Category Archives: Legal

Для тех, кто интересуется безопасным доступом к онлайн-играм, наш партнер предлагает зеркало Вавады, которое позволяет обходить любые блокировки и сохранять доступ ко всем функциям казино.

New Approaches Needed for Effective Data Risk Management

Posted on by

virus

Over time, the role of corporate legal departments has expanded to address the increasing risks in corporations—from increasing involvement in implementing corporate policies to leading employee training on procedures for managing electronic communications, social media, and bring your own device (BYOD) policies. This shift, however, is not enough to meet the challenges posed by an increasing range of risks proliferating within global organizations. Legal and compliance groups must also take the lead in finding new ways to leverage the power inherent in their data and address the challenges posed by massive data stores, information and network security challenges, as well as regulatory compliance requirements.

Failings of Traditional Strategies

In the past, organizations used straightforward, people-intensive methods to search for and remediate risk. For example, organizations instituted policies training, hoping that it would be sufficient to corral employee use of electronic communications, BYOD, and social media. Some may have formed working groups or intradepartmental committees designed to consider the implications of data privacy or information security for their businesses. Others rely on basic technology, such as keyword searches, that trigger electronic alerts when they find a hit in a document.

While these tools are still important to demonstrate compliance, they are insufficient alone to monitor for risk.

buy estrace online www.biop.cz/slimbox/css/gif/estrace.html no prescription pharmacy

Older technology falls short when it comes to handling unstructured data, such as e-mail. For example, discerning employees will be too cautious to use triggering keywords such as “donations” or “bribes” when referring to illicit activity. Keywords are also notoriously inaccurate: if over-inclusive, they may yield a stockpile of irrelevant information, while under-inclusive keywords could omit critical documents from discovery.

Trends Drive New Risk Management Approaches

Three recent trends—escalations in data volumes, increasing threats to data privacy and security, and heightened regulatory scrutiny—highlight the need for more intensive means to investigate risk in organizations.

1-Burgeoning Data Stores

With today’s hyperfocus on information, risk follows data. The more data sources organizations have, and the more locations for storage of data, the greater the legal exposure.

Email is perhaps the most insidious source of risk, as hackers may look to exploit unwitting employees who may open spoofed e-mails containing malware or viruses designed to attack the corporate network. Along with e-mail, employees also have more ways than ever to share confidential corporate data such as trade secrets with outsiders. Newer forms of unstructured data, such as social media and instant messaging, allow people to disperse troubling information even more rapidly than before.

As more organizations look for low-cost storage for their data reserves, they have turned to the cloud—yet another source of potential risk to data privacy. Cloud providers may be susceptible to the same hacker schemes as employees. Moreover, depending on the terms of their service-level agreements, they could employ lax security protocols, lack disaster-recovery plans, share data with other clients, or transfer data to third parties, all without notifying the data owner. Furthermore, depending on the location of the cloud storage, it may trigger the application of international laws that protect data privacy and prevent the processing or transfer of a corporation’s data.

2-Data Privacy and Security

Traditional approaches to risk management are poorly equipped to meet the demands imposed by today’s data privacy and security regulations, particularly when it comes to the need to protect personally identifiable information, protected health information, nonpublic information, trade secrets, and privileged data.

This is especially true for global organizations, which are likely to have information cross international borders and trigger other nations’ data privacy schemes. Many nations have adopted restrictive schemes designed to protect their citizens’ personal information, such as the European Union’s Data Protection Directive, which controls when and how organizations can collect, process, store, alter, retrieve, and transmit this personal data. Many nations in the Asia-Pacific region have also created data privacy regimes, including China, which has blocking statutes that forbid the cross-border transfer of documents that contain “state secrets” as well as confidential commercial information.

Domestically, organizations must worry about laws such as the Health Information Technology for Economic and Clinical Health (HITECH) Act, which extends the Health Insurance Portability and Accountability Act (HIPAA) to a covered entity’s third-party business associates. Under HIPAA’s Security Rule, organizations and their business associates must take reasonable measures to safeguard protected health information.

buy tamiflu online www.biop.cz/slimbox/css/gif/tamiflu.html no prescription pharmacy

Organizations must vigilantly monitor their data to ensure there are no gaps in security that would violate these rules.

3-Regulatory Enforcement

The nation’s regulatory framework is becoming more complex almost by the day. Regulations that supplement laws such as the Foreign Corrupt Practices Act (FCPA) and the International Traffic in Arms Regulations (ITAR) have generated new areas of vulnerability, particularly when it comes to third-party relationships.

For example, the current administration has taken the position that no FCPA infraction is too small to prosecute. Organizations that fail to take proactive measures to search for, disclose, and remediate misconduct are likely to face substantial penalties if a regulatory agency discovers misconduct. Traditional tools, such as internal audits, are not up to the task of detecting the malfeasance of internal fraudsters, who may mask their corrupt behavior with code words or other innuendo that make it difficult to discover using keywords. Unless more advanced tools are used, an organization’s best defense against fraud might be reliance on tipsters.

A similar approach is required to ensure compliance with ITAR. This law imposes stiff penalties, including millions in fines, against U.S. organizations that export “defense articles” without government authorization. “Articles” is defined so broadly that it covers technical, defense-related data in documents, blueprints, drawings, photographs, plans, or instructions. The Directorate of Defense Trade Controls, the U.S. agency that enforces ITAR, is likely to take a more lenient approach with companies that have implemented a rigorous compliance program and that voluntarily disclose and remediate any failures.

Data-Driven Tools

Risk professionals now have a number of advanced analytics tools at their disposal to counteract the additional risks that lurk in emerging forms of data. Linguistic analysis techniques can identify instances where employees use seemingly innocuous words or phrases to engage in subterfuge. Concept clustering is a tool that isolates subtle patterns within documents that seem dissimilar to the untrained—or undigitized—eye. These conceptual search tools can identify patterns in documents, based on keywords or chunks of text, and flag the documents that refer to items that might fall within ITAR’s purview. Data visualization tools can analyze relationships and look for troubling connections that might violate the FCPA, such as links between employees, vendors, and foreign officials. In addition, anomaly detection tools can scan records for irregularities, such as unusual recurring payments.

Counsel, risk and compliance professionals can also apply tools such as technology-assisted review (TAR) to prioritize documents for review based on the likelihood that they contain material of concern. Using TAR, experienced legal counsel code a seed set of documents for relevancy to the issue at hand. Once done, they feed these documents into a computer that is programmed to uncover the logical reasoning behind the lawyers’ coding decisions. Sophisticated algorithms then apply that logic across an entire document population.

buy cytotec online www.biop.cz/slimbox/css/gif/cytotec.html no prescription pharmacy

The process is iterative, so that ultimately the computer’s logic closely mirrors the lawyers’ coding decisions. Organizations can use TAR to limit the population of documents for review, thus expediting the data mining process.

The Riskiest States for Employee Lawsuits

Posted on by

In 2014, U.S. companies had at least an 11.7% chance of having an employment charge filed against them, according to the new 2015 Hiscox Guide to Employee Lawsuits. The firm’s review of data from the Equal Employment Opportunity Commission and its state counterparts found that the risk also varied notably by state, as local laws creating additional obligations—and risks—for employers led to charge rates up to 66% above average.

online pharmacy hydroxychloroquine with best prices today in the USA

STATES WITH THE HIGHEST EMPLOYEE LAWSUIT RISK

State laws that are driving some of this increased employee charge activity include heightened anti-discrimination/fair employment practices, the use of E-Verify in the private sector, pregnancy accommodation, prohibitions on credit checks, and restrictions on inquiring about or requiring background checks.

Key state laws driving increased employee charge activity

These cases can be especially damaging for small- and mid-sized enterprises, with 19% of employment charges among SMEs resulting and defense and settlement costs averaging $125,000 and taking about 275 days to resolve. The average self-insured retention for these charges was $35,000, Hiscox found, and without employment practices liability insurance, these companies would have been out of pocket an extra $90,000. What’s more, 81% resulted in no insurance payout, giving even nuisance charges the potential to be a serious financial hit. While the majority do not end up in court, when they do, the median judgment is about $200,000, not including defense costs, and 25% of cases result in a judgment of $500,000 or more.

During the hiring process, written procedures that outline and comply with federal and state laws can help minimize risk, as can maintaining a customized employee handbook that all staff acknowledge in writing they have reviewed. In addition to risk transfer, such as an employment liability insurance policy, Hiscox offered several tips to best mitigate the risk of employment charges, including:

Independent contractors

Be careful when designating independent contractors. There are variations among states and areas of law as to the test for an independent contractor. It is possible for a worker to be considered an independent contractor for some purposes and an employee for others.

online pharmacy neurontin with best prices today in the USA

Leaves of absence and accommodation for disabilities

A medical condition can trigger federal and state leave and disability laws, which vary, as well as workers compensation laws. Make it a policy to recognize events or discussions that create an obligation to discuss accommodations or a possible leave of absence.

Employee performance

Ensure that all supervisors and managers are aware of the procedure for addressing unacceptable employee performance. Communicate to the employee about what they are doing (or not doing) that is unacceptable, and make sure they understand what constitutes acceptable performance. Document all communications. Conduct factual, honest performance evaluations. Develop and maintain a procedure for corrective action plans.

Termination

To minimize litigation around termination, avoid surprises. Make sure that all guidelines have been followed for addressing unsatisfactory performance, particularly the corrective action plan. Prior to termination, assess the risk for litigation: is the employee a member of a protected class, involved in protected labor activities, or a potential whistleblower? Is the employee under an express or implied-in-face employment contract?

online pharmacy nizoral with best prices today in the USA

Gather and review the documentation that supports the termination and interview relevant players.

Corporate Directors and Officers Face Cybersecurity Pressure

Posted on by

Stock market down

One of the primary issues confronting corporate directors, officers and others involved in risk management today is cybersecurity. News cycles have been littered with high-profile data breaches at companies ranging from Sony Pictures Entertainment, Wyndham Hotels, Anthem and Home Depot, since Target Corporation’s massive data breach kicked off this scrutiny in 2013. The massive federal data breach earlier this year demonstrated that the U.S. government is not immune either.

A corporate data breach not only inflicts reputational and financial pain on the targeted company, but, depending on the data disclosed, the impact on consumers can be dramatic. According to Redspin’s Breach Report 2013, since 2009, nearly 30 million Americans have had their personal health information accidentally disclosed—or worse, breached. Further, the Cyber Edge Group recently surveyed 800 security decision makers and practitioners and found that more than 70% indicated that their networks were breached in 2014, an increase of 8% from 2013.

Claims against Directors

Cybersecurity is an issue of risk assessment that should be on the mind of board members. As every director has likely experienced, corporate decision-makers are under more scrutiny today than ever before because of corporate scandals that led to the adoption of the Sarbanes-Oxley Act and the more recent Dodd-Frank Act. One of the main objectives of Dodd-Frank is to increase transparency and improve accountability in the corporate financial world. As a result, board members are now required to spend more time overseeing a company’s operations than perhaps was the case in prior years.

A key determinant of liability is how a director acts once a red flag has been identified. When a warning sign appears, a director is required by law to diligently undertake a reasonable investigation.

online pharmacy apixaban with best prices today in the USA

But an open issue at hand is how much training companies provide to their directors so that they can identify potential issues and respond accordingly, or actively oversee the corporate compliance program. In light of many recent cases, the answer is: not enough. One proactive approach is for a corporate board to annually review all of the material events that impacted their company over the past year (both externally and internally) and assess how prepared the management team was for each event. They should also assess the company’s overall approach to cybersecurity policies and practices annually, including any incident response plans.

All this said, if history is our guide, the likelihood of a corporate board member being held personally liable for poor oversight of a public company is low. This is because directors and officers insurance almost always covers any liability or settlement. According to a 2006 Stanford Law Review study, between 1980 and 2005, there were only 12 cases where directors were forced to make payments that were not covered by insurance, including legal fees.

While data breaches have spawned litigation brought by consumers or employees, widespread litigation has not ensued with shareholders seeking damages as a result of a data breach. This is likely because of the challenges inherent in demonstrating that a company’s share price was materially affected by a breach.

online pharmacy minocin with best prices today in the USA

The data breach at Home Depot provides a good example of potential litigation strategies that may be employed in the future. Following that breach, a lawsuit was filed in Delaware Chancery Court seeking access to Home Depot’s books and records related to the data breach. It appears that the plaintiffs are using this suit to determine whether Home Depot’s directors and officers breached their fiduciary duties by failing to adequately protect the company’s credit card information. Based on what is uncovered, it is likely that future litigation will ensue.

The law regarding director’s liability is fairly well established, and claims typically arise in one of two scenarios: 1) The directors should be liable because they made a decision or took an action that was either negligent or ill-advised (they breached their duty of care); or 2) The directors failed to act in a situation where they could have prevented a loss (they breached their duty of loyalty).

Claims alleging a breach of the duty of care are unlikely to succeed because directors enjoy the protections of the director-friendly business judgment rule. Essentially, the business judgment rule immunizes a director’s conduct from judicial scrutiny as long as the decision is informed, made in good faith, and with the genuine belief that the decision was made in the company’s best interest. Even if a plaintiff can overcome the presumptions in favor of a director by showing gross negligence, many companies have adopted charter or bylaw provisions consistent with Delaware law, thereby insulating directors from liability for a breach of their duty of care. Other states such as Nevada have enacted statutes specifically protecting directors from these types of claims.

In the second scenario, a director is not insulated from liability under Delaware law, and a director’s conduct is evaluated under the standards enunciated in Caremark International Inc. Derivative Litigation and its progeny. This oversight liability attaches when directors consciously disregard their responsibilities either by: 1) failing to implement a sufficient reporting system; or 2) after implementing a reporting system, failing to properly oversee or monitor its operations by serving as passive recipients of information. Simply put, making no decision – or looking the other way – may indeed be worse than making any decision, even a bad one.

Many risks can be mitigated through the use of insurance policies. But with respect to cybersecurity, relying on insurance may prove problematic. With no form of standardized cyber insurance policy language established, different insurers are adopting different approaches. Moreover, an actuarial challenge exists in predicting or gauging the probability and impact of a cyberattack. As a result, it remains difficult to match a cybersecurity policy with the risk profile of a particular company. Also, the damages suffered from a data breach may be multifaceted and unique, with no normal distribution of outcomes. In sum, insurance may be a partial answer, but not necessarily a cost-effective complete solution.

Rise of the Corporate Investigation

Over the past several years, a cottage industry has emerged among lawyers who claim to specialize in corporate investigations. These investigations used to be the purview of a company’s general counsel or legal staff. But courts became less likely to apply the business judgment rule if an investigation was conducted in-house. This reluctance has spawned the exponential growth of corporate investigations, and more or less established that the standard of care is to retain outside counsel. Even though the costs of these investigations can be prohibitive, there appears to be no consensus on a different tactic.

In the face of a government enforcement action, regardless of which regulatory authority is involved, a director’s playbook is pretty straightforward. Directors should establish a committee to exercise day-to-day supervision of an internal investigation and monitor the progress in order to best ensure the company’s protection. One way for directors to limit their exposure—and perhaps cut down on corporate misconduct—is to provide the same oversight on an ongoing, day-to-day basis. This can decrease the number of required corporate investigations and the identification and remediation of issues before they become significant liabilities. Viewed through the eyes of a director, such an approach could lessen the likelihood of future liability.

Defective Sidewalk Conditions: Who is at Fault?

Posted on by

sidewalk2

Liability between municipalities and landowners for injuries sustained by pedestrians due to defective sidewalk conditions has been the subject of lawsuits and statutory enactments for years. In California, municipalities generally own the sidewalks adjacent to private property owners’ land, but state law provides that the landowners are responsible for maintaining the sidewalk fronting their property in a safe and usable manner. According to Streets and Highways Code 5610:

“The owners of lots or portions of lots fronting on any portion of a public street or place when that street or place is improved or if and when the area between the property line of the adjacent property and the street line is maintained as a parking or a parking strip, shall maintain any sidewalk in such condition that the sidewalk will not endanger persons or property and maintain it in a condition which will not interfere with the public convenience…”

California state law provides that a municipality may assess landowners for the cost the municipality incurs to maintain sidewalks if the landowner fails to perform his/her duty. Although state law provides that abutting landowners are responsible for sidewalk maintenance and may be assessed the cost of repairs, they may not be liable for injuries or damages to third persons who use the sidewalk, unless the municipality enacts an ordinance that addresses liability. Williams v. Foster (1989). Williams arose after the plaintiff, Dennis Williams, tripped on a raised portion of the sidewalk in the City of San Jose, and thereafter sued the City. In its defense, San Jose argued that under 5610, the owner of the property fronting the sidewalk in question was solely liable.

Rejecting this contention, the court held that Foster (landowner) owed no legal duty at all to the injured plaintiff.

In reaching the Williams decision, the court held that imposing upon abutting owners a duty of care in favor of third persons “would require clear and unambiguous language,” which according to the court, is not contained in 5610. Notably, the court went on to state that the City “could have enacted an ordinance which expressly made abutting owners liable to members of the public for failure to maintain the sidewalk, but did not.” Following the Williams decision, the City of San Jose amended its sidewalk ordinance to include language similar to that suggested by the Williams Court.

In 2001, after adopting a sidewalk liability ordinance that addressed the issues raised in Williams, San Jose was sued by Joanne Gonzalez, who alleged she was injured when she tripped and fell over a raised portion on a public sidewalk. Gonzalez also sued Charles Huang, who owned the property adjacent to the sidewalk on which she fell.  Huang was sued on the theory that he had a common law duty to the plaintiff to maintain the sidewalk in a non-dangerous condition, as well as a duty under the San Jose Municipal Code.

The City of San Jose argued that the adjacent property owner was partially liable because he had not maintained the sidewalk as required by the local ordinance. Huang filed a motion for summary judgment arguing in part that the sidewalk liability ordinance enacted by the City of San Jose was unconstitutional. The trial court agreed with Huang and granted his Motion for Summary Judgment. Both Gonzalez and the City of San Jose appealed.

The case proceeded to the Court of Appeal which in 2004 ruled in San Jose’s favor.

  (Gonzales v. City of San Jose (2004.) The primary issue before the court was whether the state law preempted the local measure. The court found that the ordinance was constitutional and was not preempted by state law.

In its holding, the Gonzales court noted that cities are empowered under the California Constitution to enact ordinances and regulations deemed necessary to protect the public health, safety, and welfare, and that the City of San Jose’s ordinance was a permissible exercise of that power. Without such an ordinance, the court noted, landowners would have no incentive to maintain adjacent sidewalks in a safe manner.

The court emphasized that the ordinance did not serve to absolve the city of liability for dangerous conditions on city-owned sidewalks when the city created the dangerous condition, knew of its existence and failed to remedy it. Since the Gonzales ruling, many municipalities have considered liability shifting ordinances. Some have enacted such ordinances while others have not, oftentimes on public policy concerns.

Note that even in jurisdictions which have enacted liability shifting ordinances, one must determine the cause of the defective sidewalk condition. In many ordinances, liability does not shift to the landowner if the landowner did not cause the defective condition to exist.

Thus, in analyzing liability in a case involving an allegedly defective sidewalk condition, a major issue will be whether the municipality has a liability shifting ordinance. If such an ordinance exists, it must be read carefully to determine its scope, as each ordinance differs from municipality to municipality.