Category: Uncategorized

On April 6, 2018, the U.S. District Court for the Eastern District of Pennsylvania granted a motion for summary judgment filed by a waste company in an implied certification case under the False Claims Act (FCA), holding that the relator failed to satisfy the Supreme Court’s materiality standard announced in the landmark Escobar case.

The claims in U.S. ex rel. Cressman v. Solid Waste Services, Inc. arose from waste company employees discharging leachate, a liquid that passes through or is generated by trash, onto a grassy area at a transfer station, rather than sending the leachate to a treatment plant.  The relator reported the leachate discharge to the Pennsylvania Department of Environmental Protection (DEP), which conducted an investigation.  The waste company cooperated in the investigation, conducted its own investigation, and took corrective steps in response to the allegations.  The company also entered into a consent decree in connection with which it paid a civil penalty.

The relator then filed his qui tam action under the FCA, in which the government declined to intervene.  The relator asserted that the defendant waste company was liable under the FCA because it submitted claims for payment to federal agencies without disclosing its violation of environmental regulations arising from the leachate discharge incident.

In moving for summary judgment, the defendant argued that the relator had not demonstrated that the defendant’s alleged failure to disclose the regulatory violations arising from the discharge incident was material to its right to payment by the federal agencies.  Indeed, the defendant argued that the violation had nothing to do with the waste disposal services it was contracted to perform for those agencies.

The court agreed.  First, the court observed that the defendant’s contracts with the federal agencies at issue did not even involve the transfer station where the leachate disposal occurred.  As such, the court held that the violation “was not remotely related to Defendant’s service contracts with the Federal Agencies” and as such “failed to substantiate a FCA claim under Plaintiff’s posited theory of recovery.”  The court then squarely addressed materiality, holding that the relator failed to meet the Escobar standard:

In addition, to meet the materiality requirement for his FCA claims, Plaintiff must present evidence that the Federal Agencies for whom Defendant performed waste pickup services would not have paid Defendant’s claims had they known of the February 25, 2013 Discharge Incident/Violation at Defendant’s Souderton Division transfer station.  Plaintiff has presented no such evidence.  To the contrary, record evidence demonstrates that the Federal Agencies did not deem the February 25, 2013 Discharge Incident/Violation material to their payment of the submitted invoices.  For example, record evidence shows that the government agencies to whom [Defendant] has submitted invoices for payment since the February 25, 2013 Discharge Incident/Violation have continued to pay Defendant for the waste pickup services performed even after Plaintiff filed the underlying suit and after the Department of Justice investigated the allegations contained in Plaintiff’s complaint and declined to intervene on behalf of the Federal Agencies. (emphasis added).

The court went on to emphasize the government’s lack of action after the filing of the FCA complaint:

Here, in the four years since learning of Plaintiff’s allegations in this matter, including the regulatory violations asserted and relied upon by Plaintiff, the Department of Justice has not initiated any proceedings or taken any action against Defendant. Significantly, after investigating Plaintiff’s underlying FCA claims, the Department of Justice declined to intervene and prosecute Plaintiff’s suit in the name of and on behalf of the United States Government.

This court’s decision joins the ranks of an increasingly substantial line of cases holding, based on Escobar, that what the government does—or does not do—after learning of violations is critical to the materiality analysis.

On April 2, 2018, CMS released the Contract Year 2019 Final Rules for Medicare Advantage (MA) and Part D (the MA Final Rule), incorporating changes that support CMS’ stated commitment to supporting flexibility and efficiency throughout the MA and Part D Programs.

The MA Final Rule incorporates broad changes to several aspects of the MA program, including changes to the marketing rules, the star rating process and benefit uniformity requirements, among others. Of note to providers, and the subject of today’s post, the MA Final Rule has also eliminated the requirement that providers and suppliers contracting with MA Plans, and prescribers prescribing drugs covered by Part D programs, be enrolled in Medicare. Instead, CMS will rely upon a “Preclusion List,” as described below, to eliminate prescribers, providers, and suppliers who are ineligible to provide items or services under these programs.

New Rule Eliminates Medicare Enrollment Requirement

In May of 2014, CMS implemented a rule that required that prescriptions for covered Part D drugs be prescribed by prescribers enrolled in Medicare. Later, in November of 2016, CMS implemented a rule that required providers and suppliers that furnished health care items or services to MA plan members to be enrolled in Medicare by 2019. Under the MA Final Rule, CMS is eliminating this requirement. The text of the new regulations, to take effect January 1, 2019, will instead (i) prohibit MA Plans from paying for services provided by providers and suppliers who are included in a “Preclusion List” and (ii) require pharmacy benefit managers to reject a pharmacy claim for a Part D drug if the individual who prescribed the drug is included on the preclusion list. The “Preclusion List” will be compiled by CMS and will include providers and suppliers (i) that are currently revoked from Medicare or who have engaged in behavior for which CMS could have revoked the provider or supplier to the extent applicable if they had been enrolled in Medicare, and (ii) whose underlying conduct CMS determines is detrimental to the best interests of the Medicare program. The Preclusion List will be separate and distinct from the OIG Exclusion List.

CMS will make the Preclusion List available to MA plans and Part D plan sponsors, who will be required to deny payment for claims submitted by, or associated with prescriptions written by, prescribers and providers on the list.

Impact of the New Rule on Providers and Suppliers

This new requirement allows flexibility to prescribers, providers and suppliers who have not enrolled in Medicare to provide services to MA plan members, easing the burden of enrollment, and allowing providers who have opted out of providing services under traditional Medicare to provide services to beneficiaries under Medicare part C or prescribe Part D covered drugs.

As the clock ticks down to May 25, 2018, when the European Union’s General Data Protection Regulation (“GDPR”) becomes fully enforceable throughout the EU, the Internet and airwaves have become saturated with guidance for companies about what to expect and how to prepare for its new protections and restrictions.  However, we’ve seen little intelligence for companies and their litigation counsel in situations where electronically-stored information (“ESI”) containing “personal data” resides in the EU and is relevant to discovery requests in American civil litigation.

In many ways, the process and procedures relating to transfers of personal data to the U.S. under the GDPR are similar – and similarly burdensome – to those of the existing privacy regime.  However, the GDPR does introduce new transfer options and clarifies others.  It has also added record-keeping and compliance reporting requirements as well as hefty penalties for non-compliance.

Our GDPR e-discovery series will examine these new and clarified transfer options for ESI containing personal data.  We begin our series with a newly added transfer option – the Hail Mary pass of transfer options – contained in a GDPR provision permitting a one-time limited transfer where necessary to further a “compelling interest” of the transferring party.

Before we get to the GDPR, however, some historical context is instructive about what makes transferring personal data from the EU to the U.S. for pre-trial e-discovery particularly taxing.  The challenges stem largely from the expansive definition of personal data on which existing law is premised, which encompasses any information relating to “an identified or identifiable natural person.”

The issue with this definition is immediately apparent.  In addition to information practitioners in the U.S. might typically consider “sensitive” or “private” personal data, such as social security numbers, financial account numbers, or medical treatment histories, the EU balloons the concept of personal data to include more innocuous information commonly contained in ESI, such as professional or personal email addresses, office addresses, and telephone numbers.

Existing EU privacy law further stipulates that such personal data cannot be transferred to a “third country” like the U.S. that does not ensure an adequate level of protection for personal data.  Absent such an adequacy determination by EU privacy regulators, a data transferor must demonstrate either sufficient protective safeguards incorporated into a data transfer agreement in the form of standard contractual provisions addressing the handling of the personal data; or that an enumerated “derogation,” or exemption, to the privacy law supports the transfer.

These far-reaching definitions and limited transfer options have created a classic lose-lose for American litigants.  On the one hand, U.S. courts generally observe that discovery of relevant documents in the EU cannot be avoided solely on the basis of its privacy law.  On the other, companies that do not take appropriate steps to permissibly transfer personal data can be sanctioned by privacy regulators.

While there was hope that the GDPR would address this inherent tension and simplify the transfer process, the end result is not so much simplification, or even clarity, as it is a new set of potential hazards and prospects.

It is in this context that we examine Chapter 5 of the GDPR (Articles 44 through 50) that governs transfers of personal data to third countries such as the U.S.  Of most relevance to transfers in the context of civil e-discovery are Article 46, which addresses transfers subject to standard contractual clauses relating to the handling of personal data, and Article 49, which carries over the “derogations” concept from existing law allowing for personal data transfers in the absence of Article 46 safeguards.

One Article 49 provision new to the GDPR specifically addresses the concept of a one-time limited personal data transfer, which sounds promising in the context of e-discovery.  However, this new provision also appears to be an option of last resort, applicable only where none of the safeguards or options enumerated in Articles 46 or 49 otherwise apply.  In such cases, a transfer of personal data may occur if:

• the transfer is not repetitive;
• the transfer concerns a limited number of data subjects;
• the transfer is necessary for purposes of a compelling interest of the transferor that is not overridden by the interests of the data subject; and if
• the transferor has provided suitable safeguards to protect the personal data during and after the transfer.

While this exemption sounds appealing, the jury is still out on its utility.  Just how many subjects or how much data constitutes a “limited” transfer, for example, will likely remain a subjective judgment in the eye of data protection authorities.  And, whether pre-trial e-discovery in American litigation will ultimately be considered a “compelling interest” is a new and unanswered question.  Plus, who balances the interests between the transferor and the data subjects?  Finally, this new provision subjects a transferor to significant disclosure requirements including informing the data subject about the transfer and the compelling interest being pursued as well as informing the data privacy authority of the transfer.  These disclosure requirements introduce logistical problems in-and-of-themselves.

Based on these unknowns and reporting requirements, use of this provision may entail significant risk for the transferor.  And, bear in mind that, although the GDPR was intended to harmonize some aspects of privacy law across the EU, Member States are left with the option to modify or supplement the default standard set out in Article 49.  This means you will still need to review the privacy law of a particular Member State to assess whether the compelling interest exemption even applies and, if so, in what context.

Bear in mind also that no matter what transfer method is used, the GDPR requires both transferors and transferees to maintain a record of personal data transfers and details about what adequacy decision or safeguard applied to each transfer.  Failures to do so may risk significant potential fines.  Our recommendation is that American companies with operations, employees, or data in the EU and multinational companies at risk of lawsuits or investigations in the US develop a standard policy for assessing personal data transfer requests, including those in the context of civil e-discovery.  This policy should recognize that every transfer may be different and allow flexibility based on the transfer options afforded by the GDPR.  Importantly, this policy should be adhered to rigorously and dictate the documentation required for each transfer contemplated or undertaken.

Securing data held by mobile devices is largely reliant upon technology, and a recent report by the Federal Trade Commission (“FTC”) takes aim at how that technology can be both improved and better utilized. The report, published in February 2018 and titled, Mobile Security Updates: Understanding the Issues, presents findings based upon information requested by the FTC in 2016 of eight mobile device manufacturers: Apple, Inc., Blackberry Corp., Google, Inc., HTC America, Inc., LG Electronics USA, Inc., Microsoft Corp., Motorola Mobility, LLC, and Samsung Electronics America, Inc.

Generally speaking, the FTC in the report recommended that both the devices themselves as well as their corresponding support services need to do a better job of addressing consumers’ security concerns. Security updates need to be deployed quicker and more frequently, but consumers also need to know when – and when they are not – covered by services providing these updates. The report further recommends that manufacturers provide a minimum period during which security updates are to be provided, and make that period known to the consumer prior to purchase. The report found that some manufacturers do in fact provide substantial security support, but little to no information is provided on the topic prior to purchase. It was also recommended that manufacturers consider providing security updates that are separate and distinct from other updates that are often bundled together in one package.

Providing security support services by way of software updates is only valuable, however, so long as consumers take advantage of them. To this point, the report recommended that government, industry and advocacy groups work together to educate consumers as to the importance of installing security updates as they become available. It was further recommended that manufacturers improve record keeping as pertains to update decisions, support length, update frequency, and the rate at which consumers bother to download and install the updates, all with the goal of improving upon past practices.

Takeaway for Small Businesses

The FTC’s mobile security report is intended to bolster consumer protection, however it is also relevant for small businesses and their use of mobile devices in the workplace. Many small businesses do not have the resources to implement their own mobile security measures, and thus rely heavily on the mobile device manufactures to ensure a certain level of security. Moreover, small businesses often allow for a bring-your-own-device (BYOD) policy, which permits employees to bring and use personally owned devices in the workplace. While a BYOD policy helps a small business save on device and carrier costs, it also increases the likelihood of security threats to the business.

Although small businesses should not rely entirely on the security measures provided by mobile device manufactures, improved security updates and support services as recommended by the FTC’s report will certainly be beneficial to small businesses that do not have resources to invest in security measures. That said, just as the FTC advises consumers to take of advantage of the security software updates, it is imperative that small businesses, particularly with a BYOD policy, act prudently with respect to mobile device security measures available to them by the manufactures. For more information on BYOD key issues and policy considerations, visit Jackson Lewis’s “Bring Your Own Device” BYOD Issues Outline. Mobile device manufacturers are in a constant race to stay ahead of those seeking to expose vulnerabilities. Issuing frequent updates is crucial for security, but ultimately, it is just as important that consumers and businesses that rely heavily on mobile device manufacturer securities measures, understand their role in the process.

According to a recent news article, the Korean FTC fined three game games for allegedly not making clear disclosures regarding the odds associated with certain loot boxes. Loot boxes are items that players can win or buy and that give the player a virtual item, but the players does not know which one until they “open” the box. According to the article, some of the games encouraged players to buy loot boxes to collect 16 puzzle pieces, which would award players with special in-game items once completed. This mechanic, known as Kompu Gacha,  was once popular in Japan until the Japanese FTC raised concerns there.

The Korean FTC expressed concerns over the way the odds of winning the items were advertised. In at least one of cases, the game company used the phrase “random provision.” The FTC interpreted the phrase as suggesting equal odds of receiving the different items. The issue of loot boxes has received a fair amount of attention lately. We recently prepared a post on  “Are Loot Boxes An Illegal Gambling Mechanic?” and an Updateto that post. As we also reported, Apple has required disclosure for loot box odds. Recently, Hawaii and Washington State proposed legislation relating to loot boxes.

There are at least three key issues with loot boxes. First, depending on how they are structured, some argue they are illegal gambling. We are not aware of any U.S. court reaching this conclusion. Various other countries are looking into that issue. Second, is the appropriate disclosures that must be made. Third, is that some argue loot boxes are harmful to kids for allegedly driving addictive behavior. There is much debate about these issues.

The ESRB recently helped step up the self-regulatory aspects of these issue. It recently announced that it will soon begin assigning a new “In-Game Purchases” label to physical (e.g., boxed) games. According to the ESRB press release: “The new In-Game Purchases label will be applied to games with in-game offers to purchase digital goods or premiums with real world currency, including but not limited to bonus levels, skins, surprise items (such as item packs, loot boxes, mystery awards), music, virtual coins and other forms of in-game currency, subscriptions, season passes and upgrades (e.g., to disable ads).”

The ESRB also launched ParentalTools.org to help educate parents on how kids spend money playing video games.

Game companies should continue to assess how they structure and advertise their loot box offerings and remain abreast of potential legislation that is being proposed.

In a case of first impression, the Second Circuit held on April 6, 2018 that liquidated damages may not be awarded for the same course of conduct under both the Fair Labor Standards Act and the New York Labor Law.

In its per curiam opinion in Rana v. Islam, No. 16‐3966‐cv, the Court of Appeals noted that “[w]hile the wording of the FLSA and NYLL liquidated damages provisions are not identical, there are no meaningful differences.”

Liquidated damages of to 100% of the unpaid wages are available under both statutes (FLSA § 216(b) and NYLL § 198(1-a)).  Both laws contain affirmative defenses that can reduce the amount of such damages.  Under § 260 of the FLSA, “if the employer shows to the satisfaction of the court that the act or omission giving rise to such action was in good faith and that [it] had reasonable grounds for believing that [its] act or omission was not a violation of the” FLSA, “the court may, in its sound discretion, award no liquidated damages or award any amount thereof not to exceed” the original unpaid wage amount.  Under § 198 of the NYLL, liquidated damages are not recoverable if “the employer proves a good faith basis to believe that its underpayment of wages was in compliance with the law.”

After examining both statutes and noting that “[d]ouble recovery is generally disfavored,” the Court of Appeals concluded that “if the New York State Legislature intended to provide multiple recoveries, it would have done so expressly,” and “[w]e therefore interpret the NYLL and FLSA as not allowing duplicative  liquidated damages for the same course of conduct.”  The Court left to another day whether a plaintiff entitled to liquidated damages under both statutes should receive the larger of such awards.

The decision resolves a split among district courts in the Second Circuit.