Global Regulatory Enforcement Law Blog : Global Regulatory Enforcement Lawyers & Attorneys: Reed Smith Law Firm: Government Contracts & Compliance

This post was written by Amy S. Mushahwar.

The Federal Trade Commission (FTC) reports that, for the twelfth year in a row, identity theft tops the list of consumer complaints received, constituting 15% of the overall 1.8 million complaints submitted in 2011. Debt collection complaints came in as second at 10% of the overall complaints. The FTC released these facts yesterday in its annual Consumer Sentinel Network (CSN) Databook. The CSN is a secure online database of millions of consumer complaints available to law enforcement, and stores complaints received by a number of entities, such as state attorneys general offices, the Department of Justice's Internet Crime Complaint Center (IC3), and the Council of Better Business Bureaus.

Within its Report, the FTC noted that those in the 20-29 and 30-39 year age brackets were most susceptible to identity theft and comprised 44% of the total reported victims. The states of Florida, Georgia, California, Arizona, Texas, New York, Nevada, New Jersey, Maryland and Delaware were the top ten states for per capita reported cases, with the Miami-area being the most dangerous metropolitan area for identity theft. Next year, the Consumer Financial Protection Bureau plans to contribute complaints to the CSN database, which will provide law enforcement with even more information about reported cases of identity theft.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Rosanne M. Kay.

Word on the street is that the UK's Serious Fraud Office ("SFO") has a number of active investigations into potential offences under the Bribery Act 2010. So far, the Bribery Act has only been used in a reasonably minor prosecution of a court clerk who took bribes to erase motoring offences from court records.

Despite rumours about active Bribery Act investigations, there are persistent question marks about the SFO's ability to take on such investigations and prosecutions. The SFO has suffered significant cutbacks and, apparently, only has £2million in its war chest to enforce the Act.

However, the public are highlighting potential issues to the SFO. Apparently, its hotline is receiving around 500 calls a month and the whistle-blowing section of its website has had 200 hits.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Rosanne M. Kay and Emma Osborne.

The UK Bribery Act 2010 has increased the focus placed on anti-bribery and anti-corruption
not only by the Serious Fraud Office (‘SFO’) but also by the Financial Services Authority (‘FSA’).
Anti-bribery issues fall within the FSA’s statutory objective to reduce financial crime and bribery
continues to be a strategic priority for the FSA. The FSA has imposed fines on two insurance
brokers, Aon and Willis, in relation to weaknesses in their anti-bribery systems and controls.
Many will be quick to point out that the FSA has an easier time than the SFO. Its role is one
of prevention, not prosecution. It does not need to prove that bribes have actually been paid,
merely that the firm’s systems and controls did not properly mitigate the risk of bribes being
paid.

So far, the FSA’s enforcement action relating to anti-bribery issues has concerned the insurance
industry although both the Aon and Willis cases are instructive about the types of issues that the
FSA is concerned about. However, in June 2011, the FSA announced its intention to carry out
a thematic investigation of the policies and procedures that investment banks have in place to
prevent their staff and agents from paying or receiving bribes. Whilst thematic reviews are not
enforcement actions in themselves, they may lead to.

 For a detailed analysis, please click here to read the issued Client Alert.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Paul Bond, Christopher G. Cwalina, Khurram Nasir Gore, Amy S. Mushahwar and Steven B. Roosa.

A warning from the California Attorney General’s office to mobile app developers: “Don’t get cute!” On February 22, California’s Attorney General Kamala Harris announced that her office and the six leading mobile application platform providers – Amazon, Apple, Google, Hewlett-Packard, Microsoft, and RIM – have agreed to a statement of principles that ask mobile app developers to inform users of their privacy practices before users purchase or download the app. In a press conference, Harris made it clear that failure to comply with the agreed-to principles by the thousands of mobile app developers churning out applications could lead to lawsuits being filed by the Attorney General’s office against developers.

For a detailed analysis, please click here to read the issued Client Alert.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Edward S. Miller, Marjorie C. Holmes, Katherine Holmes and Angela Gregson.

The European General Court has held that employed lawyers do not have the right to represent their in-house clients before it.

Building on the controversial rejection of the application of legal privilege to communications with in-house counsel in the Akzo case (14 September 2010, full report not yet published), the Court has decided that even where an employed lawyer is a registered member of a national bar and has a right of audience in his or her home state, the fact that the in-house lawyer is employed by an internal client deprives the in-house lawyer of the independence required to represent that client before the European courts.

For a detailed analysis, please click here to read the issued Client Alert.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Matthew R. Sheldon and Alexander Y. Thomas.

The Second Circuit Court of Appeals is reviewing a lower court decision disqualifying a former in-house attorney from acting as a False Claims Act qui tam relator against his former employer.

The relator was formerly general counsel to Unilab, a subsidiary of Quest Diagnostics Inc. The qui tam suit alleged that Unilab violated the Federal Health Care Anti-Kickback Act by engaging in a fraudulent scheme to increase medical testing referrals under the Medicare and Medicaid programs. Unilab sought to dismiss the suit, arguing that the relator's participation in the action was unethical under the New York Rules of Professional Conduct. The District Court agreed, stating that his duties included his obligation not to disclose client confidences that would otherwise be protected by the attorney-client privilege.

In an appeal of the District Court's ruling to the Second Circuit, the plaintiff has primarily argued that the relator had no duty to keep client confidences as Unilab was engaged in acts of fraud. In response to that argument, Unilab claimed that failure to disqualify counsel would have a chilling effect on a client's willingness to seek advice of counsel regarding issues that could implicate the False Claims Act.

The case raises significant questions regarding the limits of the attorney-client privilege when the client is potentially engaged in acts of fraud. Typically, communications with counsel that are in furtherance of a crime or fraud are not protected by the attorney-client privilege. But communications regarding a previous crime or act of fraud are protected by the privilege, unless the lawyer believes that disclosure is necessary to prevent a future crime. Whether the privilege applies in this particular case will depend, in part, on the Second Circuit's interpretation of the scope of the crime-fraud exception to the privilege. If the Second Circuit affirms the District Court's decision, companies can at least rest easier knowing that their communications with counsel about False Claims Act issues will, in most instances, remain private.
 

• Email This
• Print
• Comments (1)
• Trackbacks
• Share Link

This post was written by Amy J. Greer.

The SEC sent out a warning yesterday that a phony message referencing the Agency's Whistleblower Office is being used in connection with a potential computer hack or dissemination of malicious software. According to the SEC Alert, sent through the Agency's push technology, it has received numerous calls in the past 24 hours concerning an email that reads as follows:

 "Dear customer, Securities and Exchange Commission Whistleblower office has received an anonymous tip on alleged misconduct at your company, including Material misstatement or omission in a company's public filings or financial statements, or a failure to file Municipal securities transactions or public pension plans, involving such financial products as private equity funds. Failure to provide a response to this complaint within a 14 day period will result in Securities and Exchange Commission investigation against your company. You can access the complaint details in U.S. Securities and Exchange Commission Tips, Complaints, and Referrals portal under the following link: "

According to the SEC, the email is a hoax. Since the message appears to be directed at companies, it may be prudent to warn your personnel about this hoax.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Cynthia O’Donoghue and Nick Tyler; Paul Bond, Christopher G. Cwalina and Steven B. Roosa.

Following the widely reported allegation that a social network’s iPhone app had uploaded the names, addresses and phone numbers of users’ contacts onto their servers without permission, both Apple and U.S. legislators have moved swiftly to try to curb this practice.

Path, the company responsible, has apologised and promises to delete the uploaded contact information from its servers. Path has released a new version of the app that asks users for permission to upload their contacts onto Path’s servers (similar to their existing Android version of the app).

For its part, Apple has responded to this situation by modifying its app-related policies. Going forward, Apple will require all smartphone apps to obtain users’ permission before accessing users’ contact information. Apple’s existing iOS App Guidelines already prohibited non-consensual collection of such information, but now consent will be defined as “explicit user approval”. For existing apps, changes to the process of obtaining consent will have to wait for the next release of software.

In addition to action taken by Path and Apple, the U.S. government has initiated responsive steps. Two members of the U.S. House of Representatives, Reps. Henry Waxman (D-Cal.) and G.K. Butterfield (D-N.C.), wrote to Apple’s CEO, Tim Cook, wanting to know more about the Guidelines and iTunes Store policies. In their letter, the Congressmen cited an allegation that the practice of uploading and storing user contacts is tacitly accepted - there being “a quiet understanding among many iOS app developers” that they can do so.

If true, this would suggest that the “Path situation” is just the tip of an iceberg. With the proliferation of apps, it is easy for companies to make apps available to the public without terms and conditions and/or privacy policies alerting users to their practices – a situation that creates the potential to flout not only Apple's rules, U.S. laws, and best practices, but also global data privacy laws. Governmental and regulatory hackles will inevitably be raised, particularly as the practice in question was at the heart of Google Buzz, resulting in a class action lawsuit, a US$8.5 million settlement, and a 20-year regulatory audit program.

Not only has Path not followed Apple’s Guidelines, but Google, as reported in the Wall Street Journal, has also been accused of bypassing the default privacy settings on Apple’s Safari browser, allowing Google to track iPhone users’ behavior. Google has now disabled those cookies and stressed that “the advertising cookies do not collect personal information”, a view that may be contrary to the EU data privacy laws. Apple is “working to put a stop” to any ability to get around Safari’s default privacy settings. Consumers have already launched related class action suits against Google in federal courts in Delaware, Kansas, Missouri, and New Jersey.

Stories like these only increase awareness of regulators in the United States and across Europe. With the potential for class actions and consent decrees in the United States, and with the draft EU Data Protection Regulation setting penalties at up to 2 percent of a company’s annual worldwide turnover, organisations need to have mechanisms in place to ensure they are in compliance with their contractual obligations, such as Apple’s iOS Guidelines, and with consumer protection and worldwide privacy laws. A failure to do so will leave companies open to investigation and litigation unless they can get a firm handle on the apps that bear their name and brand reputation.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Paul Bond, Judith L. Harris, John P. Feldman, Christopher G. Cwalina and Amy S. Mushahwar.

Today, in a ceremony with much fanfare, Secretary of Commerce John Bryson and Federal Trade Commission Chairman John Liebowitz outlined the Obama administration's privacy blueprint for a "consumer bill of rights." Shortly thereafter, the Department of Commerce released its long-awaited consumer privacy green paper entitled,"Consumer Data Privacy in a Networked World" (the "Final Report"), which follows up on a draft staff report issued well over a year ago [see our previous post, Privacy: A Washington Tale of Two Reports].

Like the previous draft, the Final Report calls for a comprehensive privacy framework for all data, instead of the current sector-specific approach to data protection that leaves some personal data (outside of the communications, health care, education, financial services and children's-online sectors) largely unregulated. The Final Report calls for federal legislation to create such a "privacy bill of rights" that would supplement and fill in the gaps of existing federal privacy policy. However, scores of privacy bills have been introduced in 2010, 2011 and 2012, and few expect a comprehensive privacy bill to pass during a bitter election year.

Knowing that privacy legislation will be difficult to pass this year, the administration also laid out a set of voluntary privacy standards in the Final Report that could be adopted by industry in the absence of legislation. The Commerce Department indicated today that it is confident industry will adopt this cooperative approach for a privacy public-private partnership. Secretary Bryson also indicated that his office already conducted extensive outreach with Internet companies, data collection companies, retailers, ad networks, privacy advocates, academics and consumer groups to encourage the voluntary adoption of seven data-handling principles:

1. Individual Consumer Control of Data Through Choice Mechanisms
2. Greater Consumer Transparency
3. Respect for Data Context
4. Secure Handling of Data
5. Consumer Data Access & Correction Rights (Data Hygiene)
6. Focused Collection (Data Minimization)
7. Accountability (through audit controls and vendor contractual obligations)

Such a voluntary code, however, comes with a carrot and an eventual stick. The carrot: FTC enforcement actions regarding online privacy matters are ongoing. As indicated in the Final Report, if the industry adopts any voluntary code that is developed, then in any investigation or enforcement action based on an FTC Section 5 unfair and deceptive trade practices action, the FTC would consider a company's adherence to the voluntary codes favorably. The stick comes in a few weeks. The Federal Trade Commission is expected to release its Final Staff Report on Consumer Privacy that will be in sync with the administration's blueprint. Non-adherence to a Final FTC Staff Report could be used as evidence of a Section 5 violation, even in the absence of any general privacy federal legislation.

In the coming weeks we will be releasing more granular guidance on how companies should begin evaluating their respective privacy practices, as well as other elements of the staff report (i.e., international harmonization, the role of U.S. state attorneys general, and DOC support of national data breach standard legislation).

 Please click here to view additional information from the Reed Smith Teleseminar "The Department of Commerce Steams Ahead with Privacy Regulatory Blueprint: What you Need to Know." 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by John L. Hines, Jr., Paul Bond, Amy S. Mushahwar and Frederick Lah.

The Massachusetts Data Protection Regulations, 201 C.M.R. 17.00, ("Massachusetts Regulations") establish minimum standards to be met in connection with safeguarding the personal information of Massachusetts residents. Personal information is defined as a resident's first name and last name or first initial and last name in combination with the resident's Social Security number, driver's license number or state ID card number, or financial account number.

Under the Massachusetts Regulations, companies that own or license personal information must "oversee" service providers by requiring them by contract to "implement and maintain such appropriate security measures for personal information." See 201 C.M.R. 17.03(2)(f). The Massachusetts Regulations provide a grandfather clause that deems any contract with a service provider entered into before March 1, 2010 to be in compliance, even if it does not have provisions related to adequate data security. This clause, though, expires March 1, 2012, which is quickly approaching. From that date forward, all contracts with service providers must be in compliance with the provision.

All companies—whether the owner/licensor of the information overseeing the service provider, or the service provider (who would also likely be considered a licensor)—need to ensure that any contract (new or existing) touching personal information contains a provision to implement and maintain appropriate safeguards. Such a representation should be accompanied with the requisite due diligence to ensure accuracy and the right to review/audit future compliance.

Contractual modification may prove to be harder for some companies, particularly those operating under medium- or long-term contracts that do not require that a servicer provider do all the things that the Massachusetts Regulations require. In this situation, good faith and cooperation may not always work. Still, you may be able to rely on contractual clauses requiring compliance with law to effectuate change. At the very least, you should communicate (and document) your expectation of compliance to the service providers.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Cynthia O’Donoghue, Paul Bond, Chris Cwalina, Nick Tyler and Frederick Lah.

Consumers increasingly demand transparency into how companies use their personal information. We’ve seen a number of responses to this. One has been legislative; for example, the accounting requirement under the Dodd-Frank Act and California's Shine the Light Act. For our previous analysis of the latter, please click here. Regulators have also responded, with both the U.S. Department of Commerce and the Federal Trade Commission ("FTC") suggesting that the privacy practices of companies need to be more transparent. There have been enforcement actions as well; for example, Facebook's settlement with the FTC requiring better disclosures on data use and sharing.

Now we are seeing the market respond with a niche industry of privacy testers and raters arising to meet consumer demand for this information. One such rater getting recent attention on both sides of the Atlantic is PrivacyChoice (through its new Privacy Score product). According to its website, Privacy Score "estimates the privacy risk of using a website based on how they handle your personal and tracking data." The site awards websites scores out of 100. Close to 1500 sites have been scored so far. The site also offers a list of every company "tracking" consumers visiting a particular site.

By its own admission, the Privacy Score given to a company's site is just a "rough measure." The scores are based solely on the representations made on the site's privacy policy, and the amount of "tracking" purportedly being done on the site. Therefore, the scores may not accurately reflect the actual privacy practices of a company, especially considering the fact that many companies tend to use safer and broader language in their privacy policies to avoid any risk of over-promising and under-delivering. In other words, companies should not overreact if they see an especially low score (of which there are very few), nor should they find any real sense of comfort if they are given a high score.

The concept of privacy testing and rating is not new. TRUSTe has been issuing seals of approval for privacy policies for years. In addition, the Wall Street Journal has released a "What They Know" series about the tracking activity of marketers on websites, and has rated the level of "exposure" for a number of sites (using Privacy Choice data as part of its methodology). Nevertheless, this concept of testing and rating is a direct response to the growing demand from consumers to know how companies are using their personal information, and it is not going away anytime soon.

From the European perspective, these scores/ratings are of little value to consumers. They do not provide any reliable assessment of compliance with the more stringent and long-established legal requirements for transparency and fair information handling under European data protection legislation and codes of practice.

You should prepare for your company's disclosures (privacy policies, terms of use, etc.) to be heavily reviewed in a high-scrutiny environment. This means being well-informed about what is happening on your site and mapping your disclosures accordingly. If you believe you’ve been mis-reviewed by Privacy Choice, consider whether you think it’s worth speaking out and/or pursuing correction. On a more macro-level, consider how you can better present yourself to consumers to meet their increasing demand for transparency. In light of this growing trend, it’s not just a matter of compliance with law - it’s a commercial imperative to protect your brand.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Christopher L. Rissetto and Robert Helland.

The recent activity in the House of Representatives on a $260 billion, five-year transportation authorization bill, raises hope that Congress would finally enact a long-delayed successor to the SAFETEA-LU surface transportation law. This would be a relief to all those who seek a long-term source of funding to help repair and replace the nation's deteriorating roads, rails, and bridges. But don't stick that shovel in the ground just yet. With a divided Congress and an election looming, it is easy to see this train getting de-railed, at least until 2013.

SAFETEA-LU should have been re-authorized by September 30, 2009. The reason for the almost three-year delay is the lack of revenue flowing into the Highway Trust Fund ("HTF"), which is the biggest source of funds to pay for surface transportation projects. H.R. 7, the "American Energy and Infrastructure Act" ("Act"), includes a number of "pay fors" to help make up for this. However, they come with their own concerns. For example, the Act would find new revenue by opening up sections of the outer Continental Shelf to oil drilling, something that many Members of Congress from coastal states oppose. In addition, the Act would open up sections of the Arctic National Wildlife Refuge ("ANWR") to oil drilling, also a hot button issue. And it would change the rules regarding pension contributions for federal employees, which has generated its own level of opposition.

It is for this, as well as other reasons, that House Democrats are reported to be in almost unanimous opposition to the Act, with a number of Republicans opposing it as well. It is perhaps for these reasons that House Speaker John Boehner (R-OH-8) has announced (1) that the vote on the Act will be delayed until the House returns from its week-long Presidents' Day recess; and (2) the major components of the Act will each be voted on separately, rather than as a comprehensive measure. And if the Act even passes the House, it faces opposition in the Senate, which is working on its own two-year re-authorization bill (S.1813, the "Moving Ahead for Progress in the 21st Century Act" or "MAP 21"), which has a lower price tag ($109 billion). And even if it passes the Senate intact, the Act faces a veto threat from the White House.

All of this indicates a lot of political posturing, and significant uncertainty, in advance of the fall campaign season. With funding remaining a concern, however, leveraging public funds with private funds will likely need to be a component of any transportation proposal to reach the President's desk. Such measures as the "greater use of existing federal financing programs, the creation and capitalization of state "infrastructure banks" to provide financing for projects, and policies that will attract private sector investment i.e. through public-private partnerships," are common to the Act and enjoy bipartisan support in the House and Senate. Just don't expect them to become law anytime soon.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by James P. Gallatin, Jr.

Companies with global supply chains are rapidly imposing detailed standards for their suppliers that go way beyond the traditional performance and quality specifications. Until recently, the most obvious categories of concerns for global manufacturers were rules of origin for products and parts for purposes of customs valuations and treaties, heightened by protectionist legislation such as that recently introduced in the U.S. Congress regarding steel. Now come laws regarding the use of conflict minerals and the state of California (where else?) has gotten into the action to require the disclosure of how companies act to prevent human trafficking in their supply chain . And Apple is grappling publicly with allegations regarding its China-based manufacturing.

To minimize legal challenges and, more importantly, brand damage, companies with global supply chains are moving rapidly to adddress a broad range of issues with every level of those chains. They are imposing detailed and public supplier standards for workers' health and safety, wages and benefits, and the use of child labor, as well as prohibitions against the use of coercion and discipline to maintain a workforce, and prohibitions against forced sex. Two examples of companies that have imposed such standards are Hewlett Packard, the U.S.-based manufacturer of IT products, and LEGO, the Danish manufacturer of children's toys and games. Their standards and practices reflect the dramatic impact that recent laws and social norms are having on such diverse global enterprises. 

But standards are not enough. Companies with global supply chains are also moving rapidly to enforce these standards through unannounced audits and inspections, and by reviewing facilities, inspecting records, and interviewing current and former employees. They are using internal or third-party resources, and are cooperating with local governments, NGOs, and international standards organization. Where they find noncompliance, they are taking action under their agreements. Many companies are still trying to figure out where their products are actually being made this month. They are falling behind of today's norms.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Melissa E. Beras.

On Thursday, February 9, Sen. Sherrod Brown (D-Ohio) introduced the United States Steel and Security Act, along with Sens. Chuck Schumer (D-N.Y.), Kirsten Gillibrand (D-N.Y.), Amy Klobuchar (D Minn.), Robert P. Casey Jr. (D-Pa.), and Al Franken (D-Minn.). The legislation would reinstate the requirement that armor steel plate purchased by the U.S. military be 100 percent both melted and finished in the United States, reversing a 2009 decision by the U.S. Department of Defense (DOD) that allowed the military to purchase steel that had been melted in foreign countries. Armor steel plate is used by the military in vehicles, tanks, and other equipment.

The DOD’s 2009 decision was made in the midst of the wars in Iraq and Afghanistan, when the demand for steel was especially high. The final rule, published by DOD July 29, 2009, defined the word "produced" as it applied to armor steel plate under the Special Metals Amendment to include simple finishing processes. This change in definition allowed armor steel plate melted in foreign countries, including Russia and China, to be deemed "produced domestically" if it was subsequently subject to simple finishing processes in the United States. The decision reversed more than 35 years of legal interpretation and administrative practice.

After inquiries questioning the DOD on its steel purchasing standards, the National Defense Authorization Act for fiscal year 2011 included a provision requiring a review of the existing regulation to ensure the definition was consistent with congressional intent. The review was required to be completed within 270 days of enactment of the law, or early October 2011. On July 25, 2011, DOD published its request for comment, and the deadline for public comment was September 8, 2011. DOD has still yet to finalize its review.

On September 28, 2011, Sen. Brown and others sent a letter to Defense Undersecretary Ashton Carter, urging him to revise the Department’s requirements on armor steel plate. During consideration of the National Defense Authorization Act in December 2011, Brown and Senate Armed Services Committee Chairman Carl Levin (D-Mich.) called for the DOD to expedite its review of this issue. The Senators hope that the change will create jobs by providing a boost to the domestic steel industry.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Judith L. Harris and Amy S. Mushahwar.

The Federal Communications Commission (FCC) acted today to tighten its rules under the Telephone Consumer Protection Act (TCPA) and conform them, to the extent possible, with the more stringent rules already in place at the Federal Trade Commission (FTC) under the Telephone Sales Rule (TSR). This change will hit hardest entities such as banks which are not subject to FTC jurisdiction, and do not have more stringent compliance programs already in place. Although the FCC’s order has not been released and no information is available yet as to the details of how the revised rules will operate and exactly to what calls they will apply, the following four points are clear:

1. Prior express WRITTEN consent will now be required before making any telemarketing robocall (using an autodialer or a prerecorded message) to a consumer; electronic signatures will be acceptable as evidence of written consent and this change will not apply to purely informational calls (“such as those related to school closings and flight changes.”);

2. The “established business relationship” will be eliminated as an exception to the prior written consent requirement that currently applies in the case of wireline calls;

3. An automated opt-out mechanism will have to be included in each robocall to facilitate a consumer’s ability to withdraw prior consent; and

4. The rules governing abandoned or “dead air” calls will be tightened, including through stricter time limits and by changing those limits to apply to each separate marketing campaign, rather than allowing the limits to be averaged over different calling campaigns, as is currently the case.

We are awaiting further details on exactly how these rules will be applied and when they will become effective. In the interim, please contact the authors of this article or the Reed Smith attorney with whom you normally work.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Cynthia O'Donoghue, Nick Tyler, and Katalina Chin.

As reported in our January blog on the day of its release, the European Commission has now published a draft General Data Protection Regulation (the “Regulation”) and has sent it to the European Parliament, along with a new draft Directive aimed at protecting personal data in relation to criminal investigations and judicial proceedings, including across borders.

The European Commission’s stated goal is to have parliamentary approval of the Regulation by the end of 2012. Despite some areas of uncertainty and the strong potential for continued disharmony, as well as the inevitable changes that will result from the legislative process, the Regulation provides enough detail in relation to the accountability principle and the increased self-regulatory regime for organisations to start preparing for implementation within the next three years.  

For a detailed analysis, please click here to read the issued Client Alert. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Stephanie E. Giese.

The issue of senior executive compensation limits continues to be a contentious one for the federal government and its contractors. This may explain why the limit has not been raised since 2010 from the current amount of $693,951. In fact, the Obama administration has proposed lowering senior executive compensation limits to $200,000, the level it caps salaries for its own executives. Given the administration’s focus, this is an area where we are likely to see more litigation. The Appeals of J.F. Taylor, Inc., ASBCA Nos. 56105, 56322 (January 18, 2012) (“JFT”) is an example of such litigation that was recently decided in favor of the contractor.

The JFT decision is relevant to contractors subject to Federal Acquisition Regulation (“FAR”) 31.205-6(p), the federal limitation on the allowability of compensation for senior executives. This benchmark limitation is the maximum amount a contractor may seek reimbursement for under its government contracts, but does not limit the compensation an executive may earn. Further, the limit that applies to small-to-midsize government contractors may actually be lower than the benchmark limitation. Regardless of the size of the contractor, a contractor subject to FAR 31.205-6(p) must show that the executive compensation costs it charged the government are reasonable in order for the government to reimburse those costs. To evaluate reasonableness, Defense Contract Audit Agency (“DCAA”) conducts a statistical analysis considering factors such as industry, company revenue relative to other companies in the same industry, geographic location, and the executive position being evaluated.

The JFT decision offers arguments that may allow a contractor to resolve disputes with DCAA in annual Executive Compensation Reviews (“ECRs”) and to avoid potential litigation. In its JFT decision, the Armed Services Board of Contract Appeals held that DCAA’s methodology was “fatally flawed statistically”:

(a) as a matter of basic statistical analysis,

(b) because the method market priced JFT’s executive compensation at the median without adequate consideration of the company’s superior performance,

(c) because DCAA failed to evaluate the compensation of the JFT vice presidents based on the revenues of the whole company even though each vice president had companywide responsibilities for the success of the company, and

(d) because the method used does not yield auditable and reliable results.
 

Thus, JFT was not required to repay the government approximately $600,000 in disallowed executive compensation costs. A contractor should consider the fatal flaws cited by the Board as potential arguments to defend its own executive compensation costs.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Steven J. Boranian, Joshua B. Marker, Mark S. Melodia, Christopher G. Cwalina and Paul Bond.

Increasingly, consumers demand to know how the businesses they patronize use, share, and disclose personal information. California’s Shine the Light Act, California Civil Code 1798.83, is intended to meet this demand for transparency. The Shine the Light Act provides California residents a statutory right to demand an accounting of how a business has shared personal information about them, to third parties, for the purpose of those third parties engaging in direct marketing to the consumer. The Act imposes a corresponding duty on many businesses to provide a clear and conspicuous method by which consumers can make such a demand. As reflected in the Reed Smith Shine the Light Act Reference Guide, the Act does not apply to every business, nor to every disclosure. Where the Act does apply, violation of its requirements can result in liability of up to $3,000 per violation.

Despite going into effect in 2005, the Act has just recently become the statutory basis for a number of consumer class actions, including against major publishing companies such as Conde Nast and Men’s Journal LLC. The lawsuits allege that the companies did not provide a method for consumers to obtain the disclosures of their personal information as required by the law. The suits seek thousands in statutory damages on behalf of every class member. To see if the Act applies to you, and what you have to do to comply, please review the chart and call counsel with any questions.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Identity Management and Access Control is the foundation of a company's data management practices. But, because of the extensive coordination that must occur within the organization, it is often a long-term strategic goal that continues to take the back seat in favor of other, more immediate projects. Often, if a company can keep the discussions of Identity Management and Access Control within the context of central ROI prospects and/or compliance needs that already enjoy leadership support, such projects are far more likely to make it to the finish line. Reed Smith recently hosted a series of meetings on this topic in its Washington, D.C., New York, Pittsburgh and Philadelphia offices with the CISO Executive Network on "Identity Management and Access Control." Please click here for a recorded video conference of Amy Mushahwar presenting to the Pittsburgh CISO Executive Network.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Leslie A. Monahan.

Last week, the Office of Management and Budget (“OMB”) announced that President Obama is working to breathe life back into a proposal to end federal contractor executive overpayment. According to the OMB’s blog post, the Obama administration will be asking Congress to reform the current reimbursement formula for contractor executives. The proposal will not limit how much contractors can pay their top five executives. Rather, it aims to limit the amount the government can reimburse contractors for executive salaries. Specifically, the proposal seeks to cap the government’s reimbursement at the same level as what it pays its own executives – $200,000 per.

Back in the 1990s, Congress tied the levels of pay given to contractor executives to the salaries of the nation’s top private executives, as opposed to government executives. As private sector salaries soared, so did those of contractor executives, something that did not go unnoticed. Receiving support from senators on both sides of the political spectrum, an amendment to the 2012 Defense Authorization Bill capped the reimbursement of salaries for some contracts with the Department of Defense. The Obama administration now seeks to extend the provisions across all government agencies as part of its Campaign to Cut Waste.

While the Obama administration believes that ending executive overpayment will benefit all taxpayers, certain taxpayers disagree. On the same day OMB made its announcement, the Professional Services Council (“PSC”) publicly opposed the measure. PSC stated that the proposal would negatively impact small businesses and inhibit the ability of the government and industry to attract top talent to work on federal contracts.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Cynthia O’Donoghue, David Cohen, Nick Tyler, and Regis Stafford.

The American Bar Association (ABA) this week passed an important resolution urging all courts in the U.S. to:

“consider and respect…the data protection and privacy laws of any…foreign sovereign, and the interests of any person who is subject to, or benefits from such laws, with regard to data that is subject to preservation, disclosure, or sought in discovery in civil litigation.”

The ABA journal describes the long-standing dilemma faced by litigators on both sides of the Atlantic as “Hobson’s Choice”. The ABA Section of the International Law Report to the House of Delegates further explains the choice too often faced by litigants: “violate foreign law and expose themselves to enforcement proceedings that have included criminal prosecution, or choose noncompliance with a U.S. discovery order and risk U.S. sanctions ranging from monetary costs to adverse inference jury instructions to default judgments.”

It is interesting to note the timing of the resolution, coming as it has less than two weeks after publication by the EU Commission of the long-awaited draft EU Data Protection regulation with its proposed new sanctions of up to 2 percent of annual worldwide turnover for serious breaches, which would include an unlawful data transfer to the U.S..

Such sanctions represent a ‘game-changer’ in the current risk profile and choices presented to multi-nationals faced with U.S. discovery requirements demanding the transfer of personal data held by EU affiliates in breach of EU data protection laws.

Current U.S. jurisprudence will now be tested – up until now the U.S. courts have tended to strike the balance in favour of compliance with U.S. rules on the basis that there is no realistic prospect of prosecution in Europe for an enterprise which breaches EU cross-border transfer restrictions. See In Strauss v. Credit Lyonnais S.A., 242 F.R.D. 199 (E.D.N.Y. 2007).

However, as the report to the ABA House of Delegates regarding the resolution explains, there are other good reasons, in addition to the possibility of sanctions, for U.S. courts to respect Europe’s data privacy laws. If U.S. courts continue to favor broad discovery in violation of EU restrictions, U.S. litigants may face, “a similarly hardened view of U.S. laws and regulations to the detriment of U.S. litigants” in courts outside of the U.S.. Moreover, “[p]ermitting broad discovery in disregard or even defiance of foreign protective legislation can ultimately impede global commerce [and] harm the interests of U.S. parties in foreign courts and provoke retaliatory measures.”

The resolution has been diluted from that originally proposed, with the insertion of qualifying words such as “where possible in the context of the proceedings”. Nonetheless, the ABA have sent a clear signal that the time for a re-evaluation of the status quo is needed and U.S. Courts need to recognise the wider implications of cross-border litigation in the context of an increasingly globalised corporate and legal environment.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by John L. Hines, Jr.

On December 20, 2012, Reed Smith welcomed the founder and CEO of Reputation.com to discuss online reputation management. Mr. Fertik, who speaks regularly in the popular media, explained the particular reputational challenges presented by the online environment, how to take advantage of social media to control your reputation and how innovative software solutions are being used to help victims of harmful speech in situations where legal solutions may be impractical. The full presentation, which reviews the factors that make up an online reputation and how it is distinguished from your "brand", how to manage your online reputation: legal and technical tools, how to mitigate online reputation risk for yourself and your clients and ethical considerations can be found HERE.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

This post was written by Joelle E.K. Laszlo.

If you are a Federal government contractor, please take a moment to recall the name of your “Past Performance Primary POC,” or P4OC for short. [In the unlikely event that this acronym catches on, you saw it here first.] Don’t know who your P4OC is? Don’t have one? If not, remedy the situation promptly: starting this year, a good P4OC may be the only thing standing between you and unfavorable information posted by the government on the Internet for all to see.

P4OCs can attribute their recent surge in significance to the Final Rule on the Federal Awardee Performance and Integrity Information System (“FAPIIS”), which was published in the Federal Register just after the new year. Followers of this ’blog will be well-acquainted with FAPIIS by now [click here if not]. Mandated by the 2010 Supplemental Appropriations Act, FAPIIS is designed to be a one-stop-shop for information on Federal contractors – particularly information associated with contractor wrongdoing. Conceptually FAPIIS has been praised by advocates of transparency in government contracting, but it has not quite lived up to the hype in its initial months of existence.

Nevertheless, we and others have advised contractors to take FAPIIS seriously and proactively, something the new Final Rule more or less requires. The Final Rule creates a procedure under Federal Acquisition Regulation (“FAR”) clause 52.209-9 whereby a contractor’s P4OC will be notified whenever a Federal agency proposes to post new information about the contractor on FAPIIS. The contractor will have seven calendar days to review the information and object to the post under an exemption to the Freedom of Information Act (“FOIA”). If within the seven-day time frame the contractor asserts that any of the information proposed for posting is covered by a FOIA exemption, that information must be removed within another seven days and the issue must be resolved according to FOIA procedures. Importantly, and as clarified in a second Federal Register Notice, these new procedures for the review of information proposed for FAPIIS posting took effect on January 17, and apply to any government contract that contains FAR 52.209-9 (not just the January 2012 version of the clause).

Given these developments, the first step for any contractor is to ensure that its P4OC and other past performance contacts are included in the Central Contractor Registration database. Because of the short turn-around time for reviewing information proposed for posting to FAPIIS, every government contractor will want to make sure their P4OC is punctual. Even if information proposed for posting is not exempt from the FOIA, contractors will have the opportunity to comment on the data to be posted (in larger data fields than before). This means that a good P4OC will also be able to marshal the information needed to put unfavorable performance records into their proper context. So your P4OC could very well become an MVP.

• Email This
• Print
• Comments
• Trackbacks
• Share Link