Just the FAQs (Frequently Asked Questions) - COVID-19 Vaccines in the Workplace (For a printable version of this Article, click here: FAQ - Vaccinations in the Workplace) Millions of employees have received vaccinations in the United States and federal and state authorities are easing COVID-19 restrictions. As a result of this expected shift in COVID-19 management, businesses have begun looking at normalizing workplace environments by implementing elective and mandatory vaccination processes. OlenderFeldman LLP has prepared this FAQ to further explain the positive and negative aspects of mandating vaccines in the workplace. Q. Can Employers Mandate Employees to Receive the COVID-19 Vaccine Before Allowing them to Physically Return to the Workplace? A. Yes. The United States Equal Employment Opportunity Commission (“EEOC”) and the New Jersey Department of Health (“NJDOH”) have said that employers can require employees to receive the COVID-19 vaccine before allowing them to return to the workplace, with the following exceptions: Employees with a medical disability that would prevent them from getting the vaccine; Employees whose doctors have advised them not to get the vaccine while pregnant or breastfeeding; Employees with sincerely held religious beliefs, practices or observances that would prevent them from being inoculated. Q. Should Employers Implement a Mandatory Vaccination Program? A. Yes, although timing should vary based on circumstances. Vaccinations are currently the most effective method presently available to protect against the occurrence and/or adverse conditions of COVID-19. By extension, they provide the most effective means for employers to protect the health, safety and welfare of their employees as well as those individuals or businesses interacting with employees. Indeed, most employees will look to their employers to mandate such vaccination programs as a matter of self-interest (i.e. protecting them and their families from exposure to the virus). We anticipate that most employees will make the decision independent of any mandate to obtain vaccinations. The question for businesses is therefore not whether to implement such a program, but one of timing once the vaccination is universally available to all current and potential employees. Based upon available information, we anticipate that sufficient vaccination supplies will be available by the end of Summer, 2021 to accomplish that. Based upon the best available guidance, employers should consider requiring all employees who do not have a valid basis to decline vaccinations at this time (see below) to vaccinate by Fall, 2021, which will likely coincide with businesses seeking to return to office environments requiring their employees to return to work. Employers will need to tailor their mandatory vaccination programs to the conditions of the workplace environment both with respect to timing and application. Once an outer date is established, employers should consider incentivizing employees to vaccinate in order to expedite the process. There are a number of ways of doing so through educating employees on the benefits of vaccinations. The EEOC is in the process of preparing guidance as to direct employee incentives for vaccinations such as paid time off, safety awards and so forth, but we caution against use of any direct cash incentives until such time as the EEOC has addressed the matter. Q. What Are an Employer’s Obligations if a Vaccine Exception Applies? A. If an employee has a disability that precludes them from getting a COVID-19 vaccine, has been specifically advised by their doctor not to get the COVID-19 vaccine while pregnant or breastfeeding, or has a sincerely held religious belief, practice or observance that precludes them from getting a COVID-19 vaccine, employers must provide a reasonable accommodation from their mandatory vaccine policy, unless doing so would impose an undue burden on their operations. Upon learning of the possible need for a reasonable accommodation, employers should engage in the communication process required in cases involving the Americans with Disabilities Act (“ADA”) in which the employee, his or her health care provider and religious institution, and the employer share information about the nature of the disability or religious belief and the limitations on receiving an employer-required vaccination. This process is referred to as the interactive process and involves a good-faith effort by the employer and the employee to discuss the employee's specific circumstances. The purpose of this discussion is to determine what (if any) accommodations may be needed. The interactive process involves a review of the accommodation request from the employee. Neither the ADA nor Title VII requires the request to be put in writing; however, having documentation of the request is a good practice. For ADA accommodations, the employee should be asked to provide appropriate documentation from his or her health care provider regarding the nature of any impairment(s), the duration of the need for accommodation and the extent to which the impairment(s) conflict with the employer's vaccination requirement. In the event the employer needs to consult with the employee’s health care provider, the employer must obtain a written medical release or permission from the employee. The employee’s health care provider may not disclose information or answer questions about the employee's disability without his or her permission. A reasonable accommodation may include allowing the employee to continue to work remotely, or otherwise to work in a manner that would reduce or eliminate the risk of harm to other employees or to the public. It may also include providing the employee with personal protective equipment that sufficiently mitigates the employee’s risk of COVID-19 transmission and exposure. For religious accommodations, the employee should be asked to provide an explanation of his or her sincerely held religious beliefs and, if necessary, appropriate documentation from his or her religious leader or institution regarding the religious belief that conflicts with the employer’s vaccination requirement. If a reasonable accommodation cannot be utilized, an employer may exclude the employee from physically entering the workplace. However, employers must explore all reasonable options (such as maintaining remote work conditions) before taking any adverse job action against the employee. Q. Can the Employer Request Proof of Vaccination? A. Yes. Employers can require proof of vaccination. However, employers should be careful to avoid probing questions that may elicit information about an employee’s disability and trigger the ADA and its state law equivalent, such as asking why an employee did not receive a vaccination. If a sincerely held religious belief, practice, or observance precludes an employee from getting a COVID-19 vaccine, an employer generally may not question the sincerity of their religious beliefs, practices, or observance, unless the employer has an objective basis for questioning either the religious nature or the sincerity of a particular belief, practice, or observance. In that case, the employer may make a limited inquiry into the facts and circumstances supporting the employee’s request. Q. Must Employers Continue to Maintain Other Infection Control Measures Even After Employees Are Vaccinated? A. Yes. Employers must continue to follow and enforce state laws, executive orders, guidance and directives regarding social distancing and face coverings in the workplace, even after its employees are vaccinated. Although the CDC has indicated that vaccinated people can resume activities they did prior to the pandemic, employers must still follow state and local guidelines with respect to face coverings in the workplace. Currently, New Jersey continues to mandate masks in the workplace even for vaccinated employees. While we expect this mandate to be lifted in the coming months (indeed, we note that Governor Murphy announced this past Friday that the emergency orders containing business restrictions will be ending soon), businesses in New Jersey should continue to follow state guidelines to require masks in the workplace until further notice. The status of COVID-19 vaccines and related guidance is constantly evolving. It is essential that employers fully assess all the benefits, risks, and potential liabilities of requiring or encouraging employee vaccination for COVID-19, considering updated guidance from public health authorities, availability of the vaccine, and the nature of employees’ job duties. Employers should discuss mandatory vaccines and personnel policies related to COVID-19 with experienced legal professionals to ensure compliance with all federal and state laws, regulations and Executive Orders. OlenderFeldman, LLP attorneys are available to provide guidance on these issues and other challenges facing employers during these unprecedented times. The Employment Practices and Litigation Group is in the process of developing vaccination policies for near term implementation. For more information or guidance regarding employment matters, compulsory vaccination policies, and how to implement nondiscriminatory practices please contact Howard Matalon (hmatalon@olenderfeldman.com) or Alex Umansky (aumansky@olenderfeldman.com) in the Employment Practices and Employment Litigation Group. For a printable version of this Article, click here: FAQ - Vaccinations in the Workplace

On June 4, the European Commission adopted two new replacement sets of Standard Contractual Clauses (between Controllers and Processors, and separately for International Data Transfers) in light of the July 16, 2020 Schrems II decision which invalidated Privacy Shield and limited the use of the previous Standard Contractual Clauses. While the new Standard Contractual Clauses are currently being examined and analyzed, they were adopted to provide more clear guidance on data transfers to cover a more broad range of transfer scenarios. They also are intended to provide a “toolbox” to allow compliance with the Schrems II decision. Controllers and Processors currently using the previous sets of Standard Contractual Clauses will have an 18 month transition period to implement the new Standard Contractual Clauses, and any new agreement or data transfer requiring Standard Contractual Clauses should immediately begin using the new Clauses. Please contact Michael J. Feldman, Esq. at mfeldman@olenderfeldman.com or 908-964-2486 with any questions or to further discuss implementation of the new Standard Contractual Clauses.

On June 8, the Colorado General Assembly and Senate passed the Colorado Privacy Act ( “CPA”), making Colorado the third US state (after California and Virginia) to pass a comprehensive privacy law. The bill now awaits signature or veto (which is not expected) by the Governor within 10 days. The CPA applies to businesses that collect and store data on more than 100,000 people or entities which earn revenue from the data of more than 25,000 consumers. While the details of the CPA are being further examined, the CPA includes numerous new data subject rights, an opt-out consent procedure, a right to cure, and allows the state attorney general to enforce the CPA and make additional related rules. The CPA seems to sit somewhere between the more comprehensive and consumer-friendly California Consumer Privacy Act (“CCPA”) and the recently enacted California Privacy Rights and Enforcement Act (“CPRA”) on the one hand, and the Virginia Consumer Data Protection Act (“VCDPA”) on the other. Together with the stringent GDPR of the European Union (which impacts many US businesses) and data breach laws in all 50 states, making data privacy and protection an integral part of all aspects of your business – think Privacy by Design – is more important than ever. Please contact Michael J. Feldman, Esq., CIPP, at mfeldman@olenderfeldman.com or 908-964-2486 with any questions or to discuss how these laws impact your business and what you can do to stay ahead of the curve and your competition. Please also contact Michael if you would like to start receiving our free VIGILANT PSA Privacy E-Newsletter, the first edition of which can be found here: https://www.olenderfeldman.com/wp-content/uploads/2021/04/Privacy-Newsletter-01.pdf.

With the stock market remaining robust and interest rates low, M&A and investor activity continues to be frothy. Good companies are selling for premiums, and market disruptors are finding competition for investment. All signs point to elevated transaction levels for the balance of 2021. Click here for OlenderFeldman's 2021 Q1 & Q2 Overview: OF Transactions Overview Q2 2021 We hope this information on companies we represented as transaction counsel in the first two quarters of 2021 is helpful insight into the types of companies and industries that are attractive to buyers and investors in the current business environment.

Covid-19 continues to wreak havoc on our way of life, and businesses are no exception. Companies changed their operating procedures, updated their financial projections, took out PPP loans to cover payroll expenses, and found themselves having to continually update office policies relating to mask requirements, working from home, and now, vaccination status. For companies engaged in corporate transactions, these changes materially impacted deal terms and transaction mechanics. In an article which was published in the August 2021 issue of New Jersey Lawyer, a New Jersey State Bar Association publication, OlenderFeldman partner Michael J. Zussman and associate Jacob G. Shulman discuss the business issues arising from Covid-19 and their impact on mergers & acquisitions practice. Click here to read the article: NJ Lawyer Article August 2021.

Non-Fungible Tokens, or “NFTs,” have increasingly begun to attract mainstream attention from creatives, collectors, investors, and a broad range of corporations seeking to explore this new form of digital property. But what are they exactly? What is a Non-Fungible Token (“NFT”)? NFTs are, generally speaking, non-fungible digital representations of the underlying rights that are being sold or licensed. Unlike many other popular iterations of digital assets that are fungible, like bitcoin or Ether, an NFT is an unchanging representation of a designated set of rights. Virtually anything can be represented by an NFT, provided that it is an identifiable asset. For example, real property titles, cars, houses, and art, all can be represented by NFTs. The ease by which rights can be transferred from one party to another, and the security and verifiability of those transfers, is the hallmark of NFTs and the reason there is so much interest in them. How do NFTs Work? At the most basic level, an NFT is a token that is associated with an asset. NFTs are “minted” and stored on shared cryptographic ledgers called blockchains, like the Ethereum blockchain. An NFT can be programmed to reflect the legal contract terms that govern the rights obtained by the buyer of the NFT, known as a smart contract. The pseudonymous address associated with the holder of the NFT and each subsequent address of the party that acquires the NFT, are stored on the cryptographic ledger. Because a blockchain is highly secure, versus the ease by which an entry on a physical ledger can be altered, holders of NFTs can be assured of the rights they hold and the true provenance of the asset associated with the NFT. What is sold when selling an NFT? NFTs, as computer code, contain metadata which describe the corresponding assets to which they are bound. For a creator or holder who owns the intellectual property rights to the underlying asset, they can decide what rights to grant the NFT buyer. For example, a creator may want to allow the buyer the right to use and display the asset, but not copy or commercialize it. Similarly, an issuer of an NFT who possesses only limited rights to use, assign, or license the underlying asset, can correspondingly limit the rights that the buyer of the NFT obtains. What is the legal construct of an NFT? NFTs do not change the legal framework for creating, protecting or transferring rights in assets. An NFT is simply a cryptographic tool for managing and ensuring the security of an asset transfer transaction between a buyer and a seller - the same legal principles that apply to a paper contract, apply to an NFT transaction. Thus, for instance, creators of creative works (e.g. digital art) should carefully consider the scope of any rights they are granting with respect to the creation of derivative works or limitations on the use of the creative work, and well as termination rights in order to ensure the return of the NFT and its associated rights in the event that there is a breach of any terms contained in the NFT. What are some of the tax, securities, and other regulatory considerations to be made when selling NFTs? Given that NFTs can be linked to virtually any type of asset, it is important to remember that the nature of the underlying asset will often determine whether, and how, an NFT is taxed and regulated. At a fundamental level, the sale of an NFT, much like the sale of any other digital asset (e.g. bitcoin), is taxable as income. As well, if the NFT is income generating, for instance, if it generates royalty or license fees, that income will be taxable. However, the biggest area of uncertainty is whether NFTs can be considered “securities”. At present, the United States Securities and Exchange Commission (the “SEC”) has not directly commented on the status of NFTs as securities. However, the SEC has opined, through filings, speeches by high-ranking members, and a published framework, that certain digital assets may be securities—with each token’s legal status as a security depending on its own facts and circumstances. Facts and circumstances which are likely to pique the interest of securities regulators are those in which buyers are induced to purchase NFTs with the expectation of profits. Instances where there are pre-sales of NFTs which are marketed as being safe or lucrative investment opportunities are particularly at risk of regulatory scrutiny.

Many businesses include Terms & Conditions of Use on their website and assume that by stating within those Terms & Conditions that they are binding on the user, they actually are binding on the user. Other businesses may be a little more direct, by including a clear link on their home page when the user first arrives. Under at least some circumstances, proceeding in this manner may risk a judicial finding that the Terms & Conditions actually are NOT binding. Specifically, the New Jersey Appellate Division recently held that an arbitration provision was not binding on a website user notwithstanding being included in the Terms & Conditions for the website. The Appellate Division held that the Terms & Conditions, though including the arbitration provision, was not necessarily clear enough for the consumer to be aware, and the consumer had not clearly and affirmatively consented to be bound by the mere inclusion of an arbitration provision within the Terms & Conditions. While this decision did not invalidate such Terms & Conditions, it did make clear that businesses must review their Terms & Conditions to ensure that they are clearly known by their customers, and that their customers clearly assent to the terms themselves (taking into account the type and sophistication of the customer, and the clarity of the website and its Terms & Conditions). For more information on how to assure that your Terms & Conditions of Use are binding, please contact Michael J. Feldman, Esq. (mfeldman@olenderfeldman.com or 908-964-2486), Craig D. Bronsnick, Esq. (cbronsnick@olenderfeldman.com or 908-964-2482), or John J. Billiris, Esq. (jbilliris@olenderfeldman.com or 908-827-2050).

On December 6, 2021, New York City unveiled plans that will require all on-site employees of private businesses located in the city, from salons to multinational corporations, to get the COVID-19 vaccine. This first-in-the-nation vaccine mandate for private employers is intended to limit the spread of the new Omicron variant this winter. As discussed below, this mandate is set to take effect on December 27, 2021, just days before current Mayor Bill de Blasio leaves office. The rationale for this mandate is to tackle an ongoing rise in COVID-19 cases due to the cold weather and the rise of the Omicron variant. What are the specific requirements that will go into effect on December 27th? Every private business, regardless of size, must require employees to have at least one dose of a COVID-19 vaccine on or before December 27, 2021 in order to be present in a city work location. Additional details will be provided through guidance expected to be released by the city on December 15, 2021. Additionally, all children ages 5 through 11 must show proof of at least one vaccination dose in order to access covered venues, such as indoor dining, gyms and entertainment and event venues throughout the city. Individuals ages 12 and older will be required to show at least two vaccination doses, instead of one, except for the Johnson & Johnson vaccine, in order to access indoor venues. Are Employees permitted to wear a mask as an alternative to the mandate? Based on the mayor’s announcement, unlike the currently-stayed OSHA Emergency Temporary Standard, employers may not permit employees to wear a mask as an alternative to vaccination. Can Employees seek an exemption from this new mandate? Unlikely. While the guidance on this new mandate is not yet published, it will likely follow the current guidance for employers covered by the Key to NYC Pass. https://www1.nyc.gov/assets/counseltothemayor/downloads/Key-to-NYC-FAQ.pdf According to that guidance, “masking and/or testing are not a sufficient alternative to vaccination and cannot be provided as a reasonable accommodation if the employee will still be in regular contact with other employees or customers.” If the new mandate follows the same guidance as the Key to NYC Pass, unvaccinated employees would not be permitted to return to the office. As such, businesses would have to consider various accommodations available to such employees, including remote work or placing the employee on an unpaid leave of absence, so long as such accommodations do not pose an undue burden on the company. In any event, we will update this instruction once the city publishes its forthcoming guidance. What should Employers do next? It is possible that this new mandate will be challenged in court, as other mandates have been throughout the country. Although the Second Circuit Court of Appeals recently upheld New York’s mandate for healthcare workers, we cannot predict how a New York court would respond to challenges to this mandate. For now, New York City businesses should assume that the mandate will take effect on December 27. Therefore, were recommend the following: (1) promptly notify your workforce of this new directive so that unvaccinated employees have adequate time to schedule their vaccinations before the December 27th deadline; (2) gather proof of vaccination from already vaccinated employees and store same in the Company’s employee medical record database; (3) review your policies and procedures to ensure any requests for accommodations will be handled according to such policies and applicable law; and (4) prepare to publish internal policies about the vaccination mandate, and the process for employees to submit an accommodation request. Further information or guidance concerning this mandate can be obtained from OlenderFeldman LLP. Please contact Howard Matalon (hmatalon@olenderfeldman.com) or Alex Umansky (aumansky@olenderfeldman.com) in the Employment Practices and Employment Litigation group.

Our M&A transactions saw a trend towards more strategic buyers vs. pure private equity buyers, likely signaling that private equity owned platforms were executing on their growth via acquisition strategies and, correspondingly, non-private equity backed purestrategic buyers were executing on acquisitions to remain competitive. On the venture side, we also saw a trend toward more later round equity investments, with a heavier emphasis on Series A+ rounds vs. series seed and convertible instrument offerings. Click here for OlenderFeldman's 2021 Overview: OF Transactions Overview 2021 We hope this information on companies we represented as transaction counsel in 2021 is helpful insight into the types of companies and industries that are attractive to buyers and investors in the current business environment.

VIRTUAL EVENT FOR FEMALE EXECUTIVES REGARDING EMPLOYMENT NEGOTIATIONS. FEBRUARY 15TH, 2:30 - 3:45 PM. We are pleased to invite you to an UPWARD Event, Don't Leave Anything On The Table where Howard Matalon, Employment practices partner, will present alongside Jacqueline V. Twillie on the topic of employment negotiations for female executives.For more details and to obtain tickets, click here:https://www.eventbrite.com/e/dont-leave-anything-on-the-table-an-upward-event-tickets-255424781397

Playing Offense. Frequently Asked Questions on External Penetration Testing What is a penetration test? A penetration test (“pen test”) is a cybersecurity exercise that simulates the malintent or nefarious activities of a hacker to identify vulnerabilities in your IT systems or applications. The aim of conducting a pen test is to understand what vulnerabilities exist in your business systems, how they could be compromised, and what the organizational impacts would be if a hacker was successful. A pen test goes beyond scanning an organization for vulnerabilities that potentially could be exploited to gain a foothold into a network. During a test, we are actively searching for weaknesses in the organization’s security measures, and then attacking them. We are simulating a real-world attack. This goes beyond pointing out technical deficiencies like patching is needed. We are also searching for sensitive documents available to the public, finding information on the staff to conduct social engineering attacks such as spear phishing, and a lot more. A great penetration test uses hands-on keyboards, creativity, skills, and more. Great penetration tests involve listening to what the clients’ objectives are, producing actionable remediation recommendations, and making the process easy for the organization being tested. What is the external penetration tester looking for when conducting the pen test? The company performing the pen test should look for technical weaknesses in the organization such as an unpatched server, services that are misconfigured, credentials associated with the organization from historical third-party breaches and elsewhere, sensitive documents that are exposed to the public internet, and whatever else can and will be used against the organization to compromise their systems and people. Why would someone want to perform an external pen test? Some industries require it to meet regulations and industry standards. For example, NY DFS 23 NYCRR Part 500 is a regulation that requires most insurance companies to have quarterly vulnerability assessments, and at least one external pen test be performed each year. These requirements are intended to help ensure that the organization is aware of its information security weaknesses so it can continuously improve its defenses and protect its customers’ information. Apart from legal requirements, almost all organizations stand to gain by having better cyber-protection, and stand to lose if their defenses fail. One of the first steps to hardening an organizations’ defenses against accidental or intentional breaches is to determine its weaknesses. That’s where a pen testing comes in. How long does a pen test take to complete, from the start of the engagement, until completion? This depends on the scope of the engagement. A pen test typically occurs in phases: passive reconnaissance, active reconnaissance, testing, and reporting. The whole test can take anywhere from 2 weeks onward based upon its size and complexity. Will the person or people doing the external pen testing need to come onsite to work in our offices, or can this be done remotely? An external pen test does not require the tester to be on-site. Rather, it can be performed entirely remotely. What does the customer receive when the external pen test is complete? The customer will typically receive a document that details the tester's evaluation of the environment, attacks carried out, and remediation recommendations. This document should contain a list of vulnerabilities found including details on the IP addressed, hostnames, and ports involved. Remedial action to fix the vulnerabilities should also be provided. Will we need to shut down our network to conduct the external pen test? No. The penetration tester will be in communication with the customer. To ensure as close to a real-world attack is simulated, it is recommended to conduct business as usual. The customer must be mindful of the consequences of alerting staff, especially IT staff and affiliated IT support companies, of a planned test. The penetration test is going to test the customer’s staff, IT services company or MSP, and other parties’ reactions as much as it will test the customer’s technical controls. Should we expect or plan for outages during the external pen test process? There should be no services outages except to the extent the test involves attacks such as Denial-of-Services and/or and Distributed-Denial-of-Service. Of course, these types of attacks should not occur unless requested by the customer. Is a pen test required to obtain cyber liability insurance? Many carriers are now requiring external controls testing on an annual basis. Will our employees need to know that we are performing an external penetration test? No. Social engineering is included in the exercise. Therefore, you do not want your employees to know unless completely necessary for business reasons. What software tools are used in an external pen test? Without giving away all of the secret sauce, some tools include: Nmap, Tenable Nessus, Burp SuitePro, Metasploit, Maltego, theHarvester, CobaltStrike, and more. The preceding is a guest post from Daniel J. Haurey. Mr. Haurey is a Certified Information Privacy Technologist (CIPT) and founding member of Partners in Regulatory Compliance (PIRC) PIRC is a cybersecurity consulting firm that provides innovative answers to the growing, complex need for cybersecurity in businesses facing regulatory compliance controls. By addressing the full range of digital and human threats to create a compliant, secure environment, PIRC ensures customers are meeting their professional and ethical commitments to protect the sensitive data they work with and store on behalf of their clients.

Both Russia and the Ukraine have effectively declared a cyberwar on each other in addition to the catastrophic physical war we see on the news each day. While the rest of the world has so far avoided getting embroiled physically in the war in Ukraine, with the US and most of Europe (among other nations) taking a hard line on Russia, and China (a nation from which a high volume of cybercrime emanates) seeming to side with Russia, the likelihood of the US getting dragged into a cyberwar and being hit by cybercrimes has increased dramatically. To be clear, such activities are not only aimed at governmental activities, but typically target softer financial targets such as private businesses. Cybercrime is often one which expands over time when virus and malware are let loose and gradually spread throughout the world, imposing their damage months or years after first being introduced. Even without regard to what is going on in Ukraine, one only need pick up a newspaper or watch the news to know that cybercrime and data breaches (most often due to internal mistakes) continue to dramatically rise. All of this raises the questions of what you can do about it, how you can protect your business, and does the financial investment in legal compliance and sound practices make fiscal sense? The short answers are: (1) minimize your risk; (2) be pro-active; and (3) absolutely. Minimizing Risk and Being Pro-Active: You can minimize your risk by pro-actively doing the following: Develop and implement a comprehensive written Information Security Policy, updating at least annually. Conduct annual (or more frequent and upon hiring) Information Security Training. Determine data privacy laws applicable to your business and implement a plan for compliance. Determine data privacy legal obligations imposed by third-parties (i.e., by contract). Engage in data mapping so you can determine what confidential/sensitive data you have, so you can then properly protect it. Implement a data retention/destruction policy. Develop and implement a data breach plan so you are prepared in advance. Analyze risk from your vendors/service providers and implement procedures and agreements to minimize risk and insulate from liability. Implement website privacy policy (and related terms and conditions of use). Think privacy. Think security. Finances of Doing Things Right: Data breaches and harm from data breaches (including cyber-attacks) increased dramatically in 2020, and again in 2021. 2022 is no different. As more data is collected, more data protection laws are passed and imposed by contract, and more technology is implemented, the risk and cost of data breaches continues to increase dramatically with no end in sight. Here are some telling statistics: only approximately 5% of company data is properly protected; approximately 80% of senior IT leaders believe their organizations lack sufficient protection against cyberattacks; there were 1.4 million reports of identity theft in the US in 2020; the cost of a data breach (avg. almost $4 million) has increased every year for at least the last 5 years, and is predicted to dramatically increase in the future; cybercrime will cost the world $10.5 trillion annually by 2025; malware and ransomware attacks are increasing approximately 400% a year; and all of this is getting much worse with the work-from-home environment. While you may be inclined to wait to do the right thing, the cost of implementing appropriate policies and procedures, coupled with the risk and cost of harm, only increases over time – and this does not even take into account your potential contractual obligations. Always be vigilant! Please contact Michael J. Feldman, Esq., CIPP at mfeldman@olenderfeldman.com or 908-964-2486 with any questions.