Category: Consumer Protection

Dodd-Frank Whistleblower Protection: For America Only

Sheppard Mullin 2012

 

The U.S. District Court for the Southern District of New York has held that thewhistleblower protection provisions of the Dodd-Frank Act do not apply outside the United States, even where the employee alleged he was terminated for raising compliance concerns under U.S. international law. Specifically, the court found that Dodd-Frank did not protect an employee of Siemens in China who alleged he was terminated in retaliation for raising compliance concerns under the U.S. Foreign Corrupt Practices Act (FCPA). The decision will strike many observers as remarkable, since the extraterritorial provisions of the FCPA itself have been construed so broadly. The opinion in the case, Liu v. Siemens AG, Civ. No. 13 Civ. 317 (WHP) Slip Op. (S.D.N.Y. Oct. 21, 2013), may be viewed online here.

The plaintiff in the case, Meng-Lin Liu, a resident of Taiwan, was employed by Siemens China as a Division Compliance Officer. Siemens China is a subsidiary of Siemens AG, a German company whose American Depositary Receipts trade on the New York Stock Exchange. After Liu raised anti-bribery compliance concerns at Siemens China, his employment contract was terminated in 2010. After his termination he reported possible violations of the FCPA to the U.S. Securities and Exchange Commission under the SEC’s whistleblower program.

Liu then brought action against Siemens under the Dodd-Frank anti-retaliation provision, which provides as follows:

No employer may discharge, demote, suspend, threaten, harass, directly or indirectly, or in any other manner discriminate against, a whistleblower in the terms and conditions of employment because of any lawful act done by the whistleblower . . . in making disclosures that are required or protected under the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7201 et seq.), [the Securities Exchange Act of 1934 (15 U.S.C. § 78a et seq.)], section 1513(e) of Title 18, and any other law, rule, or regulation subject to the jurisdiction of the [SEC].

15 U.S.C. § 78u-6(h)(l)(a). The Dodd-Frank Act defines “whistleblower” as “any individual who provides . . . information relating to a violation of the securities laws to the [SEC], in a manner established, by rule or regulation, by the [SEC].” 15 U.S.C. § 78u-6(a)(6).

Siemens moved to dismiss the case for failure to state a claim, arguing (among other things) that the anti-retaliation provision is not applicable outside the United States. Liu argued that by using the phrases “any individual” and “no employer,” the statute evinces an intent to protect whistleblowers wherever they are. The Court rejected Liu’s hypothesis, stating that the statute is silent regarding whether it applies extraterritorially. That silence, said the Court, “invokes a strong presumption against extraterritoriality.” Liu, Slip Op. at 5. Consequently, the Court dismissed Liu’s claim.

Interestingly, the Court also rejected the idea that the anti-retaliation provision must protect foreign whistleblowers since the statute in essence creates foreign whistleblowers. The Court stated that “[t]he fact that a person outside the United States may be a “whistleblower” under Dodd-Frank does not compel the conclusion he is protected by the Anti-Retaliation Provision. Slip Op. at 6.

An earlier holding by the U.S. Court of Appeals for the 5th Circuit took a different approach but reached a similar result in July 2013. In that case, Asadi v. GE Energy, 720 F.3d 620 (5th Cir. 2013), the Court ruled that a GE Energy employee in Iraq who was terminated after reporting potential anti-bribery compliance concerns to his employer (but not to the SEC) did not qualify as a whistleblower under Dodd-Frank, and thus was not protected by the anti-retaliation provision. The Asadi opinion may be viewed online here. Interestingly, the lower court in Asadi reasoned (like the Liu court) that Asadi was not protected from retaliation because the Dodd-Frank anti-retaliation provisions are not extraterritorial. SeeAsadi v. GE Energy, 2012 U.S. Dist. LEXIS 89746 (S.D. Tex. 2012). The Fifth Circuit, reviewing the case de novo, declined to review that reasoning and based its holding on the inapplicability of the “whistleblower” definition. Asadi, id. at note 13.

The effects of these rulings warrant careful attention. For example, corporations involved in international business may wish to look closely at their own anti-retaliation policies and be careful to tailor them properly. While we would expect courts to continue to examine the limits on whistleblower retaliation under Dodd-Frank, the Asadiholding is not binding outside the Fifth Circuit, and the Liuholding is not binding outside the Southern District of New York.

Separately, it will be interesting to see whether the number of foreign whistleblowers is affected by these holdings. The SEC reported that in Fiscal Year 2012, it fielded over 3,000 whistleblower allegations. See U.S. Securities and Exchange Commission, Annual Report on the Dodd-Frank Whistleblower Program, Fiscal Year 2012, available online here. Of those, 115, or 3.8 percent, were FCPA-related allegations, and thus have inherently international fact patterns. Id. at Appendix A. If Dodd-Frank does not protect foreign whistleblowers or those who do not file formal allegations with the SEC, that may cause a chilling effect on the number of reports in the future.

Article by:

Lawrence M. Braun

Of:

Sheppard, Mullin, Richter & Hampton LLP

Litigating Asbestos Cases in Today's Environment, Featuring Insights from the Bench: The Judicial Perspective – December 12, 2013

The National Law Review is pleased to bring you information about the upcoming Litigating Asbestos Cases in Today’s Environment, Featuring Insights from the Bench: The Judicial Perspective.

Image

When:

Thursday, December 12, 2013

Where

The Princeton Club of New York
15 West 43rd Street
New York, NY

Perrin Conferences, renowned leader in joint plaintiff/defendant litigation conferences is the host of this program. The Judicial Roundtable features insights from Six New York State Supreme Court Judges. Perrin Conferences offers complimentary registrations for in-house counsel and insurance company professionals. They also offer discounted registrations for law firms who send multiple attendees.

New Federal Communication Commission (FCC) Rules to Protect Telephone Consumers from Autodial/Robocalls

Lewis & Roca

On October 16, 2013, new Federal Communication Commission rules took effect to further protect consumers under the Telephone Consumer Protection Act of 1991 (TCPA). See 47 U.S.C. § 227; 47 C.F.R. § 64.1200. The changes ordered by the FCC are designed to protect consumers from unwanted autodialed or pre-recorded telemarketing calls, also known as “telemarketing robocalls.” The new TCPA rules accomplish four main things: (1) require prior written consent for all autodialed or pre-recorded telemarketing calls to wireless numbers and residential lines; (2) require mechanisms to be in place that allow consumers to opt out of future robocalls even if during the middle of a current robocall; (3) limit permissible abandoned calls on a per-calling campaign basis in order to discourage intrusive calling campaigns; and (4) exempt from TCPA requirements calls made to residential lines by health care related entities governed by the Health Insurance Portability and Accountability Act of 1996. None of the FCC’s actions change the requirements for prerecorded messages that are non-telemarketing, informational calls such as calls by or on behalf of tax-exempt organizations, calls for political purposes, and calls for other non-commercial purposes including those to people in emergency situations.

Under the FCC’s new rules, “prior written consent” will require two things: a clear and conspicuous disclosure that by providing consent the consumer will receive auto-dialed or prerecorded calls on behalf of a specific seller, and a clear an unambiguous acknowledgement that the consumer agrees to receive such calls at the mobile number. The content and form of consent may include an electronic or digital form of signature such as the FTC has recognized under the E-SIGN Act. See Electronic Signatures in Global and National Commerce Act, 15 U.S.C. § 7001 et seq. However, prior written consent may be terminated at any time. In addition, the written agreement must be obtained “without requiring, directly or indirectly, that the agreement be executed as a condition of purchasing any good or service.” 16 C.F.R. § 310.4(b)(v)(A)(ii).

Read the full rule here.

Article By:

California Enacts New Data Privacy Laws

Sheppard Mullin 2012

As part of a flurry of new privacy legislation, California Governor Jerry Brown signed two new data privacy bills into law on September 27, 2013: S.B. 46 amending California’s data security breach notification law and A.B. 370 regarding disclosure of “do not track” and other tracking practices in online privacy policies. Both laws will come into effect on January 1, 2014.

New Triggers for Data Security Breach Notification

California law already imposes a requirement to provide notice to affected customers of unauthorized access to, or disclosure of, personal information in certain circumstances. S.B. 46 adds to the current data security breach notification requirements a new category of data triggering these notification requirements: A user name or email address, in combination with a password or security question and answer that would permit access to an online account.

Where the information subject to a breach only falls under this new category of information, companies may provide a security breach notification in electronic or other form that directs affected customers to promptly change their passwords and security questions or answers, as applicable, or to take other steps appropriate to protect the affected online account and all other online accounts for which the customer uses the same user name or email address and password or security question or answer. In the case of login credentials for an email account provided by the company, the company must not send the security breach notification to the implicated email address, but needs to provide notice by one of the other methods currently provided for by California law, or by clear and conspicuous notice delivered to the affected user online when the user is connected to the online account from an IP address or online location from which the company knows the user ordinarily accesses the account.

Previously, breach notification in California was triggered only by the unauthorized acquisition of an individual’s first name or initial and last name in combination with one or more of the following data elements, when either the name or the data elements are unencrypted: social security number; driver’s license or state identification number; account, credit card or debit card number in combination with any required security or access codes; medical information; or health information. S.B. 46 not only expands the categories of information the disclosure of which may trigger the requirement for notification, it also—perhaps unintentionally—requires notification of unauthorized access to user credential information even if that information is encrypted. Thus, S.B. 46 significantly expands the circumstances in which notification may be required.

New Requirements for Disclosure of Tracking Practices

A.B. 370 amends the California Online Privacy Protection Act (CalOPPA) to require companies that collect personally identifiable information online to include information about how they respond to “do not track” signals, as well as other information about their collection and use of personally identifiable information. The newly required information includes:

  • How the company responds to “do not track” signals or other mechanisms that provide consumers the ability to exercise choice over the collection of personally identifiable information about their online activities over time and across third-party websites or online services, if the company collects such information; and
  • Whether third parties may collect personally identifiable information about a consumer’s online activities over time and across different websites when a consumer uses the company’s website.

These disclosures have to be included in a company’s privacy policy. In order to comply with the first requirement, companies may provide a clear and conspicuous hyperlink in their privacy policy to an online description of any program or protocol the company follows that offers the user that choice, including its effects.

It’s important to note that the application of CalOPPA is broad. It applies to any “operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service.” As it is difficult to do business online without attracting users in technologically sophisticated and demographically diverse California, these provisions will apply to most successful online businesses.

What to Do

In response to the passage of these new laws, companies should take the opportunity to examine their data privacy and security policies and practices to determine whether any updates are needed. Companies should review and, if necessary, revise their data security breach plans to account for the newly added triggering information as well as the new notification that may be used if that information is accessed. Companies who collect personally identifiable information online or through mobile applications should review their online tracking activities and their privacy policies to determine whether and what revisions are necessary. The California Attorney General interprets CalOPPA to apply to mobile applications that collect personally identifiable information, so companies that provide such mobile apps should remember to include those apps in their review and any update.

Article By:

 of

A Different Kind of Adobe Update: Adobe Announces Data Breach Compromising Information of 2.9 Million Customers

MintzLogo2010_Black

Adobe Systems Inc.,(ADBE -1.24%) announced earlier today that has been the victim of a cyber attack that has compromised information of 2.9 million of its customers.  In a blog post Thursday morning, Adobe’s Chief Security Officer Brad Arkin referred to such attacks as “one of the unfortunate realities of doing business today” and added that the attack on customer information is believed to be linked to an attack in which hackers obtained source code for certain Adobe products, including its Cold Fusion web application platform and its Acrobat family of products.

Adobe Systems Inc. reported what it called a sophisticated attack on its computer network, involving illegal access to both customer information and source code related its programs

The scope of the breach was first disclosed by security blogger, Brian Krebs in his blog, Krebs on Security.  The customer information accessed by the hackers includes names, encrypted credit or debit card numbers, expiration dates, and other information relating to customer orders.  At this time Adobe does not believe that decrypted credit or debit card numbers were obtained.  Adobe has reset passwords for certain customers and will be notifying customers whose debit or credit card information is believed to have been accessed.  For those customers whose credit or debit card information has been accessed, Adobe will offer a complimentary one-year membership with a credit monitoring service.

This latest incident is a reminder that cyber attacks are not only an “unfortunate reality” of doing business, but are also increasingly common.  If your business collects customer or user information, there is no time like the present to make sure you have a response plan in place.

Read more:

New York Times – Adobe Announces Security Breach

PCWorld – Adobe Reports Massive Security Breach

Wall Street Journal — Hackers Hit Adobe Systems Network 

AllThingsD

Article By:

 of

Financial Services Legislative and Regulatory Law Update – September 30, 2013

Mintz Logo

Leading the Past Week

Working through a rare weekend session, the Congress appeared no closer to being able to avoid a shutdown of the Federal Government.  Early Sunday morning the House sent back to the Senate its version of the spending bill, including two provisions – one delaying Obamacare for one year and the other repeals the medical device tax which helps fund the law.   While there are other differences in the bills – notably how long they keep the government operating, Leader Reid has made it clear that the Senate will strip out these two provisions when it meets at 2pm on Monday.  With the midnight Monday deadline quickly approaching, all sides appear resigned to a shutdown occurring and have turned their attention to positioning for the fallout.

While the political ramifications of a shutdown are unclear – with both sides believing that they will benefit, the practical results were announced late last week as various federal agencies disclosed how they will act starting on Tuesday.  For example on Friday, Treasury announced that a government shutdown would affect some activities, but that “critical functions” would continue. The IRS would have to pull back on some functions, such as fielding taxpayer queries, but other functions like managing the government’s funds, implementing tax policy would continue.  Other offices that are not funded under annual appropriations, such as the Office of the Comptroller of the Currency (OCC) and the Financial Stability Oversight Council (FSOC), or the GSE’s, would continue to operate as normal.   The CFTC also released a shutdown plan, which outlined the “vast bulk” of oversight and surveillance responsibilities would be stopped.   Perhaps most troubling for the economy is the fact that the shutdown will also prevent the FHA from processing mortgages, and with nearly 45% of the market using FHA backed mortgages, the fear of a disruption to the real estate market, and thus potentially the economy as a whole.

Although there are options that both sides have to avert, or at least delay the shutdown, it now seems more likely than not, that the time will run out and the government will shut down for the first time since 1996 later this week.

Legislative Branch

Senate

Senate Banking Examines TRIA Extension

On September 25th, the Senate Banking, Housing, and Urban Affairs Committee held a hearing to examine the reauthorization of the Terrorism Risk Insurance Act (TRIA).  Similar to House hearing on the subject last week, the members of the Senate Banking Committee expressed general support for a reauthorization of the program but acknowledged that there is a need to evaluate and improve the program during an extension. For example, Ranking Member Crapo noted that several changes to the program which have been discussed are modifying the business deductible, changing the aggregate loss threshold, and instituting business co-insurance. Another option considered at the hearing for overhauling TRIA was instituting pre-funding of the government backstop. Lawmakers are also considering whether TRIA’s backstop should be extended to cover chemical, biological, radiological, cyber, and nuclear attacks

Majority of Senators Urge White House to Push for Currency Manipulation Protections in TPP

On September 24th, sixty senators signed onto a letter to the White House requesting the Obama Administration work to negotiate rules against currency manipulation as part of the Trans-Pacific Partnership and other future trade deals. The letter was led by Senators Debbie Stabenow (D-MI) and Lindsey Graham (R-SC) could complicate the Administration’s TPP talks with Japan, Vietnam, Malaysia and other countries. The House, led by Representative Sander Levin (D-MI), sent a similar letter to the White House over the summer. Levin, Ranking Member of the House Ways and Means Committee has said that “there is no point in negotiating a TPP agreement to eliminate import duties if countries are allowed to effectively re-impose those duties by manipulating their currencies.”

Senate Budget Committee Examines the Economic Effects of Political Uncertainty

As Congress continues to debate a final version of the CR to fund the government and with the debt ceiling deadline fast approaching, the Senate Budget Committee met to hear testimony from three economists on the economic effects of political uncertainty. Witnesses included Mark Zandi, chief economist for Moody’s Analytics; Chad Stone, chief economist for the Center of Budget and Policy Priorities; and Allan Meltzer, Professor of Political Economy at Carnegie Mellon University. Witnesses warned that a default would have a large effect on “everyday Americans” as it would become more difficult to get a mortgage, stock prices decline, and unemployment grows.

Senate Banking Subcommittee Explores Economic Conditions in India

On September 25th, the Senate Banking Subcommittee on National Security and International Trade and Finance held a hearing to consider investment and market access in India. Witnesses included Dr. Arvind Subramanian, Senior Fellow with the Peter G. Peterson Institute for International Economics; Mr. Richard Rossow, Director for South Asia with McLarty Associates; and Dr. Reena Aggarwal, Professor of Business Administration and Professor of Finance at Georgetown University. The hearing came ahead of a meeting between Prime Minister Manmohan Singh and President Obama.

House of Representatives

Lawmakers Question Big Banks on Student Debit Cards

On September 26th, Democratic lawmakers on the Education and Workforce Committee, joined by Senators Sherrod Brown (D-OH) and Elizabeth Warren (D-MA), wrote to the CEOs of several large banks requesting they explain their student debit card agreements with colleges.  Copies of the letter were sent to Wells Fargo, US Bancorp, PNC Financial Services Group, SunTrust Banks, Inc., TCF Bank, Citigroup, Huntington Bancshares Incorporated, Commerce Bancshares, Inc., and Higher One Holdings, Inc.

CBO Briefs House Committee on Budget Outlook

On September 26th, the House Budget Committee met to hear testimony from Director of the Congressional Budget Office (CBO) Doug Elmendorf on the nation’s long-term budget outlook. CBO’s most recent report was released on September 17th and notes that although in the short-term the budget will shrink, deficits are expected to begin to grow again after 2018.

Executive Branch

Federal Reserve

Basel Framework to Be Part of Stress Tests

On September 24th, the Federal Reserve announced two interim final rules clarifying how companies should incorporate Basel III regulatory capital requirements into their capital and business projections submitted as part of stress tests.  The first rule clarifies that during the upcoming stress test cycle, large banks with more than $50 billion in assets will be required to incorporate the Basel framework into their projections. The first interim final rule also directs banks to consider capital adequacy assessed against a minimum 5 percent tier 1 common ratio. The second rule provides a one-year transition period for stress test projections for most banking organizations with between $10 billion and $50 billion in total consolidated assets. The interim final rules are effective immediately but the Fed will accept comments through November 25th.

Banking Regulators Release Joint Guidance About Financial Abuse of Older Adults

On September 24th, regulators released joint guidance to clarify privacy provisions under the Graham-Leach-Bliley Act, saying that it is generally permitted for financial institutions to report suspected elder financial abuse to appropriate authorities. Regulators noted that, as older adults can be attractive targets for financial exploitation, employees of financial institutions that are able to spot irregularities or other signs of financial abuse can help protect against elder financial fraud. The guidance was released by the Federal Reserve, Consumer Financial Protection Bureau (CFPB), Federal Deposit Insurance Corporation (FDIC), Federal Trade Commission (FTC), National Credit Union Administration (NCUA), Office of the Comptroller of the Currency (OCC), and the Securities and Exchange Commission (SEC), and Commodity Futures Trading Commission (CFTC).

SEC

White Lays Out Enforcement, Implementation Priorities

On September 26th, speaking at the Council of Institutional Investors fall conference, Chairwoman Mary Jo White laid out the agency’s enforcement plans. White said that the SEC plans to shift its focus, to bring more cases against individuals who are in violation of securities law and to seek more mandatory compliance measures in settlements to prevent future wrongdoings. Earlier in the week, in a speech before the 2013 Bloomberg Markets 50 Summit, White also addressed enforcement, saying she has sought to make improvements to their operations, including by revising the “neither admit nor deny” policies. White also spoke to other items on the SEC’s regulatory agenda, telling summit participants that regulators have made “lots of progress” on finalizing a joint Volcker Rule and noting that the agency’s “highest immediate priority” is finalizing rulemakings under the Dodd-Frank Act and the Jumpstart Our Business Startups (JOBS) Act.

CFTC

CFTC Announces Phase in of Swap Execution Facility (SEF) Rules

On September 27th, the CFTC announced that it would delay enforcement of new rules for Swap Execution Facilities (SEF).  The rules were slated to take effect on October 2nd but the Commission received significant push back from industry stake holders.  For example, on September 23rd the Securities Industry and Financial Markets Association (SIFMA) wrote to the CFTC requesting the agency delay the rules governing swap execution facilities (SEFs).  In addition, it was clear that within the CFTC, there were some who agreed with the industry’s perspective, as on September 26thCommissioner Scott O’Malia said an extension of the SEF effective date would allow market participants time for a smooth transition and then Commissioner Chilton echoed these comments on September 27th, saying that the Commission should extend the compliance date by two months as soon as possible.   Later that day, the CFTC announced that the delay would extend to October 30th for foreign exchange (fx) swaps, and until December 2nd for commodity and equity swaps.

Agriculture Committee Leadership Ask CFTC to Use Caution Crafting Customer Protections

On September 25th, the leadership of the Senate and House Agriculture Committees wrote to the CFTC urging the agency to use caution when drafting futures consumer protection rules which could have a large impact on the agriculture sector. The CFTC proposed rules in October 2012 following the collapse of ML Global and Peregrine Financial that the agriculture sector has warned could prove costly to customers. Chairman Debbie Stabenow (D-MI), Chairman Frank Lucas (R-OK), Ranking Member Thad Cochran (R-MS), and Ranking Member Collin Peterson (D-MN) advised the CFTC that it should “weigh the benefits of these regulations against both the costs to America’s farmers and ranchers and the potential impact on consolidation in the industry.”

CFPB

Bureau and Jackson, Mississippi Begin 311 Line for Financial Issues

On September 20th, the CFPB and the City of Jackson, Mississippi announced a partnership to connect consumers with the CFPB to answer questions and submit complaints about financial products and services using their local 311 service.  Residents who dial 311 with a financial problem or complaint will be transferred directly to the Bureau where the CFPB will work with consumers on financial problems and handle consumer complaints on credit cards, mortgages, bank accounts or services, private student loans, consumer loans, credit reporting, money transfers, and debt collection.

CFPB Denies Petition to Dismiss Investigation of Tribal Lenders

On September 26th the CFPB denied a petition from three tribal payday lenders requesting that the CFPB end their investigation into whether the companies violated consumer laws. The lenders argued that the Bureau lacked the authority to make civil investigative demands to the companies due to sovereignty of the lenders via their affiliation with Native American tribes. In announcing the Bureau’s decision to proceed with the investigation, Director Cordray said that courts have agreed that “Indian tribes, like individual states, do not enjoy immunity from suits by the federal government.”

FHA

FHA to Draw on Treasury Funds to Cover Shortfall

On September 27th, the Federal Housing Administration (FHA) announced that it will need to draw on $1.7 billion from the Treasury in order to cover shortfalls in the mortgage insurance fund. The shortfall, though expected, was larger than the anticipated $942 million estimate that was included in the President’s FY2014 budget proposal. In a letter to Congress on the announcement, FHA Commissioner Carol Galante said that the “required mandatory appropriation is an accounting transfer and does not reflect an up-to-date view” of the long-term fiscal health of the insurance fund.

NCUA

NCUA Sues Firms Over MBS Credit Union Failures

On September 23rd, the National Credit Union Administration (NCUA) filed lawsuits against JPMorgan, Morgan Stanley, Goldman Sachs, Barclays, Credit Suisse, Royal Bank of Scotland, UBS, Ally and Wachovia alleging the firms sold $2.4 billion in faulty mortgage-backed securities to two failed credit unions. Speaking on the suits, NCUA Chairman Debbie Matz said that credit unions the agency supervises are sharing the costs of the losses and “the people who are responsible should be required to shoulder that burden, as well.”

Miscellaneous

CRFP Examines Tax Exempt Status of IRAs

On September 27th, the Committee for a Responsible Federal Budget (CRFB) released an analysis of the preferential tax treatment of the Individual Retirement Account (IRA). The report notes that IRAs hold less than 25 percent of all the nation’s retirement assets and are used by only 5 percent of workers. The analysis notes numbers from the Joint Committee on Taxation which estimates that the subsidy will cost $15 billion in lost income tax revenue in 2013, or more than $250 billion over 10 years.

Upcoming Hearings

**(Schedule subject to change contingent on status of Federal Government)**

On Monday September 30th, in H-313 of The Capitol, the House Rules Committee will meet to consider a rule for H.R. 992, the Swaps Regulatory Improvement Act, and H.R. 2374, the Retail Investor Protection Act.

On Tuesday October 1st at 10am, in 2128 Rayburn, the Financial Institutions and Consumer Credit Subcommittee of House Financial Services Committee will hold a hearing on legislative proposals intended to create more accountability and transparency to the Consumer Financial Protection Bureau.

On Tuesday, October 1st at 10am, in 538 Dirksen, the Senate Banking, Housing, and Urban Affairs Committee will hold a hearing titled “Housing Finance Reform: Fundamentals of a Functioning Private Label Mortgage Backed Securities Market.”

On Wednesday, October 2nd at 10am, in 106 Dirksen, the Joint Economic Committee will hold a hearing on the economic outlook.

On Wednesday, October 2nd at 10am, in 2128 Rayburn, the Housing and Insurance Subcommittee of House Financial Services Committee will hold a hearing on the status of the National Flood Insurance Program (NFIP).

On Wednesday, October 2nd at 2:30pm, in 538 Dirksen, the Economic Policy Subcommittee of Senate Banking, Housing, and Urban Affairs Committee will hold a hearing on rebuilding American manufacturing.

On Wednesday, October 9th at 2pm, in 2128 Rayburn, the Capital Markets and Government Sponsored Enterprises Subcommittee of House Financial Services Committee will hold a hearing on legislation that would attempt to reduce impediments to capital formation.

On Thursday, October 10th at 10am, in 2128 Rayburn, the Monetary Policy and Trade Subcommittee of House Financial Services Committee will hold a hearing to examine international central banking models.

On Thursday, October 10th at 2pm, in 2128 Rayburn, the Financial Institutions and Consumer Credit Subcommittee of House Financial Services Committee will hold a hearing on un-banked and under-banked areas in the United States.

Article By:

 of

Consumer Financial Services Basics 2013 – September 30 – October 01, 2013

The National Law Review is pleased to bring you information about the upcoming  Consumer Financial Services Basics 2013.

CFSB Sept 30 2013

When

September 30 – October 01, 2013

Where

  • University of Maryland
  • Francis King Carey School of Law
  • 500 W Baltimore St
  • Baltimore, MD 21201-1701
  • United States of America

Facing the most comprehensive revision of federal consumer financial services (CFS) law in 75 years, even experienced consumer finance lawyers might feel it is time to get back in the classroom. This live meeting is designed to expose practitioners to key areas of consumer financial services law, whether you need a primer or a refresher.

It is time to take a step back and think through some of these complex issues with a faculty that combines decades of practical experience with law school analysis. The classroom approach is used to review the background, assess the current policy factors, step into the shoes of regulators, and develop an approach that can be used to interpret and evaluate the scores of laws and regulations that affect your clients.

Photocopiers – A Recurring Data Security Risk

DrinkerBiddle

In a case that illustrates the data privacy risks associated with modern copiers, the United States Department of Health and Human Resources (HHS) has announced a $1,215,780 settlement with Affinity Health Plan, Inc. (Affinity), arising from an investigation of potential violations of the HIPAA Privacy and Security Rules.

This matter started when Affinity was advised by CBS Evening News that CBS had purchased a photocopier previously leased by Affinity.  CBS explained that the copier’s hard drive contained confidential medical information relating to Affinity patients.  As a result, on August 15, 2010, Affinity self-reported a breach with the HHS’ Office for Civil Rights (OCR).  Affinity estimated that the medical records of approximately 344,000 persons may have been affected by this breach.  Moreover, Affinity apparently had returned multiple photocopiers to office equipment vendors in the past without erasing the data contained upon the internal hard drives of those returned copiers.

After investigating this matter, OCR determined that Affinity had failed to incorporate photocopier hard drives into its definition of electronic protected health information (ePHI) in its risk assessments as required by the Security Rule.  Affinity also failed to implement appropriate policies and procedures to scrub internal hard drives when returning photocopiers to its office equipment vendors.  As a result, OCR determined that Affinity also violated the Privacy Rule.

In discussing this issue, Leon Rodriguez, Director of OCR, stated that, “This settlement illustrates an important reminder about equipment designed to retain electronic information: Make sure that all personal information is wiped from hardware before it is recycled, thrown away or sent back to a leasing agent…HIPAA covered entities are required to undertake a careful risk analysis to understand the threats and vulnerabilities to individuals’ data, and have appropriate safeguards in place to protect this information.”

In addition to the agreed upon settlement payment of $1,215,780, the settlement also requires the implementation of a Corrective Action Plan (CAP).  The CAP requires Affinity to use its best efforts to retrieve all hard drives that were contained on photocopiers previously leased by the plan that remain in the possession of the leasing agent, and take protective measures to safeguard all ePHI going forward.

Points to Consider

Affinity’s case demonstrates the risks presented by the modern copier – they are specialized computers that will store data and retain itindefinitely.  Thus, they pose a security risk for any company that processes and/or possesses personally identifiable information or proprietary information, such as trade secrets, research and development records, marketing plans and financial information.  Clearly, this risk applies to businesses regardless of specific business sector.

Therefore, when acquiring a copier, consider all options available to protect the data processed on that machine, typically through encryption or overwriting.  Encryption will scramble the data that remains stored on the copier’s hard drive.  Overwriting (or wiping) will make reconstructing the data initially on the drive very difficult.

Finally, anticipate the copier’s return to the vendor or other disposition.  Make sure that arrangements are made prior to the copier’s departure to effect the hard drive’s removal and secure disposition so as to make any data on it unusable to third parties.  Often vendors will provide such a service as will IT consultants.

Note that protecting sensitive information is a company’s ongoing responsibility.  Make sure that copiers are considered as part of any comprehensive data security or privacy policy (as are PCs, laptops, smart phones, flash drives and other electronic devices) to avoid an avoidable, but costly and embarrassing, data breach.

For additional information from the FTC on safeguarding sensitive data stored on the hard drives of digital copiers, click here.

Article By:

 of

Consumer Financial Services Basics 2013 – September 30 – October 01, 2013

The National Law Review is pleased to bring you information about the upcoming  Consumer Financial Services Basics 2013.

CFSB Sept 30 2013

When

September 30 – October 01, 2013

Where

  • University of Maryland
  • Francis King Carey School of Law
  • 500 W Baltimore St
  • Baltimore, MD 21201-1701
  • United States of America

Facing the most comprehensive revision of federal consumer financial services (CFS) law in 75 years, even experienced consumer finance lawyers might feel it is time to get back in the classroom. This live meeting is designed to expose practitioners to key areas of consumer financial services law, whether you need a primer or a refresher.

It is time to take a step back and think through some of these complex issues with a faculty that combines decades of practical experience with law school analysis. The classroom approach is used to review the background, assess the current policy factors, step into the shoes of regulators, and develop an approach that can be used to interpret and evaluate the scores of laws and regulations that affect your clients.

Working with 3rd Party Providers to Make Dodd Frank Conflict Mineral Compliance Easy

Assent Logo

At your firm or within your company dealing with conflict minerals, you might have recently heard the buzz about the latest Dodd Frank Conflict Mineral Compliance requirements. If these requirements affect the way law firms or companies do business, then working towards compliance initiatives remains a priority.

Regulatory Assessment and Scope Analysis

This involves examining the law firm’s client or company seeking compliance product portfolio and doing an analysis of whether the product are affected by the law and therefore must be in compliance, or “in scope” Vs “out of scope.” It can also include:

  • Examining corporate obligations
  • Determination of key regulatory compliance decision points
  • Creation of a conflict minerals technical document

Creation of a Compliance Plan

This involves creating an end to end compliance plan and associated processes

  • All activities detailed in chronological order
  • Creation of application of due diligence standards
  • Responsibilities assigned to personnel
  • Determination of compliance communication pathways

Software Set Up

Industry standard to date for the majority of companies in scope of this regulation involve using a software platform to manage the large amount of data and suppliers that will be surveyed.Vendor Selection

  • Vendor Selection
  • Decisions to integrate with Enterprise Resource Planning system  (ERP), which is used to design and manage resources within a company, as well as Product Lifecyle Management (PLM), used to design, manufacture and plan the development of products
  • Methodology of supplier communication

Supplier Engagement

This portion of the process involves communication and data collection from the supply chain. Includes:

  • Data collection methodology
  • Reporting and analytics of the data collected
  • Corrective action and addressing problem suppliers

Reporting

Once data has been collected firms enter the reporting phase to complete the process for the first year. This process is then replicated year over year. With the infrastructure in place firms enter the “maintenance” phase of compliance.

Standard practise in the compliance industry has also seen that Law firms or the company seeking Dodd Frank compliance are engaging 3-4 outside service providers.

They are usually:

1.       Law firms: To determine exact requirements and legal requirements.

2.       Software: To provide the platform for data collection, management and analytics.

3.    Accounting: To audit the data collected and ensure strong data backing the program.

4.    Consulting: To develop the processes, work with /train suppliers and help with data collection.

Assisting your clients with Dodd Frank Conflict Mineral Compliance does not have to be complicated. Working through the 5 step process above and working with other 3rd party providers makes compliance at any level easy.

Article By:

 of