One of the initial decisions a startup founder must make is whether they establish a corporation in Delaware or opt to incorporate in their home state. For the reasons below, Delaware continues to be the preferred choice when a startup intends on raising external sources of capital to finance growth. The following factors highlight why startups gravitate towards incorporating in Delaware: Investors' Prefer Delaware Corporations: Venture capital firms, angel investors, and startup accelerators frequently prefer, and sometimes mandate, that startups incorporate in Delaware before considering investment. The reasons behind this preference, discussed below, make Delaware incorporation a significant factor in securing equity financing from professional or institutional investors. Familiarity with Delaware Law: The widespread understanding of Delaware corporate law among investors and legal professionals translates into streamlined interactions and reduced costs. Delaware's founder-friendly legal environment, coupled with existing legal templates tailored to the state's laws, enhances fundraising efficiency, which is crucial as business transactions extend across state lines. Specialized Court of Chancery: Delaware's Court of Chancery focused exclusively on corporate law, stands in stark contrast to other states where judges handle diverse legal areas. This specialization, paired with a rich body of case law, facilitates informed decision-making and dispute resolution. Enhanced Privacy in Delaware: Delaware's laws regarding shareholder access to a corporation's books and records are more stringent than those in many other states. Requests by shareholders must be made within the state, discouraging unwarranted actions to obtain corporate records. Delaware also stands out by not requiring corporations to publicly disclose directors and officers in state filings available on public websites. Efficiency in Delaware: Delaware's swift processing of company filings expedites financings and other transactions, offering convenience and efficiency. While choosing another state for incorporation doesn't necessarily preclude a business from obtaining outside capital, and changing the jurisdiction of domicile if requested by an investor is straightforward, the decision to incorporate in Delaware at inception of the corporation will streamline the future capital raising process. Incorporating in Delaware provides startups with numerous advantages, including investor preference, familiarity with Delaware law, a specialized court system, enhanced privacy, and administrative efficiency, making it a compelling choice for investor capitalized companies. For more information, contact Frank Vito at fvito@olenderfeldman.com or 908-964-2446.

The Corporate Transparency Act: Widespread Application of Regulatory Requirements Beginning January 1, 2024, a majority of businesses will be required to disclose their Beneficial Ownership Information (“BOI”) to the U.S. Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”) to comply with the Corporate Transparency Act (“CTA”). The CTA, enacted as part of the Anti-Money Laundering Act, requires all Reporting Companies to file reports detailing their BOI for its beneficial owners and company applicants with FinCEN. What is Beneficial Ownership Information (“BOI”)? BOI is information regarding a Reporting Company, its beneficial owners, and company applicants. Beginning January 1, 2024, Reporting Companies will be required to submit BOI reports to FinCEN. Who is A Reporting Company? A “Reporting Company” is any domestic or foreign corporation, limited liability company, limited liability partnership, or any similar entity created or formed by filing a document with a secretary of state or similar office. The CTA expressly exempts 23 types of entities from reporting their BOI to FinCEN; these entities include, among others: General Partnerships; Sole Proprietorships; Large operating companies, which have: (1) an operating presence at a physical office within the United States; (2) more than 20 employees on a full-time basis; and (3) more than $5,000,000 in gross receipts or sales in the United States; Public Companies; Nonprofit entities, political organizations, and certain tax-exempt trusts; and Investment companies or investment advisers To qualify as an investment company or investment adviser, the entity must: Qualify as an investment company as defined in 15 U.S.C. § 80a-3, or as an investment adviser as defined in 15 U.S.C. § 80b-2; and Be registered with the Securities and Exchange Commission under 15 U.S.C. § 80a-1et seq. or 15 U.S.C. § 80b-1 et seq. A full list of exempt entities under the CTA can be found in 31 C.F.R. § 1010.380(c)(2). Who Is a “Beneficial Owner”? As an initial matter, a Reporting Company can have multiple beneficial owners. Under CTA, a Reporting Company must disclose all beneficial owners. As such, there is no limit on the number of beneficial owners that must be disclosed to FinCEN. A “Beneficial Owner” is defined as any individual who, directly or indirectly, exercises substantial control over the Reporting Company or owns or controls at least 25% of the ownership interests of such Reporting Company. There are more sophisticated formula requirements for calculating Beneficial Ownership when equity structures are more complex. The following individuals are deemed to have “substantial control” over a Reporting Company: Senior Officers (i.e., a president, chief financial officer, general counsel, chief executive officer, chief operating officer); Those individuals who have the authority to appoint or remove any senior officer or a majority of the board of directors, or equivalent body. Important Decision-Makers (i.e., individuals who have substantial influence over important decisions). All individuals who have any form of substantial control over the Reporting Company. The following are not beneficial owners under the CTA: A minor; An individual acting as a nominee, intermediary, custodian, or agent on behalf of another individual; An employee of a Reporting Company (excluding senior officers); An individual whose only interest in a Reporting Company is a future interest through a right of inheritance; and Creditors of a Reporting Company. Who Is A “Company Applicant”? Depending on the date the Reporting Company was created and registered, a company applicant may not have to be disclosed to FinCEN. All Reporting Companies formed prior to January 1, 2024, will not have to disclose their company applicants’ BOI to FinCEN. A “Company Applicant” is an individual who either (i) files the document that creates/registers the Reporting Company to do business in the United States, or (ii) is primarily responsible for directing or controlling such filing. Unlike beneficial owners, Reporting Companies only need to disclose two (2) company applicants. Note, however, that neither a company nor a legal entity can serve as a company applicant. What Information Must Be Disclosed As Part Of BOI Under The CTA? As a preliminary matter, all information disclosed to FinCEN will be kept confidential and only disclosed to federal and state law enforcement agencies in specified circumstances. Financial institutions will also have access to BOI in certain circumstances, with the consent of the Reporting Company. Under the CTA, the following information must be disclosed as part of BOI: For Reporting Companies: Full legal name; Any trade names or “doing business as” (d/b/a) names; Current U.S address (the address of the company’s principal place of business Jurisdiction of formation/registration; and Internal Revenue Service Taxpayer Identification Number (TIN) (including an Employer Identification Number (EIN)) For Beneficial Owners and Company Applicants: Their full legal name; Date of birth; Current address: The individual’s residential street address, except for company applicants who form or register a company in the course of their business, such as paralegals. For such individuals, report the business street address. Unique identifying number from a (non-expired) driver’s license, passport, or other state or federal issued identification, and a copy of said document. As an alternative to disclosing the above BOI for a Beneficial Owner, the individual may submit their BOI to FinCEN directly via an online filing system and obtain a “FinCEN Identifier.” A FinCEN Identifier is a unique identifying number that FinCEN will issue to a Beneficial Owner to assist in filing the required disclosures. A FinCEN Identifier will best serve individuals who are beneficial owners of multiple Reporting Companies, as it will assist with administrative efficiency. When Is The Deadline For Reporting Companies To Disclose Their BOI? Reporting Companies created or registered to do business before January 1, 2024, must file their initial BOI reports by January 1, 2025. Reporting Companies created or registered to do business in the United States on or after January 1, 2024, must disclose their BOI within 30 days after formation. Is the Personal Information Public? As it stands, information submitted through FinCEN to meet the CTA requirements will be available only to the U.S. Department of Treasury and will not be available to the public. The information supplied will be sensitive personally identifiable information, so it is important to keep in mind more secure means of gathering and transmitting data. Third parties are in the midst of either offering or developing platforms to assist professional services firms with these governmental submissions. What Happens If There Is A Change To A Reporting Company’s BOI? If there is any change to a Reporting Company’s beneficial owners, the Reporting Company must file an updated BOI report no later than 30 days after the date on which the change occurred. A Reporting Company, however, is not required to file an updated report for any changes to a Reporting Company’s company applicant. What Are The Penalties For Failing To Disclose BOI To FinCEN? Any person who (a) willfully fails to report, complete, or update BOI to FinCEN, or (b) willfully, or attempts to, provide false or fraudulent BOI, will be subject to both civil and criminal penalties. Civil Penalties: $500 per day that the violation continues, up to $10,000. Criminal Penalties: Imprisonment up to two (2) years and/or a fine of up to $10,000. As your business begins to navigate the CTA’s disclosure requirements and questions arise, further information and guidance regarding the CTA, BOI, and the process for submitting BOI to FinCEN can be obtained from Craig D. Bronsnick (cbronsnick@olenderfeldman.com) or Joseph Chletsos (jchletsos@olenderfeldman.com).

The COVID-19 Pandemic has abated but its impact has forever changed New Jersey’s legal landscape. “Zoom” court hearings, virtual meetings and remote work have become commonplace. These efficiencies have yet to solve the riddle of whether to litigate a claim in the court system or engage in some type of alternative dispute resolution such as mediation or arbitration. This quick FAQ addresses some basic questions many of our clients have in relation to the differences between litigation and the primary alternative method to resolve disputes: arbitration. Q: Is there a fundamental difference between litigation and arbitration? A: Yes. Litigation involves resolving disputes in the state court system with a judge or jury acting as the “factfinder.” In contrast, arbitration employs either a single neutral arbitrator or panel of arbitrators chosen and paid for by the parties. In the event that the parties cannot agree on an arbitrator(s), the arbitration association managing the dispute will choose. Q: Do I have the option of electing arbitration to resolve my dispute? A: Only if an agreement between the parties identifies arbitration as an option. Arbitration can be chosen as a dispute resolution method when both parties, as outlined in a contract or agreement, agree to submit their dispute to arbitration rather than pursuing litigation. If the parties stipulated to submit their dispute to arbitration, the result of the arbitration is binding. Importantly, for arbitration to be binding, both parties must have consented to the arbitrator’s jurisdiction. Absent an agreement to arbitrate—whether in the contract giving rise to the dispute or a subsequent agreement to arbitrate in lieu of litigation, arbitration is generally non-binding. Q: Are arbitration proceedings confidential? A: Yes. Unlike state court litigation which is publicly filed, absent exceptional circumstances, Arbitration is almost always private and confidential under the arbitration association’s rules, and likely the parties’ contract. Arbitration awards also generally remain private unless a party seeks to enforce the award post-hearing in the court system. Thus, arbitration generally provides a higher level of confidentiality and privacy for the parties. Q: Is arbitration more efficient than litigation? A: Typically, yes. Arbitration is often faster than litigation. Parties are compelled to agree to a discovery schedule and choose experienced arbitrators who manage the process. The discovery process in a litigation takes longer due to crowded court dockets, less active case management by judges, and numerous pre-trial procedures. Thus, arbitration is usually a faster process from initial filing to resolution. Q: Is arbitration more expensive than litigation? A: Typically, no. In any dispute the cost is directly related to its complexity. Arbitration is usually more cost-effective because the arbitration manager will “push” things along. This is especially true for less complex disputes where parties can control expenses by choosing a single arbitrator and streamlining procedures. It should be noted that the retention of an arbitrator is an additional cost. In the court system, a party does not have to pay the judge or the jury to act as “factfinder.” In arbitration, the parties split the cost of the arbitrator(s), who bill hourly. Q: Is an arbitration decision appealable? A: No. In binding arbitration, decisions are final and binding, with limited grounds for appeal, providing quicker resolution and more certainty. Q: How qualified are arbitrators? A: Very. Although judges have a wide range of legal expertise, they may not be familiar with the specific industry or subject matter of the dispute. In arbitration, arbitrators will be experts in the relevant field (e.g., construction, private equity, partnership/shareholder dispute familiarity). This expertise can lead to more informed and industry-specific decisions. Q: Are arbitration awards enforceable? A: Yes. After an arbitrator determines an award, a party can seek to enforce it in the court system. This procedure is straightforward but can vary depending on the jurisdiction. For more information, contact Sean Rose: srose@olenderfeldman.com or 908-964-2460.

As a business owner an operating agreement or shareholders agreement (an “operating agreement”) is an essential element in the operation of your company. An operating agreement sets out the rules and regulations for the operation and management of the company. There are many reasons why it may be time to review your operating agreement. If your business has undergone any significant changes, is operating differently, or has faced new financial circumstances since its last operating agreement was signed, it may be time for an update. While there are many reasons that an operating agreement may need to be reviewed and updated, there are five critical circumstances that likely warrant the amendment of your operating agreement. There has been a change in ownership of your business. A change in the ownership of your business may have resulted for numerous different reasons. One of your past owners may have retired from the business or passed away. You may have decided to give a key employee an ownership stake in the business. You or one of your partners may have purchased the ownership interests of another partner. Any one of these events almost certainly necessitates that your operating agreement be revised to reflect and address the current status of ownership. For example, the prior ownership of your company may have been two 50-50 owners. With the addition of a third member owner, you now need to address different buy-sell situations. If an employee became an owner, you may need to add certain provisions to the operating agreement addressing any buyback or surrender obligations that were agreed with the new employer-owner. The operation of the business has changed since the time your last operating agreement was signed. Every business evolves over time. Duties among the owners may have shifted and modified. The business line(s) of the company may have changed. Some of the business owners may no longer be involved in the management of the company. Your operating agreement should be updated to reflect ad hoc changes to the operation and management of the company. One example of a change in circumstances necessitating an update would be if your operating agreement contemplated that all of the owners would agree on all business decisions. That management provision may need to be changed to limit the management consent requirement where there are now passive owners. Changes in the law and tax rules. The law is never static. Every year, new regulations or statutes are enacted by governing bodies that may impact the business operations, management, and finances of a business. It is critically important that a company periodically review its operating agreement to ensure that it is in compliance with the law and taking advantage of any benefits or accommodations afforded it under the law. For instance, the Internal Revenue Code (the “Code”) provides that a business may designate one person to serve as the tax representative for a company. The designation of such a person can help to expedite notices from the Internal Revenue Service (the “Service”) and can streamline the audit and collection dispute process for a company. Until 2018, the Code provided that such a person would be the “tax matters partner” designated by the company. At that time, new regulations were adopted, which provided that such rights would now belong to a “partnership representative” if one was designated by the company. If your operating agreement still references to a tax matters partner, it is likely that such person does not have the rights he otherwise would have as partnership representative which could potentially delay the resolution of any outstanding issues with the Service. Sales and acquisitions of significant assets. If your company has acquired another company or sold off significant assets, you almost certainly need to update your operating agreement to address the structural changes arising from such a transaction. In addition, the acquisition or sale of important assets to or from another business may give rise to the need for an update to your operating agreement. For example, some operating agreements specifically address the distribution of certain assets to specific owners in the event of an owner’s departure from the business or the dissolution of the company. In the event that some of the assets designated for specific distribution may have been sold, the operating agreement should be updated to modify or eliminate any provisions that dealt specifically with those assets. In cases where an operating agreement provides for specific distribution of assets that are no longer are owned by the company, and the operating agreement has not been amended to reflect this change, there could be a disagreement as to the import of that asset lost. Disputes of this nature can be very costly. Conversely, you may want to add certain provisions setting out the allocation of newly acquired assets to a particular owner. How to handle succession matters. As your business and its owners mature, you should consider succession issues to ensure the continued viability of the company. Principal considerations should be what happens to the ownership interests of an owner who retires, dies, or becomes disabled. The owners need to consider if they would be agreeable to having the spouse or children of a deceased or disabled owner as partners in the business. Even if agreeable, who would provide the services that such departed owner provided to the business in the past and would those relatives of the departed or disabled owner have a say in the management of the company? A periodic review of your operating agreement can be one of the most important actions your business can undertake. Finding out that your operating agreement is outdated, or perhaps even invalid, could leave your business and you and your fellow owners subject to the default rules put in place by the state where your company was formed. This almost certainly is a position where owners would rather not find themselves. Having to negotiate or, worse, litigate a dispute among business owners which could have been addressed in an operating agreement undoubtedly will cost you many times the cost of periodic reviews and updates of your operating agreement. Please contact Henry Forcier, Esq. at hforcier@olenderfeldman.com, or 646-247-6792, to discuss updating your operating agreement or shareholders’ agreement.

DATA PRIVACY LAWS – WHAT’S NEW IN 2024?By: Michael J. Feldman & Marguerite Kneisser Since the European Union (“EU”) enacted the General Data Protection Regulation (“GDPR”) in 2018, see OlenderFeldman 2023 Data Privacy Updates, calling for widespread change to the way data is collected, stored, transmitted, and secured, more and more states in the United States (“US”) have enacted data privacy laws to provide protection to consumers and set forth consumers’ rights to data related to them. Those states include California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. The purpose of this article is to briefly outline the some of the main standards and rights for new data privacy laws of Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee and Texas – those states with new data privacy laws effective in 2024 and 2025 (with more surely on the way). For general discussion on California, Colorado, Connecticut, Virginia and Utah data privacy laws already in effect, see our prior article here: OlenderFeldman 2023 Data Privacy Updates. Delaware The Delaware Personal Data Privacy Act (“DPDPA”) (effective January 1, 2025) grants Delaware residents acting in an individual capacity, and not in a commercial or employment context, certain access and control rights concerning their personal data. Specifically, a Delaware consumer has the following rights with respect to their personal data: Confirm whether the controller is processing their data and obtain access to and copies of their data; Correct inaccurate personal data about them; Delete personal data about them; Obtain a list of the categories of third parties to which the controller has disclosed their personal data; and Opt-out of the processing of their personal data for purposes of targeted advertising, the sale of their personal data or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning them. The DPDPA applies, with certain exceptions, to any company that: (1) conducts business in the state; or (2) produces products or services that are targeted to Delaware residents, and during the previous calendar year, satisfies one of the following: (a) the company controlled or processed personal data of not less than 35,000 Delaware residents, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) controlled or processed personal data of at least 10,000 Delaware residents and derived more than 20% of its gross revenue from the sale of personal data. Under the DPDPA, controllers are required to: Limit the collection of personal data to what is adequate, relevant, and reasonably necessary based on the purpose disclosed to the consumer, and to not process it if otherwise; Set up safety and security measures to protect personal data of consumers. Not process personal data if it would enable discrimination, and not discriminate against any consumers who exercise their rights; Gain opt-in consent to process sensitive data or data of a known child; and Provide consumers with a privacy notice that gives them a clear explanation of what data they collect, how it is used and shared, how to exercise their rights, and how to opt-out of the sale of personal data and use of their data for targeted advertising. The DPDPA gives enforcement authority to its Department of Justice. Penalties for violations can be imposed up to $10,000 per violation. For more information regarding the DPDPA, see Delaware Personal Data Privacy Act. Indiana The Indiana Consumer Data Protection Act (“INCDPA”) (effective January 1, 2026) grants residents the following rights with respect to their personal data: Correct inaccuracies in data they previously provided to the controller; Opt-out of their data being used for targeted advertising, sold, or used for specific profiling purposes; Confirm whether a controller is processing their personal data and access that data; and Request the deletion of personal data collected or provided to a controller. The INCDPA applies, with certain exceptions, to businesses that (1) operate in Indiana; or (2) sell products and services targeted to residents of Indiana and satisfy one of the following: (a) control or process the personal data of at least 100,000 Indiana residents, or (b) control or process the personal data of a minimum of 25,000 Indiana residents while also generating over 50% of its gross revenue from personal data sales. Under the INCDPA, controllers are required to: Collect personal data that is adequate, relevant, and reasonably necessary for the disclosed purposes of processing; Implement appropriate data security measures based on the volume and nature of the personal data; Comply with anti-discrimination laws when processing personal data; Establish binding contracts with processors, detailing the nature and purpose of processing, instructions, and the rights and obligations of both parties; Obtain consumer opt-in consent for processing sensitive data and handle sensitive data of known children in compliance with the Children’s Online Privacy Protection Act (“COPPA”); Provide clear and accessible privacy notices, disclosing data categories, processing purposes, consumer rights, data sharing with third parties, and opt-out options if personal data is sold or used for targeted advertising; and Conduct data protection impact assessments for specific data processing activities involving personal data. The Indiana Attorney General has enforcement authority and may pursue injunctive relief and impose civil penalties of up to $7,500 per violation. For more information regarding the INCDPA, see Indiana Consumer Data Protection Act. Iowa The Iowa Consumer Data Protection Act (“ICDPA”) (effective January 1, 2025) grants residents the following rights with respect to their personal data: Confirm whether a controller is processing personal data and its access to personal data; Delete personal data provided by the consumer; Request a copy of their personal data in a readily usable format; and Opt-out of the sale of their personal data. The ICDPA applies, with certain exceptions, to any business that: (1) controls or processes the personal data of at least 100,000 Iowa consumers, or (2) controls or processes the personal data of at least 25,000 consumers and derives more than 50% of its gross revenue from the sale of personal data. Under ICDPA, controllers are required to: Clearly and conspicuously disclose the use of personal data for targeted advertising and give consumers a means of opting out; Respond to requests from consumers within 90 days (with right to additional 45 days if necessary); and Supply information free of charge up to twice annually per consumer Enforcement authority is given to Iowa’s Attorney General. Up to a $7,500 fine may be imposed for each violation. For more information regarding the ICDPA, see Iowa Consumer Data Protection Act. Montana The Montana Consumer Data Privacy Act (“MCDPA”) (effective October 1, 2024) grants residents the following rights with respect to their personal data: Opt-out of the sale of their personal data, targeted advertising, or profiling that leads to automated decisions with significant legal consequences, including the provision or denial of financial or lending services, housing, insurance, among others; Confirm whether a controller is processing their personal information and access to that data, with a few exceptions; Request corrections to any inaccurate or outdated information that a controller has about them, especially if it was provided by the consumer; Delete any personal data about them, with some exceptions; Obtain a copy of their personal data that they previously provided to the controller in a user-friendly format, again with certain exceptions; and Not to be discriminated against for exercising their rights. Discrimination includes any unfair treatment related to these rights. The MCDPA applies, with certain exceptions, to: (1) any data controller that handles the personal data of at least 50,000 Montana residents; and (2) controllers that manage personal data from at least 25,000 consumers and derive more than 25% of their revenue from selling personal data. The Montana Attorney General holds exclusive authority for enforcing the MTCDPA. There are no set fines for violations of the statute. For more information regarding the MTCDPA, see Montana Consumer Data Privacy Act. New Jersey The New Jersey Data Protection Act (“NJDPA”) (effective January 15, 2025) gives New Jersey residents the following rights with respect to their personal data: Confirm whether a controller processes personal data and access that data; Correct inaccuracies in their personal data; Delete personal data; Obtain a copy of personal data in a portable, readily usable and transferable format; Opt-out of processing of personal data for targeted advertising or profiling; and Opt-in to personal data involving sensitive information (which includes racial or ethnic origin, religious beliefs, mental or physical conditions, sex life or sexual orientation, citizenship or immigration status, gender identity, genetic or biometric data, precise geolocation data, and financial information) or children’s information. The NJDPA applies, with certain exceptions, to controllers who, during a calendar year, meet one of the following criteria: (1) control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction, or (2) control or process the personal data of at least 25,000 consumers and the controller derives revenue or receives a discount on the price of any goods or services, from the sale of personal data. Under the NJDPA, controllers are required to: Limit the collection of personal data to what is adequate, relevant and reasonably necessary; Establish, implement and maintain administrative, technical and physical data security practices; Secure data; Not process sensitive data or data of a known child without consent; and Post a privacy notice and a link on their website that allows consumers to opt-out. The NJDPA is enforced by the New Jersey Office of the Attorney General. No monetary amount is defined in the law, but a violation of the NJDPA will constitute a violation of the New Jersey Consumer Fraud Act, which can result in fines of up to $10,000 for the initial violation and up to $20,000 for subsequent violations as well as treble damages and attorneys’ fees in certain situations. For more information regarding the NJDPA, see New Jersey Data Privacy Law. Oregon The Oregon Consumer Privacy Act (“OCPA”) (effective July 1, 2024) gives Oregon residents the following rights with respect to their personal data: Obtain confirmation as to whether a controller is processing or has processed their personal data and the categories of personal data the controller is processing or has processed; Obtain a list of third parties to which the controller has disclosed the consumer’s personal data; Obtain a copy of the personal data the controller has processed or is processing; Require the controller to correct inaccuracies in personal data about them; Require a controller to delete personal data about them, regardless of whether the consumer provided the personal data or it was obtained from another source; and Opt-out of processing personal data for targeted advertising, selling personal data, or profiling the consumer to support legally significant decisions. The OCPA applies, with certain exceptions, to any person who conducts business in Oregon or who provides products or services to residents of the state and controls or processes: (1) the personal data of 100,000 or more consumers in a calendar year, other than personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) the personal data of 25,000 or more consumers, while deriving 25 % or more of the person’s annual gross revenue from selling personal data. Under the OCPA, controllers are required to: Respond to consumer’s requests within 45-days (which can be extended for up to an additional 45-days if necessary); Specify in their privacy notice the purposes for which they are collecting and processing personal data; Limit collection to personal data that is adequate, relevant, and reasonably necessary to serve the purposes the controller specified; Maintain safeguards to protect the confidentiality, integrity, and accessibility of personal data; Provide an effective means for a consumer to revoke consent that is at least as easy as the means by which the consumer or authorized agent provided consent; Obtain consent to process sensitive data and process sensitive data of children in accordance with COPPA; Conduct a data protection assessment for each of their processing activities that present a “heightened risk of harm to the consumer,” such as processing for targeted advertising, processing sensitive data; and Provide a reasonably accessible, clear, and meaningful privacy notice that lists information like the categories of collected personal data, the purposes for processing, and how consumers can exercise their rights, among other requirements. The Oregon Attorney General has exclusive enforcement authority over the OCPA. Those who do not comply with the law can be fined up to $7,500 per violation. For more information regarding the OCPA, see Oregon Consumer Privacy Act. Tennessee The Tennessee Information Protection Act (“TIPA”) (effective July 1, 2025) gives Tennessee residents the following rights with respect to their personal data: Confirm whether a controller is processing their personal information and to access the personal information; Correct inaccuracies in their personal information; Delete personal information provided by or obtained about the consumer unless it is aggregated or de-identified data; Obtain a copy of personal information previously provided to the controller in a portable and readily usable format; Opt-out of a controller’s processing of personal information for the purposes of selling it to a third party, targeted advertising, or profiling. The TIPA applies, with certain exceptions, to organizations that: (1) exceed $25 million in annual revenue; or (2) conduct business in the state; or (3) provide products or services that are targeted to residents of the state and satisfies one of the following: (a) during a calendar year, controls or processes personal information of at least 175,000 consumers; or (b) controls or processes personal information of at least 25,000 consumers and derives more than 50% of gross revenue from the sale of personal information. Under the TIPA, controllers are required to: Limit the collection and processing of personal information to what is adequate, relevant, and reasonably necessary for your intended purpose; Establish administrative, technical, and physical data security practices; Not process personal information that results in discrimination against consumers or discriminate against a consumer for exercising their rights; Not process sensitive data concerning a consumer without obtaining their consent first. If a controller processes sensitive data concerning a known child, it must be processed in accordance with COPPA; Respond to consumer rights requests; Conduct a data protection assessment for processing personal information for certain risky activities, like targeted advertising, the sale of information, processing sensitive data, and more; Provide a reasonably accessible, clear and meaningful privacy notice to consumers, identifying: The categories of personal information you process. The purpose for processing. How consumers can exercise their rights. Categories of information you sell to third parties. Categories of third parties to which you sell personal information; and Enter into a contract with any entity that processes personal information on behalf of a controller. TIPA is enforceable by the state Attorney General. Violations can carry fines up to $7,500 per violation. TIPA also allows courts to triple the actual damages caused if the violation was willful. For more information regarding TIPA, see Tennessee Information Protection Act. Texas The Texas Data Privacy and Security Act (“TDPSA”) (effective July 1, 2024) gives Texas residents the following rights with respect to their personal data: Confirm whether a controller is processing personal data and access the personal data; Correct inaccuracies in their personal data; Delete personal data provided by or obtained about the consumer; Obtain a copy of their personal data, if available, in a portable and readily usable format; and Opt-out of processing personal data for targeted advertising, the sale of personal data, or its use for profiling. The TDPSA applies, with certain exceptions, to entities that: (1) conduct business in Texas or generate products or services “consumed” by Texas residents; (2) process or engage in the sale of personal data; and (3) do not identify as a small business as defined by the U.S. Small Business Administration (SBA). Under the TDPSA, controllers are prohibited from: Collecting personal data for reasons not disclosed to the consumer without consent; Processing data in violation of state and federal laws that prohibit unlawful discrimination or discriminate against a consumer for exercising their rights; and Processing sensitive data without consent or processing sensitive data of a child unless it’s in accordance with COPPA. The TDPSA also requires businesses to gain consent before processing sensitive personal data and provide notice if they sell sensitive or biometric data. Enforcement authority is given to the Texas Attorney General. Violators are subject to fines of up to $7,500 per violation. For more information regarding the TDPSA, see Texas Data Privacy and Security Act. Look Out For These States Laws have also been introduced and discussed in other states, including Hawaii, Kentucky, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, New Hampshire, New York, North Carolina, Ohio, Pennsylvania, Vermont, Wisconsin, and West Virginia. We will provide further updates as these states make progress towards enacting their data privacy laws. For more information on compliance, please contact Michael J. Feldman, Esq. (mfeldman@olenderfeldman.com or 908-964-2486).

OlenderFeldman Attorneys Recognized by 2024 Super Lawyers Magazine!

Last year, OlenderFeldman LLP notified its clients of the Federal Trade Commission’s (FTC) Notice of Proposed Rulemaking, which it released on January 5, 2023, seeking to ban employers from enforcing or entering into employment agreements that contain restrictions or limitations on the ability of employees to compete following the end of an employment relationship, subject to limited exceptions as detailed below. On April 23, 2024, the FTC issued the final rule banning and invalidating nearly all non-competes (“Non-Compete Rule”). The Non-Compete Rule will impact most businesses in the United States that use non-compete agreements to protect their trade secrets, confidential business information, and other important interests. The Non-Compete Rule defines a "non-compete" agreement as any employment term or contractual condition that prohibits, penalizes, or functionally prevents a worker from getting a different job or starting a new business after leaving their employment. OlenderFeldman LLP has prepared this FAQ to address the most pertinent issues and implications relating to the FTC’s issuance of the Non-Compete Rule. Q. What is the FTC’s Proposed Non-Compete Rule? A. The FTC’s proposed Non-Compete Rule would ban employers from imposing non-compete agreements on all workers regardless of whether they are full-time, part-time, or independent contractors. The Non-Compete Rule considers all non-competes to be in violation of Section 5 of the FTC Act. The Non-Compete Rule seeks to promote fair competition and ensuring that workers have the freedom to seek employment opportunities without restrictions from their previous employers. Under the Non-Compete Rule, employers are prohibited from entering into any agreement intended to bar workers from being able to compete with their employer, establishing a nationwide comprehensive “non-compete ban” to invalidate existing and new non-competes, subject to limited exceptions. The Non-Compete Rule applies to all workers, including full-time and part-time employees, independent contractors, interns, volunteers, apprentices, and sole proprietors who provide services to clients or customers. Q. What are the Exceptions under the Non-Compete Rule? A. The proposed Non-Compete Rule includes several important exceptions: Non-Compete Agreements Attendant to the Sale of a Business: The Non-Compete Rule does not apply to non-competes entered into as a result of a “bona fide sale of a business entity, of the person’s ownership interest in [a] business entity, or of all or substantially all of a business entity’s operating assets.” The seller can agree to a non-compete individually, but not for any of the employees of the business. Senior Executives: The Non-Compete Rule does not apply to existing non-compete agreements with senior executives. The Non-Compete Rule defines the term “senior executive” as workers earning more than $151,164 annually who are in a “policy-making position.” The FTC estimates that fewer than 1% of workers are estimated to be senior executives under the proposed rule. New non-compete agreements with senior executives are prohibited after the effective date. Existing Causes of Action: The Non-Compete Rule does not apply to bar any cause of action in legal disputes related to a non-compete clause that existed prior to the effective date. Other Restrictive Agreements: Non-solicitation, non-recruitment, and non-disclosure agreements that effectively restrict a worker from seeking other employment or starting a business are also prohibited, regardless of the classification, if the agreement effectively functions as a de facto non-compete (i.e. any contractual provision that has the “effect” of prohibiting a worker from seeking/accepting employment or operating a business after the conclusion of the worker’s current employment), and these agreements are analyzed on a case-by-case basis. Even if the proposed Non-Compete Rule is implemented, employers can still protect their business interests by including confidentiality provisions and other restrictive agreements – as long as they do not create a de facto non-compete. For all other workers, existing non-compete agreements will be unenforceable as of the effective date of the Non-Compete Rule (as discussed below) and employers are required to inform workers that they are no longer bound by such non-compete clauses. Q. When will the Non-Compete Rule go into Effect? A. The FTC published the Non-Compete Rule in the Federal Register on May 7, 2024, and it is expected to take effect as of September 4, 2024. Since the announcement of the Non-Compete Rule, there have been several major lawsuits filed raising legal challenges that could delay the effective date and a court could invalidate the rule altogether. Q. What Recommended Actions Should Employers Take Now? A. The simple answer is to wait and see if the Non-Compete Rule is ultimately upheld and/or modified. We believe the rule will not be implemented in its present form. If the rule is upheld as it stands, OlenderFeldman LLP will provide an update with the notice requirements for those current and former workers who are not senior executives that their non-competes are unenforceable, and will provide guidance on recommended changes to non-compete policies to make them compliant with the FTC Rule. Q. Have there been any Legal Challenges to the Implementation of the Non-Compete Rule since the FTC’s Announcement? A. The Non-Compete Rule is currently being challenged in several lawsuits seeking, among other things, a temporary stay of the rule's September 4, 2024 effective date. In the case filed in the U.S. District Court for the Northern District of Texas, the court has indicated it will rule on whether to issue a stay (i.e. a temporary pause) of the Non-Compete Rule by July 3, 2024, and OlenderFeldman LLP will provide further updates as they become available. For more information on compliance, please contact the OlenderFeldman Employment Practices Group here.

The Federal Fair Labor Standards Act (“FLSA”) requires employers in the United States to pay all employees overtime pay of at least time and one-half the regular rate of pay for all hours worked over 40 hours in a workweek unless they are exempt from overtime pay. The U.S. Department of Labor (“USDOL”) periodically reviews these exemptions for modifications and adjustments. On April 23, 2024, USDOL announced a final rule (“Federal Exemption Rule”) redefining the standards for overtime exemptions under the FLSA for employees under one or more of the following job classifications: Executive, Administrative, Professional, Outside Sales, and Computer Employees, along with highly compensated workers (collectively, “Exempt Employees”). The Federal Exemption Rule increases the annual salary levels for Exempt Employees under the FLSA in two stages, with the first salary level increase for overtime-Exempt Employees taking effect on July 1, 2024, and then increasing again on January 1, 2025. Under the FLSA, Exempt Employees are not eligible for overtime pay, but must be paid a salary that exceeds the threshold amount and must also meet certain duties tests. If these employees are paid less than the exemption threshold or do not meet the duties tests, they must be paid 1.5 times their regular hourly rate for hours worked in excess of 40 in a workweek. OlenderFeldman LLP has prepared this FAQ to further explain the Federal Exemption Rule and how it may apply to your business. Q. What is the new Federal Exemption Rule? A. The Federal Exemption Rule will increase the salary levels for Exempt Employees and sets forth a mechanism for regular updating of these earnings thresholds. Starting July 1, 2024, most salaried workers who earn less than $844 per week (or $43,888 per year) will become eligible for overtime pay under the Federal Exemption Rule. The salary threshold will then increase again by next year and, as of January 1, 2025, most salaried workers who make less than $1,128 per week (or $58,656 per year) will become eligible for overtime pay. Currently, this rule is set to go into effect as of July 1, 2024, but employers will have until January 1, 2025 to fully comply with these new salary adjustments. The Federal Exemption Rule will also increase the salary level for the “highly compensated employee” exemption under the FLSA, which exempts certain high-salaried employees from overtime if they receive a total annual compensation of at least $132,964 (as of July 1, 2024) and $151,164 (as of January 1, 2025). Q. Why is Understanding the new Federal Exemption Rule important? A. Because the Federal Exemption Rule increases the salary threshold, millions of employees who are currently overtime-Exempt Employees in the United States could be impacted by the salary threshold change and become eligible for overtime pay. Employers must carefully review their salary pay levels to ensure their pay practices align with this significant change. Q. Does the Federal Exemption Rule change the Definitions of Exempt Employees? A. No. the full list of exemptions under the FLSA can be found here and is not changed by the implementation of the Federal Exemption Rule. Q. What is the best way to ensure Exempt Status remains in place despite the new Federal Exemption Rule? A. Employers should review Exempt Employees who make less than the current $35,568 salary threshold and either increase their annual salary or convert those employees to non-exempt status. Employers should also review and update job descriptions to ensure the duties outlined meet the exemption criteria. Employees may be considered Exempt Employees if they earn less than the salary threshold, and primarily perform certain duties. Employees who meet both the salary and duties test are considered Exempt Employees. Employees making less than the current annual salary limit of $35,568 must either receive a raise to meet the new levels or be paid overtime. Q. If an Employee earns more than the Salary Threshold are they Automatically Exempt? A. No, simply meeting the salary threshold does not automatically make an employee exempt from overtime pay. Employees must earn at least the standard salary threshold of $58,656(as of January 1, 2025) and fulfill one of the exemptions in the standard duties test. The employee's job duties must primarily involve executive, administrative or professional duties as defined by the USDOL’s regulations. In short, exempt employees must earn above the threshold and meet one of the exemptions in the standard duties test. Q. What if a State has established its own Overtime Rules? A. Many states have issued higher, stricter, or different overtime requirements that employers must comply with just like the Federal Exemption Rule. In cases where an employee is subject to both state and federal overtime laws, the employee is entitled to overtime according to the higher (more lucrative) standard (i.e., the standard that will provide the higher overtime pay or the duties test that is easier to satisfy). Simply put, employers must follow the state law if it is more favorable to employees than the federal law. Q. Have there been any Legal Challenges to the Implementation of the Federal Exemption Rule since the USDOL’s Announcement? A. On May 22, 2024, several businesses filed a lawsuit seeking to block the Federal Exemption Rule, alleging that the USDOL acted arbitrarily and capriciously in setting the new salary thresholds, despite concerns from the business community. These legal challenges could delay the implementation of the new rule’s threshold increases and OlenderFeldman LLP will provide further updates, prior to the effective date of July 1, 2024. For more information on compliance, please contact the OlenderFeldman Employment Practices Group here.

Recently, the New Jersey Supreme Court’s Committee on the Unauthorized Practice of Law issued a letter to the New Jersey Society of CPAs, providing some much-needed guidance on whether Certified Public Accountants (CPAs) and Enrolled Agents (EAs) in the state can prepare and file the FinCEN Beneficial Ownership Information Reports under Corporate Transparency Act. The letter identifies two critical issues: First, whether providing guidance and filing BOI Reports constitutes practicing law under New Jersey's definition. Second, whether allowing nonlawyers to engage in this activity serves the public interest or requires protection. On the first issue, the Committee determines that filing BOI Reports falls within New Jersey's broad definition of practicing law, which encompasses tasks requiring legal knowledge, training, skill, and ability, as per the functional definition adopted by the New Jersey Supreme Court In re Jackman, 165 N.J. 580, 586 (2000). However, the Committee explores whether public protection can be ensured without restricting service to lawyers. In re Opinion No. 26 of the Committee on the Unauthorized Practice of Law, 139 NJ. 323,340 (1995). On the second issue, the committee lists that Incidental use of legal knowledge while providing a nonlegal service does not transform the service into the practice of law. Cf. Auerbach v. Wood, 142 NJ. Eq. 484, 485-86 (E. & A. 1948). NJ Supreme Court emphasizes addressing overlaps between professional disciplines to avoid arbitrary classifications. For instance, licensed real estate brokers and salespersons may craft contracts for the sale of residential real estate, a task that is the practice of law, provided certain conditions, including an attorney-review clause in the contract, are met New Jersey State Bar Ass’n v. New Jersey Ass’n of Realtor Bds., 93 N.J. 470, 475-76 (1983). The Committee emphasizes attorney necessity based on filing complexity and potential legal ramifications. For instance, straightforward scenarios such as single-owner limited liability companies typically require basic reporting that can be adequately handled by a licensed CPA or Enrolled Agent without legal intervention. This distinction not only aims to safeguard the public against errors in complex filings but also acknowledges potential cost savings for entities in simpler cases. Further, CPAs are required under the AICPA Code (ET §0.300.060.04) & New Jersey’s regulations (13:29-3.3) to inform clients when a situation exceeds their competence, necessitating consultation or referral to maintain professional standards and competence. Therefore, the letter concludes as follows on the second issue: The Committee explains that CPAs (or EAs) must explicitly inform clients about the potential advisability of consulting with an attorney. This requirement extends beyond merely suggesting legal counsel as beneficial; it mandates that CPAs recognize and advise clients when a filing complexity warrants the involvement of legal expertise. The committee restricts the provision of assistance for submitting BOI reports in New Jersey to attorneys, CPAs, and EAs, although Businesses can file directly but must engage qualified professionals if they opt for third-party assistance. Since the Corporate Transparency Act (CTA) is new and there may be potential legal developments, the Committee reserves the right to modify or update its guidance in response to ongoing court cases and evolving circumstances affecting public interest considerations. OlenderFeldman LLP recommends the use of legal counsel to assist with CTA BOI reporting requirements for entities with more complicated considerations and to assess whether a business falls under one of the CTA’s 23 exemptions. OlenderFeldman LLP offers a new platform product to assist clients with such assessments, supplemented by its ordinary legal advisory services. For more information about the CTA BOI reporting offerings at OlenderFeldman LLP, please contact Craig D. Bronsnick at cbronsnick@olenderfeldman.com. For any questions regarding the appropriateness of services by CPAs or EAs for BOI reporting purposes, please contact Hrideja Shah at hshah@olenderfeldman.com.

In light of the new obligation under the US Treasury Department's Financial Crimes Enforcement Network ("FinCEN") to report beneficial ownership Information ("BOI"), OlenderFeldman is offering assistance via its own BOI Platform. For more information, please click here: OlenderFeldman BOI Services. Thank you

As a follow up to our most recent post regarding the Beneficial Ownership Information ("BOI") Reporting imposed by the U.S. Treasury Department’s Financial Crimes Enforcement Network (“FinCEN”), we have put together a FAQs to provide answers to questions that many entity and business owners are asking. Please click here to view: BOI FAQ - 2024

There is finally a common sense amendment to the Illinois Biometric Information Privacy Act (“BIPA”). The new Amendment, signed on August 2, 2024 by Governor Pritzker, allows entities to obtain consent via electronic signature, but far more importantly, it did away with “per scan” damages. That is, pursuant to Illinois Supreme Court precedent (Cothron v. White Castle), each data capture (i.e., fingerprint or eye scan) could constitute a separate BIPA violation with damages up to $5,000 per scan. Thus, for example, if a company had a defective consent process and used a fingerprint scan to clock in and out 100 employees for 365 days, there could be 36,500 violations (or 73,000 if used to clock in and out each day) at $5,000 per violation, or $182.5 million (or $365 million if used twice a day) in damages. Such an application of BIPA was often financially crippling to businesses and stifling of new technology despite such violation causing arguably minor harm to individuals - which apparently was never the intent of BIPA. Under the Amendment, the “aggrieved person” can only recover for one violation even if the unlawful collection or disclosure occurs more than once (such as when they sign in to a time clock every day). Using the example above, the damages would now be capped at $500,000 – still material, but obviously magnitudes less so. The next battle will be whether the Amendment applies retroactively. Should you have any questions about BIPA or the new Amendment, please feel free to reach out to Michael J. Feldman, Esq., at mfeldman@olenderfeldman.com or 908-964-2486.