Category: Uncategorized

Canada Releases New Data Breach Regulations

In a recent post, we discussed the Canadian Cabinet’s announcement that Canada’s new data breach regulations go into effect on November 1, 2018. Despite announcing the effective date, Canada had not yet finalized these regulations.  However, on April 18, 2018, Canada unveiled the Breach of Security Safeguard Regulations: SOR/2018-64 (“Regulations”).

To highlight some of the finer points, in order to trigger notification requirements, the Regulations require organizations to determine if a data breach poses a “real risk of significant harm” to any individual had their information accessed in the breach.  If an organization meets this harm threshold, then the affected organization must notify the Privacy Commissioner of Canada, as well as the affected individuals.

As far as reporting, the notification to the Commissioner must describe the circumstances of the breach, the time period, the personal information accessed, the number of individuals compromised, steps taken to reduce harm to those individuals, steps taken to notify those individuals and an organization point of contact who can answer any follow-up questions regarding the breach. The notification to the individuals requires the affected organization to disclose similar information.  As far as the communication mechanism of the individual notification, the Regulations give affected organizations flexibility to use any form of communication that a reasonable person would consider appropriate, such as phone, email or advertisement.

Interestingly, rather than specifying a strict time frame for notification, the Regulations require such notification to be completed “as soon as feasible.” In providing this flexibility, the Cabinet recognized that it takes time for organizations to gather all necessary information.  Lastly, the Regulations establish a mandatory minimum of two years for the maintenance of all records related to the breach.

It is interesting to note that these Regulations bare some similarity to the European Union’s (“EU”) new General Data Protection Regulation (“GDPR”), which goes into effect on May 25, 2018. For example, similar to GDPR, the Regulations have harsh penalties. In particular, the Regulations impose fines up to $100,000 CAD for each affected individual of a breach, whereas a violation of the GDPR can carry with it a fine of up to four percent (4%) of annual global turnover or €20 Million, whichever is greater.  Overall, the Regulations demonstrate a clear message that Canada would like to align as much as possible with the GDPR to try to maintain Canada–EU trade relationships.

This post was written by Dena M. Castricone, Daniel J. Kagan and Brad Davis of Murtha Cullina

© Copyright 2018 Murtha Cullina

Terminal Disclaimer Does Not Establish Claim Preclusion

Addressing claim preclusion, the US Court of Appeals for the Federal Circuit reversed a district court’s dismissal of a complaint as barred by claim preclusion and the Kessler doctrine. SimpleAir, Inc. v. Google LLC, Case No. 16-2738 (Fed. Cir., Mar. 12, 2018) (Lourie, J).

SimpleAir obtained a family of patents including a parent patent and several child patents claiming continuation priority back to the parent patent. During prosecution, SimpleAir filed terminal disclaimers in each child patent to overcome obviousness-type double patenting rejections.

After the patents issued, SimpleAir filed several patent infringement lawsuits against Google’s cloud messaging and cloud-to-device messaging services. In the first lawsuit, a jury found infringement of one of the child patents, but the Federal Circuit reversed the verdict. In the second lawsuit, a jury found non-infringement of a different child patent. SimpleAir then filed a third lawsuit, asserting infringement of two different child patents. Google moved to dismiss SimpleAir’s complaint (under Fed. R. Civ. Pro. 12(b)(6)) on the basis that it was barred by claim preclusion and the Kessler doctrine. The district court agreed, reasoning that (1) the two patents shared the same specification with the previously adjudicated child patents, and (2) the filing of the terminal disclaimers indicated that the US Patent and Trademark Office believed the patents-in-suit were patentably indistinct from the earlier patents. Concluding that the various child patents claimed the same underlying invention, the district court dismissed SimpleAir’s complaint. SimpleAir appealed.

On appeal, the Federal Circuit found the district court record insufficient to sustain the district court’s dismissal. The Court agreed that the various lawsuits and child patents substantially overlapped, but ultimately found that the district court never analyzed the claims of any patent in reaching its conclusion that the child patents claimed the same invention. The Court also rejected the district court’s reliance on terminal disclaimers:

[A] terminal disclaimer is a strong clue that a patent examiner and, by concession, the applicant, thought the claims in the continuation lacked a patentable distinction over the parent. But as our precedent indicates, that strong clue does not give rise to a presumption that a patent subject to a terminal disclaimer is patentably indistinct from its parent patents. It follows that a court may not presume that assertions of a parent patent and a terminally-disclaimed continuation patent against the same product constitute the same cause of action. Rather, the claim preclusion analysis requires comparing the patents’ claims along with other relevant transactional facts.

Because the district court did not specifically consider the claims, the Federal Circuit found insufficient basis for claim preclusion.

Google also argued that if claim preclusion did not apply, then the Kessler doctrine barred SimpleAir’s claims. The Kessler doctrine is based on a 1907 Supreme Court of the United States decision that protects a party’s rights to continue a practice that had been accused of infringement where an earlier judgment found that essentially the same activity did not infringe the patent. However, the Federal Circuit explained that the doctrine has not been applied to bar a broader set of rights than would have been barred by claim preclusion. The Court declined to do so, explaining, “Google asks us to subsume claim preclusion within a more expansive, sui generis Kessler doctrine. But the Kessler doctrine just fills a particular temporal gap between preclusion doctrines . . . it does not displace them.”

Practice Note: Claim preclusion does not apply where claims of an asserted patent are not the same as claims of an earlier litigated patent from same family—unless the court determines the asserted claims are narrower than the previously litigated claim.

© 2018 McDermott Will & Emery
This article was written by Hersh Mehta of McDermott Will & Emery

Supreme Court Decides Oil States – Inter Partes Review Does Not Violate Article III or the 7th Amendment

The Supreme Court issued its long-awaited opinion in Oil States Energy Services v. Greene’s Energy Group, Appeal No. 16-712 (April 24, 2018), holding 7/2 that inter parties review was an appropriate exercise of the power of Congress to assign adjudication of public rights to the USPTO, and is not required to assign such adjudications to Article III courts for resolution by a jury trial. To reach this conclusion, the Court held that the grant of a patent falls within the public rights doctrine, as a matter “arising between the government and others” and that IPR is “simply a reconsideration of that grant” that Congress has reserved to the PTO.

The Court minimized the procedures unique to IPR by reasoning that IPR involves the same interests as the original grant of a patent, and analogized the grant or cancellation of a patent to the qualification of other “public franchises” by Congress.

Although we often hear that a “strict constructionist” Justice believes in deciding cases based on what the Founding Fathers intended when they considered questions of law, such as by disregarding the first “militia clause” of the 2d amendment, I think that this opinion is unusual in the depth of the historical review of patent validity determiners as it relates to the present case. While the Court cites some 19th century precedent in deciding the “public rights” question, this is just a warm-up of the “Way Back Machine” that the Court is will use to look at really old decisions regarding the review of granted patents:

“The Patent Clause in our Constitution ‘was written against the backdrop’ of the English system. Based on the practice of the Privy Council [that invalidated British patents until 1779], it was well understood at the founding that a patent system could include a practice of granting patents subject to potential cancellation in the executive proceeding of the Privy Council. The parties have cited nothing in the text or history of the Patent Clause or Article III to suggest that the Framers were not aware of this common practice. Nor is there any reason to think they excluded this practice during their deliberations.” Slip. op. at 14.

I can hear the ghost of Justice Scalia toasting this imaginative investigation about the Framers’ state of mind when they wrote the patent clause of the Constitution. These are two “negatives” that Oil States could not disprove.

The dissent tried, arguing that the IPR procedures undermine judicial independence, which the Founding Fathers sought to protect: “Only courts could hear patent challenges in England at the time of the founding.” But tradition only goes so far and the Court “disagreed with the dissent’s assumption that, because courts have traditionally adjudicated patent validity in the courts, courts must forever do so…That Congress chose the courts in the past does not foreclose its choice of the PTO today.” Slip op. at 14-15.

The dissent also argued that the majority’s decision endorsed an unfair weakening of patentee’s rights: “To reward those who had proven the social utility of their work (and to induce other to follow suit), the law long afforded patent holders more protection … against the treat of governmental intrusion and dispossession.” Slip. op. at 10-11 (Gorsuch, dissenting).

Finally, the Court dismissed the 7th Amendment challenge “because inter partes review is a matter that Congress can properly assign to the PTO, a jury is not necessary in these proceedings”.

The arguments presented by the minority suggest that the majority is adopting an anti-patent position, a question that the majority attempts to skirt. In any case, we appear to be stuck with inter partes review, including the tensions and uncertainty provided by inconsistent rulings by the courts. The Framers may or may not have intended that validity disputes be settled in court, but it’s a pretty sure bet that they never envisioned anything like the Mad Hatter’s tea party that Alice (get it) tried to make sense of.

© 2018 Schwegman, Lundberg & Woessner, P.A. All Rights Reserved.
This article was written by Warren Woessner of Schwegman, Lundberg & Woessner, P.A.

B is for “Bias” – Is Bias The Not-So-New Cause of Discrimination?

Starbucks made national news earlier this month when two black men were arrested after refusing to leave a store.  News accounts reported that a store manager called 911 after the men remained in the store and asked to use the restroom but had not yet made a purchase.  The fallout from this event was notable to say the least: protests, calls for boycotts, and even an apology from the CEO.  The incident further has sparked a discussion on implicit bias, especially after the national restaurant chain announced that it would close thousands of stores for an afternoon to conduct companywide bias training for its employees. The looming question for employers is what, if anything, should we be doing to make sure this doesn’t happen to us?

The first thing to do is pause and take a breath.  The process of avoiding liability stemming from bias is actually not unlike other anti-discrimination initiatives.  While not intended to be an exhaustive list, these suggestions should sound familiar: 1) train managers well, 2) instill rules for handling common issues, and 3) take complaints seriously.

With Starbucks’ announcement to roll out implicit bias training, other employers might be wondering, should we be doing that?  First, not all employers are positioned to call in every major civil rights organization to lead anti-bias training (like Starbucks is doing).  Nonetheless, new employee and management training can still be crafted to effectively promote an anti-bias, anti-discrimination workplace.   Consider the location and the employee population – some report that the location of the Starbucks store was in a gentrified neighborhood where racial tensions exist.  Should targeted training be implemented in these areas?  Also, consider the type of work the employees perform and whether it requires much public interaction, such as retail or customer service.  Factors such as these may help identify where anti-bias training can be most effective.

Also, what about the concept of prescribed rules?  One aspect complicating the Starbucks story was the absence of a corporate policy for handling restroom use, responding to potential trespassers, etc.  If your employees encounter situations where implicit bias could creep in to impact their decisions, does it make sense to adopt a rule explaining how to handle those situations?

And of course, the one piece of advice we all know well – take complaints seriously (including complaints from customers)!  While employers don’t always receive a complaint prior to finding themselves in a sticky issue, employee and customer complaints can signal the need for preventative action.  Employers can’t know every potential bias-based issue (indeed, it’s not called “explicit bias”), but these issues grow much worse when a complaint existed but was overlooked or ignored.

© 2018 BARNES & THORNBURG LLP
This article was written by Jackie S. Gessner of Barnes & Thornburg LLP

Arizona Law Aimed at Curbing Service Dog Fraud May Be All Bark, No Bite (US)

Under federal and Arizona state law, persons with disabilities can bring service animals—all breeds of dog and miniature horses—into places of public accommodation (businesses open to the public) even if the business otherwise excludes pets. No specific training or certification program is required to qualify as a service animal, nor are such animals required to wear any particular vests, leashes, or other identifying gear. Owners are not required to carry any papers proving that their animals are service animals. In fact, business owners are limited to asking persons with disabilities if (1) the dog or miniature horse is a service animal required because of a disability, and (2) what work or task the animal has been trained to perform.

Because there are so few restrictions on individuals bringing animals into places of public accommodation, many business owners report situations when patrons have brought pets or comfort animals into their businesses trying to pass them off as legitimate service animals. But without the ability to inquire further or any meaningful consequence for persons who try to fraudulently represent their pets as service animals, business owners have been limited to excluding such animals only if they present a current threat to the health or safety of others, are not housebroken, or if the animal’s presence fundamentally alters the business’ service, program, or activity or poses an undue burden.

To try to remedy this, Arizona lawmakers recently passed a bill, which Gov. Ducey signed into law, making it illegal to misrepresent a pet as a service animal or service animal-in-training, and creating civil penalties of up to $250 for each violation. Critics say the law will have little practical impact, as it does not expand the type of questions business owners can ask or require that owners carry papers certifying the animal as a service animal. Business owners must still accept patrons at their word that an animal is a service animal that helps them perform a particular task; it is the rare individual who would volunteer that he or she is trying to falsely represent their pet as a service animal. Disability advocates worry the measure will prompt business owners to ask impermissible questions of disabled patrons—particularly those with non-visible disabilities like post-traumatic stress disorder (PTSD) or epilepsy—in an attempt to get them to admit that the animal is not, in fact, aiding them with their disability needs, and that calls to law enforcement to report suspected abuse of service animal accommodations will escalate.

When the law goes into effect this fall, Arizona business owners can take comfort knowing that abusers of animal accommodations may be subject to significant fines, but should still be sure to adhere to restrictions on what they can and cannot ask of patrons bringing animals into their businesses. The law does not permit business owners to demand proof of the person’s disability, the animal’s training, or any form of certification or identification, and the failure or refusal by patrons to produce such information is not a violation of the law, but business owners insisting that patrons produce such proof is a violation of disability law. Business owners still should exclude patrons with service animals only where the animal’s very presence would fundamentally alter the nature of the business or where the animals pose a safety risk.

 

© Copyright 2018 Squire Patton Boggs (US) LLP.

Bankruptcy Venue Reform: Are The District of Delaware And The Southern District Of New York At Risk?

How real is the threat to the District of Delaware and the Southern District of New York as the prime venue choices for corporate Chapter 11 bankruptcy cases?  It appears that both are safe, at least for now.

Venue for bankruptcy cases is governed by 28 U.S.C § 1408, which provides that corporations may file in the district (a) in which their “domicile, residence, principal place of business in the United States, or principal assets in the United States” have been located during a majority of the prior 180 days, or (b) in any district where an affiliate, general partner or partnership has filed using any of these provisions. Because many companies are incorporated in Delaware, the District of Delaware has been a prime beneficiary of section 1408 and many of the countries’ largest bankruptcies have historically been filed in Delaware.  Similarly, because many companies have their principal assets in the Southern District of New York, many large cases have been filed there as well.  But what is perhaps most problematic is the use of affiliates, even affiliates which are insignificant in size and in importance, to establish venue in the District of Delaware and the Southern District of New York for the entire corporate enterprise even when the enterprise, as a whole, has only tangential contact with these venues.  Often this appears to be done at the behest of lenders or bankruptcy professionals located in those districts.

Critics have long argued that section 1408 encourages forum shopping, resulting in an unwarranted concentration of large bankruptcy cases in only these two jurisdictions.  Statistics bear out these concerns.  For the year 2017, 10% of all Chapter 11 business filings were made in the District of Delaware and 8% of all Chapter 11 business filings were made in the Southern District of New York.  Taken together, 18% of the Chapter 11 business cases filed last year were filed in these two jurisdictions alone.  Critics complain that this concentration is unfair to those creditors and other parties in interest who are not located in either Delaware or the Southern District of New York, and who therefore must travel, and obtain local counsel, in order to meaningfully participate in the bankruptcy cases.

In January 2018, Senators John Cornyn (R-Tex.) and Elizabeth Warren (D-MA) introduced S. 2282, which was referred to the Senate Judiciary Committee.  Titled the “Bankruptcy Venue Reform Act of 2018”, S. 2282 would modify section 1408 to provide that a corporate debtor could only file a Chapter 11 case in the district where its principal assets or principal place of business in the United States have been located for the 180 days prior to the filing or for a longer portion of the 180-day period than the principal place of business or principal assets in the United States were located in any other district. Additionally, the affiliate rule of obtaining venue would be tightened so that the first filing affiliate must directly or indirectly own, control, be the general partner of or hold 50% or more of the outstanding voting securities of the entity that is the subject of the later filed case.  Moreover, S. 2282 provides that consideration shall not be given, for purposes of venue, to changes in the ownership, control or location of assets made within the year prior to the bankruptcy or to changes made specifically for the purposes of establishing venue.

Not surprisingly, representatives from the affected districts have opposed the bill.  The Governor of Delaware, John Carney (D), Delaware’s two senators, Tom Carper (D) and Chriss Coons (D), and Delaware’s lone Representative Lisa Blunt Rochester (D) issued a statement opposing the bill, arguing that the change in the venue provisions would negatively impact both Delaware’s economy and the national economy as well:

Many American companies, large and small, choose to incorporate in Delaware because of the expertise and experience of our judges, attorneys, and business leaders. Denying American businesses the ability to file for bankruptcy in the courts of their choice would not only hurt Delaware’s economy but also hurt businesses of all sizes and the national economy as a whole. This is a misguided policy, and we strongly oppose it[.] …  Our economy thrives when the bankruptcy system is fair, predictable, and efficient. Experienced bankruptcy judges are critical to ensuring that companies can restructure in a way that saves jobs and preserves value. Scrapping the venue laws that have been in place for decades and replacing them with restrictions flies in the face of well-settled principles of corporate law, threatens jobs, and hurts our economy.

So what are the chances for this venue reform bill to pass.? Not good, at least during this Congressional year.  The bill remains in the Senate Judiciary Committee and there is little indication that it will gain traction in the Committee, much less see a Senate floor vote, during the 115thCongress. Given the rapidly approaching August recess, and then the November midterm elections, it is extremely doubtful that the bill will pass the Senate this year, let alone the House (where it has not even been introduced).  Of course, if the bill is not passed this Congress, it could be re-introduced in the next Congress.  However, given the lack of movement in Committee and the minimal number of co-sponsors, it is highly questionable whether this bill will ultimately garner the necessary support to pass in Committee, the Senate, and ultimately the House.  The wild card may be the post-election constituency of the Senate and House as new members may take some interest in this issue.

© Copyright 2018 Squire Patton Boggs (US) LLP
This article was written by Mark A. Salzberg of Squire Patton Boggs (US) LLP

DEA Proposed Rule Would Limit Drug Manufacturer’s Annual Opioid Production

In yet another development on the fight to address the opioid epidemic, U.S. Attorney General Jeff Sessions announced on Tuesday, April 17th that the U.S. Drug Enforcement Administration (“DEA”) will issue a Notice of Proposed Rulemaking (“NPRM”) amending the controlled substance quota requirements in 21 C.F.R. Part 1303. The Proposed Rule was published in the Federal Register yesterday and seeks to limit manufacturers’ annual production of opioids in certain circumstances to “strengthen controls over diversion of controlled substances” and to “make other improvements in the quota management regulatory system for the production, manufacturing, and procurement of controlled substances.”[1]

Under the proposed rule, the DEA will consider the extent to which a drug is diverted for abuse when setting annual controlled substance production limits. If the DEA determines that a particular controlled substance or a particular company’s drugs are continuously diverted for misuse, the DEA would have the authority to reduce the allowable production amount for a given year. The objective is that the imposition of such limitations will “encourage vigilance on the part of opioid manufacturers” and incentivize them to take responsibility for how their drugs are used.

The proposed changes to 21 C.F.R. Part 1303 are fairly broad, but could lead to big changes in opioid manufacture if implemented. We have summarized the relevant changes below.

Section 1303.11: Aggregate Production Quotas

Section 1303.11 currently allows the DEA Administrator to use discretion in determining the quota of schedule I and II controlled substances for a given calendar year by weighing five factors, including total net disposal and net disposal trends, inventories and inventory trends, demand, and other factors that the DEA Administrator deems relevant. Now, the proposed rule seeks to add two additional factors to this list, including consideration of the extent to which a controlled substance is diverted, and consideration of U.S. Food and Drug Administration, Centers for Disease Control and Prevention, Centers for Medicare and Medicaid Services, and state data on legitimate and illegitimate controlled substance use. Notably, the proposed rule allows states to object to proposed, potentially excessive aggregate production quota and allows for a hearing when necessary to resolve an issue of material fact raised by a state’s objection.

Section 1303.12 and 1303.22: Procurement Quotas and Procedure for Applying for Individual Manufacturing Quotas

Sections 1303.12 and 13030.22 currently require controlled substance manufactures and individual manufacturing quota applicants to provide the DEA with its intended opioid purpose, the quantity desired, and the actual quantities used during the current and preceding two calendar years. The DEA Administrator uses this information to issue procurement quotas through 21 C.F.R. § 1303.12 and individual manufacturing quotas through 21 C.F.R. § 1303.22. The proposed rule’s amendments would explicitly state that the DEA Administrator may require additional information from both manufacturers and individual manufacturing quota applicants to help detect or prevent diversion. Such information may include customer identities and the amounts of the controlled substances sold to each customer. As noted, the DEA Administrator already can and does request additional information of this nature from current quota applicants. The proposed rule would only provide the DEA Administrator with express regulatory authority to require such information if needed.

Section 1303.13: Adjustments of Aggregate Production Quotas

Section 1303.13 allows the DEA administrator to increase or reduce the aggregate production quotas for basic classes of controlled substances at any time. The proposed rule would allow the DEA Administrator to weigh a controlled substance’s diversion potential, require transmission of adjustment notices and final adjustment orders to a state’s attorney general, and provide a hearing if necessary to resolve material factual issues raise by a state’s objection to a proposed, potentially excessive adjusted quota.

Section 1303.23: Procedures for Fixing Individual Manufacturing Quotas

The proposed rule seeks to amend Section 1303.23 to deem the extent and risk of diversion of controlled substances as relevant factors in the DEA Administrator’s decision to fix individual manufacturing quotas. According to the proposed rule, the DEA has always considered “all available information” in fixing and adjusting the aggregate production quota, or fixing an individual manufacturing quota for a controlled substance. As such, while the proposed rule’s amendment may require manufacturers to provide the DEA with additional information for consideration, it is not expected to have any adverse economic impact or consequences.

Section 1303.32: Purpose of Hearing 

Section 1303.32 currently grants the DEA Administrator to hold a hearing for the purpose of receiving factual evidence regarding issues related to a manufacturer’s aggregate production quota. The proposed rule would amend this section to conform to the amendments to sections 1303.11 and 1303.13 discussed herein, allowing the DEA Administrator to explicitly hold a hearing if he/she deems a hearing to be necessary under sections 1303.11(c) or 1303.13(c) based on a state’s objection to a proposed aggregate production quota.

Industry stakeholders will have an opportunity to submit comments for consideration by the DEA by May 4, 2018.

[1] DEA, NPRM 21 C.F.R. Part 1303 (Apr. 17, 2018).

 

©2018 Epstein Becker & Green, P.C. All rights reserved.

Don’t Gamble with the GDPR

The European Union’s (EU) General Data Protection Regulation (GDPR) goes into effect on May 25, and so do the significant fines against businesses that are not in compliance. Failure to comply carries penalties of up to 4 percent of global annual revenue per violation or $20 million Euros – whichever is highest.

This regulatory rollout is notable for U.S.-based hospitality businesses because the GDPR is not just limited to the EU. Rather, the GDPR applies to any organization, no matter where it has operations, if it offers goods or services to, or monitors the behavior of, EU individuals. It also applies to organizations that process or hold the personal data of EU individuals regardless of the company’s location. In other words, if a hotel markets its goods or services to EU individuals, beyond merely having a website, the GDPR applies.

The personal data at issue includes an individual’s name, address, date of birth, identification number, billing information, and any information that can be used alone or with other data to identify a person.

The risks are particularly high for the U.S. hospitality industry, including casino-resorts, because their businesses trigger GDPR-compliance obligations on numerous fronts. Hotels collect personal data from their guests to reserve rooms, coordinate event tickets, and offer loyalty/reward programs and other targeted incentives. Hotels with onsite casinos also collect and use financial information to set up gaming accounts, to track player win/loss activity, and to comply with federal anti-money laundering “know your customer” regulations.

Privacy Law Lags in the U.S.

Before getting into the details of GDPR, it is important to understand that the concept of privacy in the United States is vastly different from the concept of privacy in the rest of the world. For example, while the United States does not even have a federal law standardizing data breach notification across the country, the EU has had a significant privacy directive, the Data Protection Directive, since 1995. The GDPR is replacing the Directive in an attempt to standardize and improve data protection across the EU member states.

Where’s the Data?

Probably the most difficult part of the GDPR is understanding what data a company has, where it got it, how it is getting it, where it is stored, and with whom it is sharing that data. Depending on the size and geographical sprawl of the company, the data identification and audit process can be quite mind-boggling.

A proper data mapping process will take a micro-approach in determining what information the company has, where the information is located, who has access to the information, how the information is used, and how the information is transferred to any third parties. Once a company fully understands what information it has, why it has it, and what it is doing with it, it can start preparing for the GDPR.

What Does the Compliance Requirement Look Like in Application?

One of the key issues for GDPR-compliance is data subject consent. The concept is easy enough to understand: if a company takes a person’s personal information, it has to fully inform the individual why it is taking the information; what it may do with that information; and, unless a legitimate basis exists, obtain express consent from the individual to collect and use that information.

In terms of what a company has to do to get express consent under the GDPR, it means that a company will have to review and revise (and possibly implement) its internal policies, privacy notices, and vendor contracts to do the following:

  • Inform individuals what data you are collecting and why;

  • Inform individuals how you may use their data;

  • Inform individuals how you may share their data and, in turn, what the entities you shared the data with may do with it; and

  • Provide the individual a clear and concise mechanism to provide express consent for allowing the collection, each use, and transfer of information.

At a functional level, this process entails modifying some internal processes regarding data collection that will allow for express consent. In other words, rather than language such as, “by continuing to stay at this hotel, you consent to the terms of our Privacy Policy,” or “by continuing to use this website, you consent to the terms of our Privacy Policy,” individuals must be given an opportunity not to consent to the collection of their information, e.g., a click-box consent versus an automatically checked box.

The more difficult part regarding consent is that there is no grandfather clause for personal information collected pre-GDPR. This means that companies with personal data subject to the GDPR will no longer be allowed to have or use that information unless the personal information was obtained in line with the consent requirements of the GDPR or the company obtains proper consent for use of the data prior to the GDPR’s effective date of May 25, 2018.

What Are the Other “Lawful Basis” to Collect Data Other Than Consent?

Although consent will provide hotels the largest green light to collect, process, and use personal data, there are other lawful basis that may exist that will allow a hotel the right to collect data. This may include when it is necessary to perform a contract, to comply with legal obligations (such as AML compliance), or when necessary to serve the hotel’s legitimate interests without overriding the interests of the individual. This means that during the internal audit process of a hotel’s personal information collection methods (e.g., online forms, guest check-in forms, loyalty/rewards programs registration form, etc.), each guest question asked should be reviewed to ensure the information requested is either not personal information or that there is a lawful reason for asking for the information. For example, a guest’s arrival and departure date is relevant data for purposes of scheduling; however, a guest’s birthday, other than ensuring the person is of the legal age to consent, is more difficult to justify.

What Other Data Subject Rights Must Be Communicated?

Another significant requirement is the GDPR’s requirement that guests be informed of various other rights they have and how they can exercise them including:

  • The right of access to their personal information;

  • The right to rectify their personal information;

  • The right to erase their personal information (the right to be forgotten);

  • The right to restrict processing of their personal information;

  • The right to object;

  • The right of portability, i.e., to have their data transferred to another entity; and

  • The right not to be included in automated marketing initiatives or profiling.

Not only should these data subject rights be spelled out clearly in all guest-facing privacy notices and consent forms, but those notices/forms should include instructions and contact information informing the individuals how to exercise their rights.

What Is Required with Vendor Contracts?

Third parties are given access to certain data for various reasons, including to process credit card payments, implement loyalty/rewards programs, etc. For a hotel to allow a third party to access personal data, it must enter into a GDPR-compliance Data Processing Agreement (DPA) or revise an existing one so that it is GDPR compliant. This is because downstream processors of information protected by the GDPR must also comply with the GDPR. These processor requirements combined with the controller requirements, i.e., those of the hotel that control the data, require that a controller and processor entered into a written agreement that expressly provides:

  • The subject matter and duration of processing;

  • The nature and purpose of the processing;

  • The type of personal data and categories of data subject;

  • The obligations and rights of the controller;

  • The processor will only act on the written instructions of the controller;

  • The processor will ensure that people processing the data are subject to duty of confidence;

  • That the processor will take appropriate measures to ensure the security of processing;

  • The processor will only engage sub-processors with the prior consent of the controller under a written contract;

  • The processor will assist the controller in providing subject access and allowing data subjects to exercise their rights under the GDPR;

  • The processor will assist the controller in meetings its GDPR obligations in relation to the security of processing, the notification of personal data breaches, and data protection impact assessments;

  • The processor will delete or return all personal data to the controller as required at the end of the contract; and that

  • The processor will submit to audits and inspections to provide the controller with whatever information it needs to ensure that they are both meeting the Article 28 obligations and tell the controller immediately if it is asked to do something infringing the GDPR or other data protection law of the EU or a member state.

Other GDPR Concerns and Key Features

Consent and data portability are not the only thing that hotels and gambling companies need to think about once GDPR becomes a reality. They also need to think about the following issues:

  • Demonstrating compliance. All companies will need to be able to prove they are complying with the GDPR. This means keeping records of issue such as consent.

  • Data protection officer. Most companies that deal with large-scale data processing will need to appoint a data protection officer.

  • Breach reporting. Breaches of data must be reported to authorities within 72 hours and to affected individuals “without undue delay.” This means that hotels will need to have policies and procedures in place to comply with this requirement and, where applicable, ensure that any processors are contractually required to cooperate with the breach-notification process.

© Copyright 2018 Dickinson Wright PLLC
This post was written by Sara H. Jodka of Dickinson Wright PLLC.

Massachusetts Legislature Pushes Forward With Amended Non-Compete Bill

This Blog has previously covered the six non-compete bills that were introduced in the Massachusetts Legislature in 2017. On April 17, 2018, the Joint Committee on Labor and Workforce Development submitted a revised bill, House Bill 4419 (“H 4419”), in place of the prior bills.  Through this action, the Joint Committee has taken a significant step toward the finish line regarding proposed non-compete legislation.

This post offers some quick impressions following our initial review of the bill.

Definition of Employee

Resolving a split among the 2017 bills, H 4419 proposes to include independent contractors under the definition of a covered “employee.”

Consideration

Like all contracts, non-compete agreements must be supported by valuable consideration. H 4419 provides that non-compete agreements presented to an employee after the commencement of employment must be supported by additional consideration over and above continued employment.  Further, while the bill does not impose a similar requirement for agreements that are entered into in connection with the commencement of employment, no employer may enforce a non-compete covenant without complying with the bill’s “garden leave” provision (see below).

Permissible Scope of a Non-Compete Covenant

Under H 4419, a non-compete covenant must be no broader than necessary to protect a legitimate business interest; must include a geographic scope that is reasonable “in relation to the interests protected”; must not exceed one year in duration from the date of separation (with tolling up to one additional year if the employee is found to have breached a fiduciary duty or unlawfully taken his or her former employer’s property); and must be reasonable in the scope of the proscribed activities in relation to the interests protected.

Requirement of Garden Leave Pay or Some “Other Mutually-Agreed Upon Consideration”

Like three of the 2017 bills, H 4419 requires the payment of “garden leave” or some “other mutually-agreed upon consideration” whenever an employer chooses to enforce a non-compete covenant following the date of separation (for a more in depth discussion of the “garden leave” concept, see our article dated December 27, 2017). For agreements that call for “garden leave” pay (as opposed to “other … consideration”), the employer must, during the restricted period, continue paying the former employee an amount defined as “at least 50 percent of the employee’s highest annualized base salary paid by the employer within the 2 years preceding the employee’s termination.”

H 4419 diverges from the 2017 garden leave bills by imposing no requirements on the value or timing of any “other” consideration that the employer and employee may agree upon as an alternative to garden leave. Under the 2017 bills, the value of the alternative consideration needed to be equal to or greater than the statutorily-defined garden leave payments.  Further, the timing of the consideration needed to be in line with the applicable garden leave period.

H 4419 imposes no such conditions, and, as such, appears to allow parties to agree to less valuable consideration which could be provided to the employee at any time, including the commencement of employment (for instance, a hiring bonus). This “other mutually-agreed upon consideration” provision effectively negates any requirement that the non-compete contain a garden leave clause, and may be a sticking point for certain legislators as the bill makes its way through the legislative process.

Exempt Employees

Under H 4419, non-compete agreements may not be enforced against the following types of employees:

  • Employees who are classified as non-exempt under the Fair Labor Standards Act;
  • Undergraduate or graduate students who are engaged in short-term employment;
  • Employees who have been terminated without cause or laid off; or
  • Employees who are not more than 18 years of age.

Blue-Penciling Permitted

H 4419 permits courts to “reform or otherwise revise” an overly broad non-compete covenant to the extent necessary to protect the applicable legitimate business interests. Of note, most of the 2017 bills would have rendered overly broad covenants null and void.

Effective Date

Finally, barring any further revisions, H 4419 would take effect on October 1, 2018 if it is ultimately enacted. Further, any agreements entered into prior to that date would be governed by Massachusetts common law standards.

Conclusion

According to the Legislature’s bill scheduling calendar, H 4419 has a July 31, 2018 deadline for passage. Although summer is close, this should afford sufficient time to get it to a vote.

Jackson Lewis P.C. © 2018

This article was written by Erik J. Winton and Colin A. Thakkar of Jackson Lewis P.C.

FDA Seeks Comments on Potential Marijuana Reclassification Under International Drug Control Treaty

The Food and Drug Administration requested comments in a notice published in the Federal Register on April 9, 2018 concerning the “abuse potential, actual abuse, medical usefulness, trafficking, and impact of scheduling changes on availability for medical use” of five marijuana-related substances: cannabis plant and resin; extracts and tinctures of cannabis; delta-9-tetrahydrocannabinol (THC); stereoisomers of THC; and cannabidiol (CBD).  The comments will be considered in preparing a response from the United States to the World Health Organization (WHO)’s request for information regarding “the legitimate use, harmful use, status of national control and potential impact of international control” for each of these substances.

The WHO’s Expert Committee on Drug Dependence (ECDD) will be meeting in Geneva from June 4 to 8, 2018, for a special session to review cannabis and its potential to cause dependence, abuse and harm to health as well as its potential therapeutic applications. WHO will make recommendations to the United Nations Secretary-General on the need for a level of international control of these substances. In advance of the June session, the WHO is asking United Nations member states to share their evaluations of cannabis, so the comments received by the FDA will be considered in the scientific and medical evaluations the U.S. submits. WHO is expected to make its official recommendation to the U.N.’s Commission on Narcotic Drugs in mid-2018.

The ECDD also will discuss potential changes to how marijuana is scheduled. The U.N. Single Convention on Narcotic Drugs currently lists marijuana as a Schedule I drug, the classification given to drugs with the highest potential for abuse and no medicinal value. Marijuana never has been subject to formal international review since first being placed in Schedule I of the international agreement enacted in 1961.

Under the United States federal Controlled Substances Act, marijuana is considered a Schedule I drug, meaning that it has (1) a high potential for abuse; (2) no currently accepted medical use in treatment in the United States, and, (3) a lack of accepted safety for use of the drug or other substance under medical supervision. CBD also is a Schedule I drug in the United States.

Cannabis, also known as marijuana, refers to the dried leaves, flowers, stems, and seeds from the Cannabis sativa or Cannabis indica plant. It is a complex plant substance containing multiple cannabinoids and other compounds, including the psychoactive chemical THC and other structurally similar compounds.  The principal cannabinoids in the cannabis plant include THC, CBD, and cannabinol.  Marijuana is the most commonly used illicit drug in the United States.

Any change in marijuana’s classification under international drug control treaties may influence the way marijuana is classified in the United States.  Employers who are opposed to marijuana legalization should consider submitting comments.

Anyone may comment online by clicking here (click on “Comment Now”), or by sending a comment by mail (click on the link to obtain the address). Comments are due by April 23, 2018.

Jackson Lewis P.C. © 2018
This article was written by Kathryn J. Russo of Jackson Lewis P.C.