Category: International Law

Who Must Protect the Ukraine-Trump Whistleblower?

Op-Ed From Stephen M. Kohn of the National Whistleblower Center

As the impeachment proceedings heat-up, and calls for the Ukraine whistleblower to be identified increase, there remains a fundamental question:  Who has the legal responsibility to protect this whistleblower?  The answer will surprise you!

There are very few laws mandating what the President, as part of his required and mandatory job duties, must perform.   Guaranteeing that employees who make protected disclosures under the  Intelligence Community Whistleblower Protection Act (“ICWPA”) are fully protected is one of them.  The Ukraine whistleblower is a a federal employee covered under the ICWPA.  He or she made a protected disclosure under the ICWPA.  Thus, it is up to President Trump to fully and completely protect this individual.  Here’s why:  The ICWPA directs that “[t]he President shall provide for the enforcement of the [Act].” It is as clear and simple as that.  The President “shall” “enforce” the whistleblower law that makes it illegal to retaliate against intelligence community whistleblowers.

Every intelligence community whistleblower, whether they be a Democrat, Republican or Independent, is entitled to the same protection from the President.  In the case of the Ukraine whistleblower, the law does not permit the political implications of the whistleblower’s disclosure to have any impact on the mandatory duty of President Trump to fully “enforce” that whistleblower’s right to be free from any retaliation.  The President is required to put his biases or self-interest aside and defend the right of intelligence community whistleblowers to report abuses of authority.  This includes wherever those abuses are committed, including the Oval Office. Under the ICWPA the buck stops with President Trump, impeached or not.

Unlike other whistleblower laws which give the federal courts or independent agencies, like the Merit Systems Protection Board or the Department of Labor, the authority to protect whistleblowers, the ICWPA places that solemn duty directly on the shoulders of the President.  It is the unique legal responsibility of the President.  The President must ensure that the identity of the intelligence community whistleblowers who file  complaints with the Inspector General pursuant to the Inspector General Act, are fully protected.  It is the President who must ensure that every person within the executive branch of government protect the job security of ICWPA whistleblowers.  It is the obligation of the President to punish those who fail to do so.

The ICWPA anti-retaliation law is not limited simply to preventing whistleblowers from being fired.  The law defines the types of “adverse action” the President must shield whistleblowers from, including  “any change in working conditions.”   In the case of the Ukrainian “quid pro quo” whistleblower, the catastrophic impact on the whistleblower’s ability to perform his or her job duties that would be triggered by violating his right to confidentiality is obvious.  This would include undermining his or her ability to work oversees, be promoted to a covert agent (if not one already), or effectively interact with employees in the White House.

Furthermore, breaching the confidentiality of whistleblowers is well established as an “adverse action” under whistleblower law.  Federal courts and administrative agencies as divergent as the SEC and Department of Labor have ruled that revealing the name of a whistleblower is an adverse action.  Anyone with experience working with whistleblowers knows that once their identity is revealed, their working conditions will never be the same, and they will have a target on their back for the rest of their careers.

The procedures applicable to the Ukraine whistleblower actually informed the whistleblower, in writing, that he or she could file a confidential complaint to the Inspector General.   The actual form submitted guaranteed this right.  Once the complaint was filed and accepted by the Inspector General, the whistleblower protections afforded under the ICWPA kicked in.  As a matter of law, it became President Trump’s obligation to “enforce” the ICWPA and ensure that the Ukraine whistleblower suffer no retaliation. It became the President’s non-discretionary duty to ensure the whistleblower suffered no harm.   This may be hard to believe, but the law is the law.

Given the highly public attacks on the whistleblower emanating from the White House it is now incumbent upon President Trump to instruct all employees within the federal government to comply with the ICWPA.  He must take steps to have his Congressional supporters, “stand down” and stop their continued drum beat to “out” the whistleblower.  Regardless of where you stand on impeachment, the President must enforce the requirements of the ICWPA and protect the whistleblower.

When Donald Trump signed onto the job of President, protecting intelligence community whistleblowers became one of his few mandatory job duties.  Like other employees who work for the taxpayers, he many not like all of his required jobs.  Like other employees he may find some parts of his job difficult or distasteful.  But he has no discretion in this matter.  It is a requirement.  He must ensure that the whistleblower is not retaliated against, that the whistleblower’s identity remains confidential, and that the whistleblower can continue in his or her career, free from stigma.    He must hold those who retaliate accountable.  That is part of the job he wanted.  That is the job he must perform.

Copyright Kohn, Kohn & Colapinto, LLP 2019. All Rights Reserved.

Employee Video Surveillance: Position of the European Court of Human Rights

On October 17, 2019, the European Court of Human Rights (ECHR) approved the installation of a Closed-Circuit Television (“CCTV”) surveillance system which was used to monitor supermarket cashiers without informing those employees of the fact that it had been installed.

In this case, a Spanish supermarket manager decided to install cameras in the supermarket because of suspected thefts. He installed (i) visible cameras pointing at the supermarket’s entrance and exit of which he had informed the staff and (ii) hidden cameras pointing at the cash registers of which neither employees nor staff representatives had been informed.

The hidden cameras revealed that thefts were being committed by several employees at the cash registers. The concerned employees were dismissed. Some of them brought an action before the Spanish Labor court arguing that the use of CCTV without their prior knowledge was a breach to their right to privacy and that such evidence could not be admitted in the dismissal procedure.

Like French law, Spanish law requires the person responsible for a CCTV system to inform the concerned employees of the existence, purpose, and methods of the collection of their personal data, prior to implementation of the system.

The case was brought before the ECHR, which gave a first decision on January 9, 2018, concluding that Article 8 of the European Convention for the Protection of Human Rights, relating to the right to privacy, had been breached. The case was then referred to the Grand Chamber.

The issue raised was to find the proportionality and the balance between (i) the reasons justifying the implementation of a CCTV system (i.e., the right of the employer to ensure the protection of its property and the proper functioning of its business) and (ii) the employees’ right to privacy.

The ECHR stated that “domestic courts must ensure that the introduction by an employer of surveillance measures that infringe the employees’ privacy rights is proportionate and is implemented with adequate and sufficient safeguards against abuse”, referring to its previous case law [1].

The ECHR considered that in order to ensure the proportionality of CCTV measures in the workplace, domestic courts should take into account the following factors when balancing the interests involved:

  1. Has the employee been informed of the possibility of being subject to a video surveillance measure?
  2. What is the extent of the video surveillance and what is the degree of intrusion into the employee’s private life?
  3. Has the use of video surveillance been justified by the employer on legitimate grounds?
  4. Was there an alternative surveillance system based on less intrusive means and measures available to the employer?
  5. What were the consequences of the surveillance for the employee who was subject to it?
  6. Was the employee concerned by the video surveillance measure offered adequate guarantees?

Therefore, prior notification to the employees is only one of the criteria taken into account in the balance of interests.

In this particular case, the ECHR approved the examination of proportionality of the video surveillance measure. The Judges decided that despite the lack of prior notification to the employees, the CCTV was (i) justified by suspicions of theft, (ii) limited in space (only a few checkout counters), and (iii) limited in time (10 days). The Court also noted that very few people watched the recordings and then concluded that the degree of intrusion into the employees’ privacy was limited.

Consequently, the Grand Chamber considered that there was no violation of the employees’ privacy rights.

Although this decision does not directly concern France, it remains very interesting since French regulations (i.e., the Data Protection Act, the General Data Protection Regulations, and the Labor Code) provide:

  • that the monitoring measures implemented by an employer must not impose restrictions on the employees’ rights and freedoms which would neither be proportionate nor justified by the nature of the task to be performed (Article L. 1121-1 of the Labor Code); and
  • that concerned employees and staff representatives must be informed prior to the implementation of a video surveillance system (Article L. 1222-4 of the Labor Code).

According to French case law, any system that is not compliant with the above is considered illicit and the information collected could not be used as evidence of an employee’s misconduct [2].

The ECHR’s decision seems to challenge French case law: where the absence of prior notification to employees is considered as an overwhelming obstacle by French judges, the ECHR considers that it is merely one of the several criteria to be taken into account to assess the proportionality of the infringement to the employee’s right to privacy.

The question that remains is: what will be the impact of the ECHR’s decision in France?

NOTES

[1] ECHR, Grand Chamber, September 5, 2017, n°641996/08, Bărbulescu c. Roumanie; ECHR, decision, October 5, 2010, 420/07, Köpke c. Germany.

[2] See French Supreme Court, June 7, 2006, n°04-43866 ; French Supreme Court, September 20, 2018, n°16-26482.

Copyright 2019 K & L Gates

ARTICLE BY Christine Artus of K&L Gates.
For more on employee privacy rights, see the National Law Review Labor & Employment Law section.

Foreign Judgments in Israel: Recognition and Enforcement

As a basic rule in international law, a judgment rendered in one country is not recognized, per se, in another country in which its recognition is enforcement or recognition is sought. The foreign judgment must first undergo a process of integration, sometimes called ‘domestication,’ dictated by the laws of the integrating country before it can be recognized or enforced. The difference in status between a foreign and a local, or domestic, judgment necessitates this integration:[1]

“Where it exists, it is a sign that a local governmental organ – judicial or otherwise – has granted the foreign judgment an entry visa and has set the degree of its validity here according to the pertinent rules of the local law.” Justice Cheshin observed in C.A. 970/93 Attorney General of Israel v. Agam[2]:

Thus, for a foreign judgment to serve as, e.g., as a collateral estoppel in Israeli litigation, an Israeli court must first recognize, and thus integrate, the foreign judgment. Until this is done, the foreign judgment has no status in Israel, for the purpose of either recognition or enforcement. It can even be said that “a foreign judgment not yet declared enforceable holds the same status as mere pleadings.”[3]

General

A foreign judgment lacks validity, and must undergo a process of integration, before it can be recognized or enforced in Israel. Israeli law’s methods of integration are detailed in the Foreign Judgments Enforcement Law, 5718-1958 (Enforcement Law). This establishes a distinct normative framework on whose sole basis the courts in Israel may recognize a foreign judgment or declare it enforceable. The Enforcement Law establishes a series of conditions regarding the nature of the judgment, the manner of its execution, and its integration into Israeli law. Should these conditions be met, a court shall declare the judgment enforceable in Israel. Thus, inter alia, the Enforcement Law establishes conditions under which an Israeli court may declare a foreign judgment enforceable: the requirement of reciprocity of enforcement, according to which a foreign judgment would not be declared enforceable if the rendering country’s law does not enforce the judgments of Israeli courts; the time period during which a petition to enforce a foreign judgment must be filed for an Israeli court to considered it; defenses, any one of which would preclude the enforceability of the foreign judgment; and a restriction on enforcement, according to which a foreign judgment shall not be declared enforceable if its enforcement is likely to prejudice the sovereignty or security of the State of Israel.

The Enforcement Law (Article 11) also establishes conditions for recognizing a foreign judgment: “incidentally, while hearing another matter…and for the purpose of that matter”, or primarily and directly. It is significant that the original Enforcement Law, passed by the Knesset in 1958, dealt solely with incidental recognition of foreign judgments, while provisions for direct and primary recognition of foreign judgments were added later, in the Foreign Judgments Enforcement Law (Amendment 2) 5738-1977.

Although lack of good faith or unacceptable conduct do not, pursuant to the Enforcement Law, provide independent cause to refuse recognition or enforcement of a foreign judgment, “however certainly this carries weight in the court’s considerations together with all other conditions”[4] for such recognition or enforcement.

Judgments in Personam, in Rem, and Personal Status Judgments

The recognition or enforcement of a foreign judgment is highly influenced by the traditional classification of judgments into in personam, in rem, and personal status judgments. A judgment in personam obligates a person to perform an act (repay a debt, pay damages, surrender an object, etc.) or to refrain from doing so. A judgment in personam binds, in the sense of creating res judicata, only the parties involved, and by its very nature is given to execution, that is to say, enforcement. A judgment in rem declares or establishes (creates, changes, or cancels) title in immovable or movable property. Such a judgment binds the world, so to speak. It does not place any personal obligation and is therefore not given to execution. This is also true of quasi in rem judgments, which are applicable only to certain parties: for example, an inheritance order that declares certain individuals as heirs, and their resulting title in a certain property. A status judgment is a judgment that declares or establishes (creates, changes, or cancels) the personal status of a person, such as an annulment or a judgment of divorce. Like a judgment in rem, a personal status judgment is not given to execution, as it imposes no personal obligations.

Under the rules of private international law, personal status judgments can be issued by a court in the country of permanent residency or in the country of citizenship.[5] In general, however, there is no international consistency,[6] as personal status is limited to a particular country or a specific legal system. In a case where a Jewish couple, married in, e.g., New York in a civil ceremony, emigrates to Israel, they may be considered unmarried from the perspective of the Jewish law that applies in the Israeli State Rabbinical court. Yet, in the event of divorce, Israeli law may require them to accept a Rabbinic divorce. In some situations,[7] nonetheless, Israeli civil law may recognize the marriage, for example, regarding alimony.[8] A foreign divorce judgment is another example of a split status,[9] as it has no binding validity and lacks evidentiary value until validation from a competent Israeli court.

Another example is mamzerut, a status created by Jewish religious law that disqualifies the mamzer from Jewish marriage. In the Israeli legal system,[10] a mamzer is a child born of a married woman from another man, or a child of relations with a first-order relative, defined and prohibited in religious law. Within the state of Israel, qualification for marriage and divorce between Jews is set by Jewish law, a law that is not applicable in other countries. Therefore, a mamzer may other than in Israel. A parallel example, in certain countries, is a child born out of wedlock. In those countries, such a child is considered illegitimate, whereas in Jewish religious law, the status of a child born out of wedlock is not affected in any way.

Thus, only foreign judgments in personam can be enforced in Israel directly, while foreign in rem and personal status judgments are granted validity through their recognition. However, because all enforcement in and of itself includes recognition, it can be said that all types of judgments can potentially be recognized,[11] although for those judgments that cannot be enforced, the recognition per se is of nearly no value.

What options are available for a party seeking the enforcement, in Israel, of a foreign judgment? In general, the traditional means in English common law for enforcing a foreign debt judgment is by filing a domestic claim based on the foreign judgment. The foreign judgment itself, as opposed to the cause of action in the original forum, becomes the new cause of action. Claims based on foreign judgments were accepted in Palestine under the British Mandate. This expired in 1948 upon the establishment of the State of Israel. However, after enactment of the Enforcement Law, and particularly of its Article 2, it was no longer clear whether this procedure was still available to the holder of a foreign judgment.[12]

In C.A. 101/63 Winter v. Kovetz,[13] the Supreme Court dispersed any doubts, ruling unequivocally, that even given the Enforcement Law, a party might still file a claim in Israel on the basis of a foreign judgment, as opposed to filing a petition pursuant to the Enforcement Law to declare the judgment enforceable.[14] In C.A. 665/72 Mata Khan (Christophilco) v. Schweibel,[15] the Israeli Supreme Court again held that a foreign judgment creditor is permitted to “file a claim based on the original cause at the basis of the judgment, file a claim whose cause of action is the foreign judgment, or file a petition for enforcement in accordance with the enforcement law.”[16]

Enforcement proceedings for a foreign judgment are intended to grant the creditor, whose matter was already heard and adjudicated in a foreign state, tools of enforcement in the state occupied by the debtor or his property. In this way, the objectives behind the enforcement process are attained, including limiting litigation between the parties; honoring their rights; as well as encouraging cooperation and harmony between the various legal systems.

A result of the stated objectives of the enforcement process is that an Israeli court hearing a petition to enforce a foreign judgment does not act as an appellate court over the foreign court, and is inclined to “respect the judgment as is, and not question it.”[17] Thus also, “the court does not require a new, local investigation of the foreign court proceedings; does not examine the factual or legal correctness of the foreign judgment; and does not even take the reasoning of the judgment into account.”[18] Therefore, an error – even a blatant one – in the foreign judgment would not in and of itself preclude the judgment’s enforcement.

[1] Prof. Amos Shapira, Recognition and Enforcement of Foreign Judgments, Iyunei Mishpat 4 (1974) 509 (hereinafter: Shapira, Recognition and Enforcement of Foreign Judgments, or Shapira).

[2]P.D. 49(1) 561, 569 (1995).

[3]Bnk. (T.A.) 1515/04 Bamira v. Greenberg, at §4, (Nevo, Jul. 15, 2004).

[4] See Judge Keret-Meir’s ruling in Bankruptcy File (T.A.) 2193/08 First International Bank of Israel Ltd. v. Gold & Honey (1995) L.P. et al (Nevo, Oct. 30, 2008), §4.

[5] H.C. 36/50 Gottlieb v. Gottlieb P.D. 5 57, 64 (1950); C.A. 472/64 Inavi v. Attorney General of Israel P.D. 19(1) 645 (1965).

[6] Michael Corinaldi, Status, Family, and Succession Laws Between Religion And State 25-26 (2004).

[7]Avigdor Levontin, On Marriage and Divorce Abroad 7, 50-51, 67-68 (1957). See also Menashe Shawa, Personal Law in Israel 153-154, 681 (4th ed., 2001).

[8]C.A. 173/69 Becher v. Goldberg P.D. 23(2) 665 (1969).

[9]Shawa, supra n. 3 at 141-241. See also Menashe Shawa, Direct Recognition of Judgments in Israel, and Applicable Rules Kiryat Hamishpat 2 35 (2002).

[10]Corinaldi, supra n. 3 at 25-26.

[11]Shapira, Recognition and Enforcement of Foreign Judgments 513.

[12]Id. 515-516.

[13]P.D. 17 2032 (1963). See also Shapira, Recognition and Enforcement of Foreign Judgments 516 n. 28.

[14]Shapira, id.

[15]P.D. 27(1) 690 (1984).

[16]Id. at 694.

[17]C.A. 221/78 Ovadia v. Cohen P.D. 33(1) 293, 296 (1978).

[18]D.C.M. (Jm.) 4052/05 Wells Fargo Bank of Minnesota National Association v. Zimmering (Nevo, Dec. 31, 2007), Section 9 of the judgment.

Copyright © 2019 Carmon & Carmon

For more on international law, see the National Law Review Global Law page.

Apollo Settles Alleged Sanctions Violations: Aircraft Lessors Pay Attention

The Office of Foreign Assets Control (OFAC) of the U.S. Department of the Treasury has broad delegated authority to administer and enforce the sanctions laws and related sanctions programs of the United States. As a key component of its enforcement authority, OFAC may investigate “apparent violations” of sanctions laws and assess civil monetary penalties against violators pursuant to five statutes, including the Trading with the Enemy Act and the International Emergency Economic Powers Act.1

An “apparent violation” involves “conduct that constitutes an actual or possible violation of U.S. economic sanctions laws.”2 An OFAC investigation of an “apparent violation” may lead to one or more administrative actions, including a “no action” determination, a request for additional information, the issuance of a cautionary letter or finding of violation, the imposition of a civil monetary penalty and, in extreme cases, a criminal referral.3 Investigations of apparent violations by OFAC often lead to negotiated settlements where a final determination is not made as to whether a sanctions violation has actually occurred.4

Upon the conclusion of a proceeding that “results in the imposition of a civil penalty or an informal settlement” against or with an entity (as opposed to an individual), OFAC is required to make certain basic information available to the public.5 In addition, OFAC may release on a “case-by-case” basis “additional information” concerning the penalty proceeding,6 and it often does. Such additional information will sometimes include informal compliance guidance, cautionary reminders and best practices recommendations. Such information is routinely consumed by corporate compliance officers seeking fresh insight on ever-evolving compliance and enforcement trends, particularly in the context of proceedings relating to industries with which they are involved.

On November 7, 2019, OFAC released enforcement information that has caught the attention of the aircraft leasing community, particularly U.S. aircraft lessors and their owned or controlled Irish lessor subsidiaries.7 The matter involved a settlement by Apollo Aviation Group, LLC8 of its potential civil liability for apparent violations of OFAC’s Sudanese Sanctions Regulations (SSR) that existed in 2014–5.9 Although the amount of the settlement was relatively modest, the enforcement activity by OFAC in the proceeding has attracted scrutiny by aircraft lessors because, for the first time in recent memory, a U.S. aircraft lessor has paid a civil penalty to OFAC for alleged sanctions violations.

At the time of the apparent violations, Apollo was a U.S. aircraft lessor which became involved in two engine leasing transactions that came back to haunt it.

In the first transaction, Apollo leased two jet engines to a UAE lessee which subleased them to a Ukrainian airline with which it was apparently affiliated. The sublessee, in turn, installed both engines on an aircraft that it “wet leased”10 to Sudan Airways, which was on OFAC’s List of Specially Designated Nationals and Blocked Persons within the meaning of the “Government of Sudan.” Sudan Airways used the engines on flights to and from Sudan for approximately four months before they were returned to Apollo when the lease ended. Meanwhile, in a separate transaction, Apollo leased a third jet engine to the same UAE lessee, which subleased the engine to the same Ukrainian airline, which installed the engine on an aircraft that it also wet leased to Sudan Airways. Sudan Airways used the third engine on flights to and from Sudan until such time as Apollo discovered how it was being used and demanded that the engine be removed from the aircraft.

Both leases between Apollo and its UAE lessee contained restrictive covenants “prohibiting the lessee from maintaining, operating, flying, or transferring the engines to any countries subject to United States or United Nations sanctions.”11 Thus, by allowing the engines to be installed by its sublessee on aircraft that were eventually wetleased to Sudan Airways, and flown to and from Sudan during the country’s embargo, the lessee presumably breached the operating restrictions and covenants imposed by Apollo in the leases. Moreover, once Apollo learned that the first two engines had been used, and the third engine was being used, for the benefit of Sudan Airways, it demanded that the third engine be removed from the aircraft that the sub-lessee had wet-leased to Sudan Airways, and this was done.12

One might reasonably conclude from these facts that Apollo acted like a good corporate citizen. So what did Apollo do wrong from a sanctions compliance standpoint?

OFAC stated that Apollo may have violated section 538.201 of the SSR, which at the time “prohibited U.S. persons from dealing in any property or interests in property of the Government of Sudan,”13 as well as section 538.205 of the SSR, which at the time “prohibited the exportation or re-exportation, directly or indirectly, of goods, technology or services, from the United States or by U.S. persons to Sudan.”14

What are the takeaways and possible lessons to be drawn by aircraft lessors from this settlement based upon these alleged violations and the facts upon which they were based?

First, according to OFAC, Apollo did not “ensure” that the engines “were utilized in a manner that complied with OFAC’s regulations,” notwithstanding lease language that effectively required its lessee to comply.15 OFAC is clearly suggesting here that aircraft lessors have a duty to require sanctions compliance by their lessees. And, in view of the fact that many sanctions programs are enforced on a strict liability basis, OFAC’s comment that Apollo failed to “ensure” compliance by its lessee and sublessees makes sense. Apollo was not in a position to avoid civil liability by hiding behind the well-drafted language of its two leases. If a sanctions violation occurred for which Apollo was strictly liable, the mere fact that its lessee’s breach of the lease was the proximate cause of the violation would not provide a safe harbor.

As an example of Apollo’s alleged failure to “ensure” legal compliance, OFAC observed that Apollo did not obtain “U.S. law export compliance certificates from lessees and sublessees,”16 a comment which is somewhat puzzling. To our knowledge, there is nothing in the law requiring a lessor to obtain export compliance certificates, at least not in circumstances where an export or re-export license is not otherwise required in connection with the underlying lease transaction. Moreover, as a practical matter, it would be difficult, at best, for an aircraft lessor to force the direct delivery of certificates from a sublessee or sub-sub-lessee with whom it lacks privity of contract. In view of the foregoing, one assumes that OFAC was looking for Apollo to install procedures by which its lessee would self-report on a regular basis its own compliance (and compliance by downstream sublessees) with applicable export control laws and the relevant sanctions restrictions contained in the lease.

Second, OFAC found that Apollo “did not periodically monitor or otherwise verify its lessee’s and sublessee’s adherence to the lease provisions requiring compliance with U.S. sanctions laws during the life of the lease.”17 In this regard, OFAC observed that Apollo never learned how and where its engines were being used until after the first two engines were returned following lease expiration and a post-lease review of engine records, including “specific information regarding their use and destinations,” actually conducted.

In view of the foregoing, OFAC stressed the importance of “companies operating in high-risk industries to implement effective, thorough and on-going, risk-based compliance measures, especially when engaging in transactions concerning the aviation industry.”18 OFAC also reminded aircraft and engine lessors of its July 23, 2019, advisory warning of deceptive practices “employed by Iran with respect to aviation matters.”19 While the advisory focused on Iran, OFAC noted that “participants in the civil aviation industry should be aware that other jurisdictions subject to OFAC sanctions may engage in similar deception practices.”20 Thus, according to OFAC, companies operating internationally should implement Know Your Customer screening procedures and “compliance measures that extend beyond the point-of-sale and function throughout the entire business of lease period.”21

As a matter of best practices, aircraft lessors should implement risk-based sanctions compliance measures throughout the entirety of a lease period, and most do. Continuous KYC screening by lessors of their lessees and sublessees is a common compliance practice. Periodic reporting by lessees as to the use and destination of leased aircraft and engines appears to be a practice encouraged by OFAC.22 Lessors can also make it a regular internal practice to spot check the movement of their leased aircraft through such web-based platforms as Flight Tracker and Flight Aware. If implemented by lessors, such practices may enable early detection of nascent sanctions risks and violations by their lessees and sublessees.

Finally, OFAC reminded lessors that they “can mitigate sanctions risk by conducting risk assessments and exercising caution when doing business with entities that are affiliated with, or known to transact business with, OFAC-sanctioned persons or jurisdictions, or that otherwise pose high risks due to their joint ventures, affiliates, subsidiaries, customers, suppliers, geographic location, or the products and services they offer.” Such risk assessment is an integral part of the risk-based sanctions compliance program routinely encouraged by OFAC, as outlined in its Framework for OFAC Compliance Commitments on May 2, 2019.23 For aircraft and engine lessors, conducting pre-lease due diligence on the ownership and control of prospective lessees and sublessees, as well as the business they conduct, the markets they serve, the equipment they use and the aviation partners with whom they engage, are key to identifying and understanding the sanctions risks that a prospective business opportunity presents.

1 See U.S. Department of the Treasury, Office of Foreign Assets Control, Inflation Adjustment of Civil Monetary Penalties, Final Rule, 84 Fed. Reg. 27714, 27715 (June 14, 2019).

2 31 C.F.R. Part 501, Appendix A, Section I.A.

3 31 C.F.R. Part 501, Appendix A, Section II.

4 31 C.F.R. Part 501, Appendix A, Section V.C.

5 31 C.F.R. §501.805(d)(1). Such information includes “(A) [t]he name and address of the entity involved, (B) [t]he sanctions program involved, (C) A brief description of the violation or alleged violation, (D) [a] clear indication whether the proceeding resulted in an informal settlement or in the imposition of a penalty, (E) [a]n indication whether the entity voluntarily disclosed the violation or alleged violation to OFAC, and (F) [t]he amount of the penalty imposed or the amount of the agreed settlement.” Id. OFAC communicates all such information through its website. 31 C.F.R. § 501.805(d)(2).

6 31 C.F.R. § 501.805(d)(4).

7 See OFAC Resource Center, Settlement Agreement between the U.S. Department of the Treasury’s Office of Foreign Assets Control and Apollo Aviation Group, LLC (Nov. 7, 2019) (https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Page…) (the Settlement Announcement).

8 In December 2018, Apollo was acquired by The Carlyle Group and currently operates as Carlyle Aviation Partners Ltd. According to the Settlement Announcement, neither The Carlyle Group nor its affiliated funds were involved in the apparent violations at issue. See id. at 1 n.1.

9 See 31 C.F.R. Part 538, Sudanese Sanctions Regulations (7-1-15 Edition). Note that most sanctions with respect to Sudan were effectively revoked by general license as of October 2, 2017, thereby authorizing transactions previously prohibited by the SSR during the time period of the apparent violations by Apollo. However, as is true when most sanctions programs are lifted, the general license issued in the SSR program did not “affect past, present of future OFAC enforcements or actions related to any apparent violations of the SSR relating to activities that occurred prior to the date of the general license.” Settlement Announcement at 1 n.2. See also OFAC FAQ 532 (https://www.treasury.gov/resource-center/faqs/Sanctions/Pages/faq_other.aspx#sudan_whole). 

10 A “wet lease” is “an aviation leasing arrangement whereby the lessor operates the aircraft on behalf of the lessee, with the lessor typically providing the crew, maintenance and insurance, as well as the aircraft itself.” See Settlement Announcement at 1 n.3.

11 Id. at 1.

12 Unfortunately, Apollo did not learn that the first two engines were used in violation of lease restrictions until they were returned following lease expiration and it conducted a post-lease review of the relevant engine records. 

13 The alleged application of section 538.201 to Apollo in the circumstances confirms the broad interpretive meaning that OFAC often ascribes to terms such as “interest,” “property,” “property interest” and “dealings,” which appear in many sanctions programs.

14 The alleged application of section 538.205 to Apollo in the circumstances suggests that a U.S. lessor of aircraft and jet engines may be tagged with the “re-export” of such goods and related services from one foreign country to another, notwithstanding the existence of a contractual daisy-chain of lessees, sub-lessees, and/or wetlessees that actually direct and control such flight decisions. In the context of U.S. export control laws, the Export Administration Regulations (EAR) define the term “re-export” to include the “actual shipment or transmission of an item subject to the EAR from one foreign country to another foreign country, including the sending or taking of an item to or from such countries in any manner.” 15 C.F.R. § 734.14(a)(1). Thus, for export control purposes, the flight of an aircraft subject to the EAR from one foreign county to another foreign country constitutes a “re-export” of the aircraft to that country. 

15 Settlement Announcement at 1.

16 Id.

17 Id., at 1–2.

18 Id. at 3. (emphasis added).

19 Id. See OFAC, Iran-Related Civil Aviation Industry Advisory (July 23, 2019) (https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20190723.aspx)

20 Id.

21 Id. (emphasis added).

22 In Apollo, OFAC reacted favorably to certain steps alleged to have been taken by Apollo to minimize the risk of the recurrence of similar conduct, including the implementation of procedures by which Apollo began “obtaining U.S. law export compliance certificates from lessees and sublessees.” Id.

23 See https://www.treasury.gov/resource-center/sanctions/Documents/framework_ofac_cc.pdf.

© 2019 Vedder Price

ARTICLE BY John E. Bradley of Vedder Price.
More sanctions actions on the National Law Review Antitrust & Trade Regulation law page.

U.S./China Trade “Deal” Short on IP/Trade Secret Specifics

With the announcement last week of a tentative partial trade agreement with China, the U.S. appears to be headed to a somewhat easing of tensions between the two superpowers.  Terms of the agreement are vague, with references to a reduction in tariffs, increase in agricultural purchases by China, and agreements to return to the bargaining table.

What is missing, though, are references to increases in protection of U.S. intellectual property: trade secrets, patents, copyrights, and trademarks, long espoused by the U.S.  This silence is in stark contrast to the stated goal of the U.S. that protection of U.S. intellectual property in China is among the key components to a successful and permanent trade deal.

The importance of such protection has been made manifest in several recent events.  The National Association of Manufacturers was hacked over the summer and blame was placed by investigators on Chinese nationals.  Earlier in the year, a former employee of a U.S. cast iron plant was sentenced to one year in prison after being arrested at the airport, en route to China with files of confidential information of his former employer.  Furthermore, China’s trademark register is full of foreign trademarks registered in China by its citizens.

China apparently has verbally committed as a part of an overall trade package to tighten up enforcement efforts in the IP arena.  But how does China quantify that commitment?  Such requires a change in the Chinese government’s mindset, its enforcement policies, and its recognition of the protectability of foreign trade secrets and other IP rights.  None of these can be reduced to tariff percentages, bushels or other common trade terms.  What can China offer in the way of a concrete plan to bolster protection of foreign confidential information?  Indeed, the silence of the parties as to this important issue is probably an indication of the difficulty the parties are having in reaching a verifiable agreement on IP.  With trust levels between the nations at their nadir, one can easily see how resolution of the IP protection issue may be a major stumbling block to a lasting trade agreement.  Will it become prohibitive?  Time will tell.

© 2019 Jones Walker LLP

More on IP agreements on the National Law Review Intellectual Property law page.

British Member of “The Dark Overlord” Hacking Organization Extradited to Face Conspiracy and Identify Theft Charges in the United States

Beginning in 2016, the computer hacking organization known as “The Dark Overlord,” began to target victims in the St. Louis, Missouri area, including various health care providers, several accounting firms, and a medical records company.  By remotely accessing these victims’ computer networks without authorization, The Dark Overlord was able to obtain sensitive records and information, which it then threatened to release unless the companies paid a ransom in bitcoin.

Following a lengthy investigation conducted by the Federal Bureau of Investigation and British authorities, United Kingdom national Nathan Wyatt was extradited to the United States and appeared before a federal district court in eastern Missouri on Wednesday, December 18, 2019, to face charges of aggravated identity theft, threatening damage to a protected computer, and conspiracy.  While Wyatt is the first member of The Dark Overlord to face prosecution, government officials have expressed a hope that this will signal to other cyber hackers targeting American companies that they will not be able to use territorial borders to evade justice and prosecution by the United States.

Copyright © 2019 Robinson & Cole LLP. All rights reserved.

Ferrero Successfully Enforces the Tic Tac Shape Mark in Italy

Many of us had a Tic Tac box in our pockets as kids, no matter the country we grew up in. Ferrero Spa (“Ferrero”), the Italian manufacturer of Tic Tac (and lots of other delicious confectionary products) registered the Tic Tac box as a trade mark in several jurisdictions, including Italy.

After succeeding before the CJEU in the invalidation action against BMB sp. z o.o. earlier this year (click here), in a recent case brought before the Italian courts, Ferrero successfully defended its shape marks, despite the invalidity claim brought by S.r.o. Mocca spol. (“Mocca”), a Czech company selling Bliki-branded mints in an identical container.

Background

In 2017, Ferrero commenced proceedings against Mocca for infringement of its 3D reputed trade marks, the earliest of which was registered in 1973, as well as unfair competition.

Mocca, on the other end, argued that:

  1. an Italian court had no jurisdiction, as Mocca’s mints were produced in the Czech Republic;
  2. Ferrero’s trade marks would be invalid, as the shape would give substantial value to the goods or would be necessary to obtain a technical result; and
  3. there would be no likelihood of confusion because the containers would carry different word marks and the shape of the mints is standard in the industry.

The court’s findings

The court of Turin determined that it did have jurisdiction to hear the case, as the claimant was enforcing Italian trade marks, irrespective of where the defendant resides. The court also noted that sales of the Bliki products had taken place in Italy, providing further reason for the Italian court’s jurisdiction.

With regard to the second argument brought by the defendant, the court found that Ferrero’s box shape is not necessary to obtain a technical result, although it had been previously registered as a patent. In fact, the patent was registered for the closing mechanism, which is not visible on the representation for the trade marks. Lastly, the court also denied that the shape gives substantial value to the goods, as Ferrero’s mints are also sold separately, and it has not been proved that the box influences the purchase experience.

In relation to the likelihood of confusion, the court noted that the only difference claimed by the defendant was the brand on the box. However, the brand (ie Bliki and Tic Tac) was irrelevant in this case, as Ferrero was enforcing its exclusive rights on the box shape rather than on the Tic Tac trade mark (which was not included in the 3D mark registrations). By contrast, the defendant box maintained the same shape and size of the Tic Tac mints.

As a result, the court determined that the Ferrero trade marks were valid and had been infringed. In addition, Mocca’s acts amount to unfair competition. Ferrero was awarded the legal costs of this matter, the payment of a penalty should any box be sold by Mocca after 60 days from the decision and the publication of the decision on a national newspaper. However, Ferrero was not awarded damages as no evidence was filed in this regard.

Implications

In comparison to traditional trade marks, protecting shape marks can be difficult, as their validity is likely to be challenged in the context of an infringement proceeding. Therefore, national registrations may be helpful tools to ensure an effective enforcement strategy. In addition, as shown in this case, trade mark holders should always consider registering shapes without brands or logos to achieve a greater overall protection.

Copyright 2019 K & L Gates

More on shape and trade marks on the National Law Review Intellectual Property law page.

Can We Really Forget?

I expected this post would turn out differently.

I had intended to commend the European Court of Justice for placing sensible limits on the extraterritorial enforcement of the EU’s Right to be Forgotten. They did, albeit in a limited way,[1] and it was a good decision. There.  I did it. In 154 words.

Now for the remaining 1400 or so words.

But reading the decision pushes me back into frustration at the entire Right to be Forgotten regime and its illogical and destructive basis. The fact that a court recognizes the clear fact that the EU cannot (generally) force foreign companies to violate the laws of their own countries in internet sites that are intended for use within those countries (and NOT the EU), does not come close to offsetting the logical, practical and societal problems with the way the EU perceives and enforces the Right to be Forgotten.

As a lawyer, with all decisions grounded in the U.S. Constitution, I am comfortable with the First Amendment’s protection of Freedom of Speech – that nearly any truthful utterance or publication is inviolate, and that the foundation of our political and social system depends on open exposure of facts to sunlight. Intentionally shoving those true facts into the dark is wrong in our system and openness will be protected by U.S. courts.

Believe it or not, the European Union also has such a concept at the core of its foundation too. Article 10 of the European Convention on Human Rights states that:

“Everyone has the right to freedom of expression. This right shall include freedom to hold opinions and to receive and impart information and ideas without interference by public authority and regardless of frontiers.”

So we have the same values, right? In both jurisdictions the right to impart information can be exercised without interference by public authority.  Not so fast.  The EU contains a litany of restrictions on this right, including a limitation of your right to free speech by the policy to protect the reputation of others.

This seems like a complete evisceration of a right to open communication if a court can force obfuscation of facts just to protect someone’s reputation.  Does this person deserve a bad reputation? Has he or she committed a crime, failed to pay his or her debts, harmed animals or children, stalked an ex-lover, or violated an oath of office, marriage, priesthood or citizenship? It doesn’t much matter in the EU. The right of that person to hide his/her bad or dangerous behavior outweighs both the allegedly fundamental right to freedom to impart true information AND the public’s right to protect itself from someone who has proven himself/herself to be a risk to the community.

So how does this tension play out over the internet? In the EU, it is law that Google and other search engines must remove links to true facts about any wrongdoer who feels his/her reputation may be tarnished by the discovery of the truth about that person’s behavior. Get into a bar fight?  Don’t worry, the EU will put the entire force of law behind your request to wipe that off your record. Stiff your painting contractors for tens of thousands of Euros despite their good performance? Don’t worry, the EU will make sure nobody can find out . Get fired, removed from office or defrocked for dishonesty? Don’t worry, the EU has your back.

And that undercutting of speech rights has now been codified in Article 17 of Regulation 2016/679, the Right to be Forgotten.

And how does this new decision affect the rule? In the past couple weeks, the Grand Chamber of the EU Court of Justice issued an opinion limiting the extraterritorial reach of the Right to be Forgotten. (Google vs CNIL, Case C‑507/17) The decision confirms that search engines must remove links to certain embarrassing instances of true reporting, but must only do so on the versions of the search engine that are intentionally servicing the EU, and not necessarily in versions of the search engines for non-EU jurisdictions.

The problems with appointing Google to be an extrajudicial magistrate enforcing vague EU-granted rights under a highly ambiguous set of standards and then fining them when you don’t like a decision you forced them to make, deserve a separate post.

Why did we even need this decision? Because the French data privacy protection agency, known as CNIL, fined Google for not removing presumably true data from non-EU search results concerning, as Reuters described, “a satirical photomontage of a female politician, an article referring to someone as a public relations officer of the Church of Scientology, the placing under investigation of a male politician and the conviction of someone for sexual assaults against minors.”  So, to be clear, while the official French agency believes it should enforce a right for people to obscure that they have been convicted of sexual assault against children from the whole world, the Grand Chamber of the European Court of Justice believes that the people convicted child sexual assault should be protected in their right to obscure these facts only from people in Europe. This is progress.

Of course, in the U.S., politicians and other public figures, under investigation or subject to satire or people convicted of sexual assault against children do not have a right to protect their reputations by forcing Google to remove links to public records or stories in news outlets. We believe both that society is better when facts are allowed to be reported and disseminated and that society is protected by reporting on formal allegations against public figures or criminal convictions of private ones.

I am glad that the EU Court of Justice is willing to restrict rules to remain within its jurisdiction where they openly conflict with the basic laws of other jurisdictions. The Court sensibly held,

“The idea of worldwide de-referencing may seem appealing on the ground that it is radical, clear, simple and effective. Nonetheless, I do not find that solution convincing, because it takes into account only one side of the coin, namely the protection of a private person’s data.[2] . . . [T]he operator of a search engine is not required, when granting a request for de-referencing, to operate that de-referencing on all the domain names of its search engine in such a way that the links at issue no longer appear, regardless of the place from which the search on the basis of the requester’s name is carried out.”

Any other decision would be wildly overreaching. Believe me, every country in the EU would be howling in protest if the US decided that its views of personal privacy must be enforced in Europe by European companies due to operations aimed only to affect Europe. It should work both ways. So this was a well-reasoned limitation.

But I just cannot bring myself to be complimentary of a regime that I find so repugnant – where nearly any bad action can be swept under the rug in the name of protecting a person’s reputation.

As I have written in books and articles in the past, government protection of personal privacy is crucial for the clean and correct operation of a democracy.  However, privacy is also the obvious refuge of scoundrels – people prefer to keep the bad things they do private. Who wouldn’t? But one can go overboard protecting this right, and it feels like the EU has institutionalized its leap overboard.

I would rather err on the side of sunshine, giving up some privacy in the service of revealing the truth, than err on the side of darkness, allowing bad deeds to be obscured so that those who commit them can maintain their reputations.  Clearly, the EU doesn’t agree with me.

[1] The Court, in this case, wrote, “The issues at stake therefore do not require that the provisions of Directive 95/46 be applied outside the territory of the European Union. That does not mean, however, that EU law can never require a search engine such as Google to take action at worldwide level. I do not exclude the possibility that there may be situations in which the interest of the European Union requires the application of the provisions of Directive 95/46 beyond the territory of the European Union; but in a situation such as that of the present case, there is no reason to apply the provisions of Directive 95/46 in such a way.”

[2] EU Court of Justice case C-136/17, which states, “While the data subject’s rights [to privacy] override, as a general rule, the freedom of information of internet users, that balance may, however, depend, in specific cases, on the nature of the information in question and its sensitivity for the data subject’s private life and on the interest of the public in having that information. . . .”

 

Copyright © 2019 Womble Bond Dickinson (US) LLP All Rights Reserved.

For more EU’s GDPR enforcement, see the National Law Review Communications, Media & Internet law page.

Internet of Things: The Global Regulatory Ecosystem and the Most Promising Smart Environments Part II

Regulatory Ecosystem

Hyperconnectivity is a real phenomenon and it is changing the concerns of society because of the kinds of interactions that can be brought about by IoT devices, which could be: i) People to people; ii) People to things (objects, machines); iii) Things/machines to things/machines.

It gives rise to different issues for people. According to a European Survey, 72% of EU Internet users worry that too much of their personal data is being shared online and that they have little control over what happens to this information[1]. It gives rise to inevitable ethical issues and its relationship with the techno environment.

The discussion on ethics that follows aims to provide a quick tour on general ethical principles and theories that are available as they may apply to IoT[2]. Law and ethics are overlapping, but ethics goes beyond law. Thus, a comparison of law and ethics is made and their differences are pointed out in the great work of Spyros G Tzafestas, who wrote Ethics and Law in the Internet of Things World. In this article, he considers that the risks and  harms in a digital world are very high and complex, especially explaining those tech terms and their impact in our private life. Thus, it is of primary importance to review IoT and understand the limitations of protective legal, regulatory and ethical frameworks, in order to provide sound recommendations for maximizing good and minimizing harm[3].

Major data security concerns have also been raised with respect to ‘cloud’-supported IoT. Cloud computing (‘the cloud’) essentially consists of the concentration of resources, e.g. hardware and software, into a few physical locations by a cloud service provider (e.g. Amazon Web Service)[4]. We are living in a data-sharing storm and the economic impact of IoT’s cyber risks is increasing with the integration of digital infrastructure in the digital economy[5]. We are surrounded by devices which contain our data, for instance:

  • Wearable health technologies: wearable devices that continuously monitor the health status of a patient or gather real-world information about the patient such as heart rate, blood pressure, fever;
  • Wearable textile technologies: clothes that can change their color on demand or based on the biological condition of the wearer or according to the wearer’s emotions;
  • Wearable consumer electronics: wristbands, headbands, rings, smart glasses, smart watches, etc[6].

As a result of the serious impact IoT may have and because it involves a huge number of connected devices, it creates a new social, political, economic, and ethical landscape. Therefore, for a sustainable development of IoT, political and economic decision-making bodies have to develop proper regulations in order to be able to control the fair use of IoT in society.

In this sense, the most developed regions as regards establishing IoT Regulations and an ethical framework are the European Union and the United States both of which have enacted:

  • Legislation/regulations.
  • Ethics principles, rules and codes.
  • Standards/guidelines;
  • Contractual arrangements;
  • Regulations for the devices connected;
  • Regulations for the networks and their security; and
  • Regulations for the data associated with the devices.

In light of this, the next section will deal with Data Protection Regulations, Consumer Protection Acts, IoT and Cyber Risks Laws, Roadmap for Standardization of Regulations, Risk Maturity, Strategy Design and Impact Assessment related with 2020 scenario, which is: 200 billion sensor devices and market size that, by 2025, will be between $2.7 trillion and $3 trillion a year.

Europe

The Alliance for Internet of Things Innovation (AIOTI) was initiated by the European Commission in order to open a stream of dialogue between European stakeholders within the Internet of Things (IoT) market. The overall goal of this initiative was the creation of a dynamic European IoT ecosystem to unleash the potential of IoT.

In October 2015, the Alliance published 12 reports covering IoT policy and standards issues. It provided detailed recommendations for future collaborations in the Internet of Things Focus Area of the 2016-2017 Horizon 2020 programme[7].

The IoT regulation framework in Europe is a growth sector:

  • EU Directive-2013/40: this Directive deals with “Cybercrime” (i.e., attacks against information systems). It provides definitions of criminal offences and sets proper sanctions for attacks against information systems[8].
  • EU NIS Directive 2016/1148: this Network and Information Security (NIS) Directive concerns “Cybersecurity” issues. Its aim is to provide legal measures to assure a common overall level of cybersecurity (network/information security) in the EU, and an enhanced coordination degree among EU Members[9].
  • EU Directive 2014/53: this Directive “On the harmonization of the laws of the member states relating to the marketing of radio equipment”[10] is concerned with the standardization issue which is important for the joint and harmonized development of technology in the EU.
  • EU GDPR: European General Data Protection Regulation 2016/679: this regulation concerns privacy, ownership, and data protection and replaces EU DPR-2012. It provides a single set of rules directly applicable in the EU member states.
  • EU Connected Communities Initiative: this initiative concerns the IoT development infrastructure, and aims to collect information from the market about existing public and private connectivity projects that seek to provide high-speed broadband (more than 30 Mbps).

United States

A quick overview of the general US legislation that protects civil rights (employment, housing, privacy, information, data, etc.) includes:

  • Fair Housing Act (1968);
  • Fair Credit Reporting Act (1970);
  • Electronic Communication Privacy Act (1986), which is applied to service providers that transmit data, the Privacy Act 1974 which is based on the Fair Information Practice Principle (FIPP) Guidelines;
  • Breach Notification Rule which requires companies utilizing health data to notify consumers that are affected by the occurrence of any data breach; and
  • IoT Cybersecurity Improvement Act 2019: the Bill seeks “[t]o leverage Federal Government procurement power to encourage increased cybersecurity for Internet of Things devices.” In other words, this bill aims to shore up cybersecurity requirements for IoT devices purchased and used by the federal government, with the aim of affecting cybersecurity on IoT devices more broadly.
  • SB-327 Information privacy: connected devices: California’s new SB 327 law, which will take effect in January 2020, requires all “connected devices” to have a “reasonable security feature.”

The above legislation is general, and in principle can cover IoT activities, although it was not designed with IoT in mind. Legislation devoted particularly to IoT includes the following:

  • White House Initiative 2012: the purpose of this initiative is to specify a framework for protecting the privacy of the consumer in a networked work.

This initiative involves a report on a ‘Consumer Bill of Rights” which is based on the so-called “Fair Information Practice Principles” (FIPP). This includes two principles:

  1. Respect for Context Principle: consumers have a right to insist that the collection, use, and disclosure of personal data by Companies is done in ways that are compatible with the context in which consumers provide the data;
  2. Individual Control Principle: consumers have a right to exert control over the personal data companies collect from them or how they use it.

China

Where we start to see the most advanced picture is in China. In 2017, the Ministry of Industry and Information Technology (MIIT), China’s telecom regulator and industrial policy maker, issued the Circular on Comprehensively Advancing the Construction and Development of Mobile Internet of Things (NB-IoT) (MIIT Circular [2017] No. 351, the “Circular”), with the following approach in the opening provisions:

Building a wide-coverage, large-connect, low-power mobile Internet of Things (NB-IoT) infrastructure and developing applications based on NB-IoT technology will help promote the construction of network powers and manufacturing powers, and promote “mass entrepreneurship, innovation” and “Internet +” development. In order to further strengthen the IoT application infrastructure, promote the deployment of NB-IoT networks and expand industry applications, and accelerate the innovation and development of NB-IoT[11]

Nowadays China already has a huge packet of regulation on technological matters:

  • 2015 State Council – China Computer Information System Security Protection Regulation (first in 1994);
  • 2007 MPS – Management Method for Information Security Protection for Classified Levels;
  • 2001 NPC Standing Committee – Resolution about Protection of Internet Security;
  • 2012 NPC Standing Committee – Resolution about Enhance Network Information Protection;
  • July 2015: National Security Law – ‘secure and controllable’ systems and data security in critical infrastructure and key areas;
  • 2014 MIIT – Guidance on Enhance Telecom and Internet Security;
  • 2013 MIIT – Regulation about Telecom and Internet Personal Information Protection
  • 2014 China Banking Regulatory Commission – Guidance for Applying Secure and Controllable Information;
  • Technology to Enhance Banking Industry Cybersecurity and Informatization Development

Further, as if this were not enough, the Chinese government is being proactive and has several important laws and regulations in the Pipeline, as it can be seen from the list below:

  • CAC: Administrative Measures on Internet Information Services;
  • CAC Rules on Security Protection for Critical Information Infrastructure;
  • Cybersecurity Law;
  • Cyber Sovereignty;
  • Security of Product and Service;
  • Security of Network Operation (Classified Levels Protection, Critical Infrastructure);
  • Data Security (Category, Personal Information);
  • Information Security.

Finally, China established, in 2016, the National Information Security Standardization Technical Committee and its current work is developing a Standardization – TC260 (IT Security) on Technical requirement for Industrial network protocol and general reference model and requirements for Machine-to-Machine (M2M) security.

Latin America

The Latin American countries have different levels of development and this sets up a huge asymmetry between the domestic legal frameworks. The following is a quick regulation overview on Latin American countries:

  • Brazil has the “National IoT Plan” (Decree N. 9.854/2019) that aims to ensure the development of public policies for this technology sector and members of Brazilian parliament presented the bill No. 7.656/17 with the purpose of eliminating tax charges on IoT products;
  • Colombia has a Draft of Law No. 152/2018 on the Modernization of the Information and Communication providing investments incentives to IT Techs (article 3);
  • Chile has a new Draft Law Boletín N° 12.192-25/2018 on Cyber crimes and regulation on internet devices and hackers attacks;
  • In 2017, Argentina launched a Public Consultation on IoT regarding regulations that must be updated and how to get more security and improve the technological level of the country[12].

Most Promising Smart Environments

Smart environments are regarded as the space within which IoT devices interact connected through a continuous network. Thus, smart environments aim to satisfy the experience of individuals from every environment, by replacing the hazardous work, physical labor and repetitive tasks with automated agents. Generally speaking, sensors are the basis of these kind of smart devices with many different applications e.g. Smart Parking, Waste Management, Smart Roads and Traffic Congestion, Air Pollution, River Floods, M2M Applications, Vehicle auto-diagnosis, Smart Farming, Energy and Water Uses, Medical and Health Smart applications, etc[13].

Another way of looking at smart environments and assess their relative capacity to produce business opportunities is to identify and examine the most important IoT use cases that are either already being exploited or will be fully exploited by 2020.

For the purposes of this article, the approach was restricted to sectors consisting of the most promising smart environments to be developed up to 2020 in the European Market as displayed in the Chart below:

Vertical IOT Market Size in Europe
Vertical IoT Market Size in Europe

 

The conclusions of the last report of the European Commission are impressive and can help to understand the continuous development of the IoT market and how every market has to comply with the law and they will emerge facing a regulatory avalanche as mentioned in item 2 on the Regulatory Ecosystem.

Final Considerations: IoT as Consumer Product Health and Safety

IoT safety is becoming more important every day. On the one hand, as mentioned above, most concerns for IoT safety are primarily in the areas of cyber-attacks, hacking, data privacy, and similar topics; what is better referred to as security than safety. On the other hand, it can be approached by physical safety hazards which may result from the operation of consumer products in an IoT environment or system. IoT provides a new way to approach business and it is not restricted to one or other market or topic. It is a metatopic or metamarket showing different possibilities and applications and will be spread in the near future.

In general, IoT products are electrical or electronic applications with a power source and a battery connected by a charging device. So long as the power source, batteries and charging devices are present we have the usual risks of electrical related hazards (fire, burns, electrical shock, etc.). Nonetheless, IoT makes matters more complicated as smart devices have the function to send commands and control devices in the real world.

IoT applications can switch the main electrical powers of secondary products or can operate complex motor systems and so on. Then they have to be accurate and might provide minimal requirements to care of consumer health and safety. Risk assessment and hazard mitigations will have to adapt to IoT applications reinventing new methods to assure regular standards of IoT usability. Traditional health and safety regulations might be up to date with this new technological reality to be effective at reducing safety hazards for consumer products.

To conclude, this article was intended to summarize two main issues: I) IoT as an increasing and cross topic market which will become a present reality closer to our daily lives; II) IoT will be regulated and become an important concern in consumer product health and safety.

See the first Installment of the IoT:  Seizing the Benefits and Addressing the Challenges and the Vision of IoT in 2020.

[1] Nóra Ni Loideain. Port in the Data-Sharing Storm: The GDPR and the Internet of Things. King’s College London Dickson Poon School of Law Legal Studies Research Paper Series: Paper No. 2018-27.P2.

[2] Spyros G Tzafestas. Ethics and Law in the Internet of Things World. Smart Cities 2018, 1(1), 98-120. P. 102.

[3] Spyros G Tzafestas. Ethics and Law in the Internet of Things World. Smart Cities 2018, 1(1), 98-120. P. 99;

[4] Nóra Ni Loideain. Port in the Data-Sharing Storm: The GDPR and the Internet of Things. King’s College London Dickson Poon School of Law Legal Studies Research Paper Series: Paper No. 2018-27.P. 19.

[5] Petar Radanliev, David Charles De Roure and others. Definition of Internet of Things (IoT) Cyber Risk – Discussion on a Transformation Roadmap for Standardization of Regulations, Risk Maturity, Strategy Design and Impact Assessment. Oxford University. MPRA Paper No. 92569, March 2019, P. 1.

[6] pSyros G Tzafestas. Ethics and Law in the Internet of Things World. Smart Cities 2018, 1(1), 98-120. P. 101; https://doi.org/10.3390/smartcities1010006

[7] More information available here.

[8] EUR-Lex Document 32013L0040. Directive 2013/40/EU of the European Parliament and the Council of 12 August 2013. Available here.

[9] NIS Directive. The Directive on Security of Network and Information Systems.

[10] EUR-Lex Document 32014L0053. Directive 2014/53/EU of the European Parliament and the Council of 16 April 2014.

[11] Notice of the General Office of the Ministry of Industry and Information Technology on Promoting the Development of Mobile Internet of Things. Department of Industry communication letter [2017] No. 351.

[12] Available here.

[13] More examples

Copyright © 2019 Compliance and Risks Ltd.
This article was written by João Pedro Paro from Compliance & Risks.

Brexit: Can the Remainers Stop a No-Deal Brexit?

Brexit has driven fault lines through British politics as seen at no time since the 1680s. Fervent ‘leavers’ and fervent ‘remainers’ can be found in both of the main political parties, although most favour various compromise options in between.

This is reflected in the composition of the UK Parliament and has resulted in an impasse, with Parliament rejecting both the transitional ‘deal’ to leave the EU negotiated by former Prime Minister Theresa May at the end of 2018 and the prospect of leaving the EU without a deal – a ‘no deal’ Brexit. The election of Boris Johnson as the new UK prime minister and his appointment of a government leaning firmly towards leaving the EU, with or without a deal on October 31, 2019, throws up some distinctive legal challenges: If a new deal cannot be struck with the EU, is a no-deal Brexit inevitable, or can the remainer MPs stop it?

Concluding a new deal with the EU by October 31 is challenging, not least given the limited time available for negotiating it and having it approved by the European and UK Parliaments. This is compounded by the complexity of the issues the UK government seeks to renegotiate, particularly the Irish backstop, and the EU’s no-renegotiation stance – although it has indicated willingness to revisit the nature of the future relationship between the EU and UK.

The legal position on a no-deal Brexit is set out in the European Union (Withdrawal) Act 2018, as amended in April 2019. This Act sets Brexit date at October 31, 2019. It also requires Parliament to approve any withdrawal agreement with the EU. What it does not require is that there should, in fact, be a withdrawal agreement. Consequently, the Act does not require parliamentary consent for a ‘no deal’ Brexit. Prime Minister Johnson does not, accordingly, need to secure any parliamentary majority for this. And since the Act will prevail over any parliamentary vote to reject a no-deal Brexit, he does not have to comply with any vote passed to the contrary.

The first legal route open to remainer MPs is to seek to amend the 2018 Act. The problem that they would have is timing. Parliament is in recess until September 3. There is usually a further recess from mid-September to the second week in October for the party conference season. Even if the second recess were to be abandoned, there is insufficient time for an amending bill to be passed before October 31 using normal parliamentary procedures. There is provision for emergency legislation to be passed very quickly, but this would require a consensus among all parties and the support of the government, both of which seem unlikely given the split between remainers and leavers within the main parties and the new government’s express intention to achieve Brexit by October 31.

The second legal route open to remainer MPs is to force a general election. Under the terms of the UK Fixed-term Parliaments Act 2011, Leader of the Opposition Jeremy Corbyn would need to propose a motion of no confidence in Prime Minister Johnson’s government. At present, the Conservatives have a majority of one in Parliament, but only with the support of the Democratic Unionist Party from Northern Ireland. However, a number of Conservative MPs have indicated that they would be prepared to bring their own government down on this issue. An unknown factor is whether leaver MPs in the Labour Party are prepared to abstain or even vote against such a motion.

A motion of no confidence under the 2011 Act requires only a simple majority of MPs voting in favour. However, there are still timing issues. The earliest that such a motion can be proposed is September 3. If passed, it would trigger a cooling-off period of 14 days for an alternative government to be formed. At the end of this period, if, as he would be entitled to do, Mr Johnson were to remain prime minister, UK electoral law would require him to announce the date for a general election within a further 25 days. However, there is no requirement for the election actually to be held within a particular time. Although the Queen must be consulted about the date, this is a formality. Prime Minister Johnson would, therefore, be within his constitutional rights to call an election only after the October 31 Brexit deadline has passed and the UK has left the EU.

Remain supporters have indicated that their strategy, if they are able to force an election, would be to rely on the legal status of the ‘standstill’ or status quo convention to prevent a no-deal Brexit on October 31. When an election is called, the government immediately becomes a caretaker administration. By parliamentary convention (‘convention’ in the sense of accepted practice), this administration should not embark on any major new projects and may not use the UK civil service for such a purpose. Cabinet Secretary Sir Mark Sedwill, the head of the civil service, is reported as having expressed the view that the ‘standstill’ in this situation would be that the UK remains in the EU. However, government spokespersons have said that this would involve the civil service effectively acting in contravention of the 2018 Withdrawal Act.

It seems likely, if this scenario develops, that the matter will be referred to the UK Supreme Court. The British constitution is not written down and relies on many traditions and convention, some of considerable antiquity. However, there is precedent in a December 2018 Supreme Court case, which decided that the legislative consent motions passed by the Scottish Parliament under the Scotland Act 1998 could not be used to affect the validity of the 2018 Withdrawal Act. It had been argued that the convention requiring the Scottish government to be consulted on any UK legislation that involved matters devolved to Scotland was absolute. The Supreme Court disagreed, on the basis that a convention could not take precedence over a statute. On this basis, any reference to the Supreme Court seeking to block the operation of the 2018 Act through convention would likely fail.

It is often said ‘a week is a very long time in politics’. Prime Minister Johnson may be able to secure some last-minute concessions from the EU negotiators enabling a withdrawal agreement to be approved by Parliament, but this looks challenging. Legal routes to block Brexit are also likely to meet several hurdles. Consequently, at this stage, Britain’s exit from the EU on October 31 looks the more likely outcome. Whether that means an abrupt departure from the EU, or whether a managed ‘no-deal’ Brexit could be achieved through negotiation and agreement on key matters, remains to be seen.

©2019 Greenberg Traurig, LLP. All rights reserved.
This article was written by Gillian Sproul at Greenberg Traurig, LLP.
For more Brexit developments, please see the Global Law page on the National Law Review.