The COVID-19 pandemic has presented not only novel challenges, but also opportunities for companies hoping to enhance or regain productivity while preventing wrongdoing and maintaining robust compliance functions. As workplaces reopen, historical challenges will persist and new risks will emerge. To be best positioned during this transition phase and beyond, companies should embrace the opportunity to evaluate their existing compliance processes and make the adjustments now that are necessary to adapt to a risk landscape that will likely never again be the same. Empower Legal, Compliance, and Investigative Resources Responsible companies will not be receptive to attempts to excuse misconduct due to the pandemic, nor will regulators. After all, there will be no “pandemic defense” to wrongdoing, and hindsight tends to be unforgiving—particularly through the lens of regulators looking at current events months or years from now. And as businesses emerge from state stay-at-home orders, an increased focus on productivity threatens to exacerbate the already heightened risk environment. It is critical that compliance, legal, and internal and external investigative resources be empowered to mitigate these risks effectively. Some immediate mitigation actions to be considered include: Conducting mandatory training on the enhanced risk environment and compliance best practices. Assessing existing policies and procedures, including those specific to internal investigations, and revamping them as needed to address...
On February 22, 2019, another proposed amendment to the California Consumer Privacy Act (CCPA) was published. If enacted, this amendment will increase businesses’ potential exposure under the CCPA by, among other things, expanding the scope of private rights of action under the Act and eliminating a cure period prior to a civil enforcement action by the California Attorney General. The CCPA, originally enacted in June 2018 and first amended in September 2018, sets forth an entirely new privacy and security regime for many entities doing business in California. It imposes extensive requirements on the collection, use, and storage of consumer personal information, and applies to many businesses located both in and outside of the state. The deadline for all businesses to comply with the CCPA’s requirements is January 1, 2020, and the California Attorney General may bring an enforcement action six months after the passage of implementing regulations, or July 1, 2020, whichever comes first. The clock is ticking … The CCPA applies to any for-profit entity that (i) does business in California, (ii) collects “personal information” and/or determines the purposes and means of processing “personal information,” and (iii) satisfies at least one of the following threshold criteria: Has annual gross revenues of $25,000,000; Annually buys, receives, sells or shares “personal information” of 50,000 or...
On Wednesday, February 12, the White House released the National Institute of Standards and Technology’s (NIST) Final Cybersecurity Framework: a set of industry best practices and standards to help owners and operators of critical infrastructure develop better cybersecurity programs. It is accompanied by a Roadmap which discusses NIST’s next steps with the Framework and identifies key areas of development, alignment, and collaboration. The Framework stems from President Obama’s February 2013 Executive Order on cybersecurity, previously covered on October 1, 2013. The overall core of the Framework is essentially unchanged from earlier drafts, also previously discussed on October 28, 2013.
As the world becomes more interconnected, data breaches and cyber-attacks are increasingly becoming an unfortunate reality for many organizations. The stakes are high: a data security breach can disrupt a company’s operations, damage the business’s reputation, cause its stock price to fall, lead to the loss of business, and attract government investigations, agency action, and class action lawsuits. Complicating matters is the fact that a patchwork of state and federal laws can apply to the same data security breach incident.
The National Institute of Standards and Technology (NIST) has just released its Preliminary Cybersecurity Framework: a set of best practices to help owners and operators of critical infrastructure reduce cybersecurity risks. This voluntary framework provides both private and public-sector organizations with a common language for understanding and managing cybersecurity risks internally and externally. The framework stems from President Obama’s February 2013 Executive Order on cybersecurity, previously covered by this blog. The Final Framework is due to be released in February 2014, following a 45-day public comment period on the Preliminary Framework.
Update of Proposed Rule Changes: A Universal Federal Sanctions Standard for the Failure to Preserve ESI Could be a Reality
The United States Courts’ Advisory Committee on Civil Rules (“the Committee”) has proposed various amendments to the Federal Rules of Civil Procedure that, if adopted, will profoundly affect the range and scope of sanctions a court may impose for failures to preserve electronically stored information (“ESI”). F.R.C.P. 37(e), which currently addresses sanctions in those instances, is one of several rules slated for amendment.
The International Organization for Standardization (“ISO”) is forming a new e-discovery committee tasked with the development of standards for e-discovery processes and procedures. The international standard “would provide guidance on measures, spanning from initial creation of [electronically stored information] through its final disposition which an organization can undertake to mitigate risk and expense should electronic discovery become an issue” according to a draft committee charter.
As we reported in the Gibbons E-Discovery Law Alert in May 2012, “Reg FD” could present a potential pitfall for those that post material non-public information via social media platforms. In early December 2012, that “pitfall” became a reality for Netflix Inc. CEO Reed Hastings. In July 2012 Hastings published on his public Facebook page a 43-word post concerning viewership statistics, including that Netflix subscribers had watched one billion hours of video the previous month.
“Did I Just Get a Tweet From Goldman Sachs?!?”: Increased Expansion and Scrutiny of Social Media in the Financial Services Industry
With the increased use of social media by financial services industry participants, more activity and scrutiny can be expected from financial regulators. This is not to mention the litigation from investors that could arise out of, for example, the misinterpreted or well-meaning post from an advisor that simply did not translate to “less than 140 characters.” It appears that there is a trend (amongst at least the larger financial institutions) that a united and pre-approved voice is best for now.
Delivering non-public material information through Internet-based social media, especially social networking sites such as Facebook, LindedIn, and Twitter, means that this information will first reach only a fraction of the investing public — those who “follow” the company using those platforms. As illustrated by the hypothetical below, this may create a potential “Reg FD” issue for a public company. As we addressed in a previous blog, the SEC has recently issued guidance to investment advisers concerning their use of social media. We have also addressed in a previous blog that FINRA, too, has issued Regulatory Notices which make it clear that member firms are expected to have policies and procedures in place that cover the use of social media by the firm and its associated persons. While direct guidance to public companies on the use of social media to report a company’s material financial matters has yet to issue, this post offers suggestions for avoiding pitfalls in this regard.