The National Law Forum

Businessinsurance.com reported that security consultants at F-Secure (a Finnish data security company) discovered about a year ago that by “getting hold of a widely used hotel key card, an attacker could create a master key to unlock any room in the building without leaving a trace,…”. The April 25, 2018 article entitled “Hotel key cards, even invalid ones, help hackers break into rooms” included these comments:

While the researchers have fixed the flaw together with Assa Abloy, the world’s largest lock manufacturer which owns the system in question, the case serves as a wake-up call for the lodging industry to a problem that went undetected for years.

The researchers helped Assa fix the software for an update made available to hotel chains in February. Assa said some hotels have updated it but that it would take a couple more weeks to fully resolve the issue.

Timo Hirvonen (one of the F-Secure consultants) made the following comment in an interview:

We found out that by using any key card to a hotel … you can create a master key that can enter any room in the hotel. It doesn’t even have to be a valid card, it can be an expired one,…

Given the number of plastic Hotel keys used around the world this very alarming news!

In a recent post, we discussed the Canadian Cabinet’s announcement that Canada’s new data breach regulations go into effect on November 1, 2018. Despite announcing the effective date, Canada had not yet finalized these regulations.  However, on April 18, 2018, Canada unveiled the Breach of Security Safeguard Regulations: SOR/2018-64 (“Regulations”).

To highlight some of the finer points, in order to trigger notification requirements, the Regulations require organizations to determine if a data breach poses a “real risk of significant harm” to any individual had their information accessed in the breach.  If an organization meets this harm threshold, then the affected organization must notify the Privacy Commissioner of Canada, as well as the affected individuals.

As far as reporting, the notification to the Commissioner must describe the circumstances of the breach, the time period, the personal information accessed, the number of individuals compromised, steps taken to reduce harm to those individuals, steps taken to notify those individuals and an organization point of contact who can answer any follow-up questions regarding the breach. The notification to the individuals requires the affected organization to disclose similar information.  As far as the communication mechanism of the individual notification, the Regulations give affected organizations flexibility to use any form of communication that a reasonable person would consider appropriate, such as phone, email or advertisement.

Interestingly, rather than specifying a strict time frame for notification, the Regulations require such notification to be completed “as soon as feasible.” In providing this flexibility, the Cabinet recognized that it takes time for organizations to gather all necessary information.  Lastly, the Regulations establish a mandatory minimum of two years for the maintenance of all records related to the breach.

It is interesting to note that these Regulations bare some similarity to the European Union’s (“EU”) new General Data Protection Regulation (“GDPR”), which goes into effect on May 25, 2018. For example, similar to GDPR, the Regulations have harsh penalties. In particular, the Regulations impose fines up to $100,000 CAD for each affected individual of a breach, whereas a violation of the GDPR can carry with it a fine of up to four percent (4%) of annual global turnover or €20 Million, whichever is greater.  Overall, the Regulations demonstrate a clear message that Canada would like to align as much as possible with the GDPR to try to maintain Canada–EU trade relationships.

This post was written by Dena M. Castricone, Daniel J. Kagan and Brad Davis of Murtha Cullina

Addressing claim preclusion, the US Court of Appeals for the Federal Circuit reversed a district court’s dismissal of a complaint as barred by claim preclusion and the Kessler doctrine. SimpleAir, Inc. v. Google LLC, Case No. 16-2738 (Fed. Cir., Mar. 12, 2018) (Lourie, J).

SimpleAir obtained a family of patents including a parent patent and several child patents claiming continuation priority back to the parent patent. During prosecution, SimpleAir filed terminal disclaimers in each child patent to overcome obviousness-type double patenting rejections.

After the patents issued, SimpleAir filed several patent infringement lawsuits against Google’s cloud messaging and cloud-to-device messaging services. In the first lawsuit, a jury found infringement of one of the child patents, but the Federal Circuit reversed the verdict. In the second lawsuit, a jury found non-infringement of a different child patent. SimpleAir then filed a third lawsuit, asserting infringement of two different child patents. Google moved to dismiss SimpleAir’s complaint (under Fed. R. Civ. Pro. 12(b)(6)) on the basis that it was barred by claim preclusion and the Kessler doctrine. The district court agreed, reasoning that (1) the two patents shared the same specification with the previously adjudicated child patents, and (2) the filing of the terminal disclaimers indicated that the US Patent and Trademark Office believed the patents-in-suit were patentably indistinct from the earlier patents. Concluding that the various child patents claimed the same underlying invention, the district court dismissed SimpleAir’s complaint. SimpleAir appealed.

On appeal, the Federal Circuit found the district court record insufficient to sustain the district court’s dismissal. The Court agreed that the various lawsuits and child patents substantially overlapped, but ultimately found that the district court never analyzed the claims of any patent in reaching its conclusion that the child patents claimed the same invention. The Court also rejected the district court’s reliance on terminal disclaimers:

[A] terminal disclaimer is a strong clue that a patent examiner and, by concession, the applicant, thought the claims in the continuation lacked a patentable distinction over the parent. But as our precedent indicates, that strong clue does not give rise to a presumption that a patent subject to a terminal disclaimer is patentably indistinct from its parent patents. It follows that a court may not presume that assertions of a parent patent and a terminally-disclaimed continuation patent against the same product constitute the same cause of action. Rather, the claim preclusion analysis requires comparing the patents’ claims along with other relevant transactional facts.

Because the district court did not specifically consider the claims, the Federal Circuit found insufficient basis for claim preclusion.

Google also argued that if claim preclusion did not apply, then the Kessler doctrine barred SimpleAir’s claims. The Kessler doctrine is based on a 1907 Supreme Court of the United States decision that protects a party’s rights to continue a practice that had been accused of infringement where an earlier judgment found that essentially the same activity did not infringe the patent. However, the Federal Circuit explained that the doctrine has not been applied to bar a broader set of rights than would have been barred by claim preclusion. The Court declined to do so, explaining, “Google asks us to subsume claim preclusion within a more expansive, sui generis Kessler doctrine. But the Kessler doctrine just fills a particular temporal gap between preclusion doctrines . . . it does not displace them.”

Practice Note: Claim preclusion does not apply where claims of an asserted patent are not the same as claims of an earlier litigated patent from same family—unless the court determines the asserted claims are narrower than the previously litigated claim.

The Supreme Court issued its long-awaited opinion in Oil States Energy Services v. Greene’s Energy Group, Appeal No. 16-712 (April 24, 2018), holding 7/2 that inter parties review was an appropriate exercise of the power of Congress to assign adjudication of public rights to the USPTO, and is not required to assign such adjudications to Article III courts for resolution by a jury trial. To reach this conclusion, the Court held that the grant of a patent falls within the public rights doctrine, as a matter “arising between the government and others” and that IPR is “simply a reconsideration of that grant” that Congress has reserved to the PTO.

The Court minimized the procedures unique to IPR by reasoning that IPR involves the same interests as the original grant of a patent, and analogized the grant or cancellation of a patent to the qualification of other “public franchises” by Congress.

Although we often hear that a “strict constructionist” Justice believes in deciding cases based on what the Founding Fathers intended when they considered questions of law, such as by disregarding the first “militia clause” of the 2d amendment, I think that this opinion is unusual in the depth of the historical review of patent validity determiners as it relates to the present case. While the Court cites some 19^th century precedent in deciding the “public rights” question, this is just a warm-up of the “Way Back Machine” that the Court is will use to look at really old decisions regarding the review of granted patents:

“The Patent Clause in our Constitution ‘was written against the backdrop’ of the English system. Based on the practice of the Privy Council [that invalidated British patents until 1779], it was well understood at the founding that a patent system could include a practice of granting patents subject to potential cancellation in the executive proceeding of the Privy Council. The parties have cited nothing in the text or history of the Patent Clause or Article III to suggest that the Framers were not aware of this common practice. Nor is there any reason to think they excluded this practice during their deliberations.” Slip. op. at 14.

I can hear the ghost of Justice Scalia toasting this imaginative investigation about the Framers’ state of mind when they wrote the patent clause of the Constitution. These are two “negatives” that Oil States could not disprove.

The dissent tried, arguing that the IPR procedures undermine judicial independence, which the Founding Fathers sought to protect: “Only courts could hear patent challenges in England at the time of the founding.” But tradition only goes so far and the Court “disagreed with the dissent’s assumption that, because courts have traditionally adjudicated patent validity in the courts, courts must forever do so…That Congress chose the courts in the past does not foreclose its choice of the PTO today.” Slip op. at 14-15.

The dissent also argued that the majority’s decision endorsed an unfair weakening of patentee’s rights: “To reward those who had proven the social utility of their work (and to induce other to follow suit), the law long afforded patent holders more protection … against the treat of governmental intrusion and dispossession.” Slip. op. at 10-11 (Gorsuch, dissenting).

Finally, the Court dismissed the 7^th Amendment challenge “because inter partes review is a matter that Congress can properly assign to the PTO, a jury is not necessary in these proceedings”.

The arguments presented by the minority suggest that the majority is adopting an anti-patent position, a question that the majority attempts to skirt. In any case, we appear to be stuck with inter partes review, including the tensions and uncertainty provided by inconsistent rulings by the courts. The Framers may or may not have intended that validity disputes be settled in court, but it’s a pretty sure bet that they never envisioned anything like the Mad Hatter’s tea party that Alice (get it) tried to make sense of.

Starbucks made national news earlier this month when two black men were arrested after refusing to leave a store.  News accounts reported that a store manager called 911 after the men remained in the store and asked to use the restroom but had not yet made a purchase.  The fallout from this event was notable to say the least: protests, calls for boycotts, and even an apology from the CEO.  The incident further has sparked a discussion on implicit bias, especially after the national restaurant chain announced that it would close thousands of stores for an afternoon to conduct companywide bias training for its employees. The looming question for employers is what, if anything, should we be doing to make sure this doesn’t happen to us?

The first thing to do is pause and take a breath.  The process of avoiding liability stemming from bias is actually not unlike other anti-discrimination initiatives.  While not intended to be an exhaustive list, these suggestions should sound familiar: 1) train managers well, 2) instill rules for handling common issues, and 3) take complaints seriously.

With Starbucks’ announcement to roll out implicit bias training, other employers might be wondering, should we be doing that?  First, not all employers are positioned to call in every major civil rights organization to lead anti-bias training (like Starbucks is doing).  Nonetheless, new employee and management training can still be crafted to effectively promote an anti-bias, anti-discrimination workplace.   Consider the location and the employee population – some report that the location of the Starbucks store was in a gentrified neighborhood where racial tensions exist.  Should targeted training be implemented in these areas?  Also, consider the type of work the employees perform and whether it requires much public interaction, such as retail or customer service.  Factors such as these may help identify where anti-bias training can be most effective.

Also, what about the concept of prescribed rules?  One aspect complicating the Starbucks story was the absence of a corporate policy for handling restroom use, responding to potential trespassers, etc.  If your employees encounter situations where implicit bias could creep in to impact their decisions, does it make sense to adopt a rule explaining how to handle those situations?

And of course, the one piece of advice we all know well – take complaints seriously (including complaints from customers)!  While employers don’t always receive a complaint prior to finding themselves in a sticky issue, employee and customer complaints can signal the need for preventative action.  Employers can’t know every potential bias-based issue (indeed, it’s not called “explicit bias”), but these issues grow much worse when a complaint existed but was overlooked or ignored.

How real is the threat to the District of Delaware and the Southern District of New York as the prime venue choices for corporate Chapter 11 bankruptcy cases?  It appears that both are safe, at least for now.

Venue for bankruptcy cases is governed by 28 U.S.C § 1408, which provides that corporations may file in the district (a) in which their “domicile, residence, principal place of business in the United States, or principal assets in the United States” have been located during a majority of the prior 180 days, or (b) in any district where an affiliate, general partner or partnership has filed using any of these provisions. Because many companies are incorporated in Delaware, the District of Delaware has been a prime beneficiary of section 1408 and many of the countries’ largest bankruptcies have historically been filed in Delaware.  Similarly, because many companies have their principal assets in the Southern District of New York, many large cases have been filed there as well.  But what is perhaps most problematic is the use of affiliates, even affiliates which are insignificant in size and in importance, to establish venue in the District of Delaware and the Southern District of New York for the entire corporate enterprise even when the enterprise, as a whole, has only tangential contact with these venues.  Often this appears to be done at the behest of lenders or bankruptcy professionals located in those districts.

Critics have long argued that section 1408 encourages forum shopping, resulting in an unwarranted concentration of large bankruptcy cases in only these two jurisdictions.  Statistics bear out these concerns.  For the year 2017, 10% of all Chapter 11 business filings were made in the District of Delaware and 8% of all Chapter 11 business filings were made in the Southern District of New York.  Taken together, 18% of the Chapter 11 business cases filed last year were filed in these two jurisdictions alone.  Critics complain that this concentration is unfair to those creditors and other parties in interest who are not located in either Delaware or the Southern District of New York, and who therefore must travel, and obtain local counsel, in order to meaningfully participate in the bankruptcy cases.

In January 2018, Senators John Cornyn (R-Tex.) and Elizabeth Warren (D-MA) introduced S. 2282, which was referred to the Senate Judiciary Committee.  Titled the “Bankruptcy Venue Reform Act of 2018”, S. 2282 would modify section 1408 to provide that a corporate debtor could only file a Chapter 11 case in the district where its principal assets or principal place of business in the United States have been located for the 180 days prior to the filing or for a longer portion of the 180-day period than the principal place of business or principal assets in the United States were located in any other district. Additionally, the affiliate rule of obtaining venue would be tightened so that the first filing affiliate must directly or indirectly own, control, be the general partner of or hold 50% or more of the outstanding voting securities of the entity that is the subject of the later filed case.  Moreover, S. 2282 provides that consideration shall not be given, for purposes of venue, to changes in the ownership, control or location of assets made within the year prior to the bankruptcy or to changes made specifically for the purposes of establishing venue.

Not surprisingly, representatives from the affected districts have opposed the bill.  The Governor of Delaware, John Carney (D), Delaware’s two senators, Tom Carper (D) and Chriss Coons (D), and Delaware’s lone Representative Lisa Blunt Rochester (D) issued a statement opposing the bill, arguing that the change in the venue provisions would negatively impact both Delaware’s economy and the national economy as well:

Many American companies, large and small, choose to incorporate in Delaware because of the expertise and experience of our judges, attorneys, and business leaders. Denying American businesses the ability to file for bankruptcy in the courts of their choice would not only hurt Delaware’s economy but also hurt businesses of all sizes and the national economy as a whole. This is a misguided policy, and we strongly oppose it[.] …  Our economy thrives when the bankruptcy system is fair, predictable, and efficient. Experienced bankruptcy judges are critical to ensuring that companies can restructure in a way that saves jobs and preserves value. Scrapping the venue laws that have been in place for decades and replacing them with restrictions flies in the face of well-settled principles of corporate law, threatens jobs, and hurts our economy.

So what are the chances for this venue reform bill to pass.? Not good, at least during this Congressional year.  The bill remains in the Senate Judiciary Committee and there is little indication that it will gain traction in the Committee, much less see a Senate floor vote, during the 115^thCongress. Given the rapidly approaching August recess, and then the November midterm elections, it is extremely doubtful that the bill will pass the Senate this year, let alone the House (where it has not even been introduced).  Of course, if the bill is not passed this Congress, it could be re-introduced in the next Congress.  However, given the lack of movement in Committee and the minimal number of co-sponsors, it is highly questionable whether this bill will ultimately garner the necessary support to pass in Committee, the Senate, and ultimately the House.  The wild card may be the post-election constituency of the Senate and House as new members may take some interest in this issue.