Category: EU

Comparing and Contrasting the State Laws: Does Pseudonymized Data Exempt Organizations from Complying with Privacy Rights?

Some organizations are confused as to the impact that pseudonymization has (or does not have) on a privacy compliance program. That confusion largely stems from ambiguity concerning how the term fits into the larger scheme of modern data privacy statutes. For example, aside from the definition, the CCPA only refers to “pseudonymized” on one occasion – within the definition of “research” the CCPA implies that personal information collected by a business should be “pseudonymized and deidentified” or “deidentified and in the aggregate.”[1] The conjunctive reference to research being both pseudonymized “and” deidentified raises the question whether the CCPA lends any independent meaning to the term “pseudonymized.” Specifically, the CCPA assigns a higher threshold of anonymization to the term “deidentified.” As a result, if data is already deidentified it is not clear what additional processing or set of operations is expected to pseudonymize the data. The net result is that while the CCPA introduced the term “pseudonymization” into the American legal lexicon, it did not give it any significant legal effect or status.

Unlike the CCPA, the pseudonymization of data does impact compliance obligations under the data privacy statutes of Virginia, Colorado, and Utah. As the chart below indicates, those statutes do not require that organizations apply access or deletion rights to pseudonymized data, but do imply that other rights (e.g., opt out of sale) do apply to such data. Ambiguity remains as to what impact pseudonymized data has on rights that are not exempted, such as the right to opt out of the sale of personal information. For example, while Virginia does not require an organization to re-identify pseudonymized data, it is unclear how an organization could opt a consumer out of having their pseudonymized data sold without reidentification.

ENDNOTES

[1] Cal. Civ. Code § 1798.140(ab)(2) (West 2021). It should be noted that the reference to pseudonymizing and deidentifying personal information is found within the definition of the word “Research,” as such it is unclear whether the CCPA was attempting to indicate that personal information will not be considered research unless it has been pseudonymized and deidentified, or whether the CCPA is mandating that companies that conduct research must pseudonymize and deidentify. Given that the reference is found within the definition section of the CCPA, the former interpretation seems the most likely intent of the legislature.

[2] The GDPR does not expressly define the term “sale,” nor does it ascribe particular obligations to companies that sell personal information. Selling, however, is implicitly governed by the GDPR as any transfer of personal information from one controller to a second controller would be considered a processing activity for which a lawful purpose would be required pursuant to GDPR Article 6.

[3] Va. Code 59.1-577(B) (2022).

[4] Utah Code Ann. 13-61-303(1)(a) (2022).

[5] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-573(A)(1) through (4)

[6] C.R.S. 6-1-1307(3) (2022) (exempting compliance with C.R.S. Section 6-1-1306(1)(b) to (1)(e)).

[7] Utah Code Ann. 13-61-303(1)(c) (exempting compliance with Utah Code Ann. 13-61-202(1) through (3)).

[8] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-573(A)(1) through (4)

[9] C.R.S. 6-1-1307(3) (2022) (exempting compliance with C.R.S. Section 6-1-1306(1)(b) to (1)(e)).

[10] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-573(A)(1) through (4)

[11] C.R.S. 6-1-1307(3) (2022) (exempting compliance with C.R.S. Section 6-1-1306(1)(b) to (1)(e)).

[12] Utah Code Ann. 13-61-303(1)(c) (exempting compliance with Utah Code Ann. 13-61-202(1) through (3)).

[13] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-574).

[14] Va. Code 59.1-577(D) (2022) (exempting compliance with Va. Code 59.1-574).

Article By David A. Zetoony of Greenberg Traurig, LLP

For more data privacy and cybersecurity legal news, click here to visit the National Law Review.

©2022 Greenberg Traurig, LLP. All rights reserved.

Legal News Reach – Season 2, Episode 1: Immigration & Its Impacts on the U.S. Labor Market with Raymond Lahoud [PODCAST]

Welcome to our first episode of Season 2! Rachel and Jessica speak with Raymond Lahoud, a Member of Norris McLaughlin, P.A., focusing on immigration law. Immigration issues are complicated enough, but how does that factor into boosting the U.S. economy?  Listen to our last episode to find out more.

Be sure to also check out the latest episode of Mr. Lahoud’s podcast, “Immigration Matters.”

We’ve included a transcript of our conversation below, transcribed by artificial intelligence. The transcript has been lightly edited for style, clarity, and readability.

Full Transcript

INTRO  00:02

Hello and welcome to Legal News Reach, the official podcast for The National Law Review. Stay tuned for our discussion on the latest trends, legal marketing, SEO, law firm best practices, and more.

Rachel  00:15

Today’s episode is the first of the second season, where we’re broadening our focus to trending topics in the legal industry. Today we’re speaking with Ray Lahoud, Member of North McLaughlin about the impact of COVID-19 on immigration and labor shortages. Ray, would you like to tell our listeners a little bit about yourself?

Raymond Lahoud  00:30

Well, thanks for having me, Rachel. It’s really awesome to be here on this podcast and to talk about such an interesting area of law right now, in the world, particularly immigration law. I’m a partner at Norris McLaughlin, where I serve as the Chair of the Immigration Law Group here. I handle employment-based immigration matters, removal defense, employment, verification, I noncompliance all types of immigration matters, a broad spectrum with my great team of attorneys, paralegals, and assistants here at North McLaughlin. So thank you again for having me. It’s great to be here.

Rachel  01:05

One of the first topics we wanted to focus on here is immigration’s impact on labor shortages. You’ve written a lot about the impacts on the U.S. economy due to labor shortages. Can you explain how immigration can help remedy the situation?

Raymond Lahoud 01:18

I think we can all agree that without labor without employees, without people to go and work in whatever company, whatever organization, whatever place that exists out there that that needs to provide services or goods to the American public needs, needs employees. Without labor, there’s no economy, immigration right now is really a huge part of the employment demand, or the employment shortage share. There’s a lot of Americans who are able to legally work who just don’t want to work or have you know, taken different decisions or different approaches on life or what they want to do with their life. But we still need people to perform some of these essential functions from farming, to nursing care to handling, you know, mushroom picking to manufacturing, immigration is the way that has long proven to be a way to solve that through temporary visa programs through you know, green card programs that existed out there. And under the Trump administration. And when COVID hit, things really got hit pretty hard and really slowed down the ability for people to bring in international employees to the United States that fill that gap.

Rachel  02:29

This has been an ongoing issue. So are there any policy changes on your radar that will help solve this issue, either through immigration or otherwise?

Raymond Lahoud 02:38

The only way to solve this issue is through comprehensive immigration reform. For over a decade now, we’ve been using the number of 11 million people that are in the country without documentation, I think we can all agree that that number is significantly higher, probably 20, or 30 million people, step one is going to be trying to figure out how we handle those 20 to 30 million people or even Federalists 11 million people that 11 to 20 million people that we have the United States without documentation. And that means that some people are going to have to be deported, who you know, may have certain crimes may have certain issues in terms of their background, but a significant number of these individuals have been in the country for a long time, working without authorization, pleading taxes. So there has to be a process of legalization for those individuals, which is the big issue. We don’t what is legalization for them. And then there also has to be a secure border where people can’t just cross the border without any documentation. I mean, every country has borders, borders are important. We can all see how important borders are right now with what’s happening in Ukraine. You know, comprehensive immigration reform includes having an ability for individuals to come into the United States to work to claim asylum if they have to, to help our employers here in the United States who need employees because people are just not taking part or not applying to Americans are just not applying to take on these jobs. The great resignation has, for some reason taken over the United States and it continues. So what do we need? We need comprehensive immigration reform? How do we get there? It’s getting members of Congress to agree daily, I’m talking to clients who will arrive in Pennsylvania and they’ll say how do I start working here I just crossed the border assuming that because they heard on Facebook before they came up here are on TikTok are though like that it would be very easy for them to claim asylum. So I’m dealing with a lot of clients and potentials and individuals who have just recently crossed the border now feel that they’re stuck in the United States because they can’t leave because they have to go through proceedings and they can’t work. I mean, there’s also in this representation, let’s say that we keep hearing the numbers, millions are coming to the United States. There are millions of encounters. So you may have one person try to come to the United States four or five times and each one is considered an encounter. And this is a problem that we see from President to President, by the way, and this is why I say we need comprehensive immigration reform. Because let’s go back to 1986. Ronald Reagan was going to deal with the immigration problem we had, you know, millions of people here in the United States back then. And he did put three amnesty 1213 14 million people were granted permanent resident status, they say that cost the turn of California to a blue state once they became citizens top political. In the end, they’re like going back to that every President has made immigration, much tougher, actually very tough. Actually, it was the administration that puts some of the toughest policies when it comes to what’s called the public charge rule. The way our system is written right now is that the executive branch just has so much ability and authority discretionary ability and authority over what to do or what not to do, what they can do what they can’t do in terms of immigration. And then every time a new president comes in, something changes drastically. So you had Obama come in, then he puts in place DACA, you know, gives eight 900,000 people, you know, a temporary quote-unquote, status, and you have President Trump come in, and he takes it away. And then you have President Biden come in. Again, it goes back to comprehensive immigration reform. It’s all just been patchwork since after ’86. Now we have 11, 12, 13, 14, 20 million people here. So it’s-I think the distaste is, is that we’re going to grant people status, and it’s just going to happen, again, has to be a two-fold fix as to be true, comprehensive immigration reform where we’re not, you know, 10 years down the road, we don’t have another 15 million people that don’t have documentation here.

Rachel  06:34

What can companies do to help deal with this shortage of immigrant labor or just labor in general?

Raymond Lahoud 06:39

Every day, I probably field 20 to 30 calls from employers who cannot find employees. It’s the biggest problem. I think that’s facing our country right now. And I’m not sure where it comes from, I really don’t understand what this great resignation is, I don’t know how people can live. Right now, there are several legal immigration processes that are available. One is the H Tubi. system, which is a great way of bringing in seasonal employees for farms for landscaping, contractors, painters, manufacturing work, which we bring workers over here year after year. The H1-B lottery is another visa process. So there’s visa processes that are out there, it’s good to avail as an employer to not be afraid of these processes to you know, when you’re recruiting globally recruit, and when you find a candidate, seek out an immigration attorney and say, Hey, is there a way that I can bring this person over legally sponsor them? Is there a pathway and there are. You have companies like the bigger tech companies that are getting all the big H1-B visas, you have the bigger farming companies that are getting all the H2-B visas, because the smaller ones are not really availing themselves, the legalized programs that exist there, we have a lot of people who are coming into the country across the border, these individuals, they’re turning themselves into the Customs and Border Protection. So there’s an expectation at some time that, you know, some of them have fears of returning, I mean, that they’re going to start going through processes. These are individuals that will likely have employment authorization documents, within a year or so don’t forget about the American worker offer good wages, offer good benefits offer time off the world’s change right now in terms of how things work. So if there’s, you know, remote operations that you can offer, do that offer child care services, if you could, but you have to be creative.

Jessica  08:25

So I would love to get your perspective since you’ve been involved in immigration law for so long, and you definitely have a great grasp on the history of a lot of immigration policy changes. I know with COVID, you know, the legal industry got backed up in general; just court cases being rescheduled, I would really like to know what the last two years for immigration law has looked for you how has it changed because of the pandemic updates on border restrictions? I’d love to get your take on that.

Raymond Lahoud 08:52

When the pandemic hit immigration really became incredibly, incredibly busy from the travel restrictions to a title 42 at the border expulsions to people that were detained in immigration custody that were getting COVID It was a disaster for a long time for a lot of people. A lot of people out there who are stuck in other countries, you know, travel bans were coming up and moving and changing by the minute. And companies. You know, the companies that we represent, the employers that we represent that keep operating there were essential. They were central companies and they were healthcare companies. They were companies that do industrial manufacturing or handle electricity and the like, so they needed their employees here. So during COVID, we spent a lot of time trying to figure out the ways to bring a lot of these employees into the United States through the waivers that existed. They’re reaching out to the State Department to seek special exemptions. And then at the same time, you know, the immigration to the deportation defense part of it really came to a halt. court hearings were halted for all like non detained cases, which took an already incredibly backlogged immigration court system and took it about I have four more years behind now. So you’re probably looking at a good 10 years before an immigration judge for a trial. And after continuances and the, like 10 cases COVID really spread pretty heavily, we have to file lots of petitions and requests to try to get clients that were detained by immigration out of custody within the United States. So a lot happened during COVID. And when it came to immigration, in those days, there were nights where I was awake at, you know, two, three in the morning, making sure a client was able to get back in.

Jessica  10:34

We’re in such an interesting environment at this point, especially more recently with the Ukraine crisis, but we also had a changing of the hands in the White House, all the different elections. So there’s been a lot of transition period. And you know, we touched on it a little bit already. But the changes moving forward, I mean, now that the pandemic is having some type of release, besides needing that comprehensive immigration law changes, do you see any other changes now that we’re getting out of the pandemic, whether that’s Ukraine specifically, or just in general? What do you think is gonna happen here?

Raymond Lahoud 11:07

I think that we’ve, we’ve moved on to our next disaster with our next emergency, we’ll say, which is Ukraine right now. This is all that we hear about on the news, there aren’t COVID numbers at, you know, at the bottom, how do people are dying, how many people died and the like, I just feel that, you know, Ukraine has as taken over COVID. Now COVID brought on a time of remote hearings, which are still continuing now. The immigration courts, making fun of them with, you know, video, WebEx hearings in Zoom hearings, are able to move them quicker through the system and the like, and I have some serious issues. When it comes to remote hearings. You know, there’s huge due process concerns and having my client be able to testify in person where the judge can see his or her face. You know, there’s some very serious concerns in that. So they’re changes that, you know, came about from COVID, in terms of remote operations and the like, but I don’t know if they’re necessary to our benefit, even for, you know, immigrants work were coming in. And also, you would think that we really learned how to process things a lot faster. You know, what, we’re kind of hit with the crisis, and we just aren’t, you know, our embassies are still in a huge backlog when it comes to processing visas and, you know, fiance petitions and merit-based petitions and the like, but we are seeing movement here stateside within that, honestly, in terms of change. I mean, you just, it’s all patchwork.

Jessica  12:27

If memory serves me correctly, I know the Biden administration has put more emphasis on visas for STEM. I think people coming either for schooling or for employment, if I’m remembering correctly, do you think that’s a step in the right direction, I know it’s another “patch,” but…

Raymond Lahoud 12:43

 The United States has a huge number of international students in the United States, even locally here in what’s called the Lehigh Valley, Pennsylvania, Lehigh, Lafayette, Cedar Crest Moravian, their F huge international student populations and international student populations are critical to cultural diversity to you know, just to the growth of the school and it’s bringing the world together. So as part of it, so students will come here from abroad, Saudi Arabia, countries, China, Japan, Australia, they’ll come to the F1 visa complete their courses here to get a bachelor’s degree. And if they typically, if you come in under the f1 visa, regardless of your degree, you’ll get 12 months of what’s called occupational practical training. And that’s because you 12 months of just training in your, your area of of studies, when you were in school, if you earned a STEM degree science, tech, engineering or math degree, you can get an additional 24 months of occupational practical training. To me, that’s great to me for bringing people here, and we’re educating them, we should keep them here and you know, give them jobs here. I mean, we there’s no reason that you know, we should be training talent and, you know, bringing in talent from across the world, and then just sending them, you know, back to, you know, their home country, particularly if they’re willing to stay and work here and become members of society in good standing that contribute pay taxes. Why not? Even if you were you came in, you knew you were coming in across the border, see, you’re still a kid, and then you turn over all of your information to the government when you’re 17 or 18 years old. And then, you know, four, eight years later, the Trump ministration says that they are going to get rid of it and it goes through courts who put it back in and take it out and put it back in and then there’s an injunction lifted, and these are hundreds of thousands of lives in people’s hands. People really have to recognize that there are faces to these individuals that have deferred action that have temporary protected status that there are faces to them. And it’s more than just politics. But could you imagine if you were in that position with deferred action, not knowing should I finish going to college should I spend the money should I take a job, what do I do next?

Jessica  15:01

COVID already caused a very large limbo feeling if you’re coming from another country, or you’ve been here, and then you might be told, “oh, you gotta go back to where you came from.” And I can’t imagine being young when you come here and then going back to a country you don’t even really know.

Rachel  15:17

So we wanted to get your viewpoints on Ukrainian refugees and immigration, how does this compare to other refugee crises that we’ve had in the past

Raymond Lahoud 15:27

Ukraine refugee crisis has brought the US government to its peak when it comes to refugees, and the like, they’ve acted very quickly, to bring in them what’s called Temporary Protected Status. You compare it to you know, what happened in Afghanistan and the lake, there are a lot of differences, I would say just that how quickly they are granted temporary protected status. You know, if you’re from Ukraine, there’s countries that are setting up policies like Canada to try to bring in people from Ukrainian. And I hope that these policies that these countries are putting together to help refugees in times of crisis will stay for other countries to beyond Ukraine’s. Hopefully this won’t be the last time that you’ll see other countries open their doors to help people. My mom and dad are both born in Lebanon and immigrated here during the civil war in the late 70s. And it was devastating. And the US opened its doors to the Christians from the north, they came in and became an integral part of the society life here in Pennsylvania, it’s good to see that in Ukraine, but we’re going to have other countries that are going to have similar issues. And who knows where, you know, President Putin may stop, we just really have to think long term about it. Because we also have to be realistic. And we can only handle so many people in our country. I hate to say that.

Rachel  16:49

How does that factor into maybe some of the more, like, long-term policy changes that the country could implement? Is there a need to sort of rethink how we bring in refugees, and how many people we can take and how that process really goes?

Raymond Lahoud 17:02

There is, there is, but how do you rethink that? You know, how do you it’s even just saying, you know, how many people can we take in I know you just feel I feel internally bad because you don’t want to turn anybody away, that’s really hurting, you know, and but we have to, thankfully, I’m not in Congress to make up those decisions. But I think there has to be, you know, some sense of reason, and balance. And I’m not really sure what that is.

Rachel  17:29

Like the US has to work together with other countries to make sure that we help them out of people that need to be helped. I don’t think it’s realistic for one country to sort of shoulder most of the burden.

Raymond Lahoud 17:38

It’s very hard to get refugee status. I mean, you don’t just kind of come into the United States and walk-in and may take years to go through I mean, if you’re going to the Iraqi refugee have to go in through the United Nations refugee program, there’s a huge process you have to go through, it’s not easy. The things that happened in Afghanistan kind of made known the issues with our you know, the refugee program and the lake. But it’s not, it’s not an easy process to go through. You can’t just walk into an embassy, US Embassy and say, Hey, I’m I’m afraid of where I’m living, I want to go to United States,

Rachel  18:09

Right, yeah. And I imagine on top of even having to be in a situation where you have to flee your home.

Raymond Lahoud 18:15

Anybody that goes through pain, like a harm or fear, you know, I mean, whether it’s domestic violence, and those are the worst of cases where I have clients who are coming in suffered extreme domestic violence, like at the hands of their spouses and the like, and, and with those, you know, you know, what you do, you can send them back, you know, when that when the spouse is going to kill them on, you know, they’re dead on arrival. And so those are cases that we’re dealing with inside the United States right now. It’s like we have refugees coming in. But we also have asylees, here in the United States that were people who are in here applying affirmatively for asylum, we have a lot of people in the United States that are here on like a protective status we do. We do so much. And other countries are recognizing that if you take a look at Australia, so people are coming into the to Australia, they don’t go into the country, they sit off-island for a long period of time for they claim asylum or anything like that. The other countries that are out there, I think that they all have some pretty unique set of circumstances that are there, and in ours has a lot of issues that we have to really work through.

Rachel  19:16

So you’ve written about policy changes in Pennsylvania aimed at helping undocumented immigrants, you know, entrepreneurs, people who are getting driver’s licenses, things like that. I was curious to get your insight on how you see these changes impacting both immigrants in the state as a whole, like what sort of have been the changes there?

Raymond Lahoud 19:33

Driver’s licenses in Pennsylvania, we’re seeing a movement. New Jersey, just fair aware, they pass legislation in the implement to the driver’s licenses, people who may not have a social security number or the like, right now in Pennsylvania. I believe it’s in the House Committee. It’s being discussed. I don’t see it moving out of there given the current makeup of the legislature. I don’t foresee it happening in Pennsylvania anytime soon. It does keep coming up a lot by members of the State House, I think it’s a good idea because people are driving. Let’s get real. There are people without papers in the United States. I mean, if we don’t realize that, I think that we’re just fooling ourselves. So, you know, it’s if it’s a way for them, they’re voluntarily providing their information, you know, why not register it, they can get their insurance. It’s not a federal issue. It’s a state issue as the as right to get driver’s licenses, it’s state-by-state. Pennsylvania considers that they look at it, they bring it up, but it always fills in committee doesn’t go anywhere. Pennsylvania, has the political planet as a swing state, as we all know, and immigration is a hot topic issue here.

Rachel  20:37

I’m glad to hear that at least it’s even if it’s not, you know, moving forward, I think it being on people’s minds is a good thing. So in terms of changes like that, and maybe large scale changes, like we spoken about how we just need really large scale immigration reform, I was wondering, we could talk about the changes that you think need be made to both attract and retain immigrants in the United States, I think there’s a lot of talk about specifically, after the Trump administration, a lot of international students to stop coming here, you know, the United States is losing talent to countries like Canada and other places like that. So I was curious to get your thoughts on that.

Raymond Lahoud 21:14

COVID-19 opened up a different way of kind of operating, we had spoken earlier, where, you know, these companies are now recognizing that they could get that global talent opened up a facility in India or, you know, have somebody remote in from Canada, or actually just physically move their locations to Canada, or their offices or their manufacturing sites to another country, because it’s easier to bring labor in. I think that other countries are starting to embrace certain kinds of immigration, like I know that Canada is, you know, they’ve implemented that another investment-based immigration system, they’ve made it easier for Indian workers a certain kind of ticket during COVID in the light. So there are countries that are taking no more proactive approach to bringing in people but during the Trump administration, people from abroad really felt they weren’t welcomed in the United States. And I saw that a lot with students, and there was a significant number. It’s coming back, and I’m seeing the numbers come back, and just from the schools locally, that that we’re working with. So in terms of the International Student Program, you know, I do feel that it’s picking back up after COVID. And after the Trump administration, I just think we have to kind of keep going with it to make sure that, you know, we know that the people that we’re inviting into our country, we know that we have to welcome them here and treat them kindly, and work with them. Because we’re just we are one world one people. I’m really just, I think it’s a realist here, and that, you know, you have immigration lawyers who, you know, will just, you know, push things to like an end and say, No, open borders, and you have no people on another end that would say, you know, close everything to anybody. And but I think we have to have recent ability. I mean, you just can’t close the United States to everything. I mean, you can’t close the United States to the globe’s cultures, we just have to find a middle ground. And I hope that, you know, I was able to kind of present some of that reason that no middle ground, that’s there being immigration where it’s hard to take, you know, some things that Trump did weren’t necessarily I’m going to do but if somebody heard me say that, and I will now, you know, they would be shocked at it. But I think that’s what the issue is, is that there’s no meeting of minds. People just become enemies, because somebody has a different political opinion. You know, I think there really has to come a realization that we just can’t shut the borders down completely. And you can’t open the borders up completely. There just has to be a middle ground that we all have to reach in. Our members of Congress really have to grow up and hopefully, they will. And hopefully, they’ll work with the Biden ministration. We’ll get somewhere.

Jessica  23:52

I actually have an interesting question. Since you’re located in Pennsylvania; Lancaster’s, a certified welcoming status for refugees. Do you think that’s helpful in situations like Ukraine? And like if more cities did that, do you see that as a positive direction?

Raymond Lahoud 24:06

I do, I do. I mean, like…Philadelphia has, like a welcome center for Lancaster was one of the counties like that. It’s really what they do with it is, yeah, it certainly hops. The more the better. Governor Wolf has actually taken very proactive actions towards the Ukrainian community here, even locally. But again, there’s more than just the Ukrainian community that are suffering from prosecution. So hopefully, it’ll open our minds to how we deal with other areas and in the future when this happens and how other countries can work together with it. But yeah, it does. It does help because it shows that we care you know, things like that only they can start shows that we care. You know, even if you know, New Jersey, they couldn’t give them give people a real ID driver’s license, but they gave them a license to drive and pencil and they can leave the state drive and add to it, it’s still a driver’s license so they can give What they want to know as much as they can give them and if that’s what Lancaster was able to give them, that’s what it was. They can’t give driver’s licenses but um, you know, that opens up a door for immigrants and to have stuff like that it’s good for them to have programs like that is good.

Rachel  25:14

Well, excellent. Thanks again, Ray for joining us today. We had a great conversation.

Raymond Lahoud 25:20

 It’s really been good being here talking about immigration. It’s an interesting topic. And hopefully, we’ll see things changing in the years to come and I’m here to talk to you whenever. Yeah, thank you for having me.

OUTRO  25:40

Thank you for listening to The National Law Review’s Legal News Reach podcast. Be sure to follow us on Apple Podcasts, Spotify, or wherever you get your podcasts for more episodes for the latest legal news. Interested in publishing and advertising with us? Visit www.natlawreview.com. We’ll be back soon with our next episode.

Article By Rachel Popa and Jessica Scheck of The National Law Review / The National Law Forum LLC

For more Legal News Reach podcasts, click here to visit the National Law Review.

Copyright ©2022 National Law Forum, LLC

New UK IDTA and Addendum Come Into Force

The new UK International Data Transfer Agreement (“IDTA”) and Addendum to the new 2021 EU Standard Contract Clauses (“New EU SCCs”) are now in force (as of the 21 March 2022), providing much needed certainty for UK organisations transferring personal data to service providers and group companies based outside of the UK/EEA.

The IDTA and Addendum replace the old EU Standard Contractual Clauses  (“Old EU SCCs”) for use as a UK GDPR-compliant transfer tool for restricted transfers from the UK, which also enables UK data exporters to comply with the European Court of Justice’s ‘Schrems II’ judgement.

For new UK data transfer arrangements or where UK organisations are in the process of reviewing their existing arrangements, use of the new ITDA or Addendum would be the best option to seek to future proof against the need to replace them in 2 years’ time.

Where the data flows involve transfers of personal data from both the UK and the EU, the use of the Addendum alongside the New EU SCCs, will enable organisations to implement a more harmonised solution.

To view copies of the documents please follow the links below:

To read our previous blog post on this topic, click here.

Article By Francesca Fellowes of Squire Patton Boggs (US) LLP. Hannah-Mei Grisley also contributed to this article.

For more data privacy legal news, click here to visit the National Law Review.

© Copyright 2022 Squire Patton Boggs (US) LLP

Fleeing Ukrainians to Get More Help From United States

The United States has joined many European countries that are opening their doors and offering humanitarian assistance to fleeing Ukrainians.

Ireland, Great Britain and Canada have all started private sponsorship programs for Ukrainians. That assistance is not necessarily a one-way street. Easing the way for incoming Ukrainians may help those nations deal with their own labor shortages.

Ukraine is known for its skilled workforce, including tech engineers, and some companies in Europe are specifically targeting jobs for Ukrainians, offering everything from language training to child care to attract the refugees. Even temporary employment agencies are involved and new companies are being founded for the purpose of matching Ukrainians to jobs across Europe – jobs that run the gamut from highly skilled tech work, to healthcare aids, to retail and hospitality positions.

U.S. employers are generously offering humanitarian aid and donations to help Ukrainian refugees, but now those employers may be able to offer jobs to displaced Ukrainians seeking refuge. The Biden Administration will open various legal pathways that could include the refugee admissions program (which can lead to permanent residence through asylum, but is a long process), visas, and humanitarian parole (a temporary solution). The focus will be on Ukrainians with family in the United States or others considered to be particularly vulnerable. Approximately 1,000,000 people of Ukrainian descent currently live in the United States.

The administration originally believed that most Ukrainians did not want to flee to the United States because it was too far away from other family members who have remained in Ukraine. Secretary of State Antony Blinken had stated that the priority was to help European countries who are the dealing with huge waves for migration instead. But advocates have been arguing that the administration could create special status for Ukrainians to allow them to enter the U.S. or stay with family members.

In early March, the Biden Administration established Temporary Protected Status (TPS) for Ukrainians who have been in the United States continuously since March 1, 2022, but that did not help those who are still abroad. Visitor visas are hard to come by because applicants for visitor visas need to be able to show that their stay will be temporary and that they have a home to return to in Ukraine, and such temporary nonimmigrant visas may not meet that criterion or be practical in most of these situations. Moreover, consulates abroad are already overwhelmed and understaffed due to COVID-19.

While small numbers of Ukrainians have made it to the United States by finding private or family sponsors, this new policy should at least open the doors to some Ukrainians and likely make it possible for U.S. companies to hire some of the incoming refugees. They will need and want employment, but they will also need support.

Article By Forrest G. Read IV of Jackson Lewis P.C.

For more immigration-related legal news, click here to visit the National Law Review.

Jackson Lewis P.C. © 2022

EDPB on Dark Patterns: Lessons for Marketing Teams

“Dark patterns” are becoming the target of EU data protection authorities, and the new guidelines of the European Data Protection Board (EDPB) on “dark patterns in social media platform interfaces” confirm their focus on such practices. While they are built around examples from social media platforms (real or fictitious), these guidelines contain lessons for all websites and applications. The bad news for marketers: the EDPB doesn’t like it when dry legal texts and interfaces are made catchier or more enticing.

To illustrate, in a section of the guidelines regarding the selection of an account profile photo, the EDPB considers the example of a “help/information” prompt saying “No need to go to the hairdresser’s first. Just pick a photo that says ‘this is me.’” According to the EDPB, such a practice “can impact the final decision made by users who initially decided not to share a picture for their account” and thus makes consent invalid under the General Data Protection Regulation (GDPR). Similarly, the EDPB criticises an extreme example of a cookie banner with a humourous link to a bakery cookies recipe that incidentally says, “we also use cookies”, stating that “users might think they just dismiss a funny message about cookies as a baked snack and not consider the technical meaning of the term “cookies.”” The EDPB even suggests that the data minimisation principle, and not security concerns, should ultimately guide an organisation’s choice of which two-factor authentication method to use.

Do these new guidelines reflect privacy paranoia or common sense? The answer should lie somewhere in between, but the whole document (64 pages long) in our view suggests an overly strict approach, one that we hope will move closer to commonsense as a result of a newly started public consultation process.

Let us take a closer look at what useful lessons – or warnings – can be drawn from these new guidelines.

What are “dark patterns” and when are they unlawful?

According to the EDPB, dark patterns are “interfaces and user experiences […] that lead users into making unintended, unwilling and potentially harmful decisions regarding the processing of their personal data” (p. 2). They “aim to influence users’ behaviour and can hinder their ability to effectively protect their personal data and make conscious choices.” The risk associated with dark patterns is higher for websites or applications meant for children, as “dark patterns raise additional concerns regarding potential impact on children” (p. 8).

While the EDPB takes a strongly negative view of dark patterns in general, it recognises that dark patterns do not automatically lead to an infringement of the GDPR. The EDPB acknowledges that “[d]ata protection authorities are responsible for sanctioning the use of dark patterns if these breach GDPR requirements” (emphasis ours; p. 2). Nevertheless, the EDPB guidance strongly links the concept of dark patterns with the data protection by design and by default principles of Art. 25 GDPR, suggesting that disregard for those principles could lead to a presumption that the language or a practice in fact creates a “dark pattern” (p. 11).

The EDPB refers here to its Guidelines 4/2019 on Article 25 Data Protection by Design and by Default and in particular to the following key principles:

  • “Autonomy – Data subjects should be granted the highest degree of autonomy possible to determine the use made of their personal data, as well as autonomy over the scope and conditions of that use or processing.
  • Interaction – Data subjects must be able to communicate and exercise their rights in respect of the personal data processed by the controller.
  • Expectation – Processing should correspond with data subjects’ reasonable expectations.
  • Consumer choice – The controllers should not “lock in” their users in an unfair manner. Whenever a service processing personal data is proprietary, it may create a lock-in to the service, which may not be fair, if it impairs the data subjects’ possibility to exercise their right of data portability in accordance with Article 20 GDPR.
  • Power balance – Power balance should be a key objective of the controller-data subject relationship. Power imbalances should be avoided. When this is not possible, they should be recognised and accounted for with suitable countermeasures.
  • No deception – Data processing information and options should be provided in an objective and neutral way, avoiding any deceptive or manipulative language or design.
  • Truthful – the controllers must make available information about how they process personal data, should act as they declare they will and not mislead data subjects.”

Is data minimisation compatible with the use of SMS two-factor authentication?

One of the EDPB’s positions, while grounded in the principle of data minimisation, undercuts a security practice that has grown significantly over the past few years. In effect, the EDPB seems to question the validity under the GDPR of requests for phone numbers for two-factor authentication where e-mail tokens would theoretically be possible:

“30. To observe the principle of data minimisation, [organisations] are required not to ask for additional data such as the phone number, when the data users already provided during the sign- up process are sufficient. For example, to ensure account security, enhanced authentication is possible without the phone number by simply sending a code to users’ email accounts or by several other means.
31. Social network providers should therefore rely on means for security that are easier for users to re[1]initiate. For example, the [organisation] can send users an authentication number via an additional communication channel, such as a security app, which users previously installed on their mobile phone, but without requiring the users’ mobile phone number. User authentication via email addresses is also less intrusive than via phone number because users could simply create a new email address specifically for the sign-up process and utilise that email address mainly in connection with the Social Network. A phone number, however, is not that easily interchangeable, given that it is highly unlikely that users would buy a new SIM card or conclude a new phone contract only for the reason of authentication.” (emphasis ours; p. 15)

The EDPB also appears to be highly critical of phone-based verification in the context of registration “because the email address constitutes the regular contact point with users during the registration process” (p. 15).

This position is unfortunate, as it suggests that data minimisation may preclude controllers from even assessing which method of two-factor authentication – in this case, e-mail versus SMS one-time passwords – better suits its requirements, taking into consideration the different security benefits and drawbacks of the two methods. The EDPB’s reasoning could even be used to exclude any form of stronger two-factor authentication, as additional forms inevitably require separate processing (e.g., phone number or third-party account linking for some app-based authentication methods).

For these reasons, organisations should view this aspect of the new EDPB guidelines with a healthy dose of skepticism. It likewise will be important for interested stakeholders to participate in the consultation to explain the security benefits of using phone numbers to keep the “two” in two-factor authentication.

Consent withdrawal: same number of clicks?

Recent decisions by EU regulators (notably two decisions by the French authority, the CNIL have led to speculation about whether EU rules effectively require website operators to make it possible for data subjects to withdraw consent to all cookies with one single click, just as most websites make it possible to give consent through a single click. The authorities themselves have not stated that this is unequivocally required, although privacy activists notably filed complaints against hundreds of websites, many of them for not including a “reject all” button on their cookie banner.

The EDPB now appears to side with the privacy activists in this respect, stating that “consent cannot be considered valid under the GDPR when consent is obtained through only one mouse-click, swipe or keystroke, but the withdrawal takes more steps, is more difficult to achieve or takes more time” (p. 14).

Operationally, however, it seems impossible to comply with a “one-click withdrawal” standard in absolute terms. Just pulling up settings after registration or after the first visit to a website will always require an extra click, purely to open those settings. We expect this issue to be examined by the courts eventually.

Is creative wording indicative of a “dark pattern”?

The EDPB’s guidelines contain several examples of wording that is intended to convince the user to take a specific action.

The photo example mentioned in the introduction above is an illustration, but other (likely fictitious) examples include the following:

  • For sharing geolocation data: “Hey, a lone wolf, are you? But sharing and connecting with others help make the world a better place! Share your geolocation! Let the places and people around you inspire you!” (p.17)
  • To prompt a user to provide a self-description: “Tell us about your amazing self! We can’t wait, so come on right now and let us know!” (p. 17)

The EDPB criticises the language used, stating that it is “emotional steering”:

“[S]uch techniques do not cultivate users’ free will to provide their data, since the prescriptive language used can make users feel obliged to provide a self-description because they have already put time into the registration and wish to complete it. When users are in the process of registering to an account, they are less likely to take time to consider the description they give or even if they would like to give one at all. This is particularly the case when the language used delivers a sense of urgency or sounds like an imperative. If users feel this obligation, even when in reality providing the data is not mandatory, this can have an impact on their “free will”” (pp. 17-18).

Similarly, in a section about account deletion and deactivation, the EDPB criticises interfaces that highlight “only the negative, discouraging consequences of deleting their accounts,” e.g., “you’ll lose everything forever,” or “you won’t be able to reactivate your account” (p. 55). The EDPB even criticises interfaces that preselect deactivation or pause options over delete options, considering that “[t]he default selection of the pause option is likely to nudge users to select it instead of deleting their account as initially intended. Therefore, the practice described in this example can be considered as a breach of Article 12 (2) GDPR since it does not, in this case, facilitate the exercise of the right to erasure, and even tries to nudge users away from exercising it” (p. 56). This, combined with the EDPB’s aversion to confirmation requests (see section 5 below), suggests that the EDPB is ignoring the risk that a data subject might opt for deletion without fully recognizing the consequences, i.e., loss of access to the deleted data.

The EDPB’s approach suggests that any effort to woo users into giving more data or leaving data with the organisation will be viewed as harmful by data protection authorities. Yet data protection rules are there to prevent abuse and protect data subjects, not to render all marketing techniques illegal.

In this context, the guidelines should in our opinion be viewed as an invitation to re-examine marketing techniques to ensure that they are not too pushy – in the sense that users would in effect truly be pushed into a decision regarding personal data that they would not otherwise have made. Marketing techniques are not per se unlawful under the GDPR but may run afoul of GDPR requirements in situations where data subjects are misled or robbed of their choice.

Other key lessons for marketers and user interface designers

  • Avoid continuous prompting: One of the issues regularly highlighted by the EDPB is “continuous prompting”, i.e., prompts that appear again and again during a user’s experience on a platform. The EDPB suggests that this creates fatigue, leading the user to “give in,” i.e., by “accepting to provide more data or to consent to another processing, as they are wearied from having to express a choice each time they use the platform” (p. 14). Examples given by the EDPB include the SMS two-factor authentication popup mentioned above, as well as “import your contacts” functionality. Outside of social media platforms, the main example for most organisations is their cookie policy (so this position by the EDPB reinforces the need to manage cookie banners properly). In addition, newsletter popups and popups about “how to get our new report for free by filling out this form” are frequent on many digital properties. While popups can be effective ways to get more subscribers or more data, the EDPB guidance suggests that regulators will consider such practices questionable from a data protection perspective.
  • Ensure consistency or a justification for confirmation steps: The EDPB highlights the “longer than necessary” dark pattern at several places in its guidelines (in particular pp. 18, 52, & 57), with illustrations of confirmation pop-ups that appear before a user is allowed to select a more privacy-friendly option (and while no such confirmation is requested for more privacy-intrusive options). Such practices are unlawful according to the EDPB. This does not mean that confirmation pop-ups are always unlawful – just that you need to have a good justification for using them where you do.
  • Have a good reason for preselecting less privacy-friendly options: Because the GDPR requires not only data protection by design but also data protection by default, make sure that you are able to justify an interface in which a more privacy-intrusive option is selected by default – or better yet, don’t make any preselection. The EDPB calls preselection of privacy-intrusive options “deceptive snugness” (“Because of the default effect which nudges individuals to keep a pre-selected option, users are unlikely to change these even if given the possibility” p. 19).
  • Make all privacy settings available in all platforms: If a user is asked to make a choice during registration or upon his/her first visit (e.g., for cookies, newsletters, sharing preferences, etc.), ensure that those settings can all be found easily later on, from a central privacy settings page if possible, and alongside all data protection tools (such as tools for exercising a data subject’s right to access his/her data, to modify data, to delete an account, etc.). Also make sure that all such functionality is available not only on a desktop interface but also for mobile devices and across all applications. The EDPB illustrates this point by criticising the case where an organisation has a messaging app that does not include the same privacy statement and data subject request tools as the main app (p. 27).
  • Be clearer in using general language such as “Your data might be used to improve our services”: It is common in most privacy statements to include a statement that personal data (e.g., customer feedback) “can” or “may be used” to improve an organisation’s products and services. According to the EDPB, the word “services” is likely to be “too general” to be viewed as “clear,” and it is “unclear how data will be processed for the improvement of services.” The use of the conditional tense in the example (“might”) also “leaves users unsure whether their data will be used for the processing or not” (p. 25). Given that the EDPB’s stance in this respect is a confirmation of a position taken by EU regulators in previous guidance on transparency, and serves as a reminder to tell data subjects how data will be used.
  • Ensure linguistic consistency: If your website or app is available in more than one language, ensure that all data protection notices and tools are available in those languages as well and that the language choice made on the main interface is automatically taken into account on the data-related pages (pp. 25-26).

Best practices according to the EDPB

Finally, the EDPB highlights some other “best practices” throughout its guidelines. We have combined them below for easier review:

  • Structure and ease of access:
    • Shortcuts: Links to information, actions, or settings that can be of practical help to users to manage their data and data protection settings should be available wherever they relate to information or experience (e.g., links redirecting to the relevant parts of the privacy policy; in the case of a data breach communication to users, to provide users with a link to reset their password).
    • Data protection directory: For easy navigation through the different section of the menu, provide users with an easily accessible page from where all data protection-related actions and information are accessible. This page could be found in the organisation’s main navigation menu, the user account, through the privacy policy, etc.
    • Privacy Policy Overview: At the start/top of the privacy policy, include a collapsible table of contents with headings and sub-headings that shows the different passages the privacy notice contains. Clearly identified sections allow users to quickly identify and jump to the section they are looking for.
    • Sticky navigation: While consulting a page related to data protection, the table of contents could be constantly displayed on the screen allowing users to quickly navigate to relevant content thanks to anchor links.
  • Transparency:
    • Organisation contact information: The organisation’s contact address for addressing data protection requests should be clearly stated in the privacy policy. It should be present in a section where users can expect to find it, such as a section on the identity of the data controller, a rights related section, or a contact section.
    • Reaching the supervisory authority: Stating the specific identity of the EU supervisory authority and including a link to its website or the specific website page for lodging a complaint is another EDPB recommendation. This information should be present in a section where users can expect to find it, such as a rights-related section.
    • Change spotting and comparison: When changes are made to the privacy notice, make previous versions accessible with the date of release and highlight any changes.
  • Terminology & explanations:
    • Coherent wording: Across the website, the same wording and definition is used for the same data protection concepts. The wording used in the privacy policy should match that used on the rest of the platform.
    • Providing definitions: When using unfamiliar or technical words or jargon, providing a definition in plain language will help users understand the information provided to them. The definition can be given directly in the text when users hover over the word and/or be made available in a glossary.
    • Explaining consequences: When users want to activate or deactivate a data protection control, or give or withdraw their consent, inform them in a neutral way of the consequences of such action.
    • Use of examples: In addition to providing mandatory information that clearly and precisely states the purpose of processing, offering specific data processing examples can make the processing more tangible for users
  • Contrasting Data Protection Elements: Making data protection-related elements or actions visually striking in an interface that is not directly dedicated to the matter helps readability. For example, when posting a public message on the platform, controls for geolocation should be directly available and clearly visible.
  • Data Protection Onboarding: Just after the creation of an account, include data protection points within the onboarding experience for users to discover and set their preferences seamlessly. This can be done by, for example, inviting them to set their data protection preferences after adding their first friend or sharing their first post.
  • Notifications (including data breach notifications): Notifications can be used to raise awareness of users of aspects, changes, or risks related to personal data processing (e.g., when a data breach occurs). These notifications can be implemented in several ways, such as through inbox messages, pop-in windows, fixed banners at the top of the webpage, etc.

Next steps and international perspectives

These guidelines (available online) are subject to public consultation until 2 May 2022, so it is possible they will be modified as a result of the consultation and, we hope, improved to reflect a more pragmatic view of data protection that balances data subjects’ rights, security, and operational business needs. If you wish to contribute to the public consultation, note that the EDPB publishes feedback it receives (as a result, we have occasionally submitted feedback on behalf of clients wishing to remain anonymous).

Irrespective of the outcome of the public consultation, the guidelines are guaranteed to have an influence on the approach of EU data protection authorities in their investigations. From this perspective, it is better to be forewarned – and to have legal arguments at your disposal if you wish to adopt an approach that deviates from the EDPB’s position.

Moreover, these guidelines come at a time when the United States Federal Trade Commission (FTC) is also concerned with dark patterns. The FTC recently published an enforcement policy statement on the matter in October 2021. Dark patterns are also being discussed at the Organisation for Economic Cooperation and Development (OECD). International dialogue can be helpful if conversations about desired policy also consider practical solutions that can be implemented by businesses and reflect a desirable user experience for data subjects.

Organisations should consider evaluating their own techniques to encourage users to go one way or another and document the justification for their approach.

Article By Peter Craddock, Sheila A. Millar, and Tracy P. Marshall of Keller and Heckman LLP

For more cybersecurity legal news, click here to visit the National Law Review.

© 2022 Keller and Heckman LLP

Google to Launch Google Analytics 4 in an Attempt to Address EU Privacy Concerns

On March 16, 2022, Google announced the launch of its new analytics solution, “Google Analytics 4.” Google Analytics 4 aims, among other things, to address recent developments in the EU regarding the use of analytics cookies and data transfers resulting from such use.

Background

On August 17, 2020, the non-governmental organization None of Your Business (“NOYB”) filed 101 identical complaints with 30 European Economic Area data protection authorities (“DPAs”) regarding the use of Google Analytics by various companies. The complaints focused on whether the transfer of EU personal data to Google in the U.S. through the use of cookies is permitted under the EU General Data Protection Regulation (“GDPR”), following the Schrems II judgment of the Court of Justice of the European Union. Following these complaints, the French and Austrian DPAs ruled that the transfer of EU personal data from the EU to the U.S. through the use of the Google Analytics cookie is unlawful.

Google’s New Solution

According to Google’s press release, Google Analytics 4 “is designed with privacy at its core to provide a better experience for both our customers and their users. It helps businesses meet evolving needs and user expectations, with more comprehensive and granular controls for data collection and usage.”

The most impactful change from an EU privacy standpoint is that Google Analytics 4 will no longer store IP address, thereby limiting the data transfers resulting from the use of Google Analytics that were under scrutiny in the EU following the Schrems II ruling. It remains to be seen whether this change will ease EU DPAs’ concerns about Google Analytics’ compliance with the GDPR.

Google’s previous analytics solution, Universal Analytics, will no longer be available beginning July 2023. In the meantime, companies are encouraged to transition to Google Analytics 4.

Read Google’s press release.

Article By Privacy and Cybersecurity Practice Group at Hunton Andrews Kurth

For more cybersecurity legal news, click here to visit the National Law Review. 

Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.

Europol: More Than Half of Counterfeits Originate in China

On March 7, 2022, the European Union Agency for Law Enforcement Cooperation (Europol) and the European Union Intellectual Property Office (EUIPO) jointly released the Intellectual Property Crime Threat Assessment 2022. Per the Assessment, China (including Hong Kong) was the main source of counterfeits based on number of counterfeits and by value of the counterfeits seized at the EU external borders.  Almost 76% of the fake goods detained were for trademark infringement; design infringement was the second most reported at 23% while copyright was third with 15%.

China and Turkey remain the main countries of origins for counterfeit clothing, shoes, bags, watches, and jewelry seized at the EU’s border. These goods are mostly ordered online and discovered as part of postal shipments or on passengers entering the EU.

Similarly, China is the country of origin for most of the seized counterfeit electrical/electronic and computer equipment, mobile phones and accessories. With respect to mobile phones, the Assessment states,

…the visual appearance of the counterfeit devices is very convincing, closely mimicking the external characteristics of the original phones. However, typically some features and software characteristics are missing and the International Mobile Equipment Identity (IMEI) is often fake.  The use of cheap and substandard electric components, which can be found in fake batteries, headphones or chargers, pose safety risks.

“China and Turkey were among the most frequently reported non-EU countries of origin for counterfeit food and drink seized at the EU’s external border.” Similarly, counterfeit perfumes and cosmetic products often originate from China and Turkey.

In addition to ready-to-use IPR-infringing goods, product components, such as aroma compounds, fixatives and solvents, are increasingly being seized. These components are used to create the final counterfeit products in the EU.

More worrisome, China and Turkey were the main origin of counterfeit pharmaceutical products.

Toys round out the top 10 counterfeits with China also being main point of origin.

The full Assessment is available here: IP_Crime_Threat_Assessment_2022_FullR_en.

Article By Aaron Wininger of Schwegman, Lundberg & Woessner, P.A.

For more intellectual property legal news, click here to visit the National Law Review.

© 2022 Schwegman, Lundberg & Woessner, P.A. All Rights Reserved.

Law Firms Respond to Russia’s Invasion of Ukraine: How the Legal Industry & the Public Can Help

On February 21, 2022, Russian President Vladimir Putin ordered ground troops into the eastern Ukrainian provinces of Donetsk and Luhansk. Invading under the guise of establishing independence for the region on February 24, Russia started bombing key points of interest around the country, including the capital city of Kyiv. At the time of writing, the skirmishes remain ongoing, with Russia expanding its invasion force as the days go on.

The ramifications of Russia’s war are widespread. In Ukraine, infrastructural damage is considerable, an estimated 2 million civilians are evacuating or have been driven from their homes. The death toll remains uncertain at this time, but the Ukrainian health ministry estimates that hundreds of citizens have been killed as a result of the violence. Globally, financial markets are in a state of rapid flux, seeing huge rises in inflation, a strained supply chain and plummeting stock prices.

Law firms in the United States and abroad have responded to the conflict by offering pro bono services in anticipation of resultant legal complications and organized means by which money can be donated to Ukrainian humanitarian efforts.

How Have Law Firms Responded to Russia’s Invasion of Ukraine?

In some instances, firms have also closed offices in Ukraine to protect workers, and severed ties with Russian businesses. Law firms that have closed offices in Ukraine include Dentons, CMS and Baker McKenzie, which have closed offices in Kyiv.

“Dentons has established a taskforce to monitor and manage the crisis situation, with a primary focus on protecting our people,”  Tomasz Dąbrowski, CEO of Dentons Europe, told the National Law Review. “We are in regular contact with our team in Kyiv and are providing our colleagues and their families with any possible assistance, including transport, relocation and accommodation assistance in the neighboring countries. Furthermore, we have seen a wave of kindness and generosity from our people across Europe, who have volunteered to provide accommodation in their homes for Ukrainian colleagues.  Furthermore, in addition to the financial support our Firm is providing to our Ukrainian colleagues, we have also received financial donations from around the world to help them resettle.”

Many law firms have announced they are closing offices in Russia, including Squire Patton Boggs, Latham & Watkins Freshfields Bruckhaus Deringer, Akin Gump Strauss Hauer & Feld and Morgan Lewis & Bockius, among others. Norton Rose Fulbright announced March 7 that they are winding down their operations in Russia and will be closing their Moscow office as soon as they can, calling Russia’s invasion of Ukraine “increasingly brutal.”

“The wellbeing of our staff in the region is a priority. We thank our 50 colleagues in Moscow for their loyal service and will support them through this transition.”

Norton Rose Fulbright said they “stand unequivocally with the people of Ukraine,” and are taking steps to respond to the invasion.

“Some immediate actions are possible and we are taking them. We are not accepting any further instructions from businesses, entities or individuals connected with the current Russian regime, irrespective of whether they are sanctioned or not. In addition, we continue to review exiting from existing work for them where our professional obligations as lawyers allow. Where we cannot exit from current matters, we will donate the profits from that work to appropriate humanitarian and charitable causes,” the statement read. “We are working with our charitable partners in every region to raise funds to help the people of Ukraine, as well as providing pro bono support to those Ukrainians and others who are being forced to relocate.”

Law firms have also stepped forward to offer pro bono assistance to those affected by the Russian invasion of Ukraine.

Law Firms Offering Pro Bono Assistance to Ukraine

Akin Gump Partner and Pro Bono Practice leader Steven Schulman explained how the legal industry is collaborating and working to provide assistance:

“So what we often do in these crises, we will self organize, [and] say who’s a point person who knows what’s going on, and then we will share information so that again, we’re lightening the load on the legal aid organizations.”

Another law firm offering assistance to Ukraine is  Covington & Burling, which the country hired to help pursue its claim against  Russia at the International Court of Justice (ICJ). Specifically, Ukraine asked the court to order Russia to halt its invasion. Covington filed a claim on behalf of Ukraine to the ICJ.

Nongovernmental organizations (NGOs) are providing emergency aid in Ukraine, as well as in neighboring countries, such as Poland, Hungary, Slovakia and Romania to help people displaced by the war as they come across the border, Mr.Dąbrowski said. These organizations are providing food, water, hygiene supplies and other necessities, and urgent psychological counseling. Specific NGOs on the ground in Ukraine include Mercy Corps, Fight for Right, Project HOPE, Hungarian Helsinki Committee, and  Fundacja Ocalenie, among others.

However, NGOs need cash donations in order to keep providing aid. Mr.Dąbrowski detailed what pro bono work Dentons is doing, and how the firm is supporting NGOs:

“Our Positive Impact team is in touch with numerous NGOs and lawyers from our firm to identify opportunities for pro bono legal advice, mainly in the countries which share a border with Ukraine.  We are already working with NGOs in Poland and Hungary which are helping Ukrainian refugees displaced by the war. We are assisting with issues related to employment law, contracts, establishment of charitable foundations, etc… We are also in discussions with an international relief agency which is looking to set up operations within Ukraine.

While men between the ages of 18 and 60 are currently prohibited from leaving Ukraine, as of March 10, 2022, the conflict has created one of the largest refugee crises within the last few decades.

“We have activated our registered charitable foundation to collect donations from our people around the world to support Ukrainian families – and particularly children –  displaced by the war, including some of our own people from Kyiv.  So far, our colleagues from around the world have donated or pledged close to €300,000,” Mr.Dąbrowski said. “We have already distributed €60,000 of that to eight NGOs in Poland, Hungary and Romania, which are providing emergency aid, food and water, hygiene supplies, transportation, medical and psychological care, shelter and schooling to Ukrainian civilians fleeing from the war”

Concerns with immigration and refugee asylum is the next expected complication. In the short-term, the Department of Homeland Security is prioritizing Temporary Protected Status (TPS) designations for those already in the U.S.

For the public, there are a number of actions to take to support Ukrainians. However, those wishing to help should make sure to do their research before making any donations in order to ensure the funds end up in the right hands.

How Can Members of the Public Help Ukraine?

Possible scam organizations and outreach programs are common during international crises, so it’s important to know the signs of fraudulent charities. Some best practices for providing support include:

  • Giving directly to an organization rather than through shared donation links on social media

  • Being wary of crowdfunding efforts

  • Doing a background check on an organization and its donation claims using Charity Watch, Give.org, and Charity Navigator.

Some examples of charitable organizations focused on Ukraine relief include:

Informational resources for those affected are provided below:

Conclusion

Law firms and the public alike have stepped up to offer assistance and financial help to those most affected by the Russian invasion. Law firms cutting ties with Russian businesses and closing offices in Russia shows that the legal industry is standing behind Ukraine as the conflict continues to escalate.

In upcoming coverage, the National Law Review will be writing about how law firms are helping clients handle Russian sanctions, as well as the immigration implications of refugees displaced by the war in Ukraine.

*The quotes and input of interviewees reflect the latest information on the Russian invasion of Ukraine as of March 7, 2022. Readers can find the latest legal news from around the world on The National Law Review’s Global Law page.*

Article By Chandler Ford, Jessica Scheck, and Rachel Popa of the The National Law Review / The National Law Forum LLC

Copyright ©2022 National Law Forum, LLC

Apple, Inc. Probed by European Commission for Possible Antitrust Violations

In late June, the European Commission (EC) opened several formal cases investigating Apple’s mobile payment technology (Apple Pay) and various third-party and user agreements to determine whether the tech giant’s practices and policies infringe on competition rights and abuse market power. Specifically, the Commission will investigate the company’s terms and conditions integrating the payment feature into merchant applications and websites, and the imposition of its proprietary in-app purchase system and accompanying restrictions. The latter prevents third-party developers from informing their users of cheaper alternative purchases available outside the app. The investigations follow complaints made by Spotify, a music streaming service competitor, and an e-book/audiobook distributor competitor, according to the EC’s press release.

In a statement, EC Executive Vice President Margrethe Vestager said that the Commission needs to allay fears that Apple’s “gatekeeper role” in the distribution of apps and content to users does not distort market competition. The impetus, she said, was to ensure that “Apple’s measures do not deny consumers the benefits of new payment technologies, including better choice, quality, innovation and competitive prices.”

Apple is one of the latest tech targets to experience regulatory scrutiny. Facebook, Amazon, and Google are facing antitrust inquiries by EU member states, the European Commission, and the United States’ Department of Justice and Federal Trade Commission.

© MoginRubin LLP

ARTICLE BY the Competition Policy and Advocacy practice at MoginRubin.
For more on mobile payment portals, see the National Law Review Financial Institutions & Banking law section.

The Rise Of Digital Services Taxes

Governments are coming after online businesses. Multinational clients that provide online advertising services, sell consumer data, or run online intermediary platforms should prepare themselves for the imminent arrival of digital services taxes (DSTs) on revenues from digital activities.

IN DEPTH

Having failed to reach an EU-wide unanimous consensus on an earlier EU Commission proposal for a DST Directive, certain EU countries, including Austria, the Czech Republic, France, Italy, Spain and the United Kingdom, decided to go it alone and introduce DSTs unilaterally into their own national tax systems. These decisions were driven primarily by a perception that larger multinationals, many of which have highly digitalised operations, are not paying their “fair share” of taxes globally. In addition, a growing consensus has emerged in recent months that “market jurisdictions” should have the right to tax, because those markets—namely, the countries where the users and consumers are based—ultimately create value for online businesses.

The Organisation for Economic Co-operation and Development (OECD) takes a neutral view on the use of DSTs by its members, in that it neither recommends nor discourages them. Member countries that do decide to adopt a DST should

  • Comply with international obligations
  • Ensure the DST is temporary and narrowly targeted
  • Minimise over-taxation, cost, complexity, and compliance burdens
  • Ensure the DST has a minimal adverse impact on small businesses.

The French DST is already in force. The Italian DST is in draft form, with the government intending for it to enter into force in January 2020, while other DST regimes, including that of the United Kingdom, are expected to come into force some time during 2020. None of these national rules seem to have complied with the OECD guidelines, and there are several practical challenges for businesses that are common across all three regimes.

Identifying Taxable Revenues and Services 

In France, each company belonging to a group that derives gross revenues from digital services exceeding €750 million on a worldwide basis, and €25 million in France, is subject to French DST at a rate of 3 per cent. French DST is assessed at the company level only, based on gross revenues derived from digital services deemed to be provided in France during the previous calendar year. This is calculated as the gross revenues derived from taxable digital services, multiplied by the proportion of French users over the total number of users of the taxable digital services.

As it currently stands, the Italian DST would apply to Italian resident and non-resident companies that, at the individual or group level, earned during a calendar year a total amount of worldwide revenues of over €750 million, and an amount of revenues derived from digital services provided in Italy of over €5.5 million.

Only groups with annual worldwide revenues above £500 million and UK revenues above £25 million would be affected by the UK DST, with the first £25 million of UK revenues being exempt. The UK DST would be calculated on a group-wide basis and apportioned pro rata to each group member. Groups with low operating margins may opt for a “safe harbour” alternative DST calculation, based on the group’s operating margin.

Identifying Taxable Services

The taxable services that fall within the scope of the French, Italian, and UK DSTs are broadly similar and include

  • The provision of a social media platform
  • Search engines
  • Any online marketplace
  • Online advertising business, including those that use or sell individual users’ data

It is noteworthy that digital platforms for the provision of payment services, communication services, crowdfunding services, or digital content, as well as self-operated digital platforms for the direct sale of goods and services, are specifically beyond the scope of the French and UK DST.

The issues that arise are also broadly similar. There are likely to be conflicts regarding dual-purpose platforms, i.e., those that include both taxable and exempt digital services. The fact that the lists are not exhaustive and that the DSTs will apply to all revenues received in connection with a relevant DST activity means that affected businesses will need to analyse the nature of the revenue streams and the activities from which they are generated, and each case will turn on its own facts.  This will entail a substantial administrative burden for affected businesses, as well as a lack of certainty over potential DST filing obligations.

Identifying Users 

Both France and Italy consider the location of users to be based on the location of the electronic device when the user accesses the digital services. The United Kingdom intends to determine that someone is a UK user if, it is reasonable to assume, they are normally located or established in the United Kingdom.

France and Italy will use IP addresses, wi-fi connections, GPS data, etc., plus reference to that user’s personal data and place of residence; while the UK plans to extrapolate user location from data such as delivery addresses, payment details, IP addresses, contractual evidence, or the address of properties for rent or location of goods for sale.

There are many problems with these approaches. At the most basic level, different data sources can provide conflicting evidence of a user’s location, and IP addresses can be easily manipulated. Businesses will, therefore, need to come to a reasonable, evidence-based conclusion on the likelihood of that user’s location, further adding to their administrative burden and broadening the scope to make a mistake. The use of personal data and place of residence are also likely to trigger data protection issues under the EU General Data Protection Regulations.

Potential Double Taxation and Reimbursements

There is a risk of double taxation if another jurisdiction imposes a DST on the same revenues, for example as a result of inconsistencies between one set of national rules and those of another jurisdiction regarding user location or taxing rights. DST is however generally deductible for corporate income tax purposes.

France’s President Macron stated at the 2019 G7 that any excess of French DST over the new international DST being brokered by the OECD would be refunded. He did not, unfortunately, give much detail as to how and under what limitations this refund will take place.

The Italian draft DST provisions do not include any specific rule on this aspect and, although they seem to propose a sunset clause according to which the Italian DST is automatically repealed when the new OECD-agreed corporate income tax enters into force, there does not appear to be scope for a retroactive reimbursement of the difference (if any) between the Italian DST and such future corporate income tax.

The draft UK DST rules disregard 50 per cent of UK revenues from cross-border transactions between a buyer and a seller through an online marketplace where the non-UK party is in another DST jurisdiction. But this does not fully resolve the issue of potential double taxation if the other jurisdiction imposes a DST on the same revenues, for example due to inconsistencies between the UK national rules and those of the other DST jurisdiction regarding user location and/ or taxing rights.

The UK DST will also not be creditable against either corporation tax, income tax under the Offshore Receipts in respect of Intangible Property regime, or diverted profits tax; although it should generally be deductible for corporation tax purposes as a trading expense. Unlike France or Italy, neither the draft legislation nor HMRC guidance mentions the possibility of a retroactive reimbursement of the UK DST once the OECD’s long-term solution for a revised corporate income tax has been agreed and implemented by member countries.

The US Response

The US administration takes a hostile view of DST proposals generally, as evidenced by a recent investigation into whether the French DST discriminates against US businesses. This could lead to retaliatory US tariffs being imposed on imports from France and punitive US tax charges on French companies doing business in the United States.

Other DSTs, including those of the United Kingdom and Italy, can probably expect similar responses from the United States. UK Prime Minister Boris Johnson has indicated his support in principle for a UK DST or a similarly targeted tax. He has also indicated that the structure of this tax would be on the table in any trade negotiations with the United States, and the future of the current draft Finance Bill hinges on the result of the UK general election in December, so there is currently very little certainty as to whether UK DST will take effect at all.

For now, the best course of action for affected businesses is to assume that all DSTs will take effect as planned and prepare accordingly, notwithstanding any current legislative or political uncertainty.

© 2019 McDermott Will & Emery

More on digital taxation on the National Law Review Tax law page.