Regulation FD. The SEC has indicated that, in light of evolving communication technologies and habits, the use of social media to announce corporate developments may be acceptable; however, public companies must exercise caution and undertake careful preparation if they wish to disseminate information through non-traditional means. The April 5, 2013 GT Alert—Social Media May Satisfy Regulation FD But Not Without Risk and Preparation by Ira Rosner is available here.

AIFMD – Effect on U.S. Fund Managers

New European Union legislation that regulates alternative asset managers who manage or market funds within the EU comes into force on July 22, 2013. The Alternative Investment Fund Managers Directive (AIFMD) will have a significant impact on U.S. fund managers if they actively fundraise in Europe after July 21, 2013 (or if they manage EU-domiciled fund vehicles). Historically, U.S. private equity firms raising capital in Europe have relied on private placement regimes that essentially allowed marketing to institutions and high net worth investors. Beginning July 22, 2013, U.S. fund managers may continue to rely on private placement regimes in those EU jurisdictions that continue to operate them; however, they will now be under an obligation to meet certain reporting requirements and rules set out in the AIFMD relating to:

  • transparency and disclosure, and
  • rules in relation to the acquisition of EU portfolio companies.

The transparency and disclosure rules require, for the most part, the disclosure of information typically found in a PPM; however, additional items are likely to be required such as the disclosure of preferential terms to particular investors and level of professional indemnity cover. The rules also require reports to be made to the regulator in each jurisdiction in which the fund has been marketed. The reports will need to include audited financials, a description of the fund’s activities, details of remuneration and carried interest paid, and details of changes to material disclosures. Acquisitions of EU portfolio companies also lead to reporting obligations on purchase – an annual report – and a rule against “asset stripping” for 24 months after the acquisition of control. Firms with less than €500 million in assets under management are exempt from the reporting requirements and reverse solicitation is potentially an option, as the directive does not prevent an EU institution from contacting the U.S. fund manager, but in practice it may be difficult to apply systematically.  Fund managers may choose to register in the EU on a voluntary basis from late 2015. This will allow marketing across all EU member states on the basis of a single registration. However, registration will come with a significant compliance burden. If you plan to market in the EU after July 23, 2013, ensure that you review your marketing materials, evaluate your likely reporting obligations and consider how the portfolio company acquisition rules are likely to impact your transactions.

SEC Announces 2013 Examination Priorities

On February 21, 2013 the SEC’s National Examination Program (NEP) published its examination priorities for 2013. The examination priorities address issues market-wide, as well as issues relating to particular business models and organizations. Market-wide priorities include fraud detection and prevention, corporate governance and enterprise risk management, conflicts of interest, and technology controls.  Priorities in specific program areas include: (i) for investment advisers and investment companies, presence exams for newly registered private fund advisers, and payments by advisers and funds to entities that distribute mutual funds; (ii) for broker-dealers, sales practices and fraud, and compliance with the new market access rule; (iii)for market oversight, risk-based examinations of securities exchanges and FINRA, and order-type assessment; and (iv) for clearing and settlement, transfer agent exams, timely turnaround of items and transfers, accurate recordkeeping, and safeguarding of assets, and; (iv) for clearing agencies, designated as systemically important, conduct annual examinations as required by the Dodd-Frank Act. The priority list is not exhaustive. Importantly, priorities may be adjusted throughout the year and the NEP will conduct additional examinations focused on risks, issues, and policy matters that are not addressed by the release.

Reminder—Upcoming Form PF Filing Deadline

SEC registered investment advisers who manage at least $150 million in private fund assets with a December 31st fiscal year end should be well underway in preparing their submissions for the approaching April 30, 2013 deadline. Filings must be made through the Private Fund Reporting Depository (PFRD) filing system managed by the Financial Industry Regulatory Authority (FINRA). As a reminder, advisers to three types of funds must file on Form PF: hedge funds, liquidity funds and private equity funds. Hedge funds are generally defined as a private fund that has the ability to pay a performance fee to its adviser, borrow in excess of a certain amount or sell assets short. Liquidity funds are defined as a private fund seeking to generate income by investing in short-term securities while maintaining a stable net asset value for investors. Private equity funds are defined in the negative as not a hedge fund, liquidity fund, real estate fund, securitized asset fund or venture capital fund and does not generally provide investors with redemption rights. When classifying its funds, advisers should carefully read the fund’s offering documents and definitions on Form PF and should seek assistance of counsel. Particularly, we have seen the broad definition of hedge fund cause a fund considered a private equity fund by industry-standards to be a hedge fund for purposes of Form PF, thus subjecting the fund to more expansive reporting requirements. As is the case with filing Form ADV through IARD, the $150 Form PF filing fee is paid through the same IARD Daily Account and must be funded in advance of the filing. FINRA recently updated their PFRD System FAQs. The SEC has also posted new Form PF FAQs, which should be referred to for upcoming filings.

Reminder — Upcoming Dodd-Frank Protocol Adherence Deadline

All entities, including private funds, engaged in swap transactions must adhere to the ISDA Dodd-Frank Protocol no later than May 1, 2013 in order to engage in new swap transactions on or after May 1. Adherence to the Dodd-Frank Protocol will result in an entity’s ISDA swap documentation being amended to incorporate the business conduct rules that are applicable to swap dealers under Dodd-Frank.  Adherence to the Protocol involves filling out a questionnaire to ascertain an entity’s status under Dodd-Frank (e.g., pension plan, hedge fund and corporate end-user).  Further information on adherence to the Protocol can be obtained at ISDA’s website by clicking here.

Are you a lobbyist?

Over the last decade, many state and municipal governments have enacted new laws regarding how businesses may interact with government officials. These laws often establish new rules expanding the activities that are deemed to be “lobbying,” who is required to be registered as a lobbyist and what information must be publicly disclosed. Approximately half of the states, and countless municipalities, now define lobbying to include attempts to influence government decisions regarding procurement contracts – including contracts for investment advisors and placement agents – and impose steep penalties for companies that fail to register and disclose their “lobbying” activities and expenditures. Although some lobbying laws include exceptions for communications that occur as part of a competitive bidding process, the rules are inconsistent and not always clear. For example, although New York City’s lobbying law long included procurement lobbying, in 2010 the City’s Corporation Counsel and the City Clerk issued letters warning businesses that “activities by placement agents and other persons who attempt to influence determinations of the boards of trustees by the City’s . . . pension funds” are likely to be considered lobbying activity that requires registration and disclosure. Similarly, California’s lobbying law was expanded in 2011 to expressly include persons acting as “placement agents” in connection with investments made by California retirement systems, or otherwise seek to influence investment by local public retirement plans. Greenberg Traurig’s Investment Regulation Group, in conjunction with our Political Law Compliance team, is available to assist clients with questions regarding how to navigate increasingly complex lobby compliance laws and rules across the country and beyond. GT has a broad range of experience in advising to some of the world’s leading corporations, lobbying firms, public officials and others who seek to navigate lobbying and campaign finance laws.

Recent Events

On April 18, 2013, GT hosted the seminar, “The Far Reaching Impact of FATCA Across Borders and Across Industries” as both a webinar and live program in NY and Miami. The seminar explored the latest FATCA regulations and key intergovernmental agreements as well as their applications to a variety of industries. Click here to view the presentation.

On April 10, 2013, GT sponsored Artisan Business Group’s EB-5 Finance seminar at our NYC office. The program exposed participants to a unique alternative financing opportunity for projects that lend themselves to the EB-5 immigrant investor program and featured several GT speakers, including Steve Anapoell and Genna Garver, Co-Chair of the Investment Regulation Group, who provided a securities law update and considerations in the EB-5 area. Guest speakers included Jeff Carr from EPR, Phil Cohen from the EB-5 Resource Center, and Reid Thomas from NES Financial.

On April 2, 2013, GT co-hosted a Global Compliance seminar with Dun & Bradstreet on Foreign Corrupt Practices Act (FCPA) issues. The program included an overview of the FCPA, with a specific emphasis on the Department of Justice’s recently released Resource Guide to the FCPAand recent enforcement activities. A link to the Resource Guide can be found here.

Article By:

Senate Immigration Bill To Impact Business, Technology and Defense Sectors

Barnes & Thornburg

On April 17, 2013, a bipartisan group of U.S. Senators known as the “Gang of Eight” introduced an immigration bill entitled the “Border Security, Economic Opportunity, and Immigration Modernization Act of 2013.”

The bill includes provisions that substantially increase the number of visas for highly-skilled workers, creates a new visa category for lower-skilled workers, eliminates the backlog for employment-based immigration, and authorizes significant resources to achieve border security.

The bill aims to increase the annual cap of certain employment-based nonimmigrant visas (H-1B) from 65,000 to 110,000 and the number may increase up to 180,000 depending on labor demands and the unemployment rate. In order to ensure that American workers are not displaced by H-1B workers, employers will continue to be required to pay the prevailing wage to H-1B workers and it has been proposed that the prevailing wage system be strengthened. Also in fiscal year 2014, companies will be banned from bringing in additional workers if more than 75 percent of their workers are H-1B or L-1 employees. The bill also provides for dual intent visas for all students who come to the U.S. on a bachelor or advanced degree program.

To ensure the U.S. has sufficient lower-skilled workers, the bill creates a new nonimmigrant category known as the W-Visa. Eligible recipients would be immigrants who come to the U.S. to perform services or labor for a registered employer and for a registered position. Beginning April 1, 2015, unless the Secretary of Homeland Security extends the start date, the maximum cap for four years would be 75,000 visas.

The bill proposes to exempt from the annual numerical limits multinational executives and managers; immigrants of extraordinary ability in the sciences, arts, education, business, or athletics; and doctoral degree holders in the science, technology, engineering and mathematics (STEM) fields.

The bill allocates a significant number of all employment-based visas to individuals holding advanced degrees in STEM fields, in particular. The bill also creates startup visas for foreign entrepreneurs seeking to establish a company in the U.S.

The bill provides $3 billion to implement the Comprehensive Southern Border Security Strategy for achieving and maintaining effective control in all high risk border sectors along the southern border. The funds will be used for acquiring, among other things surveillance and detection capabilities developed or used by the U.S. Department of Defense; fixed, mobile, and agent portable surveillance systems; and unmanned aerial systems and fixed-wing aircraft and necessary and qualified staff equipment to fully utilize such systems.

The bill permits undocumented immigrants, who entered the U.S. before December 31, 2011 and who do not have a serious criminal record, to apply for a Registered Provisional Immigrant (RPI) status. This would permit an individual to work legally in the U.S. for any employer. RPI status would last for a 6-year term that is renewable if the worker has not committed any acts that would render the worker deportable.

The Senate bill is likely to undergo changes as other U.S. Senators and constituents weigh in on this important bill. A House bill is also expected to be unveiled soon. If the bills can pass their respective chambers, then bicameral negotiations would begin in an attempt to pass a final comprehensive immigration reform bill for the President to sign into law.

Article By:

 of

“The #1 Client-Generation Tool:” The Web-Based Art of Legal Marketing

The business of law has always been important but today it is far more complicated due to the web which has allowed the channels of advertising and business development to grow exponentially. From product placement in movies to handrails featuring advertisements, commercial culture serves as an omnipotent force and has yielded two great premises:  that we as a people respond to advertisements and that the Internet is a powerful tool for advertising.

Mark Britton, founder, CEO and president of Avvo, teaches attorneys and marketing professionals to have no legal fear when it comes to the business of law. In his upcoming address at Lawyernomics 2013 entitled “Issue Spotting: Turning 10 Legal Marketing Challenges Into Opportunity,” he seeks to instruct attorneys how to establish a marketing protocol in order to expand their practices. Mr. Britton sat down with me recently to further school the legal community on web-based legal marketing and how to “sell” one’s self in the modern legal landscape.

Attorneys historically self-promoted by attending large gatherings at rotary clubs but now there are multiple outlets for them to sell their services, such as LinkedIn, YouTube and blogging. According to Mr. Britton, a practitioner can utilize any “set of variables” for advertising purposes and this is important, given the rising number of lawyers and the resulting competition. Therefore, in order to truly succeed in today’s legal marketplace, attorneys must remain strategic and learn how to manage their businesses effectively.

The Internet, which Mr. Britton characterized as “central to life” as the law, serves as the most influential avenue for legal marketing. Facebook alone hold 8 million registered users—a small nation of its own. Practitioners must therefore act defensively—while they frequently rely on word of mouth, they must transfer this technique to such Internet sources as Yelp, Reputation.com and the Yellow Pages. Mr. Britton advises that the attorney who is aware of her “Google status” is ahead of the game.

In addition, attorneys must act on the offensive by making use of the Internet to increase clientele. Mr. Britton relayed how in his interactions with thousands of lawyers on a yearly basis, the common complaint is that the less experienced attorneys obtain more business because they advertise more. Regardless of the level of experience and professionalism, practitioners must utilize the web as a “tremendous strategic tool” to attain a larger client base. For example, they can join blogging spheres and practice groups that exchange ideas, build networks and develop business. This sort of self-promotion might be considered “unseemly” by some lawyers, yet the Internet serves as the number one tool to generate clients.

Mr. Britton acknowledges the challenge of thinking in a technology-driven, business-geared mentality when one comes from a legal background. He stresses that the objective should be to take on the role of an opportunity-spotter rather than just an issue-spotter.  However, in law school, we were trained only to take fact patterns and analyze them and when we practice, we spot the issue and mitigate risks, all without placing any emphasis on the business aspects of practicing law. As a result, when it comes to a tool such as social media, nine out of ten attorneys will focus on its privacy issues, entirely missing the point of its social networking benefits.

For all the attorneys and legal marketing professionals who struggle with how to go about conforming to the marketing must’s, Mr. Britton offers his insights on five baselines of legal marketing with the ultimate intention of converting contacts into clients:

#1. Establish your target audience.

Who are you searching for? Future and existing clientele? Law firms invest significant resources into bringing in clients so figure out who you are trying to attract so you can tailor your marketing strategies accordingly. For example, after establishing that you want to attract clients, refrain from writing your blog posts in legalese.

#2. Target your time and money as it relates to your target audience.

This should be preplanned and reviewed on a quarterly basis and should be initiated with a goal in mind. For instance, if your aim is to acquire a higher number of lawyer referrals, find space in your budget and calendar to start an e-newsletter or present at a conference.

#3. Target channels that you think are valuable one at a time.

Be deliberate about your marketing tools. Learn if your channels’ ROI is worth the time and money and either maintain the channel or turn it off accordingly. After you start that e-newsletter, get Constant Contact or any other service that provides monthly reports to figure out how many people are reading them and whether it is a successful investment.

#4. Measure your targets by figuring out the benefits.

Hire a consultant to see if you are actually gaining benefits from your investments. Paying high fees to place an ad in the Yellow pages is pointless if you do not know how many clients you are actually attracting.

#5. Establish a strong web presence.

Your website is the modern-day calling card so certify that it is in fact well-developed. To exemplify, if someone were to raise a point on Twitter and you respond by saying you wrote about this topic on your blog, the potential client may go to your website and develop her first impression of you through your website. This is often how social networking works—it all goes back to the website where people first connect with you. Make sure you also have strong seo controls in place so you can zero in on the demographics of your website visitors.

Article By:

 of

Employee’s Deactivation Of Facebook Account Leads To Sanctions

DrinkerBiddleRegMark_rgb_hires

The latest Facebook case highlights how courts now intend to hold parties accountable when it comes to preserving their personal social media accounts during litigation.  Recently, a federal court ruled that a plaintiff’s deletion of his Facebook account during discovery constituted spoliation of evidence and warranted an “adverse inference” instruction against him at trial.  Gatto v. United Airlines and Allied Aviation Servs., et al. , No. 10-CV-1090 (D.N.J. March 25, 2013).

The plaintiff, a ground operations supervisor at JFK Airport, allegedly suffered permanent disabling injuries from an accident at work which he claimed limited his physical and social activities.  Defendants sought discovery related to Plaintiff’s damages, including documents related to his social media accounts.

Although Plaintiff provided Defendants with the signed authorization for release of information from certain social networking sites and other online services such as eBay, he failed to provide an authorization for his Facebook account.  The magistrate judge ultimately ordered Plaintiff to execute the Facebook authorization, and Plaintiff agreed to change his Facebook password and to disclose the password to defense counsel for the purpose of accessing documents and information from Facebook.  Defense counsel briefly accessed the account and printed some portion of the Facebook home page.  Facebook then notified Plaintiff that an unfamiliar IP address had accessed his account.   Shortly thereafter, Plaintiff “deactivated” his account, causing Facebook to permanently delete the account 14 days later in accordance with its policy.

Defendants moved for spoliation of evidence sanctions, claiming that the lost Facebook postings contradicted Plaintiff’s claims about his restricted social activities.  In response, Plaintiff argued that he had acted reasonably in deactivating his account because he did know it was defense counsel accessing his page.  Moreover, the permanent deletion was the result of Facebook’s “automatically” deleting it.  The court, however, found that the Facebook account was within Plaintiff’s control, and that “[e]ven if Plaintiff did not intend to deprive the defendants of the information associated with his Facebook account, there is no dispute that plaintiff intentionally deactivated the account,” which resulted in the permanent loss of  relevant evidence.  Thus, the court granted Defendants’ request for an “adverse inference” instruction (but declined to award legal fees as a further sanction).

The Gatto decision not only affirms that social media is discoverable by employers, but also teaches that plaintiffs who fail to preserve relevant social media data will face harsh penalties.  Employers are reminded to specifically seek relevant social media (Facebook, Twitter, blogs, LinkedIn accounts) in their discovery requests since such sources may provide employers with sufficient evidence to rebut an employee’s claims.  This case also serves as a reminder and a warning to employers that the principles of evidence preservation apply to social media, and employers should take steps very early in the litigation to preserve its own social media content as it pertains to the matter.

Article By:

 of

New generic Top Level Domain (gTLD) – ICANN Trademark Clearinghouse Goes Live

Lewis and Roca LLP eading business law firm in the Southwest U.S.

Trademark Clearinghouse Launch

Complaints regarding inadequate protection for trademark owners will apparently not stop the Internet Corporation for Assigned Names and Numbers (“ICANN“) from launching its new unlimited gTLD (generic Top Level Domain) program as quickly as possible in 2013. The new web environment will include hundreds of different words appearing to the right of the dot in domain names, in sharp contrast to the existing limited number of authorized strings such as .com, .biz, .net, and .info. Initial evaluations of over 1900 applications for new Top Level Domains have begun to be published by ICANN and will continue through August. Strings containing non-Latin script, known as Internationalized Domain Names (“IDNs”), of which there are over 100 in Chinese, Arabic and other alphabets, will launch first in May or June.

Trademark owners concerned about cybersquatting and counterfeit goods or services that could be sold at websites created at second level (before the dot) urls via domain name registrations obtained in the new gTLDs should consider filing registered trademarks with ICANN’s Trademark Clearinghouse (TMCH) which goes live this week. For example, a manufacturer of food products may consider recording its registered brand names with the TMCH to help protect against use of the brand name by an infringer who might purchase the name to the left of the dot in the new (dot)food domain. As long as the registration was applied for before the particular TLD application was published and was also registered before that TLD contract is awarded, entry of a trademark registration record into the TMCH will provide two benefits: (1) eligibility for Sunrise registrations before the general launch of any particular new TLD if a specimen of use is filed at the time the registration record is entered into the TMCH and (2) notification to the owner if a third party proceeds to register the owner’s trademark at the second level after being notified by the TMCH of the owner’s claim. Common law marks and state registrations are not eligible for entry into the TMCH, but marks validated through judicial process or by statute will qualify

There are caveats associated with these benefits because eligibility for Sunrise does not guarantee the trademark owner will get the Sunrise registration if other parties also own the same registered mark (perhaps for different goods or services). It’s easy to see how this might become a problem in proposed TLDs such as (dot)store. For example, Apple Records may want to sell downloadable music at apple.store, but Apple Inc. may also want to sell consumer electronics at apple.store. Registries will have a method in place for resolving Sunrise registration disputes and this may not be first come, first served. It could ultimately involve a bidding or auction process. Further, the notification described above will only be in place for the first 90 days after general launch of a new TLD so the holder may need to employ a watch service to track registrations purchased by third parties after that 90 day period.

Unlike the recent launch of the XXX domain, there is no “blocking” mechanism available to trademark holders in connection with the new TLDs. This puts a premium on obtaining a preventive Sunrise registration or being willing to follow up with cybersquatters on an “after-the-fact” basis once they have already obtained a registration.

In a decision issued at the end of last week, ICANN confirmed requested improvements for (a) 30 days prior notice of the launch of Sunrise, (b) extending IP claims notification from 60 days to 90 days out from general launch and (c) allowing previously “abused names” (such as those established as “abused” by way of prior UDRP proceedings) to be entered into the TMCH alongside the registered trademark even if not identical to the registered trademark. Presumably these previously abused names would then give rise to IP Claims notifications, but the implications are unclear since the TMCH has yet to issue its final Submission Guidelines based on these latest changes to the system. Entry of TMCH records will involve legal decisions, including, but not limited to (1) whether to enter a registration into the TMCH or not, (2) whether to seek Sunrise registration or not, (3) how best to provide proof of use if a Sunrise registration is desired in any new TLD, (4) which period of protection to select (1, 3, or 5 years), and (5) which domain names and previously “abused names” will qualify for TMCH protection.

©2013 All Rights Reserved. Lewis and Roca LLP

HIPAA Omnibus Rule Effective March 26, 2013

The National Law Review recently featured an article, HIPAA Omnibus Rule Effective March 26, 2013, written by the Health Care & Health Care Finance group with Vedder Price:

VedderPriceLogo

 

The omnibus final rule that amends the privacy, security and enforcement rules1 promulgated under the Health Insurance Portability and Accountability Act of 1996 (the statute and rules, together, HIPAA) requires that Covered Entities revise and redistribute their notice of privacy practices (NPP). As described below, this will generally involve updating NPPs for legally required changes and redistributing the NPPs, whether by posting on an intranet site or distributing hard copies, by September 23, 2013.

The final rule became effective on March 26, 2013; however, Covered Entities have until September 23, 2013 (the compliance date), unless otherwise excepted, to bring their NPPs into compliance. Many of the changes to the NPPs are required pursuant to statutory enactments under the Health Information Technology for Economic and Clinical Health Act (HITECH Act) and the Genetic Information Nondiscrimination Act (GINA). Most new requirements are generally applicable to all Covered Entities, as defined under HIPAA, but certain requirements apply specifically to health plan Covered Entities and health care provider Covered Entities as summarized below.

New Requirements for Covered Entities’ NPPs

A Covered Entity must update its NPP to include these additional elements:

  1. A statement that certain uses and disclosures of protected health information (PHI) require an authorization from the subject individual, specifically psychotherapy notes (if recorded or maintained by the Covered Entity), PHI for marketing purposes and PHI in instances constituting the sale of PHI;
  2. A statement that uses and disclosures not addressed within the NPP require a written authorization;
  3. An acknowledgment that the individual may revoke any authorization granted for uses and disclosures requiring such authorization; and
  4. A notice of the individual’s rights following a breach of unsecured PHI, which can be sufficiently accomplished with a statement that the individual has a right to or will receive notification of a breach of his or her unsecured PHI.

Covered Entities that seek to contact individuals to raise funds for themselves must also include a notice of such intentions and of the individual’s right to opt out of such communications. However, the mechanism for opting out of fundraising communications does not need to be included in the NPP.

Specific Requirements for Health Care Providers’ NPPs

Tangential to new rights created by the final rule for individuals to restrict access to PHI, each health care provider must notify individuals of such new rights through its NPP.

  1. Notice Elements. In addition to those provisions discussed above, health care providers must include in their NPPs a statement notifying the individual of the individual’s right to restrict—and a health care provider’s affirmative obligation to agree to restrict—disclosures of PHI to the individual’s health plan where the individual has paid for the items or services out-of-pocket and in full.
  2. Distribution Methods. The final rule did not amend those provisions relating to the distribution of NPPs for health care providers; however, the preamble to the final rule did clarify the manner in which health care providers are expected to distribute NPPs by the compliance date. NPPs must be available at the delivery site, but health care providers may choose to post a summary of the policy with copies of the entire policy readily available at the patient’s request, with the exception of new patients, who must be given a complete copy and must return a good faith acknowledgment of receipt.

Specific Requirements for Health Plans’ NPPs

  1. Notice Elements. In addition to the above requirements, a health plan that uses PHI for underwriting purposes must include in its NPP a disclosure that the health plan may not use or disclose PHI that is genetic information for underwriting purposes.
  2. Distribution Methods. A health plan that currently posts its NPP on the company’s intranet site must (i) post the revised NPP (or the material changes to the NPP) on the website by September 23, 2013 and (ii) within the next annual mailing, provide the revised NPP or information about the material changes to the NPP and instructions for obtaining a copy of the revised NPP.

Alternatively, for those health plans that do not provide access to the NPP on the company’s intranet site, either (i) the revised NPP or (ii) information regarding the material change in the policy and instructions on how to obtain a copy of the revised notice must be distributed to individuals covered by the subject plan of the NPP within 60 days of such material revision. Distribution may be made via regular mail, hand delivery or, if applicable, electronic means. We anticipate many health plans will distribute a revised NPP as part of open enrollment.

Excepted Entities

The final rule exempts certain entities from specific aspects of the revised NPP provisions. Issuers of long-term care policies do not need to include notice of the restrictions on the use and disclosure of genetic information for underwriting purposes, as GINA did not apply such restrictions to these plans. As discussed above, health care providers are not required to disclose the protections afforded to individuals under GINA in NPPs, as health care providers may continue to disclose genetic information, subject to the minimum necessary requirements and in reliance upon a patient’s health plan’s exclusive obligation to comply with GINA’s restrictions on its use of and requests for such information.

Lastly, those health plans that have previously distributed NPPs in compliance with the final rule (as a result of the statutory enactment of such requirements under GINA and the HITECH Act) do not need to redistribute NPPs by the compliance date.

Action Items

Before September 23, 2013, Covered Entities should revise NPPs to be compliant with the final rule and distribute such revised NPPs in accordance with the specified distribution methods applicable to the Covered Entity. Furthermore, those health plans that have previously distributed NPPs to comply with GINA and the HITECH Act should ensure that all of the elements of the final rule, including those applicable to all Covered Entities, have been satisfied before determining that the exception granted under the final rule applies.

1 45 C.F.R. parts 160 and 164, subparts A and E, 45 C.F.R. parts 160 and 164, subparts A and C, and 45 C.F.R. parts 160, subparts C through E, respectively.

© 2013 Vedder Price

Service of Process through Social Media

The National Law Review recently featured an article, Service of Process through Social Media, written by Philip H. Cohen with Greenberg Traurig, LLP:

GT Law

 

In the matter of Federal Trade Commission v. PCCare247 Inc., Case No. 12 Civ. 7189 (PAE), 2013 WL 841037 (S.D.N.Y. March 7, 2013) (PCCare247), the United States District Court for the Southern District of New York sanctioned using social media as a means of circumventing the Hague Service Convention’s standard method of facilitating service among signatory states through designated Central Authorities. Granting the FTC’s motion for leave to effect service of documents by alternative means on defendants located in India, Judge Paul A. Engelmayer’s ruling appears to represent the first time a U.S. court has permitted service of process via Facebook.

In PCCare247, Indian defendants allegedly operated a scheme to convince American consumers that they should spend money to fix non-existent problems with their computers. After the Indian Central Authority was unable to formally serve the Indian defendants pursuant to the Hague Convention, the court granted the FTC’s request to serve process on the defendants by both email and through a Facebook account.

The FTC’s proposed service using Facebook presented the court with a novel issue.  Last year, another court in the Southern District of New York denied a motion to permit a party to effect service using Facebook because the plaintiff had not sufficiently established the credibility of the defendant’s Facebook account.  Fortunato v. Chase Bank USA, N.A., Case No. 11 Civ. 6608 (JFK), 2012 WL 2086950 (S.D.N.Y. June 7, 2012) (Fortunato).  Fortunato involved a domestic defendant accused of committing credit card fraud.  After several failed attempts at personal service, the court rejected the third-party plaintiff’s “unorthodox” proposal to serve process, including by Facebook, citing concerns about the lack of certainty and authenticity of the defendant’s purported Facebook profile.  The court questioned whether the Facebook profile was in fact operational and accessed by the party to be served, noting that the location listed on the profile was inconsistent with four potential addresses a private investigator had identified. The court opted instead for service by publication pursuant to New York rules.

Distinguishing  PCCare247 from  Fortunato, Judge Engelmayer articulated several considerations supporting his confidence in “service by Facebook.” The court observed that under Rule 4(f)(3) of the Federal Rules of Civil Procedure, a court remains free to order alternative means of service on an individual in a foreign country so long as the means of service are not prohibited by international agreement and comport with due process.  The court acknowledged that although service by email and Facebook is not enumerated in Article 10 of the Hague Service Convention, India has not specifically objected to them. Therefore, under Rule 4(f)(3) the court found that it was free to authorize process by these means provided that doing so would satisfy due process.

Recognizing that the reasonableness inquiry is intended to “unshackle[] the federal  courts from anachronistic methods of service and permit[] them entry into the technological renaissance,” quoting Rio Props., Inc. v. Rio Int’l Interlink, 284 F.3d 1007, 1017 (9th Cir. 2002), the court concluded that Facebook was “reasonably calculated to provide defendants with notice of future filings” in the case. In support of its conclusion, the court explained that the defendants ran an Internet-based  business and that the email addresses specified for the defendants were those used for various aspects of the  alleged scheme.  For two of the Indian defendants in PCCAre247, their Facebook accounts were registered to the same email addresses to be served. Moreover, the court had “independent confirmation” that one of the email addresses identified was genuine and operated by a defendant, because it had been used to communicate with the court on several occasions.  Additional evidence that the Facebook profiles were authentic included that some of the defendants listed their job titles at the defendant companies and that the defendants were  Facebook “friends” with each other. Additional considerations the court noted were: the FTC had made several good faith efforts to serve the defendants by other means; and defendants had already demonstrated knowledge of the lawsuit. Accordingly, the FTC’s proposal to serve process by both email and Facebook was a combination that satisfied due process as a means of alternative service and was highly likely to be an effective means of reaching and communicating with the defendants.

This decision suggests that under the right circumstances, where a party establishes a reasonable foundation for the authenticity of the accounts, service via email and social media may be an economical and effective option for serving process on foreign parties, or even domestic parties that are otherwise difficult to track down by traditional means.

©2013 Greenberg Traurig, LLP