Category: Communication Media & Internet

Improving the Return on Investment of Your Legal Marketing Dollars

consumer_colorlogo

At the end of April, Avvo hosted its “Lawyernomics” conference.  Some 300 lawyers from across the country assembled at the Bellagio in Las Vegas to hear from speakers from a variety of disciplines and communications platforms (including representatives from Avvo, Twitter and Yelp).  Although a wealth of information was shared, there was a broad, tactical theme that permeated the entire program:  Improving return on a firm’s business development investment.

Choosing Your Investments Wisely

For an industry that pays so much to get in front of consumers, lawyers are often poor at converting interested consumers into paying clients.  Similarly, even those firms investing heavily in numerous forms of advertising – online and traditional – usually don’t have a clear picture of which of those advertising channels are effective.  They’re left to “go by gut” when choosing whether to continue investing in an advertising campaign.

The lowest-hanging fruit in this area is establishing systems for following up with client inquiries.  It should be simple, but far too many firms don’t have adequate processes in place to ensure that consumer inquiries are immediately followed up on.  With the likelihood of making contact with someone who leaves a message plummeting within minutes of their reaching out, establishing a follow-up system is critical.  Doing so involves a mix of “rules and tools.”  The “rules” are business processes established and monitored to ensure that phones are covered, calls are answered, and inquiries get an immediate response.  The “tools” can be as simple as an excel spreadsheet tracking inbound inquiries to as sophisticated as powerful Customer Relationship Management (“CRM”) systems such as Salesforce or Avvo Ignite.

Measuring Marketing Channel’s Effectiveness

Having a good system for contact and customer management is key to calculating marketing channel effectiveness. Used diligently, the CRM tools of such a system will tell the firm where each inquiry originates from (its website, a search marketing campaign, the Yellow Pages, etc.). Over a period of months, the firm will then be able to tell the rate at which those inquiries turn into actual clients. This may show, for example, that while a conference sponsorship is driving a lot of calls, such contacts become clients at a far lower rate than the smaller number of calls and appointments generated from a webinar. When all marketing platforms are matched up, the most successful ones should stand out for future business development projections and budget reviews.

By layering the cost of these marketing initiatives on the number of clients generated, a firm can get a very clear picture of the return on investment of each channel (i.e., what it costs to generate a client).  That information allows the firm to identify those channels where it can profitably increase its marketing investment – and those that it needs to cut loose.

Article By:

 of

Twitter: Little Statements with Big Consequences for Companies

McBrayer

Twitter is under attack. In recent months, accounts belonging to media giants CBS, BBC, and NPR have all been temporarily taken over by hackers. The Associated Press is the most recent victim. On April 23, 2013, a false statement about explosions at the White House and the President being injured sent shock waves through the Twitter-sphere. The real surprise is the effect the single tweet had in the real world: the Standard & Poor’s 500 Index dropped so sharply moments after the frightening tweet that $136 billion in market value was wiped out. While the hacking of these massive media outlets make headlines, everyday businesses are not safe from the threat, either. In February of this year, a hacker changed the @BurgerKing feed to resemble that of McDonald’s, putting the McDonald’s logo in place of Burger King’s. The hackers posted offensive claims about company employees and practices. If accounts belonging to well-established companies like these are vulnerable, so is yours. If a tweet can have a profound impact on the nation’s stock market, imagine what an ill-contrived tweet could do to your business.

Business owners may have the knee-jerk reaction to delete their Twitter account, but despite the recent blemishes to its security, Twitter remains one of the most important social media sites out there. Just recently, the Securities Exchange Commission made clear that companies could use social media like Twitter when announcing key information in compliance with Regulation Fair Disclosure. Twitter is not just a marketing or PR tool—Twitter is business. And you should never turn your back on existing business. So instead of hanging up your hashtags, consider some steps that can make your Twitter account safer.

Limit Access

Not every employee should have access to the company’s Twitter account. In fact, hardly anyone should, except a few designated employees like the marketing director or business owner. While those with access may never do anything harmful to the account, the more people who have the log-in information, the more likely it is to fall into the wrong hands.

Create a strong password

I know, you already have too many passwords to remember. But a creative password is your best defense against someone seeking to break into your account. Employers should, at minimum, have unique passwords for their most commonly used media sites; please do not use the same word for your Facebook, LinkedIn, and Twitter account. Once a hacker figures it out, they have control of your entire social media presence.

When creating a password, avoid using anything that would be too common. “Password,” “1234,” or the business’s name should never be the only thing standing between you and a hacker. The longer the password, the better. Use a mix of uppercase and lowercase letters, numbers, and symbols.

Article By:

 of

Making Copies! The Fourth Circuit Defines Taxable Costs Associated With eDiscovery

GT Law

Can this happen to your client? Your client gets sued, is forced to spend over $100,000 on eDiscovery despite you making all the right objections, you deliver a clean victory on dispositive motions and the District Court awards costs of … $200. Here is what happened in the Fourth Circuit and what you can do to help your clients avoid the same fate:

The Fourth Circuit just decided the scope of taxable eDiscovery costs under 28 U.S.C. § 1920(4) in Country Vintner of North Carolina v. E. & J. Gallo Winery, Inc., __ F.3d __, 2013 WL 1789728 (4th Cir. Apr. 29, 2013). Section 1920(4) allows the District Courts to “tax as costs … [f]ees for exemplification and the costs of making copies of any materials where the copies are necessarily obtained for use in the case.” Id. 1   Under Federal Rule of Civil Procedure 54(d)(1), the cost of making copies “should be allowed to the prevailing party.” As an initial matter, the Fourth Circuit concluded that section 1920(4) applies to the costs related to documents produced in discovery – not just used at trial or in connection with a dispositive motion. Country Vintner, 2013 WL 1789728, *7. The Fourth Circuit then examined the meaning of “making copies,” and held that section 1920(4) “limits taxable costs to … converting electronic files to non-editable formats and burning files onto discs.” Id., *9. 2   In reaching that conclusion, the Fourth Circuit explicitly rejected the argument that “ESI processing costs constitute[d]” “making copies” under Section 1920(4). Id., *7. As a consequence, Appellant Gallo was awarded only $218.59 out of the $111,047.75 in eDiscovery costs it sought.

What does that mean?

Appellant Gallo sought more than $70,000 for “indexing” and “flattening” ESI – processing methods that extracted irrelevant files and duplicates, made the remaining data searchable, and organized the data; spent more than $15,000 extracting and organizing metadata and preparing it for review; less than $100 on electronic bates numbering; and over $20,000 on quality assurance and preparing the document production. None of these costs were taxed. Instead, Gallo received only $178.59 to convert certain native files into TIFF and PDF format and another $40 to burn images onto CDs. While the documents could not be “copied” without all of the processing that preceded it, such processing costs will not be shifted through a bill of costs. Id., *8-9 (citing Race Tires Am., supra n. 2, 674 F.3d at 169).

What lessons can we learn?

The Fourth Circuit seems to recognize the harshness of its ruling and provides two helpful clues for future litigants seeking to manage their eDiscovery burdens. The court first observes: “That Gallo will recover only a fraction of its litigation costs under our approach does not establish that our reading of the statute is too grudging in an age of unforeseen innovations in litigation-support technology.” Id., *9. Then, the court leaves open the question of whether the allowable costs of production might include the processing costs had the parties “clearly agreed to the production of ESI on a particular database or in native file format.” Id., *9 n. 20 (citing In re Ricoh Co., Ltd. Patent Litig., 661 F.3d 1361, 1365–66 (Fed. Cir. 2011) (holding that $234,702.43 for the cost of an electronic database which the parties agreed to use for document production would have been allowed, but for the parties’ agreement to share costs)). Next, the court points out that, where discovery costs are excessive, the responding party can move for a protective order and, if that motion is denied (as Gallo’s motion was denied), then the responding party “can appeal that decision” Id., *9; id., *9 n. 21 (noting that Gallo had not appealed the denial of its motion for protective order).

Lesson #1: While it is not entirely clear how the parties’ agreement to utilize a particular format or database alters the conclusion that processing is not “making copies,” the Fourth Circuit seems to suggest that it might. 3  So, any party seeking to shift its eDiscovery costs should consider agreeing with the other side regarding the format or database to be used to handle the parties’ productions.

Lesson #2: While it is not entirely clear whether parties are entitled to file an interlocutory appeal with respect to the denial of a motion for protective order, the Fourth Circuit seems to urge parties to do so. 4  Either the court is encouraging interlocutory appeals before the ESI expenses are incurred, or the court is suggesting that a final judgment (for either party) does not moot the trial court’s refusal to shift pre-trial eDiscovery costs.

 1 Because appellant Gallo’s eDiscovery costs neither involved authentication of public records nor demonstrative exhibits – two potential meanings of exemplification – the Fourth Circuit did not define the meaning of exemplification in this case.  Country Vintner, 2013 WL 1789728, *10.

 2 In reaching that conclusion, the Fourth Circuit aligned itself with the Third Circuit’s approach in Race Tires Am., Inc. v. Hoosier Racing Tire Corp., 674 F.3d 158 (3d Cir. 2012).

3  In distinguishing In re Ricoh Co., the Third Circuit explained: “we have acknowledged that the costs of conversion to an agreed-upon production format are taxable as the functional equivalent of ‘making copies.’ It is all the other activity, such as searching, culling and deduplication that are not taxable.” Race Tires Am., 674 F.3d at 171 n.11.

 4 On one hand, discovery orders against a party are not immediately appealable. See, e.g., Nicholas v. Wyndham Int’l, Inc., 373 F.3d 537 (4th Cir. 2004). On the other hand, most discovery orders will be moot by the time a final order is entered. See, e.g., E. H. Reise v. Bd. of Regents of the Univ. of Wisconsin, Sys., 957 F.2d 293, 295-296 (7th Cir. 1992).

Article By:

 of

No “Safe Harbor” for BitTorrent Website Operator

McDermottLogo_2c_rgb

The U.S. Court of Appeals for the Ninth Circuit affirmed a summary judgment ruling in favor of seven film studios finding that the defendant induced third parties to download infringing copies of the plaintiffs’ copyrighted works. Columbia Pictures Industries, Inc., et al.  v. Gary Fung, et al., Case No. 10-55946 (9th Cir., Mar.21, 2013) (Berzon, J.).

Seven film studios—including Columbia Pictures, Disney and Twentieth Century Fox—sued Gary Fung and his company isoHunt Technologies, claiming that Fung induced third parties to download infringing copies of the studios’ copyrighted works through Fung’s websites, such as torrentbox.com and isohunt.com—websites that help users find copies of videos to download and stream through a type of peer-to-peer file sharing network.

The district court found Fung liable for contributory copyright infringement for inducing others to infringe the studios’ copyrights and also found that Fung was not entitled to protection from damages liability under the safe harbor provisions of the Digital Millennium Copyright Act (DMCA).  After a permanent injunction was issued, Fung appealed.

On appeal, Fung challenged the full holding, including the scope of the injunction claiming that it was vague, punitive and an impediment to free speech.  The 9th Circuit, citing the Supreme Court decision in Grokster III (which also dealt with peer-to-peer file sharing technology), analyzed the facts of the present case under the four elements of the Grokster III inducement principle:  the distribution of a device or product, acts of infringement, an object of promoting its use to infringe copyright and causation.

Inducement Liability Under Grokster III

With respect to the first element of the Grokster III inducement liability standard, Fung argued that he did not develop or distribute products, nor did he develop the BitTorrent protocol used by his websites.  The 9th Circuit, however, distinguished copyrights as expression that are not necessarily in the form of products or devices. Thus, the court concluded that a copyright can be infringed through “culpable actions resulting in impermissible reproductions of copyrighted expression,” even if such actions are the provision of services used in accomplishing the infringement.

Fung was not able to rebut the second “acts of infringement” Grokster III factor after the studios presented evidence that Fung’s services were widely used to infringe copyrights by allowing uploading and downloading of copyrighted material. Accordingly, the court found for the studios on the second factor, noting that the “predominant use” of Fung’s services was for copyright infringement.

As to the third Grokster III factor, the court agreed with Fung that mere knowledge of a potential to infringe, or knowledge of actual infringing uses of a product or service, is not enough for liability.  Nevertheless, the court found there was more than enough evidence that Fung offered his services with the object to promote their use to infringe copyrighted material.  Specifically, the court found that the evidence showed Fung actively encouraged uploading files of specific copyrighted material; he provided links for certain movies and urged users to download those movies; he affirmatively responded to requests for help in locating and playing copyrighted materials; and, he even personally instructed users on how to burn infringing files to DVDs.  The court also referenced two points of circumstantial evidence raised by the Grokster III opinion, namely, that Fung took no steps to develop filtering tools to diminish infringing activity and that he generated revenue by selling advertising space on his websites.

Finally, as to causation, the court adopted the studios’ interpretation of causation and held that the acts of infringement by third parties need only be caused by the product distributed or services provided.  This was contrary to Fung’s theory of causation (which was also joined by amicus curiae, Google) wherein Fung claimed that the infringement must be directly caused by a defendant’s inducing messages.

The Digital Millennium Copyright Act “Safe Harbor” Provisions

Fung also asserted affirmative defenses under three of the DMCA’s safe harbor provisions, 17 U.S.C. §512(a), (c) and (d). Although the studios argued that there can never be a DMCA safe harbor defense to contributory copyright liability inducement, the 9th Circuit disagreed, noting that the safe harbor provisions do not exclude vicarious or contributory liability from its protections. Even so, the court denied all of Fung’s safe harbor defenses.

In particular, the court concluded that Fung did not qualify for protection under §512(a) for transitory digital network communications because Fung’s torrent file trackers, not the third party users, were responsible for selecting the copyrighted data to be transmitted.

The court also concluded that § 512(c), relating to information residing on networks or systems at the direction of the users, was also not applicable because Fung had actual and “red flag” knowledge of infringing activity on his system due to his own active encouragement of infringement, as well as the fact that Fung did not dispute evidence that he personally used his isohunt.com website to download infringing material.

According to the 9th Circuit, Fung did not qualify for protection under §512(c) or §512(d) (for providers of information location tools) because Fung received a “financial benefit” from his services by selling ad space and because he had the “right and ability to control” the infringing activity, which was shown through evidence that Fung exerted substantial influence on the activities of the users of his websites.

Finding no available defenses under the DMCA safe harbors, the court affirmed summary judgment for the studios on the issue of liability under contributory copyright infringement.  However, the court found various terms of the lower court’s permanent injunction to be vague and unduly burdensome and remanded to the district court to modify certain employment prohibitions and to provide more specific language for several terms in the injunction.

Article By:

 of

Recent Social Media Developments Impacting Employers

Sills-Cummis-Gross-607x84

NLRB: Latest Decisions Addressing Social Media Policies and Activities

Within the past several months, the National Labor Relations Board (“NLRB“) has issued four precedent-setting opinions addressing the legality of an employer’s use of social media as a basis for taking adverse employment action. These decisions apply to both unionized and non-unionized workforces.

The key issue in each of these cases was whether the employer’s actions compromised the right of employees to engage in “protected concerted activities” for the purpose of their “mutual aid and protection.” However, as noted in a prior alert, recent federal case law could void all NLRB decisions dating back to January 4, 2012 (including those discussed below). Until there is clarity the NLRB decisions continue to be significant in shaping social media use, policy and practice.

On April 19, 2013, the NLRB, in Design Technology Group, LLC, found that an employee’s Facebook posts that criticized a manager’s handling of employee concerns were a “classic connected protected activity” under the National Labor Relations Act (“the Act”).

In that case, workers had approached their manager about closing the store they worked in at 7 PM instead of 8 PM, because of safety concerns. The manager advised that she would discuss those concerns with corporate officials, but the issue was never resolved. Subsequently, two employees posted messages on Facebook that were critical of how the manager handled that issue. Another employee showed the manager those posts and six days later, both employees who made the critical Facebook posts were fired by the manager.

The NLRB determined that the Facebook posts were part of the employees’ efforts to convince their employer to close the store earlier in the evening, based on their concerns about working late in an unsafe neighborhood. The NLRB found that those posts were protected under the Act and that the employees’ terminations constituted unfair labor practices.

Design Technology comes on the heels of three other NLRB social media rulings issued late last year.

In Hispanic United of Buffalo (December 14, 2012), the NLRB held that the termination of five employees for violating an employer’s policies on the basis of their social media activity was unlawful. In that case, five employees posted comments on Facebook that were critical of a co-worker who was scheduled to meet with and complain to management about their work performance. The employer terminated the five employees for “bullying and harassing” the co-worker in violation of its policies.

Hispanics United of Buffalo applied settled NLRB law regarding oral communications among co-workers to the social media context. Under NLRB precedent, employees’ comments regarding the terms and conditions of their employment are protected if their comments are “concerted” — meaning they are “‘engaged in, with or on the authority of other employees,” not only by “one employee on behalf of himself.” Finding the actions of these employees to be protected, the NLRB set a relatively low threshold for interpreting social media activity as protected concerted activity under the Act.

The Hispanics United decision is especially controversial because it may conflict with an employer’s competing obligation under federal and state discrimination laws to prevent workplace harassment. And, the decision may ultimately be in conflict with workplace anti-bullying laws in those states where such legislation is being actively considered. In Karl Knauz Motors, Inc. (September 28, 2012), the NLRB ordered another employer to rescind its social media policy. In that case, the employer terminated the employee for multiple reasons, including violation of the employer’s “Courtesy” rule requiring employees to be “courteous, polite and friendly” to customers, vendors, suppliers and fellow employees and not to use “language which injures the image or reputation of the Dealership.”

The NLRB held that the “Courtesy” rule violated the NLRA because employees could “reasonably construe its broad prohibition against ‘disrespectful’ conduct and ‘language’ which injures the image or reputation of the Dealership as encompassing Section 7 activity.” However, the NLRB upheld the employee’s termination, finding it was not motivated by protected concerted activity, but rather was solely based on the employee’s Facebook postings that did not relate to the terms and conditions of his or any other employee’s employment. The NLRB did not address whether other posts would be protected by the Act.

In Costco Wholesale Corp. (September 7, 2012), the NLRB ruled that an employer’s overbroad social media policy violated the National Labor Relations Act because it prohibited employees from posting statements “that damage the Company, defame any individual or damage any person’s reputation or violate the policies outlined in the Costco Employee Agreement.” The NLRB ordered Costco to rescind the policy based on its finding that the policy inhibited employees from engaging in protected concerted activity.

NJ Legislative Update: Proposed Law Seeks to Protect Employee and Job Applicant Passwords

A-2878, a bill that prohibits employers from requiring, or requesting, a current or prospective employee to reveal, as a condition of employment, his or her user name, password or other means of accessing the employee’s personal social media account, has passed both houses of the NJ Legislature and is awaiting further action by Governor Chris Christie. While it is not clear as of this writing whether Governor Christie will sign or veto this bill, the implications to employers of this potential new law are far reaching.

If enacted, this bill would prohibit employers from even asking an employee or prospective employee whether he or she has a profile on a social media site. In addition, the bill would prohibit employers from requiring prospective employees to waive or limit any protection granted to them under the law as a condition of applying for or receiving an offer of employment. It provides for a $1,000 civil penalty for the law’s first violation and $2,500 for each subsequent violation. If Governor Christie signs this bill into law, New Jersey would join other states that have enacted legislation preventing employers from requesting social media access information, including Arkansas, California, Delaware, Illinois, and Michigan, though it would be the first state to prevent employers from inquiring if employees or applicants have a social media account.

Notably, the bill does not prevent employers from performing their own online search to determine if a prospective or current employee is on a social media site. Accordingly, if a social media account is publically available, an employer would not run afoul of this proposed law by independently viewing an employee’s or prospective employee’s social media account. This type of activity could have other potential pitfalls associated with it however, such as learning protected class information about applicants.

We will continue to monitor the signing status of this bill.

What These Decisions and the Prospective NJ Statute Mean to Employers

In light of the foregoing, we recommend the following:

  • Employers should review and consider revising social media polices and hiring practices to address the NLRB decisions, the new NJ legislation, if enacted, and EEO issues associated with searches on applicants.
  • With respect to policies, employers should ensure that prohibitions placed on employees’ communications do not prohibit employees’ rights to engage in protected concerted activity.
  • Employers should continue to exercise caution when disciplining or terminating any employee based on his/her social media activities and should also consider training its managers in this area so that they do not inadvertently run afoul of these laws.
  • It is important to consult with counsel to consider whether an employee’s comments or posts would be deemed to be protected concerted activity under the Act before any disciplinary action is taken by the employer based on those comments or posts.
Article By:

of

Is Your Smartphone Costing You Thousands Each Month in Billable Time?

Client Logo

Back in the early 2000s, I had a friend who’d recently purchased a new-fangled flip-style mobile phone. Oohing and aahing, I asked if he loved all the things he could do with it. “I can play games on it and check the news, stock prices, sports scores, and weather” he lamented, “but I can’t figure out how to just make a phone call.”

Flash forward a decade to the ubiquity of smartphones, with their sleek design, shiny screens, and bright, colorful icons. Nearly every lawyer, young and old, has one. Newsletters and blog posts extol the smartphone’s positive impact on a lawyer’s productivity. New apps appear in the store almost daily to assist with note taking, dictation, file creation and storage, calendaring, practice management, and time tracking, to name a few. Bar associations and professional organizations host conferences, meetings, and CLEs to offer practical training on making the most of tablets, smartphones and cloud services.

Despite this, when lawyers use their smartphones for the most basic of tasks – talking on the phone – they struggle with capturing and billing that time. Are you one of them? Ask yourself the following questions:

  • Do I spend a lot of billable time on the phone?
    Surveys show that lawyers spend nearly one-quarter of their billable time on the phone, with over 70% percent of that time spent on the desktop phone in their office.
  • Do I use my mobile smartphone for work calls when I’m out of the office?
    If you do, you’re not alone. Lawyers report spending an average of 23 percent of their time working outside the office, during which time over 85 percent make work calls on smartphones.
  • Have I struggled finding good smartphone apps to use for work?
    Although a majority of lawyers responding to the 2012 ABA Legal Technology Survey use their own personal devices for work (making them part of the growing Bring Your Own Device, or BYOD, movement), two-thirds have never downloaded a general business app, while even fewer have tried a legal-specific smartphone app.
  • Have I ever forgotten or been unable to bill my time spent on the phone?
    You’re human and you’re busy, so you’re probably like most lawyers, who estimate that they lose a conservative five billable hours related to phone calls each month. Some of these hours are for forgotten, undocumented, or untimed calls. Others come from time spent reconstructing the call history for billing purposes, an arduous and inaccurate task.

If you answered yes to these questions, then that ubiquitous productivity tool – your smartphone – may make you more productive but still not help your bottom line. At an average hourly billable rate of $250, an office of four lawyers stands to lose nearly $5,000 every month, just on billable phone time.

With numbers like these, it’s never been more important that attorneys have access to timekeeping solutions that make it simple to track billable hours while on the phone. There are many time-trackers on the market, but common complaints about them include:

  • They’re too complex and full of bells and whistles that I will never use” (just like my friend with the fancy new flip phone).
  • “They require the use of a timer, which I often forget to start and stop.”
  • “They don’t capture time on the desktop phone, where I make the majority of my calls.”
  • “There’s too much manual entry required to create detailed records. Postponing the entry does nothing to alleviate the chore of billing reconciliation at the end of the month.”

When evaluating the options, consider these requirements:

  • Choose a solution that’s so simple, compliance is a snap.
    Look for a solution that is compatible with both mobile and desktop phones. From here, you can easily capture the call details and duration as it happens, no matter which device you’re using. In seconds, you can ensure that every minute spent on the phone is billed.
  • Simplify the billing reconciliation process with 24×7 access to the captured call data.
    A worthwhile solution will reclaim the hours previously spent digging through voicemail, paper phone messages, calendar appointments, and mobile call logs to reconstruct billable phone time. The internet is the perfect platform for the billing staff to gain access to captured call data from any browser whenever and wherever needed.
  • Impress your clients with descriptive, auditable billing records.
    Capturing comprehensive call details as they happen will improve your billing accuracy and show your clients exactly what they’re paying for. The more detail you can provide, the more they will trust your records, and the more likely you will be to collect on each invoice. Greater detail will help speed up your billing reconciliation time as well.
  • Minimize training time and increase usage by ensuring that the app is virtually identical on any device.
    If the process of capturing call information is the same on both office and mobile phones, it will quickly become a habit, no matter which device is in use. Consolidating the records generated from every device in a single, intuitive place online will help billing staff easily export and create line items for invoices.

While many time-trackers offer bells and whistles that sound great on paper, their complexity leaves many lawyers feeling like my friend who couldn’t figure out how to make a call on his new flip phone. Focus on simplicity to find a telephone timekeeping solution that you’ll actually use. An app that works automatically on any device will eliminate lost revenue for billable phone time, provide an audit trail for your clients, and allow your lawyers to be both productive and profitable.

Article By:

 of

“Actually, Someone Knows You are a Dog”– the Chinese Regulation Efforts on Private Data Protection

Sheppard Mullin 2012

Do you have privacy in the era of information?

“On the Internet, nobody knows you’re a dog.” First published in The New Yorker on July 5, 1993, this widely known and recognized saying has been quoted many times to describe the anonymous feature of Internet. However, now this description has been drifting from the truth.

The truth is that, some people using the Internet may know you better than yourself. When you log on Amazon, not only will the site greet you by name, the homepage will also suggest certain purchases. Surprisingly, you will be interested in at least one third of them. Your addresses have been recorded and Amazon will automatically calculate the delivery period. Besides those online shopping sites, getting visitors’ information is the common practice of online service and/or information providers. Youku and Netflix suggest videos to watch. Weibo and Facebook suggest friends to follow. Douban and IMDB suggest movie tickets to buy and parties to attend.

On one hand, these recommendations might give you convenience in your life and entertainment; while on the other hand, this can be really intruding and make you anxious by knowing you so much. For example, you just bought an apartment and even did not get the keys. However, decoration companies and contractors give you calls telling you the decoration designs for the new apartment have been done. You just submitted some resumes for a job. Even before the interview, insurance companies and training companies give you calls and emails to make sales. Have you wondered how strangers know your private, personal information?

Every time you log on a website, make a call or buy a ticket by showing ID card, computer systems will track you down, and record everything you have clicked and purchased. Data analyzing systems will collect, characterize, store your information, and take further actions based on the information. Some entities even purchase and resell personal data for profit. The reason why personal data become commodities is because direct marketing based on private data is profitable. Marketing communications are only classified as “direct marketing” where they are addressed to a specific person by name or where a phone call is made to a specific person, and the use of private data is the foundation of direct marketing. The newly issued Hong Kong Personal Data (Privacy) Amendment Ordinance contains a number of new provisions regulating the use of personal data in connection with direct marketing activities in Hong Kong, which has come into force since April 1, 2013. Apart from Hong Kong, there are over fifty countries and regions which have laws and regulations protecting personal data.

What is the new trend in China to protect personal data?

In order to safeguard the legitimate rights and interests of Chinese citizens concerning private data protection, the Ministry of Industry and Information Technology of China (“MIIT”) announced the Provisions on the Protection of Personal Information of Telecommunication and Internet Users (Draft for Comments) (“PPI Rules”) and the Provisions on the Registration of True Identity Information of Telephone Users (Draft for Comments) (“RTII Rules”) and sought for public comments. The deadline for submitting comments is May 15, 2013.

The PPI Rules and RTII Rules are a breakthrough with respect to legislation of personal information protection. Although these two rules are not officially a personal information protection law, they are a good beginning and call for a complete set of rules.

The PPI Rules and RTII Rules are designed to protect personal information from two perspectives. While the PPI Rules regulates the collection and utilization of users’ private information, the RTII Rules requests “real-name registration” of telephone users for the prohibition of direct or indirect marketing using no-name telephone numbers. Specifically, the PPI Rules requires that telecommunication service providers and Internet information service providers (“Service Providers”) shall not collect or use the users’ personal information without their consent. Service Providers shall also clearly notify the users of the purpose, method and scope of collection and utilization of the users’ personal information, retention period of such information, ways to access and modify such information, and consequences of refusal to provide such information.

Meanwhile, the “real-name registration” required by RTII Rules is a double-edged sword. Not only are telephone users required to supply their true identity information, some Internet services, for example, the Chinese Twitter Weibo, also require users’ true identity information. On one hand, it will reduce the risk of private information abuse by no-name telephones and Weibo bloggers. One the other hand, the “real-name registration” regime means it is legitimate for telephone and some Internet service providers to collect their users’ information. Although RTII Rules prohibits the sales and illegal provision of users’ information, it doesn’t mean those providers will not utilize the users’ information to make profits and provide such information to government or other compulsive entities. This “real-name registration” may limit the health development of Internet and even harm users’ right to free speech. Is “real-name registration” the only way to protect personal information? This is a controversial topic.

What can enterprises do to avoid violations of personal data protection rules in China?

Putting the controversial topic aside, let’s talk about what the enterprises doing business in China can do regarding new rules to protect personal information. Those enterprises may not be limited to Internet/telecommunication service providers, because the regime may expand in the future to regulate more entities that may get access to citizens’ personal data.

First, the concerned enterprises can log on MITT official websites and submit comments if any. They can make their voice heard since the rules are in the “draft for comments” period.

Second, thorough study of the new rules and other anticipated rules in this area is needed. The concerned enterprises need to provide proper training to their employees regarding the users’ information protection, since this is not only required by the new rules, but the enterprises might also have joint and several obligations with the employees who abuse the users’ information.

Third, proper drafts of disclaimer/declaration/agreement are needed when the enterprises want to collect and utilize the users’ private information. The enterprises need to make sure that they have obtained the users’ consents concerning the information collection and utilization. Proper preparations are needed to avoid future risks.

 of

The “Reasonable” Perils of Data Security Law

Your House Counsel Logo

The following is drawn from the materials to be presented at the 17th Annual America’s Claims Event 2013 conference in the “Cyber-Liability and Data Loss Claims: A Case Study from Notice of Occurrence Through Conclusion” session on June 20, 2013 in Austin, Texas.

NEGLIGENCE. “The omission to do something which a reasonable man, guided by those ordinary considerations which ordinarily regulate human affairs, would do, or the doing of something which a reasonable and prudent man would not do.”1

“When we think about data breaches, we often worry about malicious minded computer hackers exploiting software flaws, or perhaps Internet criminals seeking to enrich themselves at our expense. But the truth is that errors and negligence within the workplace are a significant cause of data breaches that compromise sensitive personal information.”2

According to a recent privacy institute study by the Ponemon Institute, only 8% of the surveyed data breach incidents were due to external cyber attack, while 22% could be attributed in part to malicious employees or other insiders. Loss of laptops or other mobile devices containing sensitive data topped the survey, while mishandling of data “at rest” or “in motion” were also major contributors.3 A later study showed that 39% of surveyed organizations identified negligence as the root cause of their data breaches, while 37% were attributed to malicious or criminal attack.4

Negligent document disposal is a clear source of preventable negligence. On December 7, 2012, at least eight garbage bags were left unattended on a dirt road in Hudson, Florida, containing credit applications to Rock Bottom Auto Sales with names, driver’s license information, and Social Security numbers. Three days later, in Pittsburgh, Pennsylvania, job placement documents were found in a dumpster from the West Pittsburgh Partnership, all containing names and SSN’s.5 For that matter, the Internal Revenue Service in 2008 was found to have disposed of taxpayer documents in regular waste containers and dumpsters, and that a follow-up investigation revealed that IRS officials failed to consistently verify whether contract employees who have access to taxpayer documents had passed background checks.6

Convincing users to back up their laptops has been difficult enough in practice; getting them to encrypt them voluntarily is much more daunting a task. A 2010 Ponemon Institute study, admittedly biased towards large corporations, concluded that of those surveyed typically 46% of the laptops held confidential data, while only 30% had their contents encrypted. A startlingly low 29% of the laptops had backup/imaging software installed, which implies that more than two thirds of all laptops if lost or stolen would leave no backup of work in progress.7

Even though more devices are coming to market with built-in encryption capabilities, these features may simply be left switched off by their users despite the fact that lost laptops, tablets, smartphones, USB “thumb” drives and other portable devices with unencrypted contents continue to provide a wealth of information to identity thieves.

On March 22, 2013, a laptop used by clinicians at the University of Mississippi Medical Center was discovered to be missing. It contained patient names, social security numbers, addresses, diagnoses, birthdates and other personal information, protected only by a password.8

On January 8, 2013, an unencrypted flash drive was stolen from a Hephzibah Georgia middle school teacher’s car, containing student SSN’s and other information.9 TD Bank had two unencrypted backup tapes with customer and their dependent names, SSN’s, addresses, account, credit and debit card numbers go missing while being transported between two TD Bank offices in March 2012, but public notice was not made until March 4, 2013.10

An examination of reported data security incidents with potential or actual data privacy breaches reveals that the scope of what is deemed “reasonable” ranges from ordinary care in the disposal of documents containing personally identifiable information (“PII”) and personal health information (“PHI”), to sophisticated data encryption, access authentication and other highly technical data security practices that the “reasonably prudent” persons, companies and governmental agencies are now expected to employ to protect the personal data that they have collected.

On October 10, 2012, the South Carolina Department of Revenue was informed of a potential cyber attack involving the personal information of taxpayers.11 The origin of the attack was traced to a state Department of Revenue employee who clicked on an embedded link in a “salacious” email and compromised his computer.12 The subsequent investigation revealed that “outdated computers and security flaws at the state’s Department of Revenue allowed international hackers to steal 3.8 million tax records”, according to Governor Nikki R. Haley. Apparently South Carolina did not encrypt Social Security Numbers, and once the outer perimeter security was compromised the hackers were able to log in as tax officials and read the data.13

Users of online services will routinely provide personal information as a matter of course to shop or obtain other services, all of which gets recorded and tracked. Data privacy laws are intended to promote and enforce a number of fair information practices to give individuals the ability to find out what personal information is being kept and by whom, opportunities to correct or remove such information, assurances that reasonable measures will be undertaken to protect such information from disclosure and to properly dispose of such information when appropriate, and may include remedial measures to be undertaken in the event of a data breach.

In the United States, there is no single comprehensive statute for data privacy laws.14 Instead, a number of sector-specific federal laws have been enacted to address the particular sensitivity of information generally recorded by companies in that market sector, and forty six states have enacted data breach notification statutes. If there is a data breach, you may be liable under state law to provide notice to those affected.15 In some jurisdictions, you may be required to provide notice to all consumer credit reporting agencies as well.16

The financial exposure to a data breach by a company may be insurable to some degree using various forms of “cyber liability” insurance, which expand and supplement many forms of more standard insurance coverages underwritten today. Policy premiums for such policies, however, are dependent upon the extent of data security practices implemented.

Conducting a data security risk assessment before encountering a data breach should identify measures that can be taken at the corporate level to provide additional protection not only to sensitive data, but also mitigate the consequences of a security incident where company data is disclosed, lost or stolen. Encrypted data in many cases may not be considered “exposed” for purposes of mandated notice to affected individuals.

In the event of a data security incident, please consider obtaining a data forensic team to not only identify the source and extent of the breach, but to preserve evidence in the event that a potential prosecution may be possible.

We will discuss a data breach case study from inception through enforcement, resolution and potential mitigation through cyber liability insurance at our presentation at ACE 2013. We hope to see you then.

1 BLACK’S LAW DICTIONARY 1184 (4th ed. 1968).

2 Privacy Rights Clearinghouse, Are the Businesses You Frequent or Work For Exposing You to an Identity Thief?, (Mar. 6, 2012), https://www.privacyrights.org/workplace-identity-theft-quiz-alert-2012

3 The Human Factor in Data Protection, 3 PONEMON INSTITUTE LLC (January 2012), available athttp://www.ponemon.org/local/upload/file/The_Human_Factor_in_data_Protection_WP_FINAL.pdf.

4 2011 Cost of Data Breach Study: United States, 7 PONEMON INSTITUTE LLC (March 2012),available at http://   www.ponemon.org/local/upload/file/2011_US_CODB_FINAL_5.pdf.

5 http://www.privacyrights.org/data-breach/new (check Breach Type “PHYS”, Organization Type “BSR” and Year “2012”).

6 Increased Management Oversight of the Sensitive but Unclassified Waste Disposal Process Is Needed to Prevent Inadvertent Disclosure of Personally Identifiable Information, TREASUR INSPECTOR GENERAL FOR TAX ADMINISTRATION (May 8, 2009), http://www.treas.gov/tigta/auditreports/2009reports/200930059fr.pdf.

7 The Billion Dollar Lost Laptop Problem 6 PONEMON INSTITUTE LLC (Sept. 30, 2010), availableat http://newsroom.intel.com/servlet/JiveServlet/download/1544-8-3132/The_Billion_Dollar_Lost_Laptop_Study.pdf.

8 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “EDU” and Year “2013”).

9 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “EDU” and Year “2013”).

10 http://www.privacyrights.org/data-breach/new (check Breach Type “PORT”, Organization Type “BSF” and Year “2013”).

11 Kara Durrette, SC Department of Revenue hacked; millions of SC residents affected, http://www.midlandsconnect.com/sports/story.aspx?id=817902#.UVyOdheYu7w (posted Oct. 26, 2012, updated Oct. 27, 2012).

12 Matthew J. Schwartz, How South Carolina Failed To Spot Hack Attack, INFORMATION WEEK, Nov. 26, 2012, http://www.informationweek.com/security/attacks/how-south-carolina-failed-to-spot-hack-a/240142543.

13 Robbie Brown, South Carolina Offers Details of Data Theft and Warns It Could Happen Elsewhere, N.Y. TIMES, Nov. 20, 2012, available at http://www.nytimes.com/2012/11/21/us/more-details-of-southcarolina-hacking-episode.html?_r=0.

14 PETER P. SWIRE & KENESA AHMAD, FOUNDATIONS OF INFORMATION PRIVACY AND DATA PROTECTION 41 (International Association of Privacy Professionals) (2012).

15 NYC Administrative Code § 20-117(c) (2013); NY CLS State Technology Law § 208(2) (NY state residents only); 73 Pa. Stat. § 2303 (PA residents).

16 73 Pa. Stat. § 2305; NY CLS State Technology Law §208(7)(b).

Article By:

of

Price Transparency and the Legal Marketplace

consumer_colorlogo (1)

My teenage children don’t know a world without the internet; a place where the sum of all human wisdom is a few clicks away.
Or where it’s really easy to research and buy the latest videogame.

 

Aside from the democratization of information and sharing enabled by the internet, the biggest impact of the web in most people’s lives is how it has transformed the consumer experience.  It has done so in two important ways:  by creating unprecedented levels of transparency and removing friction from the purchase process.   In nearly every industry, a wealth of information is available to consumers prior to making a purchase:  what the options are, differences between products, user feedback, and price transparency.  With full information about products, including price, the internet makes comparison shopping easy.

 

And with all of that information, purchasing is smoothed out as well.  Web services continue to refine the art of removing friction from the purchase process.  Amazon aggressively knocked down reasons to purchasing goods in brick-and-mortar stores.  Uber removed the transactional choke points from cab rides.  iTunes made it easy to buy music on an a la carte basis.  Much of the consumer internet continues to iterate and expand on the winning concept of blending ever-higher levels of information with ever-smoother transaction processing.

 

This online purchasing revolution has also reached beyond everyday consumer goods and services.  Buying insurance, trading stocks, even government licensing – all have been streamlined online.

 

But there’s one notable area that has remained largely impervious: legal services.  Despite some increases in transparency on lawyer backgrounds (Avvo) and do-it-yourself online legal forms (LegalZoom), the legal marketplace has seen nothing approaching the change in consumer empowerment and ease of transacting experienced in virtually all other industries.
It’s not as if legal services is a tiny economic niche.  The market for legal services in the U.S. is worth over $250 billion per year, and nearly 40% of that is made up of consumer legal spending.  Rather, a mixture of byzantine regulation, barriers to market entry, and restrictions on common forms of marketing have kept consumers from experiencing the same form of experimentation and innovation that has transformed the delivery of so many other goods and services:

  • Until the late 1970’s, lawyers in the U.S. could not advertise in any meaningful way, and many states still have laws on the books prohibiting lawyers from using common advertising techniques.
  • Non-lawyers cannot own even a minority interest law firms, preventing outside investment in the industry and removing the ability to offer equity compensation to talented non-lawyer leaders.
  • Except in limited circumstances, attorneys are prevented from participating in services that attempt to match clients with lawyers based on specific legal circumstances.
  • Rules based on the geographic location of an attorney prevent many forms of remote counseling, even when the matter in question is not dependent on a given state’s law.
  • Legal obligations in most states make it difficult for attorneys to offer limited-scope services that attempt to counsel or coach consumers through specific legal issues rather than engage in full-blown client advocacy.

Some of these restrictions are rooted in a learned profession’s reliance on tradition and resistance to rapid change, and much of it stems from a desire to protect clients and ensure the quality of legal work.  But a consequence of the locked-down nature of the industry is that many consumers who would otherwise use legal services do not avail themselves of them.

 

It’s not hard to see why.  There’s no way to shop for a lawyer-reviewed estate plan the way you would for a pair of shoes or a flight to Mexico.  And beyond price transparency, attorneys and law firm have shown little interest in marketing fixed-price, entry-level offerings that work fine for a large percentage of consumers.  Instead of leading with such offers and then upselling to those needing more involved help, the vast majority of lawyers treat every client as being in need of a custom solution.

 

It’s a shame for both consumers and lawyers. Many consumers who choose to do without a lawyer’s help are no doubt getting suboptimal outcomes in their legal matters.  And lawyers, by failing to deliver the transparency and ease of transacting that consumers have become used to, are missing out on a massive, underserved market.

–          Josh King is vice president and general counsel of Avvo.com, the web’s largest legal Q&A platform, directory and marketplace.

Federal Communications Commission (FCC) Considers Proposal To Lift 25% Cap On Indirect Foreign Investment In Broadcast Licensees

Sheppard Mullin 2012

In August 2012, the Coalition for Broadcast Investment (“CBI”), a group comprising national broadcast networks, radio and television station licensees, and community and consumer organizations, filed a letter with the FCC requesting clarification of the foreign ownership rules contained in Section 310(b)(4) of the Communications Act. Specifically, CBI requested clarification that “the FCC will conduct a substantive, facts, and circumstances evaluation of proposals for foreign investment in excess of 25 percent in the parent company of a broadcast licensee.…” If adopted, this approach would represent a marked change of course for the FCC, which has in the past “categorically refused” to consider transactions involving investment in broadcasters above the 25% benchmark, according to CBI.

Citing the numerous other contexts where foreign investment above 25% is permitted (including, among others, sectors such as cable, direct-to-home satellite, and wireless), CBI highlighted the “structural disadvantage” broadcasters face because of the FCC’s “effective presumption” against foreign investment above 25% in the broadcast sector. In addition, CBI pointed out that ending the presumption would place broadcasters “on the same footing” as other industry participants, facilitating crucial access to capital in a market where they face increasing competition for consumers.

In February 2013, the FCC responded with a Public Notice (MB Docket No. 13-50) soliciting comments on CBI’s request. The first round of comments were due April 15, and a review of those submissions reveals a uniform desire for the FCC to relax the de facto 25% indirect cap applied to foreign ownership in broadcasters. Although all commenters supported CBI’s request, different groups highlighted particular points of emphasis.

Adelante Media Group, the National Association of Broadcasters, and Nexstar Broadcasting all noted that the Over-the-Top providers competing with traditional broadcasters face no restriction on foreign ownership. The Minority Media and Telecommunications Council emphasized that encouraging foreign investment in broadcasters would help “reverse the decline in minority broadcast ownership.” The National Association of Media Brokers referenced the fact that many entities that provided working capital to prospective new broadcasters were no longer in the market.

The question remains whether the FCC will hear the pleas of the broadcasters for regulatory parity. On the one hand, broadcasters may have reason for optimism if the FCC’s recent Public Notice (IB Docket No. 11-133) stating that it has streamlined its policies and procedures for reviewing foreign ownership of common carrier wireless licenses and certain aeronautical radio licenses is any indication. On the other hand, the broadcast industry has a long history of special concern in Congress due to its potential to influence the outcome of elections, and the FCC has not yet heard from Congress on these issues.

Reply comments on the proposal to lift the 25% cap on indirect foreign ownership of broadcast licensees are due at the FCC on April 30.

Article By:

 of