By: Aaron Krowne The Federal Trade Commission (“FTC”) has recently made a number of significant updates to its guidance for Children’s Online Privacy Protection Act (“COPPA”). Chiefly, these updates streamline compliance requirements for COPPA’s parental consent mandate, in response to the widespread popularity of “app stores” for obtaining and running software. The updates also add support for “knowledge based identification,” a new method of verification that utilizes credit cards. The Recent COPPA Updates The FTC provides an online “FAQ” which serves as its guidance on how to comply with COPPA (for more background on COPPA click here for the extended version of this article). Periodically, it updates this FAQ in response to various developments, including changing technology. On July 16, 2014, a significant set of updates was made, containing key clarifications and additions. 1. Knowledge Based Identification One of the updates was to section H.5 of the FAQ, where the FTC added “credit card plus” authentication as an express approved means to confirm parental consent. Originally, the FTC’s guidance expressly approved verification via the use of a parent’s credit card, but only if it was charged. The rationale for this requirement, as originally written, was that it would cause an actual financial record to be generated that a parent would be sure to see. But this guidance by itself had the effect of foreclosing other useful authentication methods that made use of a credit card without charging it. The new H.5 now suggests that a credit card, used in combination with additional questions (the “plus”) which only a parent would typically know the answers to, such as detailed items from a parent’s credit history, can constitute valid confirmation of parental consent. This update was most likely in direct response to Imperium, Inc.’s December 13, 2013, consent method inquiry for such “knowledge-based identification,” which included questions associated with credit history (e.g., past addresses), that was ultimately approved by the FTC. 2. App Store Apps And Parental Consent The FTC also updated H.10 of the FAQ, to state expressly that developers can rely on parental consent obtained by “app stores.” “App stores” (e.g., Google Play and Apple’s App Store) are the now-popular venues where customers can purchase, download and install software for their smartphones, computers or tablets. This update considerably lowers the barrier for app store developers, as they no longer have to implement the “mechanics” of COPPA parental consent. However, app developers still cannot simply ignore parental consent entirely. In H.10, the FTC explicitly cautioned that merely utilizing an app store login does not in itself constitute parental consent. Rather, an actual “call” to the app store’s parental consent facility must be made by each app that chooses to rely on its app store to obtain this consent. Further, app developers still must present their own privacy policy addressing COPPA’s requirements. Thus, a COPPA-compliant privacy policy is still needed, and must be presented in the proper way. Finally – and critically – the developer must ensure the app store’s parental consent method complies with COPPA fully; it is not enough to simply trust assurances. In sum, a significant part of the COPPA compliance process has been removed vis-a-vis app developers; but operators of apps must still comply with the other aspects of COPPA, including actually invoking the app store’s parental consent method properly, and making sure the consent method is actually compliant. 3. App Store Liability On the flip side, since app stores can now take an “active” role in the COPPA consent-obtaining process for the apps they carry, they themselves might be liable for non-compliance under COPPA – for example, in the case of a deficiency in an app’s privacy policy. Luckily, H.16 allays this concern, by (1) reiterating that app stores are not considered “operators” under COPPA, and (2) setting forth that an app store “will not be liable under COPPA for failing to investigate the privacy practices of the [app] operators for whom [it] obtains consent.” Thus, in the scenario described above, or even in the case of an app with no privacy policy whatsoever, there would be no liability for the app store itself. Of course, if the app store misrepresents its particular part of the process, i.e., the actual parental consent-obtaining service, it could still be liable under the FTC’s general Section 5 “unfair or deceptive” authority. Conclusion The above updates to the COPPA guidelines bring them further in tune with the current state of real-world software distribution and use, providing welcome guidance that has the effect of significantly lowering the COPPA compliance burden for app store app developers, as well as bringing COPPA up to speed with credit card “knowledge based authentication” methods that do not require charging a card. However, this new guidance far from eliminates all COPPA burdens on app store developers; rather, it merely focuses them, leaving undisturbed basic COPPA requirements – such as proper formulation and display of a privacy policy – and a backdrop of active FTC enforcement. Thus, all developers of apps or web sites which even might be considered directed toward children should contact a certified OlenderFeldman privacy attorney today and make sure their privacy and data security policies are COPPA-compliant.

Effective March 1, 2015, many New Jersey employers will be prohibited from making inquiries into an applicant’s criminal record on employment applications. The following is a brief list of Frequently Asked Questions concerning the new Opportunity to Compete or “Ban the Box” law. 1. Does the law apply to all New Jersey employers? No. The law only applies to employers with 15 or more employees who conduct business, employ persons or take applications for employment within the State of New Jersey. 2. Does the law prohibit employers from making any inquiry regarding an applicant’s criminal record at any point during the interview process? No. The law only prohibits employers from making oral or written inquiries regarding an applicant’s criminal record during the initial employment application process, meaning the employment application itself. The law also prohibits employers from posting job advertisements stating that the employer will not consider any applicant who has been arrested or convicted of a crime. 3. What does the “initial application process” mean? The “initial application process” is when an applicant or the employer makes an inquiry about a prospective employment position, either in writing or by other means. It is important to note that the process concludes when an employer has completed the first interview of the applicant. 4. What if the applicant voluntarily discloses information regarding his or her criminal background during the initial application process? If that occurs during the interview process, the employer is free to ask questions concerning the criminal record. However, it is imperative that the employer document that the information was obtained as a result of a voluntary disclosure by the applicant. 5. What are the penalties associated with a violation of the new law? The New Jersey Department of Labor can impose $1,000.00 for the first violation, $5,000.00 for the second violation, and $10,000.00 for each subsequent violation. 6. Do employers need to have a posting in the workplace regarding the new law? There are no required postings. 7. What other States currently have similar “ban the box” legislation? At present, 12 other states have embraced bans on criminal background checks during the initial application process including: California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Maryland, Massachusetts, Minnesota, Nebraska, New Mexico and Rhode Island. There are also a number of cities and counties (including New York City) that have passed similar legislation. If you have any questions, please feel free to contact Howard A. Matalon, Esq. at 908-964-2424.

Cellphone companies are now using “perma-cookies” to track mobile browsing despite consumer’s do not track” requests, which permits advertisers to identify users for targeted behavioral advertising and has concerning implications for users’ privacy. OlenderFeldman Privacy Lawyer Aaron Messing Interviewed By Fox News was interviewed by Fox News regarding how cellphone companies are using various methods to track their users’ mobile browsing habits. While most people think their mobile browsing activity is anonymous, this activity can be tracked to their phone and, thus to them by both their phone companies and, increasingly, but the websites that they view. This can have concerning implications when the user of a phone is a minor, or when the subject of the browsing is personal health information or other sensitive information. OF was also asked about the mandatory arbitration provisions and other waivers that are hidden in the fine print of many cellphone contracts. In our modern electronic society, many users simply hit “I accept” without reading the contracts that they are agreeing to, not realizing that they may be giving away important rights.

On September 23, 2014, the New Jersey Supreme Court held in Atalese v. U.S. Legal Services Group that an arbitration clause in a consumer contract is not enforceable unless it clearly indicates that the plaintiff is giving up the right to go to court. Accordingly, any company doing business in New Jersey that uses an arbitration clause in its contracts, consumer or otherwise, must make sure that the clause states in easy to read language: 1) the differences between litigation and arbitration, and 2) that the contracting party is being foreclosed from proceeding to court on any dispute arising from the contract. The Atalese Decision The plaintiff in Atalese contracted with U.S. Legal Services Group (USLSG) for debt adjustment services. The plaintiff filed suit in state court, alleging that USLSG violated two State consumer protection statutes, the New Jersey Consumer Fraud Act (CFA) and the Truth-in-Consumer Contract, Warranty and Notice Act (TCCWNA) by misrepresenting the scope of the services it would provide and its status as a licensed debt adjuster in New Jersey. USLSG moved to compel arbitration, based on an arbitration clause in the parties’ agreement, which provided: “Arbitration: In the event of any claim or dispute between Client and the USLSG related to this Agreement or related to any performance of any services related to this Agreement, the claim or dispute shall be submitted to binding arbitration upon the request of either party upon the service of that request on the other party. The parties shall agree on a single arbitrator to resolve the dispute. . . . Any decision of the arbitrator shall be final and may be entered into any judgment in any court of competent jurisdiction.” The trial court granted USLSG’s motion to compel Plaintiff to arbitrate her dispute. Plaintiff appealed the trial court’s decision, arguing that the arbitration clause was unenforceable because it did not adequately notify plaintiff of her right to have her consumer claims tried before a jury. The New Jersey Appellate Decision affirmed the trial court’s decision, but in a unanimous decision the New Jersey Supreme Court reversed, and held that the arbitration clause was unenforceable because it “did not clearly and unambiguously signal to plaintiff that she was surrendering her right to pursue her statutory claims in court.” The Court reasoned that arbitration is essentially a waiver of rights which, to be effective, “requires a party to have full knowledge of his legal rights and intent to surrender those rights.” The Court criticized the arbitration clause at issue for not “explain[ing] what arbitration is,” how it “is different from a proceeding in a court of law,” and for not being “written in plain language that would be clear and understandable to the average consumer.” The Court also recognized a countervailing State legislature policy implicit in the enactment of the CFA and TCCWNA that favored consumers seeking relief though courts of law. In reaching this decision, the Court rejected the argument that consumers are sophisticated enough to understand that agreeing to resolve disputes in binding arbitration means they are forgoing their right to have disputes resolved in court. The Court stressed that there was no “magic language” required in order to make an arbitration clause enforceable. Rather, the clause must use “clear and unambiguous” language, which in a “general and sufficiently broad way, must explain that the plaintiff is giving up her right to bring her claims in court or have a jury resolve the dispute”. However, it did provide the following broad guidance for the enforceability of consumer arbitration clauses, generally, an enforceable consumer arbitration clause must: (1) state what arbitration is, (2) explain how arbitration differs from a court proceeding, and (3) do so in language that is plain and understandable to the average consumer. The Court went on to cite the following arbitration provisions that New Jersey’s courts have previously upheld as enforceable: The parties agree “to waive [the] right to a jury trial” and that “all disputes relating to [the plaintiff’s] employment . . . shall be decided by an arbitrator.” “By agreeing to arbitration, the parties understand and agree that they are waiving their rights to maintain other available resolution processes, such as a court action or administrative proceeding, to settle their disputes.” “Instead of suing in court, we each agree to settle disputes (except certain small claims) only by arbitration. The rules in arbitration are different. There’s no judge or jury, and review is limited, but an arbitrator can award the same damages and relief, and must honor the same limitations stated in the agreement as a court would.” Going Forward Given the sweeping nature of Atalese, all New Jersey businesses using arbitration clauses in their agreements must rewrite these clauses in order to make sure that the they contain clear and easy to read language that: 1) explains the nature of arbitration proceedings and how they differ from judicial proceedings; and 2) expressly states the rights that are being waived or forfeited as a result of the agreement. If you have any questions, please feel free to contact Howard A. Matalon, Esq. at 908-964-2424.

Startup companies and entrepreneurs love to innovate. A good lawyer can help startups push the envelope while avoiding rookie mistakes. While all resources are given a premium with a burgeoning company, NJ Tech Weekly polled some of New Jersey’s top professionals – including OlenderFeldman LLP partner Christian Jensen — for their thoughts on the one major mistake that startups make that can be avoided with the right professional advice. Among the number of issues faced including entity choice, equity issues and privacy policy/terms and conditions, Chris spoke about the importance of delineating employee issues – both through classification and contract – at the outset of a business. Give the entire article a read here. You can also read more about common legal mistakes made by small businesses,

On December 31, 2014, the second-largest U.S. grocery chain, Safeway, was ordered to pay a $9.87 million penalty as a part of a settlement with California prosecutors related to the improper dumping of hazardous waste, and the improper disposal of confidential pharmacy records containing protected health information in violation of California’s Confidentiality of Medical Information Act (“CIMA”). This settlement comes after an investigation revealed that for over seven years hazardous materials, such as medicine and batteries, had been “routinely and systematically” sent to local landfills that were not equipped to receive such waste. Additionally, the investigation revealed that Safeway failed to protect confidential medical and health records of its pharmacy customers, by disposing of records containing patients’ names, phone numbers, and addresses without shredding them, putting these customers at risk of identify theft. Under this settlement agreement, while Safeway admits to no wrongdoing, it will pay (1) a $6.72 million civil penalty, (2) $2 million for supplemental environmental projects, and (3) $1.15 million in attorneys’ fees and costs. In addition, pursuant to the agreement, Safeway must maintain and enhance its customer record disposal program to ensure that customer medical information is disposed of in a manner that preserves the customer’s privacy and complies with CIMA. “Today’s settlement marks a victory for our state’s environment as well as the security and privacy of confidential patient information throughout California,” said Alameda County District Attorney Nancy O’Malley. Another Alameda County Assistant District Attorney, Kenneth Misfud, says the case against Safeway spotlights the importance of healthcare entities, such as pharmacy chains and hospitals, properly shredding, or otherwise “making indecipherable,” patient and other consumer personal information prior to disposal. However, despite the settlement, customers whose personal information was improperly disposed of will have a difficult time suing for a “pure” loss of privacy due Safeway’s violation of CIMA. In Sutter Health v. Superior Court, a California Court of Appeals held that confidential information covered by CIMA must be “actually viewed” for the statutory penalty provisions of the law to apply. So, parties bringing claims under CIMA will now have to allege, and ultimately prove, that their confidential information (1) changed possession in an unauthorized manner, and that (2) it was actually viewed (or presumably, used) by an unauthorized party. The takeaway from Safeway’s settlement is to ensure that your customers are not at risk of data breaches and identity theft, and protect your company from facing the million dollar consequences that can result from doing so. If you have any questions about complying with privacy and health information laws, please feel free to contact one of our certified privacy attorneys at OlenderFeldman LLP.

Technology can impact the way we work, play, communicate and live, and “big data” analysis – the processing of large amounts of data in order to gain actionable insights – has the ability to radically alter society by identifying patterns and traits that would otherwise go undiscovered. This data, however, can raise significant privacy concerns in the context of a merger or acquisition. Dun and Bradstreet interviewed us regarding various Tips for Customer Data Management During a Merger or Acquisition. We thought the topic was so interesting, that we decided to expand a little bit more on the subject. As background, it is important to consider that there are three types of M&A transactions affecting data: stock transactions, mergers, and sales of assets. In a stock transaction, there are no data issues, while the owners of a company sell stock to a new owner, the entity itself remains intact. This means business as usual from the entity’s standpoint, and there are no data or confidentiality issues. By contrast, in a merger (where the target is not the surviving entity) or in an asset transaction, the original entity itself goes away, which means all of the assets in that entity have to be transferred, and there is a change of legal title to those assets (including to any data) which can have legal implications. For example, if a party consents to the use of their data by OldCo, and OldCo sells all of its assets to NewCo, does that party’s consent to use data also transfer to NewCo? In a merger, data needs to be appropriately assigned and transferred, which often has privacy implications. Companies generally have privacy policies explaining how they collect and use consumers’ personal information. These policies often contain language stating that the company will not give such information to any third-party without the consumer’s consent. In such situations, the transfer of data must be done in accordance with the written commitments and representations made by that company (which may vary if different representations were made to different categories of individuals), and may require providing notice or obtaining consent from consumers (which, depending on the scope of the notice or consent required, can be an arduous task). Companies also generally maintain employee data and client data in addition to consumer data. This information needs to be handled in accordance with contractual obligations, as well as legal obligations. National and foreign laws may also regulate the transfer of certain information. For example, in transborder transactions, or for transactions involving multinational companies, it is extremely important to ensure that any transfer of data complies with the data privacy and transborder transfer obligations applicable in all of the relevant jurisdictions. Obligations may arise even during the contemplation of a merger, or during the due diligence process, where laws may impact the ability of companies to disclose certain information and documentation. For example, in the United States, financial companies are required to comply with the Sarbanes-Oxley Act and the Gramm-Leach-Bliley Act, which govern the controls required to protect certain types of data, and companies in the health care and medical fields are often required to comply with the Health Insurance Portability and Accountability Act. In the multinational / crossborder context, businesses may run into challenges posed by conflicting multi-jurisdictional data protection laws, which may prevent routine data flows (such as phone lists or other employee data) to countries that are deemed to have insufficient data protection laws, or require that centralized databases comply with the laws in multiple jurisdictions. Additionally, employee rights to access and amend data, as well as requirements to obtain consent before collection and limitations on maintenance of data may cause challenges as well. So what should companies do when contemplating or navigating a merger or acquisition? First, companies should determine what information they have. Next, companies must ensure that they understand what information they have, including the circumstances under which the information was collected, and what rights and obligations they have relative to that information. Companies should determine what ability they have to transfer information, what consents or approvals are necessary to do so, and the potential impact of a transfer on the various stakeholders. The bottom line? Any technology, and big data in particular, can be put to both good and bad uses. It is important that as companies gather data about individuals, that that information be used in accordance with existing laws and regulations governing data use, as well as in a way that respects the privacy of the individuals to which the data pertains.

The following is a guest post from Daniel Haurey, President of Exigent Technology, an IT Services and Cloud Services Provider. One of my favorite business authors, David Meerman Scott, said it best: “Because of the infinite amount of information available on the web, buyers now have more information than sellers, and therefore buyers have the upper hand in negotiations.” Prospects and new clients, each armed with mini-computers in their pockets are peering through your virtual window with more relevant information about your firm than you could have ever have hoped. As competition increases along with demands for transparency, it’s important to try and forge relationships with prospective clients before you even meet them, and on a common ground that has most recently become the location of choice for nearly every demographic. Where? On their phones, of course. Mobile devices have recently surpassed all others in total web traffic. Smartphones and tablets combined now account for 6o percent of all online traffic, up from 50 percent a year ago. And 51 percent of that traffic is driven by mobile apps. Fortunately, the combination of web, social media and a barrage of affordable, easily-accessible technology has leveled the virtual playing field, giving small and mid-sized law firms the same vast reach as their gargantuan counterparts. But as blogging, tweeting and content marketing have pretty much become commonplace, how does your firm stay relevant online and create brand recognition, before and after the client engagement? These days, part of the answer may be, with a custom Mobile Application. Depending on your goals and the areas of law you focus on, there are countless possibilities for your own law firm to provide a custom-designed, engagement-driving mobile application that can drive client engagement and keep your firm at the forefront of the industry. Here is a list of law firm app use cases to get your gears moving: 1. Custom Accident Kit App for Personal Injury Attorneys Imagine how useful it could be for a victim of an accident to gather GPS location, insurance information, key contacts, facts, notes, and pictures right at the scene of the incident. Now imagine they can send you all of that information with a few swipes of their finger. 2. DUI Assistance Our mobile devices are always with us, even after a glass or three of wine at dinner. Help prospective clients estimate their blood alcohol level and navigate DUI laws that they can share with their friends. Including advice on what to do or how to respond to questions when dealing with a traffic stop for suspicion of DUI. 3. Workers Compensation and Social Security Disability Law Ease client intakes by extending evaluation forms to help determine eligibility. Assist clients in tracking expenses, symptoms, medical history and medications. 4. Family and Matrimonial Law Provide clients with useful information, tips and tools such as contacts for battered women’s shelters and various sources of support and guidance apropos for individuals planning for or enduring divorce. 5. Establish your firm as thought leader in your field Your firm has garnered the respect of its peers and differentiated itself in the marketplace, and a mobile application is the best way to guide your peers and clients to that differentiating factor. Nothing says “we get it” to prospective millennial and Generation X’er clients like having your own mobile app. Daniel Haurey is president and CEO at New Jersey based IT Services and Cloud Service provider Exigent Technologies, and one of Tri-State’s leading entrepreneurs and IT thought leaders.

The following is a guest post from Damon Finaldi, President of Tele-Data Solutions, a provider of VoIP phone systems and cloud technology. You’re a litigator stuck in court who needs to check email. A law firm business manager looking to increase revenue. Or the IT manager who knows there’s a better way to tie together your communications. In any of these cases and many others, an upgrade of your firm’s telecommunications to a VoIP (voice over internet protocol) phone system can boost profits and productivity. In today’s connected world, a phone is more than just a phone. It’s a business tool that can give your firm a competitive edge in terms of client service, mobility, collaboration, and billings. Internet telephony using VoIP has been around for several decades, and services using this technology have improved as broadband services have become more widely available. VoIP offers speed and flexibility that traditional phone services lack. Here are several key ways that implementing VoIP can help boost revenues, streamline communications, and improve productivity: Lower phone bills. By migrating to a VoIP system you eliminate local and long distance phone bills—it’s one flat price no matter where you call nationwide, and international rates are highly competitive. Increase client billings. VoIP technology captures every billable second that attorneys, paralegals, and assistants spend on the phone talking to clients, automatically. You get automated call logs that no one has to maintain (manual paper time sheets are so 20th century). No one has to remember their call lengths down to the 0.1 second—VoIP does it for you. Your business manager can easily review these logs through a desktop dashboard and determine who gets billed and who doesn’t. The system can tie in all your firm’s account codes. A mobile app tracks phone time on company cell phones as well, and it all reports to the central system. You can integrate the phone logs with your time and billing software package for streamlined accounting and convenience. Check voice mail anywhere without disrupting proceedings or meetings (or traffic). Attorneys who are in court or driving can access all their voicemail and email easily, safely and discreetly via VoIP. The system can send all voicemail to any phone in a WAV file that is easily accessed from anywhere. Voicemail can also be transcribed as email so you can quietly scroll through messages while away from the office. Attorneys in certain practice areas—such as personal injury or criminal law—know how crucial it is to respond quickly to messages (and get the client who’s searching for representation now). In the car and need to check your messages? The phone system identifies you by your caller ID and will automatically log you into your voice mailbox, hands-free. Built-in conferencing. VoIP eliminates the need for third-party conference call services. VoIP’s conference call features include: Allows unlimited connections—as many people as you need to include, from any location; Includes an integrated conference bridge; Can record the conference call (or any phone call) for future transcription or deposition, eliminating “he said/she said” and allowing more effective negotiation with a real-time recording of the call; Exports the call recording as an MP3 or WAV file to include in case management software. Go mobile or multi-site. With a VoIP phone system, staff can work from anywhere and stay in touch, so sick days, personal days or working vacations are never an issue: Integrates multiple locations centrally in the background so callers get through to everyone no matter what. Centralizes receptionist duties across locations. Easy to administer. Manage the entire system from anywhere via the web portal. If you need to shut down early or open late (and indicate this with outgoing voice mail), or change users’ names on extensions as people join or leave the firm or move offices, it can all be done online on any interface. This eliminates the need for complicated programming, phone trees, or specialists. No down time. Natural disasters, power or service outages, and inaccessible locations are no longer barriers to maintaining phone service with VoIP. Because internet telephony is in the Cloud, the system is always up as calls are routed through a data center. Internet telephony has come a long way since its inception in the 1990’s. Internet telephony technology suing VoIP can save your firm money and can also help your firm make money at the same time; it can save your attorneys time and keeps everyone connected seamlessly—even in multiple offices.

The biggest privacy challenges affecting businesses today are regulatory scrutiny from government agencies, media coverage with unintended consequences, and privacy risks that are discovered during corporate transactions. Rapidly growing eCommerce and technology companies typically focus on creating viable products and services, adapting business models and responding to challenges, and using data in new ways to glean valuable insights and advantages. They often achieve success by disrupting existing industry norms and flouting convention in an attempt to do things better, faster and more cost-effectively. In the tech world, this strategy is often a blueprint for success. At the same time, this strategy also often raises privacy concerns from regulators and investors. In fact, three of the biggest privacy challenges affecting businesses today are regulatory scrutiny from government agencies (and potentially, personal liability arising from such scrutiny), media coverage with unintended consequences, and privacy risks that are discovered during corporate transactions. Regulatory Scrutiny Of Privacy Practices Government regulators, led by the Federal Trade Commission (“FTC”), have taken an activist role in enforcing privacy protections. The FTC often does so by utilizing its powers under the FTC Act, which enables the FTC to investigate and prosecute companies and individuals for “unfair or deceptive acts and practices.” Some of the activities which the FTC considers to fall under the “unfair or deceptive” umbrella are: a company’s failure to enforce privacy promises; violations of consumers’ privacy rights; and failing to maintain reasonably adequate security for sensitive consumer information. Though most of the FTC’s investigations are settled privately and non-publicly, those that do become public (usually, as a result of a company refusing to cooperate voluntarily or disagreeing with the FTC on the proper resolution) are often instructive. For example, the FTC recently settled charges against Snapchat, the developer of a popular mobile messaging app. The FTC accused Snapchat of deceiving consumers with promises about the disappearing nature of messages sent through the service, the amount of personal data Snapchat collected, and the security measures taken to protect that data from misuse and unauthorized disclosure. Similarly, when Facebook acquired WhatsApp, another cross-platform mobile messaging app, the FTC explicitly warned both Facebook and WhatsApp that WhatsApp had made clear privacy promises to consumers, and that WhatsApp would be obligated to continue its current privacy practices ― even if such policies differ from those of Facebook ― or face FTC charges. The takeaway from the FTC’s recent investigations and enforcement actions are clear: (1) businesses should be very careful about the privacy representations that they make to consumers; (2) businesses should comply with the representations they make; and (3) businesses should take adequate measures to ensure the privacy and security of the personal information and other sensitive data that they obtain from consumers. Sometimes officers and directors of businesses are named in a FTC action along with, or apart from, the company itself. In such cases, the interests of the individuals and those of the companies often diverge as the various parties try to apportion blame internally. In certain cases, companies and their officers are held jointly and severally liable for violations. For example, the FTC sued Innovative Marketing Inc. and three of its owners/officers. A federal court found the business and the owners/officers to be jointly and severally liable for unfair and deceptive actions, and entered a verdict for $163 million against them all. The evolving world of regulatory enforcement actions reveals that traditional liability protections (i.e., acting through a corporate entity) do not necessarily shield owners, officers, and/or directors from personal liability when privacy violations are at issue. Officers and directors should keep in mind that knowledge of, or indifference to, an unfair or deceptive practice can put them squarely in the FTC’s crosshairs ― and that the “ostrich defense” of ignoring and avoiding such issues is unlikely to produce positive results. Unintended Consequences of Publicity Most businesses crave publicity as a means of building credibility and awareness for their products or services. However, businesses should keep in mind that being in the spotlight can also put the company on regulators’ radar screens, potentially resulting in additional scrutiny where none previously existed. One of our clients, for example, came out with an innovative service that allows consumers to utilize their personal information in unique ways, and received significant positive publicity as a result. Unfortunately, that publicity also caught the interest of a regulatory entity. It turns out that some of our client’s statements about their service were misunderstood by the government. Ultimately, we were able to clarify the service offered by our client for the government in an efficient and cost-effective manner, demonstrating that no wrongdoing had occurred, and the inquiry was resolved to our client’s (and the government’s) satisfaction. Nonetheless, the process itself resulted in substantial aggravation for our client, who was forced to focus on an investigation rather than on its business activities. Ultimately, the misunderstanding could have been avoided if the client had checked with us first, before speaking with reporters, to ensure the client’s talking points were appropriate. Another more public example occurred at Uber’s launch party in Chicago. Uber, the car service company which allows users to hail a cab using a mobile app, allegedly demonstrated a “God View” function for its guests which allowed the partygoers (including several journalists) to see, among other information, the name and real-time location of some of its customers (including some well-known individuals) in New York City – information which those customers did not know was being projected onto a large screen at a private party. The resulting publicity backlash was overwhelming. Senator Al Franken wrote Uber a letter demanding an explanation of Uber’s data collection practices and policies and Uber was forced to retain a major law firm to independently audit its privacy practices, and implement changes to its policies, including limiting the availability and use of the “God View.” Experience has shown us that contrary to the old mantra, all publicity is not necessarily good publicity when it comes to the world of privacy. Before moving forward with publicity or marketing for your business, consider incorporating a legal review into the planning to avoid any potentially adverse impact of such publicity. Privacy Concerns Arising During A Corporate Transaction Perhaps most importantly to company owners, the failure to proactively address privacy issues in connection with corporate transactions can cause significant repercussions, potentially destroying an entire deal. Most major corporate transactions involve some degree of due diligence. That due diligence, if properly performed by knowledgeable attorneys and businesspeople, will uncover any existing privacy risks (i.e., violations of privacy-related laws, insufficient privacy security measures or compliance issues which become financially overwhelming). If these issues were not already factored into the financial terms of the transaction or affirmatively addressed from the outset, the entire landscape of the transaction can change overnight once the issues are uncovered – with the worst case scenario being the collapse of the entire deal. Therefore, it is critical that businesses contemplating a corporate transaction be prepared to address all relevant privacy issues upfront. Such preparation should include an internal analysis of the business from a privacy-law perspective (i.e., determining which regulatory schemes apply, and whether the business is currently in compliance) and being prepared to provide quick responses to relevant inquiries, such historical policies and procedures related to privacy and data security, diagrams of network/data flow, lists of third-parties with whom data has been shared, representations and warranties made to data subjects, and descriptions of complaints, investigations, and litigation pertaining to privacy issues. Privacy and data security issues can be particularly tricky depending on the nature of the data that is maintained by the company and the representations that the company has made with respect to such data. Businesses are well-advised to prepare a due diligence checklist in preparation for any corporate transaction which should include an assessment of the business’ compliance with applicable information privacy and data security laws as well as any potential liabilities from deficiencies that are discovered. Addressing these issues in a proactive manner will allow the business to be more prepared for the corporate transaction and mitigate any harm which otherwise might flow from any problems which arise.

The Federal Americans with Disabilities Act, the New Jersey Law Against Discrimination and the New Jersey Pregnancy Discrimination and Accommodation Law each impose significant obligations on employers, who are required to provide reasonable accommodations to employees. There is a considerable amount of confusion on the part of many New Jersey employers as to their obligation to provide reasonable accommodations for those who are disabled or pregnant. As of January 2014, with the passage of the New Jersey Pregnancy Discrimination and Accommodation Law, pregnancy is now its own protected class and pregnant employees are entitled to accommodations regardless of whether they suffer from a disability relating to the pregnancy. This FAQ will address at a basic level the most important aspects of employment law as it pertains to reasonable employee accommodations. Of course, don’t miss our other posts about protecting against employee lawsuits, employer compliance with the Affordable Care Act (Obamacare), employee privacy obligations and other employment hiring practices. Q: What is a reasonable accommodation? A: Under the Federal Americans with Disabilities Act (“ADA”) or the New Jersey Law Against Discrimination (“NJLAD”), a reasonable accommodation is defined as a practical change to a job description or work situation needed to support the employment of a qualified disabled person or someone with a special need in that capacity. Reasonable accommodation also refers to modifications made by an employer to assist qualified disabled persons in enjoying the same rights and privileges that other employees of an equal level enjoy. Q: What is a disability? A: A disability under the ADA (which is constantly expanding and is considered a fairly universal definition from an employment standpoint) includes impairments (mental or physical) which substantially interfere with one or more major life activities such as walking, bending, sitting, pushing, pulling, holding, stooping, climbing a ladder, or stairs, running, jogging, breathing, shopping, dressing, bathing, eating, concentrating, listening, communicating and so forth. Even episodic conditions (i.e., epilepsy, migraine headaches and so forth) can be deemed disabling if, when active, such conditions interfere with one or more major life activities. Q: Who has to request or propose the accommodation? A: The employee must request the accommodation, and the accommodation must be communicated as clearly and specifically as possible. Specificity with regard to the accommodation is crucial, because a vague request such as a lateral transfer, etc. can be easily (and legally?) denied by the employer saying there are no such positions. Q: What are the employer’s obligations once an accommodation has been requested? A: Once an employee requests an accommodation, both the employer and employee have to engage in what is known as an “interactive process.” That means that the employee and the employer must actively work together on a solution to come up with an accommodation. Unilateral demands on the part of the employee or unilateral denials on the part of the employer are not interactive and would violate the requirements of the ADA or NJLAD. Q: What are the limits on the accommodation that must be provided to qualifying employees? A: The accommodation must be reasonable. That means that the employee must be able to perform the functions of his or her job with the accommodation and without causing undue hardship. Undue hardship means an action that would be unduly costly, excessive, substantial or disruptive in relation to the size, resources, nature, and structure of the employer’s operation. For example, an outside sales representative who is required to travel the majority of the time to secure business opportunities or meet with clients and who cannot perform job functions from an office location cannot claim as a reasonable accommodation to be permitted to work from home for the remainder of his/her disability or employment. Q: Does a New Jersey employer need to provide a reasonable accommodation in New Jersey if it has less than 25 employees? A: Yes. Although the reasonable accommodation requirements of the ADA only apply to employers who employ 25 or more employees, the NJLAD also requires employers to provide reasonable accommodations for disabled and pregnant workers regardless of the number of employees they have. Q: Does a New Jersey employer need to provide a reasonable accommodation to a pregnant worker who is not disabled? A: Yes. Under the New Jersey Pregnancy Discrimination and Accommodation Law (which became effective as of January 21, 2014), employers who know or should know that an employee is pregnant or recovering from pregnancy cannot discriminate against the employee in terms and conditions of employment. Prior to the law’s enactment, pregnancy was not considered as a protected class under the NJLAD (meaning that an employee could not sue for discrimination under that law) unless there were complications associated with the pregnancy that could cause the pregnancy to come within the definition of a disability. The new law requires employees to treat pregnant employees no less favorably than non-pregnant employees in their employment policies even if they are not suffering from any pregnancy related complications. The law also specifically requires employers to provide pregnant employees with reasonable accommodations relating to the pregnancy upon the advice of the employee’s physician. The law provides a non-exhaustive list of examples of accommodations which include bathroom or water intake breaks, rest breaks, assistance with manual labor, job restructuring or modifying work schedules and temporary transfers to less hazardous or strenuous jobs. As in the case of reasonable accommodations for disabled employees, employers must grant the employee’s request for a pregnancy accommodation unless doing so would cause an undue burden upon the their operations. This FAQ merely scratches the surface of the requirements imposed upon all New Jersey employers to provide reasonable accommodations to their employees. Needless to say, it is incumbent upon all New Jersey employers to review their employment policies with counsel to insure that they are compliant with this area of employment law. If you have any questions concerning this important FAQ, please contact Howard A. Matalon, who leads the firm’s Employment Law practice group.

A company’s social media page, profile and accounts (and its followers and other connections) are generally considered to be valuable business assets. Recent court decisions illustrate the importance of clear policies and procedures to address ownership and appropriate use of business-related social media assets. While most businesses recognize the importance of maintaining a minimum Internet presence, an increasing number of businesses are attempting to impact consumers where they congregate most: in social media. The benefits of maintaining an active social media presence include developing loyal relationships with customers, leveraging those relationships into quantifiable, networked campaigns, and refining your brand with niche audiences. Because of both the company resources spent developing these channels as well as their potential value/return, it is important to remember that social media accounts are company assets and should be protected accordingly through policies and procedures, as would any other company intellectual property. While major brands often farm out social media management and content creation to marketing firms, small or medium sized business often do not have this financial flexibility. Accordingly, chances are a member of management of the employees, takes on this role. In that case, with both personal and business interests in the same sphere it is especially crucial set clear expectations and boundaries around social media responsibilities in the workplace and the ownership of your business’ accounts and content. As a recent case in Texas (In re CTLI, LLC, 2015 Banker. LEXIS 1117 (Bankr. S.D. Tex. 2015)) makes clear, when it comes to social media, the line between personal and professional can be blurry and when companies fail, or when partnerships falter, ownership of social media accounts can result in costly litigation. The dispute in CTLI centered on ownership of the Facebook account for a firearms business. The account was run by one of the business’ owners who posted a mixture of professional content promoting the business, and personal content reflecting his interests, activities and opinions. When the business filed for Chapter 11 protection, the social media-savvy former owner refused to relinquish control of the Facebook account, claiming that the amount of time, goodwill and his own personality that he had invested into developing the account entitled him to ownership. The U.S. Bankruptcy court ultimately disagreed and ruled that the account was property of the business but not before wading through the thorny issues of personal privacy, contract interpretation relating to Facebook’s terms and conditions, and the separation of personal and business assets. Some important lessons for your business to keep in mind: Have a written Technology Use and Social Media Policy in place for all of your employees to read and sign. These policies should include parameters for appropriate uses of company technology, guidelines on how to discuss your company online and in social media (even when your employees are using their own personal accounts), and clear definitions concerning who owns what when it comes to devices and accounts. While interacting with consumers can be great for business consider prohibiting your social media managers from sending direct/private messages from your customer-facing business accounts. While you may permit employees to send personal emails from their work computers, this is very different than sending a personal message emanating from your company’s branded Facebook or Twitter account. Social media marketing allows for a more nuanced line between personal and professional content. Something that you might consider to be a personal comment could be seen in court as an attempt to integrate your business’ brand with your target customers or your local community. Just because you are posting casual or personal items from your official business account does not mean that the accounts belong to you or your employees. An effective social media manager may be able to generate hundreds or thousands of followers or fans for your business, but it is important for them to know that it is the business, and not the employee, who ultimately owns those accounts and the followers that go with it, no matter how much of themselves and their personality the employee has poured into developing the accounts. Maintain a record of all of your social media account credentials like account names, user handles, and passwords. Employees should be prohibited from altering these credentials or using their own passwords. In the event that you need to remove an employee’s access this will help you avoid being in the position of demanding passwords which the employee may be also using for private, personal accounts. If you need help drafting an effective Technology Use or Social Media Policy for your business or simply have questions about the benefits and risks of leveraging social media to help your business grow, contact OlenderFeldman LLP.