The Jumpstart Our Business Startups Act or JOBS Act, intended to encourage funding of United States small businesses by easing various securities regulations, was signed into law by President Obama on April 5, 2012. By Louis A. Zambrio On April 5, 2012, the Jumpstart Our Business Startups Act (“JOBS Act”) was signed into law. The fundamental change that it will have on companies is their ability to raise capital through a private placement under Rule 506 of Regulation D of the Securities Act of 1933, as amended (“Rule 506 Offering”). The JOBS Act, among other things, will eliminate the prohibitions under the U.S. federal securities laws against general advertising or general solicitation in connection with a Rule 506 Offering; provided that all purchases are made to accredited investors. The elimination of the general advertising and general solicitation restrictions could have a significant impact on a company’s ability to raise capital because it allows companies to reach a more diverse group and larger number of potential investors through their marketing efforts. The enactment of the JOBS Act directed the U.S. Securities and Exchange Commission (“SEC”) to revise Rule 506 of Regulation D within 90 days of its enactment, or by July 4, 2012. The current rules are still applicable to Rule 506 Offerings until the SEC amends Rule 506 of Regulation D. Currently, under Rule 506 of Regulation D, companies are prohibited from soliciting investors through general advertisements or general solicitations, which makes it difficult for startups and small companies to raise capital since, as is often the case, they do not have enough contacts who are accredited investors that have the financial capability to invest in their company. With the implementation of the JOBS Act, a company will have the ability to tap a larger pool of investors than they originally had access to since they will now be allowed to solicit investors through general advertisements and general solicitations. This should open up access to more funding opportunities then companies previously experienced. The one caveat is that all investors must be accredited investors as such term is defined under Rule 501(a) of Regulation D (“Accredited Investor”). An Accredited Investor is generally someone who has enough knowledge and business experience and acumen that they do not need to be afforded the full protection of the securities laws. Since this was a difficult standard to interpret, the SEC enacted Rule 501(a) to clarify the meaning of an Accredited Investor. There are eight (8) different categories of investors under the definition of an Accredited Investor, the most widely used by startup and small companies is: 501(a)(6) any natural person whose individual net worth, or jointly with their spouse, exceeds $1 million at the time of purchase, excluding the value of such person’s primary residence; or 501(a)(7) any natural person with income exceeding $200,000, or joint income with a spouse exceeding $300,000, for the two most recent years with a reasonable expectation of achieving the same income level in the current year. A company can avail itself of the elimination of the advertising prohibitions in a Rule 506 Offering by taking “reasonable steps to verify that purchasers of the securities are accredited investors”. The meaning of this standard is unclear as of now, but hopes are that the SEC will clarify its meaning when it revises Rule 506 of Regulation D. Once the SEC amends Rule 506 of Regulation D, companies will be able to conduct private placements through the facilitation of general advertisements and general solicitations as long as they reasonably verify that the securities are sold to Accredited Investors only.

A New Jersey court recently held that a teacher who accessed and printed a co-worker’s personal email after the coworker left the computer without signing out of her account was not guilty of a crime. By Alice Cheng In Marcus v. Rogers, 2012 WL 2428046 (N.J.Super.A.D. June 28, 2012), a New Jersey court held that a defendant was not in violation of any laws when he snooped through the emails of a coworker who had forgotten to sign out of a shared computer. The defendant, a teacher who was involved in a salary dispute with the school district he worked for, sat down to use a computer in the school’s computer room when he accidentally bumped the mouse of the computer next to him. The screen of the adjacent computer came alive to show the Yahoo! email inbox of a member of the education association he was in dispute with, which included two emails that clearly mentioned him. He then clicked on the emails, printed them out, and used them at a meeting with the education association as evidence that they had not bargained in good faith. The individuals who were copied on the email conversations filed suit, claiming that the defendant had violated New Jersey’s version of the Stored Communications Act (N.J.S.A. 2A:156A-27), which reads in pertinent part: A person is guilty . . . if he (1) knowingly accesses without authorization a facility through which an electronic communication service is provided or exceeds an authorization to access that facility, and (2) thereby obtains, alters, or prevents authorized access to a wire or [an] electronic communication while that communication is in electronic storage. The court found that the defendant did not “knowingly access [the facility] without authorization” as it was the previous user who had logged into the account. The judge then let the jury decide whether or not he “exceed[ed] an authorization to access that facility” when she failed to close her inbox and log out of her account. The jury found that did not, as he had “tacit authorization” to access the account. On appeal, the court affirmed. While there is no clear answer to the question of whether snooping emails is illegal (as always, it depends), always remember to log out of public computers. Similarly, all mobile devices, such as smartphones or laptops, should be password protected. As for the email snoopers, be forewarned that snooping may nevertheless carry major consequences, if hacking or unauthorized access is found.

The Internal Revenue Code (IRC) Section 83 governs property transferred to an employee in connection with the performance of services. Currently, the section states that such transfers of property (typically restricted stock or stock options) are subject to federal income tax when the property is no longer subject to a substantial risk of forfeiture; however, new regulations will go into effect on January 1, 2013. By Alice Cheng On May 29, 2012, the Internal Revenue Service (IRS) issued proposed regulations (REG-141075-09) under Section 83 to refine and narrow the concept of the substantial risk of forfeiture. Whether a substantial risk of forfeiture exists is based on the facts and conditions of a property transfer arrangement. The proposed regulations will address the confusion over the appropriate elements of what constitutes a substantial risk of forfeiture. The Internal Revenue Code (IRC) Section 83 governs property transferred to an employee in connection with the performance of services. Currently, the section states that such transfers of property (typically restricted stock or stock options) are subject to federal income tax when the property is no longer subject to a substantial risk of forfeiture. The proposed regulations will make clarifications in the following three areas: Under current regulations, a substantial risk of forfeiture exists subject to the performance (or non-performance) of substantial services of the employee, or to the occurrence of a condition related to the purpose of the transfer. The proposed regulation clarifies that a substantial risk of forfeiture arises only through a future service condition or a condition relating to the purpose of the transfer. Two issues will be considered to determine whether a substantial risk of forfeiture exists—the likelihood that the forfeiture event will occur, and the likelihood that the forfeiture will be enforced. A transfer restriction (such as lock-up provisions, buyback provisions, and blackout periods) generally does not create a substantial risk of forfeiture for the purposes of the Section. However, there is an exception if the sale of property at profit could subject a person to suit under Section 16(b) of the Securities and Exchange Act of 1943. The proposed regulations are to go into effect on January 1, 2013, and will apply to property transfers on or after that date.

All companies, big and small, are at risk for data breaches. Most companies have legal obligations with respect to the integrity and confidentiality of certain information in its possession. Information privacy and security is essential to protect your business, safeguard your customers’ privacy, and secure your company’s vital information. Recently, hackers gained access to Yahoo’s databases, exposing over 450,000 usernames and passwords to Yahoo, Gmail, AOL, Hotmail, Comcast, MSN, SBC Global, Verizon, BellSouth and Live.com accounts. This breach comes on the heels of a breach of over 6.5 million LinkedIn user passwords. With these embarrassing breaches, and the widespread revelation of their inadequate information security practices, Yahoo and LinkedIn were added to the rapidly growing list of large companies who have suffered massive data breaches in recent years. While breaches at large companies like Yahoo and LinkedIn make the headlines, small businesses are equally at risk, and must take appropriate measures to keep their information safe. Aaron Messing, an information privacy attorney with OlenderFeldman LLP, notes that most businesses networks are accessible from any computer in the world and, therefore, potentially vulnerable to threats from individuals who do not require physical access to it.A recent report by Verizon found that nearly three-quarters of breaches in the last year involved small businesses. In fact, small business owners may be the most vulnerable to data breaches, as they are able to devote the least amount of resources to information security and privacy measures. Studies have found that the average cost of small business breaches is $194 per record breached, a figure that includes various expenses such as detecting and reporting the breach, notifying and assisting affected customers, and reimbursing customers for actual losses. Notably, these expenses did not include the cost of potential lawsuits, public embarrassment, and loss of customer goodwill, which are common consequences of weak information security and poorly managed data breaches. For a large business, a data breach might be painful. For a small business, it can be a death sentence. LinkedIn presents a good example of these additional costs. It is currently facing a $5 million class action lawsuit related to the data breach. The lawsuit does not allege any specific breaches of cybersecurity laws, but instead alleges that LinkedIn violated its own stated privacy policy. Businesses of all sizes should be very careful about the representations they make on their websites, as what is written in a website terms of use or privacy policy could have serious legal implications. Proactive security and privacy planning is always better than reactive measures. “While there is no sure-fire way to completely avoid the risk of data breaches,” says Aaron Messing, an information privacy lawyer with OlenderFeldman LLP, “steps can be taken, both before and after a breach, to minimize risk and expense.” To preserve confidential communications and to obtain advice on possible legal issues related to your company, consulting with privacy attorneys about your specific requirements is recommended. OlenderFeldman recommends the following general principles as a first step towards securing your business. First, consider drafting a detailed information security policy and a privacy policy tailored to your company’s specific needs and threats which will to guide the implementation of appropriate security measures. A privacy policy is complementary to the information security policy, and sets the standards for collection, processing, storing, use and disclosure of confidential or personal information about individuals or entities, as well as prevention of unauthorized access, use or disclosure. Your policies should plan for proactive crisis management in the event of a security incident, which will enable coordinated execution of remedial actions. Most companies have legal obligations with respect to the integrity and confidentiality of certain information in its possession. Your company should have and enforce policies that reflect the philosophy and strategy of its management regarding information security. Second, although external breaches from hackers gain the most publicity, the vast majority of data breaches are internal. Accordingly, physical security is one of the most important concerns for small businesses. Informal or non-existent business attitudes and practices with regards to security often create temptations and a relatively safe environment for an opportunist within to gain improper or unauthorized access to your company’s sensitive information. Mitigating this risk requires limiting access to company resources on a need to know/access basis and restricting access to those who do not need the access. Theft or damage of the system hardware or paper files presents a great risk of business interruption and loss of confidential or personal information. Similarly, unauthorized access, use, or disclosure, whether intentional or unintentional, puts individuals at risk for identity theft, which may cause monetary liability and reputational damage to your company. Third, be vigilant about protecting your information. Even if your company develops a secure network, failure to properly monitor logs and processes or weak auditing allows new vulnerabilities and unauthorized use to evolve and proliferate. As a result, your company may not realize that a serious loss had occurred or was ongoing. Develop a mobile device policy to minimize the security and privacy risks to your company. Ensure that your technology resources (such as photocopy machines, scanners, printers, laptops and smartphones) are securely erased before it is otherwise recycled or disposed. Most business owners are not aware that technology resources generally store and retain copies of documents that have been printed, scanned, faxed, and emailed on their internal hard drives. For example, when a document is photocopied, the copier’s hard drive often keeps an image of that document. Thus, anyone with possession of that photocopier (i.e., when it is sold or returned) can obtain copies of all documents that were copied or scanned on the machine. This compilation of documents and potentially sensitive information poses serious threats of identity theft. Finally, in the event of a breach, consult a privacy lawyer to determine your obligations. After a breach has been discovered, there should be a forensic investigation to determine what information was accessed and whether that information is still accessible to unauthorized users. Your business may be legally obligated to notify customers or the authorities of the breach. Currently, there are no federal laws regulating notification, but 46 states and the District of Columbia have enacted data breach notification laws, which mandate various breach reporting times, and to various authorities.

If your password looks something like “123456,” you might want to change it. By Alice Cheng Late Wednesday evening, hackers successfully breached Yahoo! security published a list of unencrypted emails and passwords. The list exposed the login information of more than 450,000 Yahoo! users. The hackers, who call themselves the D33D Company, explained that they obtained the passwords by using an SQL injection vulnerability—a technique that is often used to make online databases cough up information. The familiar method has been employed in other high-profile hacks, including of Sony and, more recently, LinkedIn. However, unlike other malicious attacks, the D33D hackers claim that they only had good intentions: “We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat.” The attempted wake-up call is apparently much needed, though often ignored. An analysis of the exposed Yahoo! passwords revealed that a large number were incredibly weak— popular passwords in the set ranged from sequential numbers to being merely “password.” In a statement, Yahoo! apologized and stated that notifications will be sent out to all affected users. The company also urged users to change their passwords regularly. If you are a Yahoo! user, you may want to change your account password, as well as any accounts with similar login credentials. It will also be well worth your time to heed to the wake-up call and incorporate better password practices. Use a different password for each site, and create long passwords that include a mix of upper- and lower- case letters, numbers, and symbols. To help keep things simple, password management software (such as LastPass and KeePass) is also available to help keep track of the complex passwords you create.

Pending approval by Governor Christie, New Jersey will adopt a new set of laws pertaining to the formation and operation of limited liability companies. By Joseph Olender In 2011, the New Jersey Assembly proposed Bill No. 1543, which would change the way that limited liability companies (LLCs) in the state are created and operate. The bill was created in an attempt to fill gaps in New Jersey law regarding the operation of LLCs, as well as to update existing law that had become outdated. The bill passed unanimously through the Assembly on May 24th and the Senate on June 21st, needs only the signature of Governor Christie to become law. This bill, a version of the Revised Uniform Limited Liability Company Act (RULLCA), effectively repeals the New Jersey Limited Liability Company Act (NJLLCA), and replaces it with a modern regulatory scheme for the creation and operation of limited liability companies in New Jersey. The RULLCA, as developed by the National Conference of Commissioners on Uniform State Laws (NCCUSL), is a significant advancement and common sense approach to the governing of limited liability companies. New Jersey is one of many states to propose a bill which would adopt a version of the RULLCA. The bill would significantly impact the way LLCs do business, and assemblymen hope that it will boost job growth potential in the state. The bill is designed to change some aspects of the law currently in place via the NJLLCA, and also deal with areas of the law that New Jersey has not yet covered. The bill would mandate some significant changes including: Perpetual Duration. Eliminates the default rule that LLCs have a limited life. As is already the case with New Jersey corporations, New Jersey LLCs would have perpetual duration. Permissible form of operating agreement. Permits operating agreements to be oral, written or implied based on the way the LLC is operated. Distributions. Unless otherwise agreed upon, distributions are made to members on a per capita basis. Statements of authority. It allows an LLC to file statement s of authority with the Division of Revenue in the Department of the Treasury, authorizing certain individuals or entities to bind the LLC. Disassociation of a member. This would eliminate a major pitfall for the unwary practitioner forming an LLC in New Jersey. A resigning owner is no longer entitled to receive the fair value of his or her LLC interest as of the date of resignation. Rather, upon, resignation, the resigning member is disassociated as a member and only has the rights of an economic interest holder. Remedies for deadlock and oppression. It extends many of the traditional remedies available at common law or pursuant to statute to LLCs. It permits a member to seek a court order dissolving the company on the grounds that the managers or those members in control of the company have acted or are acting in manner that is oppressive and was, is, or will be directly harmful to the member. It also permits a less drastic form to resolve deadlock in the form of an appointed custodian. If signed by Governor Christie the bill will become effective after 180 days and will govern all LLCs formed after its effective date. Following the first day of the 18th month following the bill’s enactment, it will apply to all New Jersey LLCs.

The NTIA’s first multistakeholder meeting on mobile privacy focused on ways to improve the transparency of the privacy practices of mobile apps. By Alice Cheng On Thursday, the U.S. Department of Commerce’s National Telecommunications and Information Administration (NTIA) held a public meeting in Washington, D.C., to discuss mobile privacy. After taking public comment in March on consumer data privacy, the NTIA decided to address mobile app transparency in its first privacy multistakeholder process. The discussion is part of the Obama administration’s push for companies to abide by a consumer privacy “bill of rights,” and is an issue that has been recently tackled by the Federal Communications Commission as well. As smartphone use continues to grow rapidly, concerns about mobile app access to consumer data have also grown. Through the devices, mobile apps may be able to access sensitive personal information regarding users, such as geographic location. Additionally, privacy advocates have pushed fervently for regulation on digital advertising. The prevalence of digital advertising on apps is not only a nuisance, but can at times be downright aggressive (i.e., ads pushed onto notification bars and phone desktops). During the meeting, audience members were asked how greater mobile app transparency could be achieved. Suggestions ranged from software that notified users of what information was shared, to the use of icons indicating privacy concepts in lieu of lengthy privacy policies. Others proposed that broader fair information practices should be addressed, as transparency itself would not be helpful without regulations. While the NTIA’s next steps are unclear, keep in mind that privacy policies should still be as clear as possible. Effective privacy policies let users know how and for what purpose information is collected and used. Privacy lawyers and advocates generally recommend an opt-in approach is where possible, as it allows users to choose what information they would like to share.

Survey finds that only 61.3% of apps have privacy policies, reflecting perceived need for increased app privacy regulations. By Alice Cheng A recent survey conducted by the Future of Privacy Forum (FPF) examined whether popular free and paid mobile apps provided users with access to a privacy policy visit this website. The survey found that 61.3% of the 150 apps examined had a privacy policy, while more free apps than paid apps had privacy policies. While the numbers of apps with privacy policies are still low, these findings mark an overall increase from the previous year. The FPF credits the consumer privacy efforts of various groups, including the Federal Trade Commission and the California Attorney General. The FTC has made continuous efforts to develop companies develop best consumer privacy practices, and has been involved in battling privacy violations. In February, California Attorney General Kamala Harris persuaded six major companies with mobile platforms (including Apple, Microsoft, and Google) to ensure that app developers include privacy policies that comply with the California Online Privacy Protection Act. More recently, Harris also announced the formation of the Privacy Enforcement and Protection Unit to oversee privacy issues and to ensure that companies are in compliance with the state’s privacy laws. Together with the FPF survey results, these recent strides reflect a growing nationwide concern for information privacy. However, mere access to privacy policies does not ensure that consumers are aware of what happens to information collected about them. Many policies are long and onerous, and can be confusing for consumers. As many privacy laws focus on protecting the consumer’s privacy interests, providing a clear privacy policy is oftentimes a best practice for all companies

Several House lawmakers have sent letters to nine major data broker firms, seeking transparency on data practices. By Alice Cheng Last week, eight House members, including Congressional Bi-Partisan Privacy Caucus chairmen Ed Markey (D-Mass.) and Joe Barton (R-Tex.), sent letters to nine major data broker firms, asking for information on how they collect, assemble, maintain, and sell consumer information to third parties. The letter references a recent New York Times article profiling data broker Acxiom, which may have spurred the lawmakers’ decision to target the firms. Data brokers are large firms that aggregate information about hundreds of millions of consumers, selling them to third parties for marketing, advertising, and other purposes. Oftentimes, profiles of consumers are created to reflect spending habits, political affiliation, and other behavioral information. As the article explains, the issue with these activities is that they are largely unregulated, largely unknown to the general public, and are often be difficult to opt out of. Privacy advocates, lawmakers, and often the Federal Trade Commission have made continued moves towards increased transparency of the activities of data brokers. A statement explains that, in sending the letter to the nine firms, the lawmakers in the Bi-Partisan Privacy Caucus seek to obtain information on the brokers relating to “privacy, transparency and consumer notification, including as they relate to children and teens.”

The Federal Trade Commission has proposed revisions that will bring the Children’s Online Privacy Protection Act in line with 21st century technology, largely targeting social networks and online advertisers. By Alice Cheng Based on comments solicited last year, the Federal Trade Commission (FTC) has posted proposed revisions to the Children’s Online Privacy Protection Act (COPPA). The Act, which has not been updated since its inception in 1998, may be extended to include social networks and online advertisers. According to the current regulations, COPPA applies only to website operators who know or have reason to know that users are under the age of 13, requiring the sites to obtain parental consent before any collection of data. In the past decade, an increased ability to harvest consumer information has necessitated revisions. In a FTC staff report conducted earlier this year, the Commission addressed a growing need for app stores and app developers to provide more information regarding their data collection practices to parents. With the proposed changes posted today, the FTC plans to update COPPA to respond to modern concerns surrounding social networking sites, advertising networks, and applications. Under the proposed changes, such third parties may be held responsible for unlawful data collection practices when they know or have reason to know that they are connecting to children’s websites. Mixed audience websites may have to screen all visitors in order for COPPA regulations to apply to users under 13 years of age. Additionally, restrictions on advertising based on children’s online activity may be tightened. The FTC will be accepting public comment to the proposed rules via the FTC website. Comments will be accepted until September 10, 2012.

We often receive questions about how to choose an attorney or law firm that is suitable for your particular issue or business. Here are some considerations to keep in mind. There are a number of consideration that go into vetting an appropriate attorney. The first, and arguably most important, is ensuring that your attorney understands business relationships and how companies function. While many lawyers are technically proficient in the law, it is important to ensure that your attorney understands, and craft legal solutions specific to, your business and industry. Your attorney should be practical and be able to develop solutions that not only address your requirements, but also those with whom you wish to do business with or interact with. In the negotiating process, many attorneys make unrealistic demands based on idealistic desired outcomes, or are unwilling to consider strategic compromises in order to make sure an agreement is actually reached. This ultimately works against your ultimate interests, as the job of your attorney is to make sure that your goals are accomplished with a minimum of time, effort and cost. You should also ensure that your attorney has subject matter experience, both in the industry and specific to the work to be performed. This enables the attorney to work efficiently, and minimize cost and time. This is an important consideration that is often overlooked and bears emphasis. Hourly rates are actually less important than the ability to execute work efficiently. If an attorney is learning “on the go”, they will ultimately end up being more expensive than a lawyer who has experience in the industry and subject matter, even if the inexperienced lawyer’s hourly rates are cheaper. Finally, you should ensure that the attorney is accessible, and that if work is to be delegated, that your attorney retains constant oversight of subordinates, rather than just handing off the work.

Directive 2002/58 on Privacy and Electronic Communications, otherwise known as E-Privacy Directive, is an European Union directive on data protection and privacy in the digital age, which has been recently updated to require informed consent for non-essential cookies. Many of our clients transact business internationally and have websites that target European users. The European Union’s E-Privacy Directive (the “Directive”), implemented in May 2012, requires that websites obtain informed consent from users prior to storing cookies on a device. The Financial Times recently reported that the Information Commissioner’s Office (ICO) is beginning to crack down on non-compliant companies. If a website is found to be non-compliant, the ICO can issue fines of up to £500,000 ($807,450). Cookies are small data files sent from a website and stored in a user’s web browser while a user is browsing a website, and are commonly used for remembering preferences and tracking user activity. Although the Directive exempts some cookies from the informed consent requirement, most commonly found cookies, such as third-party analytics, personalization and other persistent cookies are not exempt. Generally speaking, if your website uses technology to track users, you need their consent to do so. There are a few basic steps to take in order to comply with the Directive. First, audit your tracking technologies to determine what cookies, if any, your website places. You may be surprised at what is going on behind the scenes. Categorize your cookies into groups (i.e., necessary service/function cookies, analytical cookies, advertising cookies, etc.) so that you can better explain the types of cookies used on your site. Next, update your privacy policy to ensure that it accurately reflects what is actually going on under the hood of your website. Once your privacy policy is up-to-date and accurate, you should consider how you want to inform your users of your cookie policies. Simply relying that users might have read your privacy policy is no longer considered sufficient. Instead, many websites are implementing banners, headers, footers or splash screens that are designed to ensure informed consent. According to the Financial Times, the European Union has been aggressively enforcing compliance with the Directive and recently increased the size of its enforcement team by 60 percent to investigate infringements. All companies that use cookies on their websites and are subject to European Union jurisdiction should ensure that their site is updated to comply with the Directive.